OpenVPN on Windows doesn't work with Routing service?

Terry

I'm running the OpenVPN server on port 443, so that I can run it in the AWS cloud and connect to it from my company's intranet. The OpenVPN server is a Windows 8 server, but is not the LAN gateway.

Everything seems to work (I can ping)... until I enable IP Forwarding (in the registry) and enable the "Routing and Remote Access" Windows service on my OpenVPN server. If I do that and start OpenVPN I get the following error:

"Sun Feb 02 23:21:31 2014 us=277280 TCP/UDP: Socket bind failed on local address [undef]: Permission denied (WSAEACCES)
Sun Feb 02 23:21:31 2014 us=277280 Exiting due to fatal error"

I'm doing this because I have a number of other servers in AWS that I'm trying to make enable to my client machine at work. In mentions in the OpenVPN "How-To" document that IP forwarding must be enabled:

http://openvpn.net/index.php/open-source/documentation/howto.html

"Next, you must set up a route on the server-side LAN gateway to route the VPN client subnet (10.8.0.0/24) to the OpenVPN server (this is only necessary if the OpenVPN server and the LAN gateway are different machines).
Make sure that you've enabled IP and TUN/TAP forwarding on the OpenVPN server machine."

Reading up on IP forwarding, I read on Microsoft's site that you should modify a key in the registry and then enable the Routing service.

So my questions are:
1. Do I need to run the Routing service? (I can't verify whether I need to since I haven't been able to get it to work yet, with or without the service)
2. Any idea why they don't work together? Is it my specific configuration, or should we update the How-To docs?

Thanks!

Terry

Forgot to add my configs.

Server Config:
port 443
proto tcp-server
dev tun
ifconfig 192.168.0.1 192.168.0.2
secret static.key
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log

Client config:
dev tun
proto tcp-client
port 443
ifconfig 192.168.0.2 192.168.0.1
remote 107.21.26.140
nobind
persist-key
persist-tun
secret static.key
comp-lzo

And some more info on my environment. I have a 10.0.1.0/24 subnet in AWS that is my "public" subnet, and a 10.0.0.0/24 that is my "private" subnet. I have a server with a public IP in my public subnet that I RDP to (which is also my OpenVPN server), and from there I RDP to the servers in my "private" subnet (none of which have public IPs). There's a NAT to make everything work as well.

I need for the servers in the Private subnet in AWS to be able to talk to a specific client machine at my company's intranet. So I have the OpenVPN client running on my local computer, and connecting to the OpenVPN server in my public server in AWS (in the Public subnet).

From what I understand, one way to do this is as follows (?):
1. Turn on IP Forwarding on my OpenVPN server.
2. On the private subnet servers add a Route entry with the local client's IP (192.168.0.2) and point it to my OpenVPN server.
3. In OpenVPN "push" the route for my private subnet to the local OpenVPN client (via the server config).

So when my AWS server (in private subnet) tries to contact the client (in my company's intranet), it consults its route table, finds an entry for that IP, and sends it to the OpenVPN server. That server has IP Forwarding enabled (and the Route service running?) and therefore sends it along to the client. The client then responds. It has been "pushed" the private subnet by the OpenVPN server, and presumably this adds a route table entry for that private subnet to point to 192.168.0.1, the OpenVPN server connection. The OpenVPN server then gets a message for one of the private servers, and forwards it along.

Does that seem correct?

ix

I have the same issue. Do you have any progress with this?