[Solved] can't redirect all traffic through vpn

rumple

I've set up an openvpn server in my home network with the intention of using it when I'm on the road, connecting to it from my laptop so that all my network traffic traverses the vpn tunnel. I'm almost there but I just can't get over the finish line.

I can successfully connect to my openvpn server and I can access servers on my home network. Not just the openvpn server itself but other servers too. However, traffic not destined for my home network goes out locally. Web browsing, for example, doesn't use the vpn tunnel.

My openvpn server is FreeBSD. It isn't the gateway of my home network, it's just another server.
My laptop is running Windows 7.

Server config.

local 192.168.10.15
port 1194
proto udp
dev tap0
ca /usr/local/share/certs/cacert.pem
cert /usr/local/share/certs/servercert.pem
key /usr/local/share/certs/serverkey.pem
dh /usr/local/etc/openvpn/dh2048.pem
ifconfig-pool-persist ipp.txt
server-bridge 192.168.10.1 255.255.255.224 192.168.10.4 192.168.10.6
ifconfig 192.168.10.3 255.255.255.224
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 192.168.10.11"
keepalive 10 120
tls-auth /usr/local/etc/openvpn/tlskey.pem 0
cipher AES-256-CBC
auth SHA256
comp-lzo
max-clients 10
user nobody
group nobody
persist-key
persist-tun
plugin /usr/local/lib/openvpn/plugins/openvpn-plugin-auth-pam.so login
status openvpn-status.log
verb 4

Client config.

client
dev tap
proto udp
remote vpn.example.com 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca cacert.pem
cert clientcert.pem
key clientkey.pem
ns-cert-type server
tls-auth tlskey.pem 1
auth-user-pass
cipher AES-256-CBC
auth SHA256
explicit-exit-notify
comp-lzo
verb 4

I'm using tap instead of tun because I have a dumb home router that doesn't let me add routes to the LAN network. I've looked into using DD-WRT but my hardware revision isn't supported.

To set up the bridge between the tap and local interface on my openvpn server, I have these lines in my /etc/rc.conf file.

cloned_interfaces="tap0 bridge0"
ifconfig_bridge0="addm tap0 addm em0 up"

I also have IP forwarding enabled although I don't know if that's necessary for a bridged vpn.

I've played with the server config quite a bit already. I've tried using dhcp-proxy but got the same results as the config I've listed; I can access my home network no problem but web browsing still goes out on the local network.

I suspect a proper default route is not being set on my laptop properly to tell it to route all traffic through the vpn but I'm at a loss as to how to fix it.

Something else I can't explain, I can't ping my home gateway router from my laptop when the vpn is connected. I can ping all the servers on my home network but not the gateway. If I ssh to one of my home servers I can ping the gateway router from there.

rumple

Here are the log files. I was at home when I collected these logs so the client log shows me connecting to the vpn while on my home wifi. I added the 'local' flag to redirect-gateway in the server config file before restarting openvpn. I hope this doesn't confuse things too much.

server log

Tue Dec 31 16:46:25 2013 us=897923 Current Parameter Settings:
Tue Dec 31 16:46:25 2013 us=898163   config = '/usr/local/etc/openvpn/openvpn.conf'
Tue Dec 31 16:46:25 2013 us=898181   mode = 1
Tue Dec 31 16:46:25 2013 us=898197   show_ciphers = DISABLED
Tue Dec 31 16:46:25 2013 us=898211   show_digests = DISABLED
Tue Dec 31 16:46:25 2013 us=898226   show_engines = DISABLED
Tue Dec 31 16:46:25 2013 us=898241   genkey = DISABLED
Tue Dec 31 16:46:25 2013 us=898256   key_pass_file = '[UNDEF]'
Tue Dec 31 16:46:25 2013 us=898271   show_tls_ciphers = DISABLED
Tue Dec 31 16:46:25 2013 us=898286 Connection profiles [default]:
Tue Dec 31 16:46:25 2013 us=898301   proto = udp
Tue Dec 31 16:46:25 2013 us=898316   local = '192.168.10.15'
Tue Dec 31 16:46:25 2013 us=898331   local_port = 1194
Tue Dec 31 16:46:25 2013 us=898345   remote = '[UNDEF]'
Tue Dec 31 16:46:25 2013 us=898361   remote_port = 1194
Tue Dec 31 16:46:25 2013 us=898375   remote_float = DISABLED
Tue Dec 31 16:46:25 2013 us=898389   bind_defined = DISABLED
Tue Dec 31 16:46:25 2013 us=898404   bind_local = ENABLED
Tue Dec 31 16:46:25 2013 us=898419   connect_retry_seconds = 5
Tue Dec 31 16:46:25 2013 us=898434   connect_timeout = 10
Tue Dec 31 16:46:25 2013 us=898449   connect_retry_max = 0
Tue Dec 31 16:46:25 2013 us=898464   socks_proxy_server = '[UNDEF]'
Tue Dec 31 16:46:25 2013 us=898479   socks_proxy_port = 0
Tue Dec 31 16:46:25 2013 us=898494   socks_proxy_retry = DISABLED
Tue Dec 31 16:46:25 2013 us=898509   tun_mtu = 1500
Tue Dec 31 16:46:25 2013 us=898524   tun_mtu_defined = ENABLED
Tue Dec 31 16:46:25 2013 us=898539   link_mtu = 1500
Tue Dec 31 16:46:25 2013 us=898553   link_mtu_defined = DISABLED
Tue Dec 31 16:46:25 2013 us=898568   tun_mtu_extra = 32
Tue Dec 31 16:46:25 2013 us=898583   tun_mtu_extra_defined = ENABLED
Tue Dec 31 16:46:25 2013 us=898598   mtu_discover_type = -1
Tue Dec 31 16:46:25 2013 us=898613   fragment = 0
Tue Dec 31 16:46:25 2013 us=898628   mssfix = 1450
Tue Dec 31 16:46:25 2013 us=898642   explicit_exit_notification = 0
Tue Dec 31 16:46:25 2013 us=898657 Connection profiles END
Tue Dec 31 16:46:25 2013 us=898689   remote_random = DISABLED
Tue Dec 31 16:46:25 2013 us=898705   ipchange = '[UNDEF]'
Tue Dec 31 16:46:25 2013 us=898721   dev = 'tap0'
Tue Dec 31 16:46:25 2013 us=898736   dev_type = '[UNDEF]'
Tue Dec 31 16:46:25 2013 us=898751   dev_node = '[UNDEF]'
Tue Dec 31 16:46:25 2013 us=898766   lladdr = '[UNDEF]'
Tue Dec 31 16:46:25 2013 us=898781   topology = 1
Tue Dec 31 16:46:25 2013 us=898796   tun_ipv6 = DISABLED
Tue Dec 31 16:46:25 2013 us=898811   ifconfig_local = '192.168.10.3'
Tue Dec 31 16:46:25 2013 us=898826   ifconfig_remote_netmask = '255.255.255.224'
Tue Dec 31 16:46:25 2013 us=898841   ifconfig_noexec = DISABLED
Tue Dec 31 16:46:25 2013 us=898855   ifconfig_nowarn = DISABLED
Tue Dec 31 16:46:25 2013 us=898870   ifconfig_ipv6_local = '[UNDEF]'
Tue Dec 31 16:46:25 2013 us=898885   ifconfig_ipv6_netbits = 0
Tue Dec 31 16:46:25 2013 us=898900   ifconfig_ipv6_remote = '[UNDEF]'
Tue Dec 31 16:46:25 2013 us=898915   shaper = 0
Tue Dec 31 16:46:25 2013 us=898929   mtu_test = 0
Tue Dec 31 16:46:25 2013 us=898945   mlock = DISABLED
Tue Dec 31 16:46:25 2013 us=898960   keepalive_ping = 10
Tue Dec 31 16:46:25 2013 us=898975   keepalive_timeout = 120
Tue Dec 31 16:46:25 2013 us=898990   inactivity_timeout = 0
Tue Dec 31 16:46:25 2013 us=899006   ping_send_timeout = 10
Tue Dec 31 16:46:25 2013 us=899048   ping_rec_timeout = 240
Tue Dec 31 16:46:25 2013 us=899063   ping_rec_timeout_action = 2
Tue Dec 31 16:46:25 2013 us=899079   ping_timer_remote = DISABLED
Tue Dec 31 16:46:25 2013 us=899094   remap_sigusr1 = 0
Tue Dec 31 16:46:25 2013 us=899109   persist_tun = ENABLED
Tue Dec 31 16:46:25 2013 us=899124   persist_local_ip = DISABLED
Tue Dec 31 16:46:25 2013 us=899139   persist_remote_ip = DISABLED
Tue Dec 31 16:46:25 2013 us=899154   persist_key = ENABLED
Tue Dec 31 16:46:25 2013 us=899169   passtos = DISABLED
Tue Dec 31 16:46:25 2013 us=899184   resolve_retry_seconds = 1000000000
Tue Dec 31 16:46:25 2013 us=899199   username = 'nobody'
Tue Dec 31 16:46:25 2013 us=899224   groupname = 'nobody'
Tue Dec 31 16:46:25 2013 us=899240   chroot_dir = '[UNDEF]'
Tue Dec 31 16:46:25 2013 us=899256   cd_dir = '/usr/local/etc/openvpn'
Tue Dec 31 16:46:25 2013 us=899270   writepid = '/var/run/openvpn.pid'
Tue Dec 31 16:46:25 2013 us=899286   up_script = '[UNDEF]'
Tue Dec 31 16:46:25 2013 us=899301   down_script = '[UNDEF]'
Tue Dec 31 16:46:25 2013 us=899315   down_pre = DISABLED
Tue Dec 31 16:46:25 2013 us=899330   up_restart = DISABLED
Tue Dec 31 16:46:25 2013 us=899345   up_delay = DISABLED
Tue Dec 31 16:46:25 2013 us=899360   daemon = ENABLED
Tue Dec 31 16:46:25 2013 us=899376   inetd = 0
Tue Dec 31 16:46:25 2013 us=899391   log = ENABLED
Tue Dec 31 16:46:25 2013 us=899406   suppress_timestamps = DISABLED
Tue Dec 31 16:46:25 2013 us=899422   nice = 0
Tue Dec 31 16:46:25 2013 us=899437   verbosity = 4
Tue Dec 31 16:46:25 2013 us=899452   mute = 0
Tue Dec 31 16:46:25 2013 us=899467   gremlin = 0
Tue Dec 31 16:46:25 2013 us=899482   status_file = 'openvpn-status.log'
Tue Dec 31 16:46:25 2013 us=899497   status_file_version = 1
Tue Dec 31 16:46:25 2013 us=899512   status_file_update_freq = 60
Tue Dec 31 16:46:25 2013 us=899527   occ = ENABLED
Tue Dec 31 16:46:25 2013 us=899543   rcvbuf = 65536
Tue Dec 31 16:46:25 2013 us=899558   sndbuf = 65536
Tue Dec 31 16:46:25 2013 us=899573   sockflags = 0
Tue Dec 31 16:46:25 2013 us=899587   fast_io = DISABLED
Tue Dec 31 16:46:25 2013 us=899602   lzo = 7
Tue Dec 31 16:46:25 2013 us=899617   route_script = '[UNDEF]'
Tue Dec 31 16:46:25 2013 us=899632   route_default_gateway = '[UNDEF]'
Tue Dec 31 16:46:25 2013 us=899647   route_default_metric = 0
Tue Dec 31 16:46:25 2013 us=899662   route_noexec = DISABLED
Tue Dec 31 16:46:25 2013 us=899677   route_delay = 0
Tue Dec 31 16:46:25 2013 us=899692   route_delay_window = 30
Tue Dec 31 16:46:25 2013 us=899708   route_delay_defined = DISABLED
Tue Dec 31 16:46:25 2013 us=899723   route_nopull = DISABLED
Tue Dec 31 16:46:25 2013 us=899738   route_gateway_via_dhcp = DISABLED
Tue Dec 31 16:46:25 2013 us=899755   max_routes = 100
Tue Dec 31 16:46:25 2013 us=899781   allow_pull_fqdn = DISABLED
Tue Dec 31 16:46:25 2013 us=899796   management_addr = '[UNDEF]'
Tue Dec 31 16:46:25 2013 us=899811   management_port = 0
Tue Dec 31 16:46:25 2013 us=899827   management_user_pass = '[UNDEF]'
Tue Dec 31 16:46:25 2013 us=899842   management_log_history_cache = 250
Tue Dec 31 16:46:25 2013 us=899857   management_echo_buffer_size = 100
Tue Dec 31 16:46:25 2013 us=899872   management_write_peer_info_file = '[UNDEF]'
Tue Dec 31 16:46:25 2013 us=899888   management_client_user = '[UNDEF]'
Tue Dec 31 16:46:25 2013 us=899903   management_client_group = '[UNDEF]'
Tue Dec 31 16:46:25 2013 us=899918   management_flags = 0
Tue Dec 31 16:46:25 2013 us=899937   plugin[0] /usr/local/lib/openvpn/plugins/openvpn-plugin-auth-pam.so '[/usr/local/lib/openvpn/plugins/openvpn-plugin-auth-pam.so] [login]'
Tue Dec 31 16:46:25 2013 us=899952   shared_secret_file = '[UNDEF]'
Tue Dec 31 16:46:25 2013 us=899968   key_direction = 1
Tue Dec 31 16:46:25 2013 us=899982   ciphername_defined = ENABLED
Tue Dec 31 16:46:25 2013 us=899998   ciphername = 'AES-256-CBC'
Tue Dec 31 16:46:25 2013 us=900013   authname_defined = ENABLED
Tue Dec 31 16:46:25 2013 us=900028   authname = 'SHA256'
Tue Dec 31 16:46:25 2013 us=900044   prng_hash = 'SHA1'
Tue Dec 31 16:46:25 2013 us=900058   prng_nonce_secret_len = 16
Tue Dec 31 16:46:25 2013 us=900074   keysize = 0
Tue Dec 31 16:46:25 2013 us=900089   engine = DISABLED
Tue Dec 31 16:46:25 2013 us=900104   replay = ENABLED
Tue Dec 31 16:46:25 2013 us=900120   mute_replay_warnings = DISABLED
Tue Dec 31 16:46:25 2013 us=900135   replay_window = 64
Tue Dec 31 16:46:25 2013 us=900149   replay_time = 15
Tue Dec 31 16:46:25 2013 us=900165   packet_id_file = '[UNDEF]'
Tue Dec 31 16:46:25 2013 us=900180   use_iv = ENABLED
Tue Dec 31 16:46:25 2013 us=900195   test_crypto = DISABLED
Tue Dec 31 16:46:25 2013 us=900210   tls_server = ENABLED
Tue Dec 31 16:46:25 2013 us=900225   tls_client = DISABLED
Tue Dec 31 16:46:25 2013 us=900240   key_method = 2
Tue Dec 31 16:46:25 2013 us=900266   ca_file = '/usr/local/share/certs/cacert.pem'
Tue Dec 31 16:46:25 2013 us=900282   ca_path = '[UNDEF]'
Tue Dec 31 16:46:25 2013 us=900298   dh_file = '/usr/local/etc/openvpn/dh2048.pem'
Tue Dec 31 16:46:25 2013 us=900313   cert_file = '/usr/local/share/certs/servercert.pem'
Tue Dec 31 16:46:25 2013 us=900329   priv_key_file = '/usr/local/share/certs/serverkey.pem'
Tue Dec 31 16:46:25 2013 us=900344   pkcs12_file = '[UNDEF]'
Tue Dec 31 16:46:25 2013 us=900359   cipher_list = '[UNDEF]'
Tue Dec 31 16:46:25 2013 us=900374   tls_verify = '[UNDEF]'
Tue Dec 31 16:46:25 2013 us=900389   tls_export_cert = '[UNDEF]'
Tue Dec 31 16:46:25 2013 us=900405   verify_x509_type = 0
Tue Dec 31 16:46:25 2013 us=900420   verify_x509_name = '[UNDEF]'
Tue Dec 31 16:46:25 2013 us=900435   crl_file = '[UNDEF]'
Tue Dec 31 16:46:25 2013 us=900450   ns_cert_type = 0
Tue Dec 31 16:46:25 2013 us=900466   remote_cert_ku[i] = 0
Tue Dec 31 16:46:25 2013 us=900481   remote_cert_ku[i] = 0
Tue Dec 31 16:46:25 2013 us=900496   remote_cert_ku[i] = 0
Tue Dec 31 16:46:25 2013 us=900511   remote_cert_ku[i] = 0
Tue Dec 31 16:46:25 2013 us=900526   remote_cert_ku[i] = 0
Tue Dec 31 16:46:25 2013 us=900541   remote_cert_ku[i] = 0
Tue Dec 31 16:46:25 2013 us=900556   remote_cert_ku[i] = 0
Tue Dec 31 16:46:25 2013 us=900571   remote_cert_ku[i] = 0
Tue Dec 31 16:46:25 2013 us=900585   remote_cert_ku[i] = 0
Tue Dec 31 16:46:25 2013 us=900601   remote_cert_ku[i] = 0
Tue Dec 31 16:46:25 2013 us=900616   remote_cert_ku[i] = 0
Tue Dec 31 16:46:25 2013 us=900631   remote_cert_ku[i] = 0
Tue Dec 31 16:46:25 2013 us=900646   remote_cert_ku[i] = 0
Tue Dec 31 16:46:25 2013 us=900661   remote_cert_ku[i] = 0
Tue Dec 31 16:46:25 2013 us=900676   remote_cert_ku[i] = 0
Tue Dec 31 16:46:25 2013 us=900691   remote_cert_ku[i] = 0
Tue Dec 31 16:46:25 2013 us=900706   remote_cert_eku = '[UNDEF]'
Tue Dec 31 16:46:25 2013 us=900722   ssl_flags = 0
Tue Dec 31 16:46:25 2013 us=900737   tls_timeout = 2
Tue Dec 31 16:46:25 2013 us=900752   renegotiate_bytes = 0
Tue Dec 31 16:46:25 2013 us=900773   renegotiate_packets = 0
Tue Dec 31 16:46:25 2013 us=900789   renegotiate_seconds = 3600
Tue Dec 31 16:46:25 2013 us=900804   handshake_window = 60
Tue Dec 31 16:46:25 2013 us=900819   transition_window = 3600
Tue Dec 31 16:46:25 2013 us=900835   single_session = DISABLED
Tue Dec 31 16:46:25 2013 us=900849   push_peer_info = DISABLED
Tue Dec 31 16:46:25 2013 us=900865   tls_exit = DISABLED
Tue Dec 31 16:46:25 2013 us=900880   tls_auth_file = '/usr/local/etc/openvpn/tlskey.pem'
Tue Dec 31 16:46:25 2013 us=900899   server_network = 0.0.0.0
Tue Dec 31 16:46:25 2013 us=900916   server_netmask = 0.0.0.0
Tue Dec 31 16:46:25 2013 us=900940   server_network_ipv6 = ::
Tue Dec 31 16:46:25 2013 us=900956   server_netbits_ipv6 = 0
Tue Dec 31 16:46:25 2013 us=900973   server_bridge_ip = 192.168.10.1
Tue Dec 31 16:46:25 2013 us=900990   server_bridge_netmask = 255.255.255.224
Tue Dec 31 16:46:25 2013 us=901006   server_bridge_pool_start = 192.168.10.4
Tue Dec 31 16:46:25 2013 us=901024   server_bridge_pool_end = 192.168.10.6
Tue Dec 31 16:46:25 2013 us=901040   push_entry = 'redirect-gateway local def1 bypass-dhcp'
Tue Dec 31 16:46:25 2013 us=901055   push_entry = 'dhcp-option DNS 192.168.10.11'
Tue Dec 31 16:46:25 2013 us=901070   push_entry = 'route-gateway 192.168.10.1'
Tue Dec 31 16:46:25 2013 us=901085   push_entry = 'ping 10'
Tue Dec 31 16:46:25 2013 us=901101   push_entry = 'ping-restart 120'
Tue Dec 31 16:46:25 2013 us=901116   ifconfig_pool_defined = ENABLED
Tue Dec 31 16:46:25 2013 us=901132   ifconfig_pool_start = 192.168.10.4
Tue Dec 31 16:46:25 2013 us=901149   ifconfig_pool_end = 192.168.10.6
Tue Dec 31 16:46:25 2013 us=901167   ifconfig_pool_netmask = 255.255.255.224
Tue Dec 31 16:46:25 2013 us=901182   ifconfig_pool_persist_filename = 'ipp.txt'
Tue Dec 31 16:46:25 2013 us=901198   ifconfig_pool_persist_refresh_freq = 600
Tue Dec 31 16:46:25 2013 us=901213   ifconfig_ipv6_pool_defined = DISABLED
Tue Dec 31 16:46:25 2013 us=901228   ifconfig_ipv6_pool_base = ::
Tue Dec 31 16:46:25 2013 us=901249   ifconfig_ipv6_pool_netbits = 0
Tue Dec 31 16:46:25 2013 us=901265   n_bcast_buf = 256
Tue Dec 31 16:46:25 2013 us=901281   tcp_queue_limit = 64
Tue Dec 31 16:46:25 2013 us=901296   real_hash_size = 256
Tue Dec 31 16:46:25 2013 us=901311   virtual_hash_size = 256
Tue Dec 31 16:46:25 2013 us=901327   client_connect_script = '[UNDEF]'
Tue Dec 31 16:46:25 2013 us=901342   learn_address_script = '[UNDEF]'
Tue Dec 31 16:46:25 2013 us=901356   client_disconnect_script = '[UNDEF]'
Tue Dec 31 16:46:25 2013 us=901372   client_config_dir = '[UNDEF]'
Tue Dec 31 16:46:25 2013 us=901387   ccd_exclusive = DISABLED
Tue Dec 31 16:46:25 2013 us=901403   tmp_dir = '/tmp'
Tue Dec 31 16:46:25 2013 us=901418   push_ifconfig_defined = DISABLED
Tue Dec 31 16:46:25 2013 us=901435   push_ifconfig_local = 0.0.0.0
Tue Dec 31 16:46:25 2013 us=901451   push_ifconfig_remote_netmask = 0.0.0.0
Tue Dec 31 16:46:25 2013 us=901467   push_ifconfig_ipv6_defined = DISABLED
Tue Dec 31 16:46:25 2013 us=901482   push_ifconfig_ipv6_local = ::/0
Tue Dec 31 16:46:25 2013 us=901499   push_ifconfig_ipv6_remote = ::
Tue Dec 31 16:46:25 2013 us=901513   enable_c2c = DISABLED
Tue Dec 31 16:46:25 2013 us=901572   duplicate_cn = DISABLED
Tue Dec 31 16:46:25 2013 us=901589   cf_max = 0
Tue Dec 31 16:46:25 2013 us=901603   cf_per = 0
Tue Dec 31 16:46:25 2013 us=901620   max_clients = 10
Tue Dec 31 16:46:25 2013 us=901634   max_routes_per_client = 256
Tue Dec 31 16:46:25 2013 us=901650   auth_user_pass_verify_script = '[UNDEF]'
Tue Dec 31 16:46:25 2013 us=901665   auth_user_pass_verify_script_via_file = DISABLED
Tue Dec 31 16:46:25 2013 us=901681   port_share_host = '[UNDEF]'
Tue Dec 31 16:46:25 2013 us=901696   port_share_port = 0
Tue Dec 31 16:46:25 2013 us=901712   client = DISABLED
Tue Dec 31 16:46:25 2013 us=901727   pull = DISABLED
Tue Dec 31 16:46:25 2013 us=901741   auth_user_pass_file = '[UNDEF]'
Tue Dec 31 16:46:25 2013 us=901758 OpenVPN 2.3.2 amd64-portbld-freebsd8.4 [SSL (OpenSSL)] [LZO] [eurephia] [MH] [IPv6] built on Dec 25 2013
Tue Dec 31 16:46:25 2013 us=901827 NOTE: when bridging your LAN adapter with the TAP adapter, note that the new bridge adapter will often take on its own IP address that is different from what the LAN adapter was previously set to
AUTH-PAM: BACKGROUND: INIT service='login'
Tue Dec 31 16:46:25 2013 us=902276 PLUGIN_INIT: POST /usr/local/lib/openvpn/plugins/openvpn-plugin-auth-pam.so '[/usr/local/lib/openvpn/plugins/openvpn-plugin-auth-pam.so] [login]' intercepted=PLUGIN_AUTH_USER_PASS_VERIFY 
Tue Dec 31 16:46:25 2013 us=914133 Diffie-Hellman initialized with 2048 bit key
Tue Dec 31 16:46:25 2013 us=914738 Control Channel Authentication: using '/usr/local/etc/openvpn/tlskey.pem' as a OpenVPN static key file
Tue Dec 31 16:46:25 2013 us=914783 Outgoing Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
Tue Dec 31 16:46:25 2013 us=914805 Incoming Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
Tue Dec 31 16:46:25 2013 us=914834 TLS-Auth MTU parms [ L:1602 D:178 EF:78 EB:0 ET:0 EL:0 ]
Tue Dec 31 16:46:25 2013 us=914867 Socket Buffers: R=[42080->65536] S=[9216->65536]
Tue Dec 31 16:46:25 2013 us=914969 WARNING: --local address [192.168.10.15] conflicts with --ifconfig subnet [192.168.10.3, 255.255.255.224] -- local and remote addresses cannot be inside of the --ifconfig subnet. (silence this warning with --ifconfig-nowarn)
Tue Dec 31 16:46:25 2013 us=915033 TUN/TAP device tap0 exists previously, keep at program end
Tue Dec 31 16:46:25 2013 us=915213 TUN/TAP device /dev/tap0 opened
Tue Dec 31 16:46:25 2013 us=915232 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Tue Dec 31 16:46:25 2013 us=915266 /sbin/ifconfig tap0 192.168.10.3 netmask 255.255.255.224 mtu 1500 up
Tue Dec 31 16:46:25 2013 us=917847 Data Channel MTU parms [ L:1602 D:1450 EF:70 EB:135 ET:32 EL:0 AF:3/1 ]
Tue Dec 31 16:46:25 2013 us=919381 GID set to nobody
Tue Dec 31 16:46:25 2013 us=919438 UID set to nobody
Tue Dec 31 16:46:25 2013 us=919471 UDPv4 link local (bound): [AF_INET]192.168.10.15:1194
Tue Dec 31 16:46:25 2013 us=919509 UDPv4 link remote: [undef]
Tue Dec 31 16:46:25 2013 us=919530 MULTI: multi_init called, r=256 v=256
Tue Dec 31 16:46:25 2013 us=919664 IFCONFIG POOL: base=192.168.10.4 size=3, ipv6=0
Tue Dec 31 16:46:25 2013 us=919692 ifconfig_pool_read(), in='win7-laptop,192.168.10.4', TODO: IPv6
Tue Dec 31 16:46:25 2013 us=919754 succeeded -> ifconfig_pool_set()
Tue Dec 31 16:46:25 2013 us=919769 IFCONFIG POOL LIST
Tue Dec 31 16:46:25 2013 us=919783 win7-laptop,192.168.10.4
Tue Dec 31 16:46:25 2013 us=919888 Initialization Sequence Completed
Tue Dec 31 16:57:53 2013 us=276706 MULTI: multi_create_instance called
Tue Dec 31 16:57:53 2013 us=276784 192.168.10.16:57480 Re-using SSL/TLS context
Tue Dec 31 16:57:53 2013 us=276911 192.168.10.16:57480 LZO compression initialized
Tue Dec 31 16:57:53 2013 us=277277 192.168.10.16:57480 Control Channel MTU parms [ L:1602 D:178 EF:78 EB:0 ET:0 EL:0 ]
Tue Dec 31 16:57:53 2013 us=277297 192.168.10.16:57480 Data Channel MTU parms [ L:1602 D:1450 EF:70 EB:135 ET:32 EL:0 AF:3/1 ]
Tue Dec 31 16:57:53 2013 us=277451 192.168.10.16:57480 Local Options String: 'V4,dev-type tap,link-mtu 1602,tun-mtu 1532,proto UDPv4,comp-lzo,keydir 0,cipher AES-256-CBC,auth SHA256,keysize 256,tls-auth,key-method 2,tls-server'
Tue Dec 31 16:57:53 2013 us=277465 192.168.10.16:57480 Expected Remote Options String: 'V4,dev-type tap,link-mtu 1602,tun-mtu 1532,proto UDPv4,comp-lzo,keydir 1,cipher AES-256-CBC,auth SHA256,keysize 256,tls-auth,key-method 2,tls-client'
Tue Dec 31 16:57:53 2013 us=277505 192.168.10.16:57480 Local Options hash (VER=V4): '24ab3272'
Tue Dec 31 16:57:53 2013 us=277527 192.168.10.16:57480 Expected Remote Options hash (VER=V4): '3b66b7c7'
Tue Dec 31 16:57:53 2013 us=277586 192.168.10.16:57480 TLS: Initial packet from [AF_INET]192.168.10.16:57480, sid=9a2bd2d7 8eafe506
Tue Dec 31 16:57:53 2013 us=349486 192.168.10.16:57480 VERIFY OK: depth=1, CN=The Arda Network CA Root, ST=Ontario, C=CA, emailAddress=ca@example.com, O=The Arda Network Certification Authority
Tue Dec 31 16:57:53 2013 us=349722 192.168.10.16:57480 VERIFY OK: depth=0, CN=win7-laptop, ST=Ontario, C=CA, emailAddress=postmaster@empowered.ca, O=The Arda Network
AUTH-PAM: BACKGROUND: received command code: 0
AUTH-PAM: BACKGROUND: USER: andrew
AUTH-PAM: BACKGROUND: my_conv[0] query='Password:' style=1
Tue Dec 31 16:57:53 2013 us=373630 192.168.10.16:57480 PLUGIN_CALL: POST /usr/local/lib/openvpn/plugins/openvpn-plugin-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=0
Tue Dec 31 16:57:53 2013 us=373694 192.168.10.16:57480 TLS: Username/Password authentication succeeded for username 'andrew' 
Tue Dec 31 16:57:53 2013 us=373885 192.168.10.16:57480 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Tue Dec 31 16:57:53 2013 us=373905 192.168.10.16:57480 Data Channel Encrypt: Using 256 bit message hash 'SHA256' for HMAC authentication
Tue Dec 31 16:57:53 2013 us=373921 192.168.10.16:57480 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Tue Dec 31 16:57:53 2013 us=373943 192.168.10.16:57480 Data Channel Decrypt: Using 256 bit message hash 'SHA256' for HMAC authentication
Tue Dec 31 16:57:53 2013 us=376004 192.168.10.16:57480 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Tue Dec 31 16:57:53 2013 us=376086 192.168.10.16:57480 [win7-laptop] Peer Connection Initiated with [AF_INET]192.168.10.16:57480
Tue Dec 31 16:57:53 2013 us=376129 win7-laptop/192.168.10.16:57480 MULTI_sva: pool returned IPv4=192.168.10.4, IPv6=(Not enabled)
Tue Dec 31 16:57:55 2013 us=600834 win7-laptop/192.168.10.16:57480 PUSH: Received control message: 'PUSH_REQUEST'
Tue Dec 31 16:57:55 2013 us=600877 win7-laptop/192.168.10.16:57480 send_push_reply(): safe_cap=940
Tue Dec 31 16:57:55 2013 us=600918 win7-laptop/192.168.10.16:57480 SENT CONTROL [win7-laptop]: 'PUSH_REPLY,redirect-gateway local def1 bypass-dhcp,dhcp-option DNS 192.168.10.11,route-gateway 192.168.10.1,ping 10,ping-restart 120,ifconfig 192.168.10.4 255.255.255.224' (status=1)
Tue Dec 31 16:57:55 2013 us=710352 win7-laptop/192.168.10.16:57480 MULTI: Learn: 00:ff:81:fe:21:ba -> win7-laptop/192.168.10.16:57480

client log

Tue Dec 31 16:57:43 2013 us=168647 Current Parameter Settings:
Tue Dec 31 16:57:43 2013 us=169647   config = 'client.ovpn'
Tue Dec 31 16:57:43 2013 us=169647   mode = 0
Tue Dec 31 16:57:43 2013 us=169647   show_ciphers = DISABLED
Tue Dec 31 16:57:43 2013 us=169647   show_digests = DISABLED
Tue Dec 31 16:57:43 2013 us=169647   show_engines = DISABLED
Tue Dec 31 16:57:43 2013 us=169647   genkey = DISABLED
Tue Dec 31 16:57:43 2013 us=169647   key_pass_file = '[UNDEF]'
Tue Dec 31 16:57:43 2013 us=169647   show_tls_ciphers = DISABLED
Tue Dec 31 16:57:43 2013 us=169647 Connection profiles [default]:
Tue Dec 31 16:57:43 2013 us=169647   proto = udp
Tue Dec 31 16:57:43 2013 us=169647   local = '[UNDEF]'
Tue Dec 31 16:57:43 2013 us=169647   local_port = 0
Tue Dec 31 16:57:43 2013 us=169647   remote = '192.168.10.15'
Tue Dec 31 16:57:43 2013 us=169647   remote_port = 1194
Tue Dec 31 16:57:43 2013 us=169647   remote_float = DISABLED
Tue Dec 31 16:57:43 2013 us=169647   bind_defined = DISABLED
Tue Dec 31 16:57:43 2013 us=169647   bind_local = DISABLED
Tue Dec 31 16:57:43 2013 us=169647   connect_retry_seconds = 5
Tue Dec 31 16:57:43 2013 us=169647   connect_timeout = 10
Tue Dec 31 16:57:43 2013 us=169647   connect_retry_max = 0
Tue Dec 31 16:57:43 2013 us=169647   socks_proxy_server = '[UNDEF]'
Tue Dec 31 16:57:43 2013 us=169647   socks_proxy_port = 0
Tue Dec 31 16:57:43 2013 us=169647   socks_proxy_retry = DISABLED
Tue Dec 31 16:57:43 2013 us=169647   tun_mtu = 1500
Tue Dec 31 16:57:43 2013 us=169647   tun_mtu_defined = ENABLED
Tue Dec 31 16:57:43 2013 us=169647   link_mtu = 1500
Tue Dec 31 16:57:43 2013 us=169647   link_mtu_defined = DISABLED
Tue Dec 31 16:57:43 2013 us=169647   tun_mtu_extra = 32
Tue Dec 31 16:57:43 2013 us=169647   tun_mtu_extra_defined = ENABLED
Tue Dec 31 16:57:43 2013 us=169647   mtu_discover_type = -1
Tue Dec 31 16:57:43 2013 us=169647   fragment = 0
Tue Dec 31 16:57:43 2013 us=169647   mssfix = 1450
Tue Dec 31 16:57:43 2013 us=169647   explicit_exit_notification = 1
Tue Dec 31 16:57:43 2013 us=169647 Connection profiles END
Tue Dec 31 16:57:43 2013 us=169647   remote_random = DISABLED
Tue Dec 31 16:57:43 2013 us=169647   ipchange = '[UNDEF]'
Tue Dec 31 16:57:43 2013 us=169647   dev = 'tap'
Tue Dec 31 16:57:43 2013 us=169647   dev_type = '[UNDEF]'
Tue Dec 31 16:57:43 2013 us=169647   dev_node = '[UNDEF]'
Tue Dec 31 16:57:43 2013 us=169647   lladdr = '[UNDEF]'
Tue Dec 31 16:57:43 2013 us=169647   topology = 1
Tue Dec 31 16:57:43 2013 us=169647   tun_ipv6 = DISABLED
Tue Dec 31 16:57:43 2013 us=169647   ifconfig_local = '[UNDEF]'
Tue Dec 31 16:57:43 2013 us=169647   ifconfig_remote_netmask = '[UNDEF]'
Tue Dec 31 16:57:43 2013 us=169647   ifconfig_noexec = DISABLED
Tue Dec 31 16:57:43 2013 us=169647   ifconfig_nowarn = DISABLED
Tue Dec 31 16:57:43 2013 us=169647   ifconfig_ipv6_local = '[UNDEF]'
Tue Dec 31 16:57:43 2013 us=169647   ifconfig_ipv6_netbits = 0
Tue Dec 31 16:57:43 2013 us=169647   ifconfig_ipv6_remote = '[UNDEF]'
Tue Dec 31 16:57:43 2013 us=169647   shaper = 0
Tue Dec 31 16:57:43 2013 us=169647   mtu_test = 0
Tue Dec 31 16:57:43 2013 us=169647   mlock = DISABLED
Tue Dec 31 16:57:43 2013 us=169647   keepalive_ping = 0
Tue Dec 31 16:57:43 2013 us=169647   keepalive_timeout = 0
Tue Dec 31 16:57:43 2013 us=169647   inactivity_timeout = 0
Tue Dec 31 16:57:43 2013 us=169647   ping_send_timeout = 0
Tue Dec 31 16:57:43 2013 us=169647   ping_rec_timeout = 0
Tue Dec 31 16:57:43 2013 us=169647   ping_rec_timeout_action = 0
Tue Dec 31 16:57:43 2013 us=169647   ping_timer_remote = DISABLED
Tue Dec 31 16:57:43 2013 us=169647   remap_sigusr1 = 0
Tue Dec 31 16:57:43 2013 us=169647   persist_tun = ENABLED
Tue Dec 31 16:57:43 2013 us=169647   persist_local_ip = DISABLED
Tue Dec 31 16:57:43 2013 us=169647   persist_remote_ip = DISABLED
Tue Dec 31 16:57:43 2013 us=169647   persist_key = ENABLED
Tue Dec 31 16:57:43 2013 us=169647   passtos = DISABLED
Tue Dec 31 16:57:43 2013 us=169647   resolve_retry_seconds = 1000000000
Tue Dec 31 16:57:43 2013 us=169647   username = '[UNDEF]'
Tue Dec 31 16:57:43 2013 us=169647   groupname = '[UNDEF]'
Tue Dec 31 16:57:43 2013 us=169647   chroot_dir = '[UNDEF]'
Tue Dec 31 16:57:43 2013 us=169647   cd_dir = '[UNDEF]'
Tue Dec 31 16:57:43 2013 us=169647   writepid = '[UNDEF]'
Tue Dec 31 16:57:43 2013 us=169647   up_script = '[UNDEF]'
Tue Dec 31 16:57:43 2013 us=169647   down_script = '[UNDEF]'
Tue Dec 31 16:57:43 2013 us=169647   down_pre = DISABLED
Tue Dec 31 16:57:43 2013 us=169647   up_restart = DISABLED
Tue Dec 31 16:57:43 2013 us=169647   up_delay = DISABLED
Tue Dec 31 16:57:43 2013 us=169647   daemon = DISABLED
Tue Dec 31 16:57:43 2013 us=169647   inetd = 0
Tue Dec 31 16:57:43 2013 us=169647   log = ENABLED
Tue Dec 31 16:57:43 2013 us=169647   suppress_timestamps = DISABLED
Tue Dec 31 16:57:43 2013 us=169647   nice = 0
Tue Dec 31 16:57:43 2013 us=169647   verbosity = 4
Tue Dec 31 16:57:43 2013 us=169647   mute = 0
Tue Dec 31 16:57:43 2013 us=169647   status_file = '[UNDEF]'
Tue Dec 31 16:57:43 2013 us=169647   status_file_version = 1
Tue Dec 31 16:57:43 2013 us=169647   status_file_update_freq = 60
Tue Dec 31 16:57:43 2013 us=169647   occ = ENABLED
Tue Dec 31 16:57:43 2013 us=169647   rcvbuf = 0
Tue Dec 31 16:57:43 2013 us=169647   sndbuf = 0
Tue Dec 31 16:57:43 2013 us=169647   sockflags = 0
Tue Dec 31 16:57:43 2013 us=169647   fast_io = DISABLED
Tue Dec 31 16:57:43 2013 us=169647   lzo = 7
Tue Dec 31 16:57:43 2013 us=169647   route_script = '[UNDEF]'
Tue Dec 31 16:57:43 2013 us=169647   route_default_gateway = '[UNDEF]'
Tue Dec 31 16:57:43 2013 us=169647   route_default_metric = 0
Tue Dec 31 16:57:43 2013 us=169647   route_noexec = DISABLED
Tue Dec 31 16:57:43 2013 us=169647   route_delay = 5
Tue Dec 31 16:57:43 2013 us=169647   route_delay_window = 30
Tue Dec 31 16:57:43 2013 us=169647   route_delay_defined = ENABLED
Tue Dec 31 16:57:43 2013 us=169647   route_nopull = DISABLED
Tue Dec 31 16:57:43 2013 us=169647   route_gateway_via_dhcp = DISABLED
Tue Dec 31 16:57:43 2013 us=169647   max_routes = 100
Tue Dec 31 16:57:43 2013 us=169647   allow_pull_fqdn = DISABLED
Tue Dec 31 16:57:43 2013 us=169647   management_addr = '127.0.0.1'
Tue Dec 31 16:57:43 2013 us=169647   management_port = 25340
Tue Dec 31 16:57:43 2013 us=169647   management_user_pass = 'stdin'
Tue Dec 31 16:57:43 2013 us=169647   management_log_history_cache = 250
Tue Dec 31 16:57:43 2013 us=169647   management_echo_buffer_size = 100
Tue Dec 31 16:57:43 2013 us=169647   management_write_peer_info_file = '[UNDEF]'
Tue Dec 31 16:57:43 2013 us=169647   management_client_user = '[UNDEF]'
Tue Dec 31 16:57:43 2013 us=169647   management_client_group = '[UNDEF]'
Tue Dec 31 16:57:43 2013 us=169647   management_flags = 6
Tue Dec 31 16:57:43 2013 us=169647   shared_secret_file = '[UNDEF]'
Tue Dec 31 16:57:43 2013 us=169647   key_direction = 2
Tue Dec 31 16:57:43 2013 us=169647   ciphername_defined = ENABLED
Tue Dec 31 16:57:43 2013 us=169647   ciphername = 'AES-256-CBC'
Tue Dec 31 16:57:43 2013 us=169647   authname_defined = ENABLED
Tue Dec 31 16:57:43 2013 us=169647   authname = 'SHA256'
Tue Dec 31 16:57:43 2013 us=169647   prng_hash = 'SHA1'
Tue Dec 31 16:57:43 2013 us=169647   prng_nonce_secret_len = 16
Tue Dec 31 16:57:43 2013 us=169647   keysize = 0
Tue Dec 31 16:57:43 2013 us=169647   engine = DISABLED
Tue Dec 31 16:57:43 2013 us=169647   replay = ENABLED
Tue Dec 31 16:57:43 2013 us=169647   mute_replay_warnings = DISABLED
Tue Dec 31 16:57:43 2013 us=169647   replay_window = 64
Tue Dec 31 16:57:43 2013 us=169647   replay_time = 15
Tue Dec 31 16:57:43 2013 us=169647   packet_id_file = '[UNDEF]'
Tue Dec 31 16:57:43 2013 us=169647   use_iv = ENABLED
Tue Dec 31 16:57:43 2013 us=169647   test_crypto = DISABLED
Tue Dec 31 16:57:43 2013 us=169647   tls_server = DISABLED
Tue Dec 31 16:57:43 2013 us=169647   tls_client = ENABLED
Tue Dec 31 16:57:43 2013 us=169647   key_method = 2
Tue Dec 31 16:57:43 2013 us=169647   ca_file = 'cacert.pem'
Tue Dec 31 16:57:43 2013 us=169647   ca_path = '[UNDEF]'
Tue Dec 31 16:57:43 2013 us=169647   dh_file = '[UNDEF]'
Tue Dec 31 16:57:43 2013 us=169647   cert_file = 'clientcert.pem'
Tue Dec 31 16:57:43 2013 us=169647   priv_key_file = 'clientkey.pem'
Tue Dec 31 16:57:43 2013 us=169647   pkcs12_file = '[UNDEF]'
Tue Dec 31 16:57:43 2013 us=169647   cryptoapi_cert = '[UNDEF]'
Tue Dec 31 16:57:43 2013 us=169647   cipher_list = '[UNDEF]'
Tue Dec 31 16:57:43 2013 us=169647   tls_verify = '[UNDEF]'
Tue Dec 31 16:57:43 2013 us=169647   tls_export_cert = '[UNDEF]'
Tue Dec 31 16:57:43 2013 us=169647   verify_x509_type = 0
Tue Dec 31 16:57:43 2013 us=169647   verify_x509_name = '[UNDEF]'
Tue Dec 31 16:57:43 2013 us=169647   crl_file = '[UNDEF]'
Tue Dec 31 16:57:43 2013 us=169647   ns_cert_type = 1
Tue Dec 31 16:57:43 2013 us=169647   remote_cert_ku[i] = 0
Tue Dec 31 16:57:43 2013 us=169647   remote_cert_ku[i] = 0
Tue Dec 31 16:57:43 2013 us=169647   remote_cert_ku[i] = 0
Tue Dec 31 16:57:43 2013 us=169647   remote_cert_ku[i] = 0
Tue Dec 31 16:57:43 2013 us=170647   remote_cert_ku[i] = 0
Tue Dec 31 16:57:43 2013 us=170647   remote_cert_ku[i] = 0
Tue Dec 31 16:57:43 2013 us=170647   remote_cert_ku[i] = 0
Tue Dec 31 16:57:43 2013 us=170647   remote_cert_ku[i] = 0
Tue Dec 31 16:57:43 2013 us=170647   remote_cert_ku[i] = 0
Tue Dec 31 16:57:43 2013 us=170647   remote_cert_ku[i] = 0
Tue Dec 31 16:57:43 2013 us=170647   remote_cert_ku[i] = 0
Tue Dec 31 16:57:43 2013 us=170647   remote_cert_ku[i] = 0
Tue Dec 31 16:57:43 2013 us=170647   remote_cert_ku[i] = 0
Tue Dec 31 16:57:43 2013 us=170647   remote_cert_ku[i] = 0
Tue Dec 31 16:57:43 2013 us=170647   remote_cert_ku[i] = 0
Tue Dec 31 16:57:43 2013 us=170647   remote_cert_ku[i] = 0
Tue Dec 31 16:57:43 2013 us=170647   remote_cert_eku = '[UNDEF]'
Tue Dec 31 16:57:43 2013 us=170647   ssl_flags = 0
Tue Dec 31 16:57:43 2013 us=170647   tls_timeout = 2
Tue Dec 31 16:57:43 2013 us=170647   renegotiate_bytes = 0
Tue Dec 31 16:57:43 2013 us=170647   renegotiate_packets = 0
Tue Dec 31 16:57:43 2013 us=170647   renegotiate_seconds = 3600
Tue Dec 31 16:57:43 2013 us=170647   handshake_window = 60
Tue Dec 31 16:57:43 2013 us=170647   transition_window = 3600
Tue Dec 31 16:57:43 2013 us=170647   single_session = DISABLED
Tue Dec 31 16:57:43 2013 us=170647   push_peer_info = DISABLED
Tue Dec 31 16:57:43 2013 us=170647   tls_exit = DISABLED
Tue Dec 31 16:57:43 2013 us=170647   tls_auth_file = 'tlskey.pem'
Tue Dec 31 16:57:43 2013 us=170647   pkcs11_protected_authentication = DISABLED
Tue Dec 31 16:57:43 2013 us=170647   pkcs11_protected_authentication = DISABLED
Tue Dec 31 16:57:43 2013 us=170647   pkcs11_protected_authentication = DISABLED
Tue Dec 31 16:57:43 2013 us=170647   pkcs11_protected_authentication = DISABLED
Tue Dec 31 16:57:43 2013 us=170647   pkcs11_protected_authentication = DISABLED
Tue Dec 31 16:57:43 2013 us=170647   pkcs11_protected_authentication = DISABLED
Tue Dec 31 16:57:43 2013 us=170647   pkcs11_protected_authentication = DISABLED
Tue Dec 31 16:57:43 2013 us=170647   pkcs11_protected_authentication = DISABLED
Tue Dec 31 16:57:43 2013 us=170647   pkcs11_protected_authentication = DISABLED
Tue Dec 31 16:57:43 2013 us=170647   pkcs11_protected_authentication = DISABLED
Tue Dec 31 16:57:43 2013 us=170647   pkcs11_protected_authentication = DISABLED
Tue Dec 31 16:57:43 2013 us=170647   pkcs11_protected_authentication = DISABLED
Tue Dec 31 16:57:43 2013 us=170647   pkcs11_protected_authentication = DISABLED
Tue Dec 31 16:57:43 2013 us=170647   pkcs11_protected_authentication = DISABLED
Tue Dec 31 16:57:43 2013 us=170647   pkcs11_protected_authentication = DISABLED
Tue Dec 31 16:57:43 2013 us=170647   pkcs11_protected_authentication = DISABLED
Tue Dec 31 16:57:43 2013 us=170647   pkcs11_private_mode = 00000000
Tue Dec 31 16:57:43 2013 us=170647   pkcs11_private_mode = 00000000
Tue Dec 31 16:57:43 2013 us=170647   pkcs11_private_mode = 00000000
Tue Dec 31 16:57:43 2013 us=170647   pkcs11_private_mode = 00000000
Tue Dec 31 16:57:43 2013 us=170647   pkcs11_private_mode = 00000000
Tue Dec 31 16:57:43 2013 us=170647   pkcs11_private_mode = 00000000
Tue Dec 31 16:57:43 2013 us=170647   pkcs11_private_mode = 00000000
Tue Dec 31 16:57:43 2013 us=170647   pkcs11_private_mode = 00000000
Tue Dec 31 16:57:43 2013 us=170647   pkcs11_private_mode = 00000000
Tue Dec 31 16:57:43 2013 us=170647   pkcs11_private_mode = 00000000
Tue Dec 31 16:57:43 2013 us=170647   pkcs11_private_mode = 00000000
Tue Dec 31 16:57:43 2013 us=170647   pkcs11_private_mode = 00000000
Tue Dec 31 16:57:43 2013 us=170647   pkcs11_private_mode = 00000000
Tue Dec 31 16:57:43 2013 us=170647   pkcs11_private_mode = 00000000
Tue Dec 31 16:57:43 2013 us=170647   pkcs11_private_mode = 00000000
Tue Dec 31 16:57:43 2013 us=170647   pkcs11_private_mode = 00000000
Tue Dec 31 16:57:43 2013 us=170647   pkcs11_cert_private = DISABLED
Tue Dec 31 16:57:43 2013 us=170647   pkcs11_cert_private = DISABLED
Tue Dec 31 16:57:43 2013 us=170647   pkcs11_cert_private = DISABLED
Tue Dec 31 16:57:43 2013 us=170647   pkcs11_cert_private = DISABLED
Tue Dec 31 16:57:43 2013 us=170647   pkcs11_cert_private = DISABLED
Tue Dec 31 16:57:43 2013 us=170647   pkcs11_cert_private = DISABLED
Tue Dec 31 16:57:43 2013 us=170647   pkcs11_cert_private = DISABLED
Tue Dec 31 16:57:43 2013 us=170647   pkcs11_cert_private = DISABLED
Tue Dec 31 16:57:43 2013 us=170647   pkcs11_cert_private = DISABLED
Tue Dec 31 16:57:43 2013 us=170647   pkcs11_cert_private = DISABLED
Tue Dec 31 16:57:43 2013 us=170647   pkcs11_cert_private = DISABLED
Tue Dec 31 16:57:43 2013 us=170647   pkcs11_cert_private = DISABLED
Tue Dec 31 16:57:43 2013 us=170647   pkcs11_cert_private = DISABLED
Tue Dec 31 16:57:43 2013 us=170647   pkcs11_cert_private = DISABLED
Tue Dec 31 16:57:43 2013 us=170647   pkcs11_cert_private = DISABLED
Tue Dec 31 16:57:43 2013 us=170647   pkcs11_cert_private = DISABLED
Tue Dec 31 16:57:43 2013 us=170647   pkcs11_pin_cache_period = -1
Tue Dec 31 16:57:43 2013 us=170647   pkcs11_id = '[UNDEF]'
Tue Dec 31 16:57:43 2013 us=170647   pkcs11_id_management = DISABLED
Tue Dec 31 16:57:43 2013 us=170647   server_network = 0.0.0.0
Tue Dec 31 16:57:43 2013 us=170647   server_netmask = 0.0.0.0
Tue Dec 31 16:57:43 2013 us=171647   server_network_ipv6 = ::
Tue Dec 31 16:57:43 2013 us=171647   server_netbits_ipv6 = 0
Tue Dec 31 16:57:43 2013 us=171647   server_bridge_ip = 0.0.0.0
Tue Dec 31 16:57:43 2013 us=171647   server_bridge_netmask = 0.0.0.0
Tue Dec 31 16:57:43 2013 us=171647   server_bridge_pool_start = 0.0.0.0
Tue Dec 31 16:57:43 2013 us=171647   server_bridge_pool_end = 0.0.0.0
Tue Dec 31 16:57:43 2013 us=171647   ifconfig_pool_defined = DISABLED
Tue Dec 31 16:57:43 2013 us=171647   ifconfig_pool_start = 0.0.0.0
Tue Dec 31 16:57:43 2013 us=171647   ifconfig_pool_end = 0.0.0.0
Tue Dec 31 16:57:43 2013 us=171647   ifconfig_pool_netmask = 0.0.0.0
Tue Dec 31 16:57:43 2013 us=171647   ifconfig_pool_persist_filename = '[UNDEF]'
Tue Dec 31 16:57:43 2013 us=171647   ifconfig_pool_persist_refresh_freq = 600
Tue Dec 31 16:57:43 2013 us=171647   ifconfig_ipv6_pool_defined = DISABLED
Tue Dec 31 16:57:43 2013 us=171647   ifconfig_ipv6_pool_base = ::
Tue Dec 31 16:57:43 2013 us=171647   ifconfig_ipv6_pool_netbits = 0
Tue Dec 31 16:57:43 2013 us=171647   n_bcast_buf = 256
Tue Dec 31 16:57:43 2013 us=171647   tcp_queue_limit = 64
Tue Dec 31 16:57:43 2013 us=171647   real_hash_size = 256
Tue Dec 31 16:57:43 2013 us=171647   virtual_hash_size = 256
Tue Dec 31 16:57:43 2013 us=171647   client_connect_script = '[UNDEF]'
Tue Dec 31 16:57:43 2013 us=171647   learn_address_script = '[UNDEF]'
Tue Dec 31 16:57:43 2013 us=171647   client_disconnect_script = '[UNDEF]'
Tue Dec 31 16:57:43 2013 us=171647   client_config_dir = '[UNDEF]'
Tue Dec 31 16:57:43 2013 us=171647   ccd_exclusive = DISABLED
Tue Dec 31 16:57:43 2013 us=171647   tmp_dir = 'C:\Users\ASTJEA~1.ENT\AppData\Local\Temp\'
Tue Dec 31 16:57:43 2013 us=171647   push_ifconfig_defined = DISABLED
Tue Dec 31 16:57:43 2013 us=171647   push_ifconfig_local = 0.0.0.0
Tue Dec 31 16:57:43 2013 us=171647   push_ifconfig_remote_netmask = 0.0.0.0
Tue Dec 31 16:57:43 2013 us=171647   push_ifconfig_ipv6_defined = DISABLED
Tue Dec 31 16:57:43 2013 us=171647   push_ifconfig_ipv6_local = ::/0
Tue Dec 31 16:57:43 2013 us=171647   push_ifconfig_ipv6_remote = ::
Tue Dec 31 16:57:43 2013 us=171647   enable_c2c = DISABLED
Tue Dec 31 16:57:43 2013 us=171647   duplicate_cn = DISABLED
Tue Dec 31 16:57:43 2013 us=171647   cf_max = 0
Tue Dec 31 16:57:43 2013 us=171647   cf_per = 0
Tue Dec 31 16:57:43 2013 us=171647   max_clients = 1024
Tue Dec 31 16:57:43 2013 us=171647   max_routes_per_client = 256
Tue Dec 31 16:57:43 2013 us=171647   auth_user_pass_verify_script = '[UNDEF]'
Tue Dec 31 16:57:43 2013 us=171647   auth_user_pass_verify_script_via_file = DISABLED
Tue Dec 31 16:57:43 2013 us=171647   client = ENABLED
Tue Dec 31 16:57:43 2013 us=171647   pull = ENABLED
Tue Dec 31 16:57:43 2013 us=171647   auth_user_pass_file = 'stdin'
Tue Dec 31 16:57:43 2013 us=171647   show_net_up = DISABLED
Tue Dec 31 16:57:43 2013 us=171647   route_method = 0
Tue Dec 31 16:57:43 2013 us=171647   ip_win32_defined = DISABLED
Tue Dec 31 16:57:43 2013 us=171647   ip_win32_type = 3
Tue Dec 31 16:57:43 2013 us=171647   dhcp_masq_offset = 0
Tue Dec 31 16:57:43 2013 us=171647   dhcp_lease_time = 31536000
Tue Dec 31 16:57:43 2013 us=171647   tap_sleep = 0
Tue Dec 31 16:57:43 2013 us=172647   dhcp_options = DISABLED
Tue Dec 31 16:57:43 2013 us=172647   dhcp_renew = DISABLED
Tue Dec 31 16:57:43 2013 us=172647   dhcp_pre_release = DISABLED
Tue Dec 31 16:57:43 2013 us=172647   dhcp_release = DISABLED
Tue Dec 31 16:57:43 2013 us=172647   domain = '[UNDEF]'
Tue Dec 31 16:57:43 2013 us=172647   netbios_scope = '[UNDEF]'
Tue Dec 31 16:57:43 2013 us=172647   netbios_node_type = 0
Tue Dec 31 16:57:43 2013 us=172647   disable_nbt = DISABLED
Tue Dec 31 16:57:43 2013 us=172647 OpenVPN 2.3.2 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [eurephia] [IPv6] built on Aug 22 2013
Enter Management Password:
Tue Dec 31 16:57:43 2013 us=173648 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Tue Dec 31 16:57:43 2013 us=173648 Need hold release from management interface, waiting...
Tue Dec 31 16:57:43 2013 us=646675 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Tue Dec 31 16:57:43 2013 us=747680 MANAGEMENT: CMD 'state on'
Tue Dec 31 16:57:43 2013 us=748680 MANAGEMENT: CMD 'log all on'
Tue Dec 31 16:57:43 2013 us=840686 MANAGEMENT: CMD 'hold off'
Tue Dec 31 16:57:43 2013 us=841686 MANAGEMENT: CMD 'hold release'
Tue Dec 31 16:57:49 2013 us=102987 MANAGEMENT: CMD 'username "Auth" "andrew"'
Tue Dec 31 16:57:49 2013 us=107987 MANAGEMENT: CMD 'password [...]'
Tue Dec 31 16:57:49 2013 us=250995 Control Channel Authentication: using 'tlskey.pem' as a OpenVPN static key file
Tue Dec 31 16:57:49 2013 us=251995 Outgoing Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
Tue Dec 31 16:57:49 2013 us=251995 Incoming Control Channel Authentication: Using 256 bit message hash 'SHA256' for HMAC authentication
Tue Dec 31 16:57:49 2013 us=251995 LZO compression initialized
Tue Dec 31 16:57:49 2013 us=251995 Control Channel MTU parms [ L:1602 D:178 EF:78 EB:0 ET:0 EL:0 ]
Tue Dec 31 16:57:49 2013 us=251995 Socket Buffers: R=[8192->8192] S=[8192->8192]
Tue Dec 31 16:57:49 2013 us=251995 Data Channel MTU parms [ L:1602 D:1450 EF:70 EB:135 ET:32 EL:0 AF:3/1 ]
Tue Dec 31 16:57:49 2013 us=251995 Local Options String: 'V4,dev-type tap,link-mtu 1602,tun-mtu 1532,proto UDPv4,comp-lzo,keydir 1,cipher AES-256-CBC,auth SHA256,keysize 256,tls-auth,key-method 2,tls-client'
Tue Dec 31 16:57:49 2013 us=251995 Expected Remote Options String: 'V4,dev-type tap,link-mtu 1602,tun-mtu 1532,proto UDPv4,comp-lzo,keydir 0,cipher AES-256-CBC,auth SHA256,keysize 256,tls-auth,key-method 2,tls-server'
Tue Dec 31 16:57:49 2013 us=251995 Local Options hash (VER=V4): '3b66b7c7'
Tue Dec 31 16:57:49 2013 us=251995 Expected Remote Options hash (VER=V4): '24ab3272'
Tue Dec 31 16:57:49 2013 us=251995 UDPv4 link local: [undef]
Tue Dec 31 16:57:49 2013 us=251995 UDPv4 link remote: [AF_INET]192.168.10.15:1194
Tue Dec 31 16:57:49 2013 us=251995 MANAGEMENT: >STATE:1388527069,WAIT,,,
Tue Dec 31 16:57:49 2013 us=255995 MANAGEMENT: >STATE:1388527069,AUTH,,,
Tue Dec 31 16:57:49 2013 us=255995 TLS: Initial packet from [AF_INET]192.168.10.15:1194, sid=fa554b6d 0c214a5d
Tue Dec 31 16:57:49 2013 us=256996 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Tue Dec 31 16:57:49 2013 us=285997 VERIFY OK: depth=1, CN=The Arda Network CA Root, ST=Ontario, C=CA, emailAddress=ca@example.com, O=The Arda Network Certification Authority
Tue Dec 31 16:57:49 2013 us=285997 VERIFY OK: nsCertType=SERVER
Tue Dec 31 16:57:49 2013 us=285997 VERIFY OK: depth=0, CN=atlas.example.com, ST=Ontario, C=CA, emailAddress=postmaster@example.com, O=The Arda Network
Tue Dec 31 16:57:49 2013 us=353001 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Tue Dec 31 16:57:49 2013 us=353001 Data Channel Encrypt: Using 256 bit message hash 'SHA256' for HMAC authentication
Tue Dec 31 16:57:49 2013 us=353001 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Tue Dec 31 16:57:49 2013 us=354001 Data Channel Decrypt: Using 256 bit message hash 'SHA256' for HMAC authentication
Tue Dec 31 16:57:49 2013 us=354001 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Tue Dec 31 16:57:49 2013 us=354001 [atlas.example.com] Peer Connection Initiated with [AF_INET]192.168.10.15:1194
Tue Dec 31 16:57:50 2013 us=466065 MANAGEMENT: >STATE:1388527070,GET_CONFIG,,,
Tue Dec 31 16:57:51 2013 us=578128 SENT CONTROL [atlas.example.com]: 'PUSH_REQUEST' (status=1)
Tue Dec 31 16:57:51 2013 us=581128 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway local def1 bypass-dhcp,dhcp-option DNS 192.168.10.11,route-gateway 192.168.10.1,ping 10,ping-restart 120,ifconfig 192.168.10.4 255.255.255.224'
Tue Dec 31 16:57:51 2013 us=581128 OPTIONS IMPORT: timers and/or timeouts modified
Tue Dec 31 16:57:51 2013 us=581128 OPTIONS IMPORT: --ifconfig/up options modified
Tue Dec 31 16:57:51 2013 us=581128 OPTIONS IMPORT: route options modified
Tue Dec 31 16:57:51 2013 us=581128 OPTIONS IMPORT: route-related options modified
Tue Dec 31 16:57:51 2013 us=581128 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Tue Dec 31 16:57:51 2013 us=581128 WARNING: --remote address [192.168.10.15] conflicts with --ifconfig subnet [192.168.10.4, 255.255.255.224] -- local and remote addresses cannot be inside of the --ifconfig subnet. (silence this warning with --ifconfig-nowarn)
Tue Dec 31 16:57:51 2013 us=629131 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Tue Dec 31 16:57:51 2013 us=629131 MANAGEMENT: >STATE:1388527071,ASSIGN_IP,,192.168.10.4,
Tue Dec 31 16:57:51 2013 us=629131 open_tun, tt->ipv6=0
Tue Dec 31 16:57:51 2013 us=630131 TAP-WIN32 device [OpenVPN Client Connection] opened: \\.\Global\{81FE21BA-CDC0-4CE7-9C18-E3E4CCD4EEE5}.tap
Tue Dec 31 16:57:51 2013 us=630131 TAP-Windows Driver Version 9.9 
Tue Dec 31 16:57:51 2013 us=630131 TAP-Windows MTU=1500
Tue Dec 31 16:57:51 2013 us=633131 Notified TAP-Windows driver to set a DHCP IP/netmask of 192.168.10.4/255.255.255.224 on interface {81FE21BA-CDC0-4CE7-9C18-E3E4CCD4EEE5} [DHCP-serv: 192.168.10.0, lease-time: 31536000]
Tue Dec 31 16:57:51 2013 us=633131 DHCP option string: 0604c0a8 2a0b
Tue Dec 31 16:57:51 2013 us=634131 Successful ARP Flush on interface [41] {81FE21BA-CDC0-4CE7-9C18-E3E4CCD4EEE5}
Tue Dec 31 16:57:56 2013 us=39383 TEST ROUTES: 1/1 succeeded len=0 ret=1 a=1 u/d=up
Tue Dec 31 16:57:56 2013 us=39383 C:\Windows\system32\route.exe ADD 192.168.10.11 MASK 255.255.255.255 192.168.10.1 IF 11
Tue Dec 31 16:57:56 2013 us=40383 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=25 and dwForwardType=4
Tue Dec 31 16:57:56 2013 us=40383 Route addition via IPAPI succeeded [adaptive]
Tue Dec 31 16:57:56 2013 us=40383 C:\Windows\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 192.168.10.1
Tue Dec 31 16:57:56 2013 us=48384 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Tue Dec 31 16:57:56 2013 us=49384 Route addition via IPAPI succeeded [adaptive]
Tue Dec 31 16:57:56 2013 us=49384 C:\Windows\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 192.168.10.1
Tue Dec 31 16:57:56 2013 us=57384 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Tue Dec 31 16:57:56 2013 us=57384 Route addition via IPAPI succeeded [adaptive]
Tue Dec 31 16:57:56 2013 us=57384 Initialization Sequence Completed
Tue Dec 31 16:57:56 2013 us=57384 MANAGEMENT: >STATE:1388527076,CONNECTED,SUCCESS,192.168.10.4,192.168.10.15

rumple

OK. It looks like I've solved my own problem. I have MAC address filtering enabled on my home network and I hadn't added the MAC address of my laptops tap interface to the allowed list. I didn't think of that at first because only my router was dropping pings. I was able to connect to all the servers on my home network. Anyway, after adding the required MAC address to the allowed list, I could ping my router and web traffic began traversing the vpn tunnel so everything's good.