OpenVPN on Windows - occasional routing issues

Alex Morris

OpenVPN server: OpenWRT router with static WAN address. LAN subnet 192.168.20.0/24. VPN subnet 192.168.30.0/24.
OpenVPN Client: Windows 7 x64 and Windows 8 x64, running OpenVPN x64 v2.3.2-I003

I want to route all traffic through the VPN and it usually works as I want it to. However, occasionally the routing table changes and some traffic stops being routed through the VPN. Tonight, for example, I'm connecting to the VPN from a hotel and the routing table is changing after only a few minutes each time I connect. A few days ago I was connecting from a coffee bar and the connection was reasonably reliable with only one routing table change that I noticed.

I've spent a few hours yesterday and today searching the forum without success; I suspect I might not have used optimal search terms. I tried searching for windows table rout*.

I've noticed this symptom on both Windows 7 and Windows 8. Conversely, my Android phone does not appear to exhibit this symptom, but that might be because I'm never on the VPN long enough from my phone to trigger the problem.

I ended up forcing the TAP adapter to have an Interface Metric of 1, instead of leaving it set to Automatic. That appears to have worked around the problem, but I'm still no closer to understanding why the problem happens in the first place and why it doesn't happen every time.

Is it caused by something at the client end? Is it caused by something at the server end? Is is a known problem with the Windows client? Is it a 64-bit issue? Is something else behind it? Is the long sequence of W and R characters at the end of the log file significant?

Working routing table extract:

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0     192.168.30.5     192.168.30.6     30
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306

"Broken" routing table extract:

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0     192.168.30.5     192.168.30.6     30
          0.0.0.0          0.0.0.0    192.168.182.1   192.168.182.69     25
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306

"Fixed" routing table extract:

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0     192.168.30.5     192.168.30.6      1
          0.0.0.0          0.0.0.0    192.168.182.1   192.168.182.69     25
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306

Client config:

client
proto udp
dev tun

remote my.home.ip.address 1194
pkcs12 mycertificate.p12

ns-cert-type server
comp-lzo
persist-key
persist-tun
nobind
resolv-retry infinite
verb 5
mute 10

Server config:

config 'openvpn' 'samplevpnconfig'
        option 'enable' '1'
        option 'port' '1194'
        option 'proto' 'udp'
        option 'dev' 'tun'

        option 'client_to_client' '1'
        option 'keepalive' '10 120'
        option 'comp_lzo' '1'
        option 'persist_key' '1'
        option 'persist_tun' '1'
        option 'verb' '5'
        option 'mute' '20'
        option 'ifconfig_pool_persist' '/tmp/ipp.txt'
        option 'status' '/tmp/openvpn-status.log'
        option 'ca' '/etc/openvpn/ca.crt'
        option 'cert' '/etc/openvpn/server.crt'
        option 'key' '/etc/openvpn/server.key'
        option 'dh' '/etc/openvpn/dh2048.pem'

        option 'server' '192.168.30.0 255.255.255.0'
        list 'push' 'route 192.168.20.0 255.255.255.0'
        list 'push' 'dhcp-option DNS 192.168.20.3'
        list 'push' 'dhcp-option DOMAIN lan'
        list 'push' 'redirect-gateway'

Log file:

Tue Mar 04 00:20:12 2014 us=462524 Current Parameter Settings:
Tue Mar 04 00:20:12 2014 us=463525   config = 'myvpn.ovpn'
Tue Mar 04 00:20:12 2014 us=463525   mode = 0
Tue Mar 04 00:20:12 2014 us=463525   show_ciphers = DISABLED
Tue Mar 04 00:20:12 2014 us=463525   show_digests = DISABLED
Tue Mar 04 00:20:12 2014 us=463525   show_engines = DISABLED
Tue Mar 04 00:20:12 2014 us=463525   genkey = DISABLED
Tue Mar 04 00:20:12 2014 us=463525   key_pass_file = '[UNDEF]'
Tue Mar 04 00:20:12 2014 us=463525   show_tls_ciphers = DISABLED
Tue Mar 04 00:20:12 2014 us=463525 Connection profiles [default]:
Tue Mar 04 00:20:12 2014 us=463525 NOTE: --mute triggered...
Tue Mar 04 00:20:12 2014 us=463525 275 variation(s) on previous 10 message(s) suppressed by --mute
Tue Mar 04 00:20:12 2014 us=463525 OpenVPN 2.3.2 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [eurephia] [IPv6] built on Aug 22 2013
Enter Management Password:
Tue Mar 04 00:20:12 2014 us=464526 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Tue Mar 04 00:20:12 2014 us=464526 Need hold release from management interface, waiting...
Tue Mar 04 00:20:12 2014 us=936555 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Tue Mar 04 00:20:13 2014 us=38320 MANAGEMENT: CMD 'state on'
Tue Mar 04 00:20:13 2014 us=38320 MANAGEMENT: CMD 'log all on'
Tue Mar 04 00:20:13 2014 us=114363 MANAGEMENT: CMD 'hold off'
Tue Mar 04 00:20:13 2014 us=117364 MANAGEMENT: CMD 'hold release'
Tue Mar 04 00:20:13 2014 us=249452 LZO compression initialized
Tue Mar 04 00:20:13 2014 us=249452 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Tue Mar 04 00:20:13 2014 us=249452 Socket Buffers: R=[65536->65536] S=[64512->64512]
Tue Mar 04 00:20:13 2014 us=249452 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Mar 04 00:20:13 2014 us=249452 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Tue Mar 04 00:20:13 2014 us=249452 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Tue Mar 04 00:20:13 2014 us=249452 Local Options hash (VER=V4): '41690919'
Tue Mar 04 00:20:13 2014 us=249452 Expected Remote Options hash (VER=V4): '530fdded'
Tue Mar 04 00:20:13 2014 us=250453 UDPv4 link local: [undef]
Tue Mar 04 00:20:13 2014 us=250453 UDPv4 link remote: [AF_INET]my.home.ip.address:1194
Tue Mar 04 00:20:13 2014 us=250453 MANAGEMENT: >STATE:1393892413,WAIT,,,
Tue Mar 04 00:20:13 2014 us=290483 MANAGEMENT: >STATE:1393892413,AUTH,,,
Tue Mar 04 00:20:13 2014 us=290483 TLS: Initial packet from [AF_INET]my.home.ip.address:1194, sid=369575a5 17a899fd
Tue Mar 04 00:20:14 2014 us=586816 VERIFY OK: depth=1, C=UK, ST=London, L=London, O=OpenWRT, OU=OpenWRT, CN=OpenWRT CA, name=OpenWRT, emailAddress=me@myhost.mydomain
Tue Mar 04 00:20:14 2014 us=587816 VERIFY OK: nsCertType=SERVER
Tue Mar 04 00:20:14 2014 us=587816 VERIFY OK: depth=0, C=UK, ST=London, L=London, O=OpenWRT, OU=OpenWRT, CN=server, name=OpenWRT, emailAddress=me@myhost.mydomain
Tue Mar 04 00:20:15 2014 us=919433 NOTE: Options consistency check may be skewed by version differences
Tue Mar 04 00:20:15 2014 us=919433 WARNING: 'version' is used inconsistently, local='version V4', remote='version V0 UNDEF'
Tue Mar 04 00:20:15 2014 us=919433 WARNING: 'dev-type' is present in local config but missing in remote config, local='dev-type tun'
Tue Mar 04 00:20:15 2014 us=919433 WARNING: 'link-mtu' is present in local config but missing in remote config, local='link-mtu 1542'
Tue Mar 04 00:20:15 2014 us=919433 WARNING: 'tun-mtu' is present in local config but missing in remote config, local='tun-mtu 1500'
Tue Mar 04 00:20:15 2014 us=919433 WARNING: 'comp-lzo' is present in local config but missing in remote config, local='comp-lzo'
Tue Mar 04 00:20:15 2014 us=919433 WARNING: 'cipher' is present in local config but missing in remote config, local='cipher BF-CBC'
Tue Mar 04 00:20:15 2014 us=920445 WARNING: 'auth' is present in local config but missing in remote config, local='auth SHA1'
Tue Mar 04 00:20:15 2014 us=920445 WARNING: 'keysize' is present in local config but missing in remote config, local='keysize 128'
Tue Mar 04 00:20:15 2014 us=920445 WARNING: 'key-method' is present in local config but missing in remote config, local='key-method 2'
Tue Mar 04 00:20:15 2014 us=920445 NOTE: --mute triggered...
Tue Mar 04 00:20:15 2014 us=921444 1 variation(s) on previous 10 message(s) suppressed by --mute
Tue Mar 04 00:20:15 2014 us=921444 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Mar 04 00:20:15 2014 us=921444 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Mar 04 00:20:15 2014 us=921444 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Mar 04 00:20:15 2014 us=921444 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Mar 04 00:20:15 2014 us=922437 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Tue Mar 04 00:20:15 2014 us=922437 [server] Peer Connection Initiated with [AF_INET]my.home.ip.address:1194
Tue Mar 04 00:20:16 2014 us=927275 MANAGEMENT: >STATE:1393892416,GET_CONFIG,,,
Tue Mar 04 00:20:17 2014 us=930582 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Tue Mar 04 00:20:17 2014 us=967789 PUSH: Received control message: 'PUSH_REPLY,route 192.168.20.0 255.255.255.0,dhcp-option DNS 192.168.20.3,dhcp-option DOMAIN lan,redirect-gateway,route 192.168.30.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 192.168.30.6 192.168.30.5'
Tue Mar 04 00:20:17 2014 us=967789 OPTIONS IMPORT: timers and/or timeouts modified
Tue Mar 04 00:20:17 2014 us=967789 OPTIONS IMPORT: --ifconfig/up options modified
Tue Mar 04 00:20:17 2014 us=967789 OPTIONS IMPORT: route options modified
Tue Mar 04 00:20:17 2014 us=967789 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Tue Mar 04 00:20:18 2014 us=19831 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Tue Mar 04 00:20:18 2014 us=19831 MANAGEMENT: >STATE:1393892418,ASSIGN_IP,,192.168.30.6,
Tue Mar 04 00:20:18 2014 us=19831 open_tun, tt->ipv6=0
Tue Mar 04 00:20:18 2014 us=25835 TAP-WIN32 device [OpenVPN] opened: \\.\Global\{1A9D01CC-590C-4D12-B6C7-A974AEF4A715}.tap
Tue Mar 04 00:20:18 2014 us=26835 TAP-Windows Driver Version 9.9 
Tue Mar 04 00:20:18 2014 us=26835 TAP-Windows MTU=1500
Tue Mar 04 00:20:18 2014 us=31839 Notified TAP-Windows driver to set a DHCP IP/netmask of 192.168.30.6/255.255.255.252 on interface {1A9D01CC-590C-4D12-B6C7-A974AEF4A715} [DHCP-serv: 192.168.30.5, lease-time: 31536000]
Tue Mar 04 00:20:18 2014 us=31839 DHCP option string: 0f036c61 6e0604c0 a81403
Tue Mar 04 00:20:18 2014 us=32832 Successful ARP Flush on interface [13] {1A9D01CC-590C-4D12-B6C7-A974AEF4A715}
Tue Mar 04 00:20:23 2014 us=48504 TEST ROUTES: 3/3 succeeded len=2 ret=1 a=0 u/d=up
Tue Mar 04 00:20:23 2014 us=48504 C:\WINDOWS\system32\route.exe ADD my.home.ip.address MASK 255.255.255.255 192.168.182.1
Tue Mar 04 00:20:23 2014 us=58513 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=25 and dwForwardType=4
Tue Mar 04 00:20:23 2014 us=58513 Route addition via IPAPI succeeded [adaptive]
Tue Mar 04 00:20:23 2014 us=59514 C:\WINDOWS\system32\route.exe DELETE 0.0.0.0 MASK 0.0.0.0 192.168.182.1
Tue Mar 04 00:20:23 2014 us=68515 Route deletion via IPAPI succeeded [adaptive]
Tue Mar 04 00:20:23 2014 us=68515 C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 0.0.0.0 192.168.30.5
Tue Mar 04 00:20:23 2014 us=102531 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Tue Mar 04 00:20:23 2014 us=102531 Route addition via IPAPI succeeded [adaptive]
Tue Mar 04 00:20:23 2014 us=102531 MANAGEMENT: >STATE:1393892423,ADD_ROUTES,,,
Tue Mar 04 00:20:23 2014 us=103531 C:\WINDOWS\system32\route.exe ADD 192.168.20.0 MASK 255.255.255.0 192.168.30.5
Tue Mar 04 00:20:23 2014 us=118541 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Tue Mar 04 00:20:23 2014 us=118541 Route addition via IPAPI succeeded [adaptive]
Tue Mar 04 00:20:23 2014 us=118541 C:\WINDOWS\system32\route.exe ADD 192.168.30.0 MASK 255.255.255.0 192.168.30.5
Tue Mar 04 00:20:23 2014 us=123544 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Tue Mar 04 00:20:23 2014 us=123544 Route addition via IPAPI succeeded [adaptive]
Tue Mar 04 00:20:23 2014 us=123544 Initialization Sequence Completed
Tue Mar 04 00:20:23 2014 us=123544 MANAGEMENT: >STATE:1393892423,CONNECTED,SUCCESS,192.168.30.6,my.home.ip.address

[Edit: read/write events] (truncated; posting attempt failed with complete sequence of W & R characters)

Alex Morris

debbie10t wroteHave you tried (Server config):

push "redirect-gateway def1 bypass-dhcp" # Adapt for your WRT router

Not yet. I'll try it the next time I need to connect remotely.

debbie10t wroteI am having trouble understanding what process would be changing your routing table, other than OpenVPN ? Can you shed any more light on this ... DHCP Renew / Anti-Virus / Software firewall / Secondary VPN Software .. a Virus ?

DHCP renew might be a possibility, if the wireless connection was flaky and reconnecting often. I shall see if I can find a correlation there; it may take a while to gather enough evidence.
The anti-virus program is currently Kaspersky AV 2014, but was previously Microsoft Security Essentials; the same symptom occurred with both.
Ditto the software firewall: it's currently the Windows 8 Firewall Control from Sphinx Soft, but previously there was no software firewall; again, the symptom was seen in both cases.
There is no other VPN software installed apart from OpenVPN.
As for a virus, I regularly run online scans as well as offline scans from bootable media; I'm reasonably confident no virus lurks.

Alex Morris

I said it might take a while...

I've finally found another wireless network which I can use regularly, and which exhibits the same symptoms as in the first post when connecting to my OpenWRT router, even though the TAP adapter's metric is still 1.

As a comparison, I set up an OpenVPN appliance on EC2, using this document: https://docs.openvpn.net/how-to-tutorialsguides/virtual-platforms/amazon-ec2-appliance-ami-quick-start-guide/

The connection to EC2 appears to be rock-solid, and routing didn't flake out once. It's only when connecting to my OpenWRT router that I see the symptoms described.

The next step is to compare the client and server config files for both setups, to see where the differences are.

I've found the OpenVPN config files on my router, but I haven't yet been able to find the config files on the EC2 appliance. I can't find any likely candidates in /etc and its subdirectories.

Where are the EC2 appliance config files kept?

Alex Morris

debbie10t wrote
Alex Morris wroteWhere are the EC2 appliance config files kept?
By appliance do you mean OpenVPN Access server ?

See this post for clarification:
https://forums.openvpn.net/topic14454.html

By "appliance" I mean the product referenced in the page I linked in my previous post. As the subject line on that page says "Amazon EC2 Appliance" I figured I should stick with that wording.

It appears, from that page, that the EC2 appliance is running OpenVPN Access Server (v2.0.10 at the time of writing).

debbie10t wroteGetting back to your original problem:
Did you change to using: push "redirect-gateway def1 bypass-dhcp" ?

Please change your server/client to verb 4

Yes, and yes. The problem still occurs.

debbie10t wrote[*]Please post a full log created at the time that the routing problem occurs.[/list]

No need; I'm not asking you to do my thinking for me. As long as I can find the appliance OpenVPN server configuration file I can compare it against the config file on my router and try to work out what's missing from or incorrect in my configuration. Hence my earlier question: where are the EC2 appliance config files kept? That's my current hurdle to overcome.

If, after comparing the two, I manage to fix the problem, I'll post what I did here. Alternately, if I'm still stuck after comparing the two files then I'll post some logs for analysis.

Alex Morris

debbie10t wrote
Alex Morris wroteIt appears, from that page, that the EC2 appliance is running OpenVPN Access Server (v2.0.10 at the time of writing).
For OpenVPN Technologies Access Server Support please see THIS post.

That's all well and good, except I don't require support for Access Server. That one works.

The problem is with the Community Edition GPL version, which is installed on my router. I'm only using Access Server as a comparison to test, while I try to troubleshoot the Community Edition.

However, while perusing my router's config file, I spotted the following typo: "bpyass_dhcp". I've corrected it to "bypass_dhcp", and will be in a position to test it again in a fortnight's time. Hopefully correcting that simple typo may do the trick.

Alex Morris

"bypass_dhcp" doesn't seem to have done the trick; or, at least, "bypass_dhcp" on its own hasn't worked. I suspect I'm missing something.

Here's the current config file on my router:

root@router:/etc/config# cat openvpn
config 'openvpn' 'samplevpnconfig'
        option 'enable' '1'
        option 'port' '1194'
        option 'proto' 'udp'
        option 'dev' 'tun'

        option 'client_to_client' '1'
        option 'keepalive' '10 120'
        option 'comp_lzo' '1'
        option 'persist_key' '1'
        option 'persist_tun' '1'
        option 'verb' '4'
        option 'mute' '20'
        option 'ifconfig_pool_persist' '/tmp/ipp.txt'
        option 'status' '/tmp/openvpn-status.log'
        option 'ca' '/etc/openvpn/ca.crt'
        option 'cert' '/etc/openvpn/server.crt'
        option 'key' '/etc/openvpn/server.key'
        option 'dh' '/etc/openvpn/dh2048.pem'

        option 'server' '192.168.30.0 255.255.255.0'
        list 'push' 'route 192.168.20.0 255.255.255.0'
        list 'push' 'dhcp-option DNS 192.168.20.3'
        list 'push' 'dhcp-option DOMAIN lan'
        list 'push' 'redirect-gateway def1 bypass_dhcp'

Here's the log file from the OpenVPN client on my laptop, when connecting to my router:

Thu Aug 14 06:51:48 2014 us=29688 Current Parameter Settings:
Thu Aug 14 06:51:48 2014 us=29688   config = '2BC.ovpn'
Thu Aug 14 06:51:48 2014 us=29688   mode = 0
Thu Aug 14 06:51:48 2014 us=29688   show_ciphers = DISABLED
Thu Aug 14 06:51:48 2014 us=29688   show_digests = DISABLED
Thu Aug 14 06:51:48 2014 us=29688   show_engines = DISABLED
Thu Aug 14 06:51:48 2014 us=29688   genkey = DISABLED
Thu Aug 14 06:51:48 2014 us=29688   key_pass_file = '[UNDEF]'
Thu Aug 14 06:51:48 2014 us=29688   show_tls_ciphers = DISABLED
Thu Aug 14 06:51:48 2014 us=29688 Connection profiles [default]:
Thu Aug 14 06:51:48 2014 us=29688 NOTE: --mute triggered...
Thu Aug 14 06:51:48 2014 us=29688 275 variation(s) on previous 10 message(s) suppressed by --mute
Thu Aug 14 06:51:48 2014 us=29688 OpenVPN 2.3.4 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Jun  5 2014
Thu Aug 14 06:51:48 2014 us=29688 library versions: OpenSSL 1.0.1h 5 Jun 2014, LZO 2.05
Enter Management Password:
Thu Aug 14 06:51:48 2014 us=29688 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Thu Aug 14 06:51:48 2014 us=29688 Need hold release from management interface, waiting...
Thu Aug 14 06:51:48 2014 us=483312 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Thu Aug 14 06:51:48 2014 us=592694 MANAGEMENT: CMD 'state on'
Thu Aug 14 06:51:48 2014 us=592694 MANAGEMENT: CMD 'log all on'
Thu Aug 14 06:51:48 2014 us=701967 MANAGEMENT: CMD 'hold off'
Thu Aug 14 06:51:48 2014 us=717592 MANAGEMENT: CMD 'hold release'
Thu Aug 14 06:51:49 2014 us=45719 LZO compression initialized
Thu Aug 14 06:51:49 2014 us=45719 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Thu Aug 14 06:51:49 2014 us=45719 Socket Buffers: R=[65536->65536] S=[64512->64512]
Thu Aug 14 06:51:49 2014 us=45719 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Thu Aug 14 06:51:49 2014 us=45719 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Thu Aug 14 06:51:49 2014 us=45719 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Thu Aug 14 06:51:49 2014 us=45719 Local Options hash (VER=V4): '41690919'
Thu Aug 14 06:51:49 2014 us=45719 Expected Remote Options hash (VER=V4): '530fdded'
Thu Aug 14 06:51:49 2014 us=45719 UDPv4 link local: [undef]
Thu Aug 14 06:51:49 2014 us=45719 UDPv4 link remote: [AF_INET]<redacted>:1194
Thu Aug 14 06:51:49 2014 us=45719 MANAGEMENT: >STATE:1407995509,WAIT,,,
Thu Aug 14 06:51:49 2014 us=61347 MANAGEMENT: >STATE:1407995509,AUTH,,,
Thu Aug 14 06:51:49 2014 us=61347 TLS: Initial packet from [AF_INET]<redacted>:1194, sid=f5981c34 19f57c54
Thu Aug 14 06:51:50 2014 us=170983 VERIFY OK: depth=1, C=UK, ST=London, L=London, O=OpenWRT, OU=OpenWRT, CN=OpenWRT CA, name=OpenWRT, emailAddress=me@myhost.mydomain
Thu Aug 14 06:51:50 2014 us=170983 VERIFY OK: nsCertType=SERVER
Thu Aug 14 06:51:50 2014 us=170983 VERIFY OK: depth=0, C=UK, ST=London, L=London, O=OpenWRT, OU=OpenWRT, CN=server, name=OpenWRT, emailAddress=me@myhost.mydomain
Thu Aug 14 06:51:51 2014 us=170986 NOTE: Options consistency check may be skewed by version differences
Thu Aug 14 06:51:51 2014 us=170986 WARNING: 'version' is used inconsistently, local='version V4', remote='version V0 UNDEF'
Thu Aug 14 06:51:51 2014 us=170986 WARNING: 'dev-type' is present in local config but missing in remote config, local='dev-type tun'
Thu Aug 14 06:51:51 2014 us=170986 WARNING: 'link-mtu' is present in local config but missing in remote config, local='link-mtu 1542'
Thu Aug 14 06:51:51 2014 us=170986 WARNING: 'tun-mtu' is present in local config but missing in remote config, local='tun-mtu 1500'
Thu Aug 14 06:51:51 2014 us=170986 WARNING: 'comp-lzo' is present in local config but missing in remote config, local='comp-lzo'
Thu Aug 14 06:51:51 2014 us=170986 WARNING: 'cipher' is present in local config but missing in remote config, local='cipher BF-CBC'
Thu Aug 14 06:51:51 2014 us=170986 WARNING: 'auth' is present in local config but missing in remote config, local='auth SHA1'
Thu Aug 14 06:51:51 2014 us=170986 WARNING: 'keysize' is present in local config but missing in remote config, local='keysize 128'
Thu Aug 14 06:51:51 2014 us=170986 WARNING: 'key-method' is present in local config but missing in remote config, local='key-method 2'
Thu Aug 14 06:51:51 2014 us=170986 NOTE: --mute triggered...
Thu Aug 14 06:51:51 2014 us=170986 1 variation(s) on previous 10 message(s) suppressed by --mute
Thu Aug 14 06:51:51 2014 us=170986 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Aug 14 06:51:51 2014 us=170986 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Aug 14 06:51:51 2014 us=170986 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Aug 14 06:51:51 2014 us=170986 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Aug 14 06:51:51 2014 us=170986 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Thu Aug 14 06:51:51 2014 us=170986 [server] Peer Connection Initiated with [AF_INET]<redacted>:1194
Thu Aug 14 06:51:52 2014 us=374996 MANAGEMENT: >STATE:1407995512,GET_CONFIG,,,
Thu Aug 14 06:51:53 2014 us=578127 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Thu Aug 14 06:51:53 2014 us=593752 PUSH: Received control message: 'PUSH_REPLY,route 192.168.20.0 255.255.255.0,dhcp-option DNS 192.168.20.3,dhcp-option DOMAIN lan,redirect-gateway def1 bypass_dhcp,route 192.168.30.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 192.168.30.6 192.168.30.5'
Thu Aug 14 06:51:53 2014 us=593752 Options error: unknown --redirect-gateway flag: bypass_dhcp
Thu Aug 14 06:51:53 2014 us=593752 OPTIONS IMPORT: timers and/or timeouts modified
Thu Aug 14 06:51:53 2014 us=593752 OPTIONS IMPORT: --ifconfig/up options modified
Thu Aug 14 06:51:53 2014 us=593752 OPTIONS IMPORT: route options modified
Thu Aug 14 06:51:53 2014 us=593752 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Thu Aug 14 06:51:53 2014 us=609305 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Thu Aug 14 06:51:53 2014 us=609305 MANAGEMENT: >STATE:1407995513,ASSIGN_IP,,192.168.30.6,
Thu Aug 14 06:51:53 2014 us=609305 open_tun, tt->ipv6=0
Thu Aug 14 06:51:53 2014 us=624920 TAP-WIN32 device [OpenVPN] opened: \\.\Global\{1A9D01CC-590C-4D12-B6C7-A974AEF4A715}.tap
Thu Aug 14 06:51:53 2014 us=624920 TAP-Windows Driver Version 9.9 
Thu Aug 14 06:51:53 2014 us=624920 TAP-Windows MTU=1500
Thu Aug 14 06:51:53 2014 us=624920 Notified TAP-Windows driver to set a DHCP IP/netmask of 192.168.30.6/255.255.255.252 on interface {1A9D01CC-590C-4D12-B6C7-A974AEF4A715} [DHCP-serv: 192.168.30.5, lease-time: 31536000]
Thu Aug 14 06:51:53 2014 us=624920 DHCP option string: 0f036c61 6e0604c0 a81403
Thu Aug 14 06:51:53 2014 us=624920 Successful ARP Flush on interface [12] {1A9D01CC-590C-4D12-B6C7-A974AEF4A715}
Thu Aug 14 06:51:58 2014 us=875969 TEST ROUTES: 2/2 succeeded len=2 ret=1 a=0 u/d=up
Thu Aug 14 06:51:58 2014 us=875969 MANAGEMENT: >STATE:1407995518,ADD_ROUTES,,,
Thu Aug 14 06:51:58 2014 us=875969 C:\WINDOWS\system32\route.exe ADD 192.168.20.0 MASK 255.255.255.0 192.168.30.5
Thu Aug 14 06:51:58 2014 us=875969 Route addition via IPAPI succeeded [adaptive]
Thu Aug 14 06:51:58 2014 us=875969 C:\WINDOWS\system32\route.exe ADD 192.168.30.0 MASK 255.255.255.0 192.168.30.5
Thu Aug 14 06:51:58 2014 us=875969 Route addition via IPAPI succeeded [adaptive]
Thu Aug 14 06:51:58 2014 us=875969 Initialization Sequence Completed
Thu Aug 14 06:51:58 2014 us=875969 MANAGEMENT: >STATE:1407995518,CONNECTED,SUCCESS,192.168.30.6,<redacted>

In the above log, "<redacted>" replaces the public IP address of the router.

As a comparison, here's the log file generated when connecting to the EC2 Appliance, which does route traffic as desired:

Thu Aug 14 06:43:31 2014 OpenVPN 2.3.4 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Jun  5 2014
Thu Aug 14 06:43:31 2014 library versions: OpenSSL 1.0.1h 5 Jun 2014, LZO 2.05
Enter Management Password:
Thu Aug 14 06:43:31 2014 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25342
Thu Aug 14 06:43:31 2014 Need hold release from management interface, waiting...
Thu Aug 14 06:43:32 2014 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25342
Thu Aug 14 06:43:32 2014 MANAGEMENT: CMD 'state on'
Thu Aug 14 06:43:32 2014 MANAGEMENT: CMD 'log all on'
Thu Aug 14 06:43:32 2014 MANAGEMENT: CMD 'hold off'
Thu Aug 14 06:43:32 2014 MANAGEMENT: CMD 'hold release'
Thu Aug 14 06:43:35 2014 MANAGEMENT: CMD 'username "Auth" "openvpn"'
Thu Aug 14 06:43:35 2014 MANAGEMENT: CMD 'password [...]'
Thu Aug 14 06:43:35 2014 Control Channel Authentication: tls-auth using INLINE static key file
Thu Aug 14 06:43:35 2014 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Aug 14 06:43:35 2014 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Aug 14 06:43:35 2014 Socket Buffers: R=[65536->100000] S=[64512->100000]
Thu Aug 14 06:43:35 2014 MANAGEMENT: >STATE:1407995015,RESOLVE,,,
Thu Aug 14 06:43:35 2014 UDPv4 link local: [undef]
Thu Aug 14 06:43:35 2014 UDPv4 link remote: [AF_INET]<redacted>:1194
Thu Aug 14 06:43:35 2014 MANAGEMENT: >STATE:1407995015,WAIT,,,
Thu Aug 14 06:43:36 2014 MANAGEMENT: >STATE:1407995016,AUTH,,,
Thu Aug 14 06:43:36 2014 TLS: Initial packet from [AF_INET]<redacted>:1194, sid=8abaa864 afa12e39
Thu Aug 14 06:43:36 2014 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Thu Aug 14 06:43:36 2014 VERIFY OK: depth=1, CN=OpenVPN CA
Thu Aug 14 06:43:36 2014 VERIFY OK: nsCertType=SERVER
Thu Aug 14 06:43:36 2014 VERIFY OK: depth=0, CN=OpenVPN Server
Thu Aug 14 06:43:38 2014 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Aug 14 06:43:38 2014 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Aug 14 06:43:38 2014 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Aug 14 06:43:38 2014 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Aug 14 06:43:38 2014 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Thu Aug 14 06:43:38 2014 [OpenVPN Server] Peer Connection Initiated with [AF_INET]<redacted>:1194
Thu Aug 14 06:43:39 2014 MANAGEMENT: >STATE:1407995019,GET_CONFIG,,,
Thu Aug 14 06:43:40 2014 SENT CONTROL [OpenVPN Server]: 'PUSH_REQUEST' (status=1)
Thu Aug 14 06:43:40 2014 PUSH: Received control message: 'PUSH_REPLY,explicit-exit-notify,topology subnet,route-delay 5 30,dhcp-pre-release,dhcp-renew,dhcp-release,route-metric 101,ping 12,ping-restart 50,auth-token SESS_ID,comp-lzo yes,redirect-gateway def1,redirect-gateway bypass-dhcp,redirect-gateway autolocal,route-gateway 172.27.232.1,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,register-dns,block-ipv6,ifconfig 172.27.232.32 255.255.248.0'
Thu Aug 14 06:43:40 2014 Option 'explicit-exit-notify' in [PUSH-OPTIONS]:1 is ignored by previous <connection> blocks 
Thu Aug 14 06:43:40 2014 Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:19: block-ipv6 (2.3.4)
Thu Aug 14 06:43:40 2014 OPTIONS IMPORT: timers and/or timeouts modified
Thu Aug 14 06:43:40 2014 OPTIONS IMPORT: explicit notify parm(s) modified
Thu Aug 14 06:43:40 2014 OPTIONS IMPORT: LZO parms modified
Thu Aug 14 06:43:40 2014 OPTIONS IMPORT: --ifconfig/up options modified
Thu Aug 14 06:43:40 2014 OPTIONS IMPORT: route options modified
Thu Aug 14 06:43:40 2014 OPTIONS IMPORT: route-related options modified
Thu Aug 14 06:43:40 2014 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Thu Aug 14 06:43:40 2014 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Thu Aug 14 06:43:40 2014 MANAGEMENT: >STATE:1407995020,ASSIGN_IP,,172.27.232.32,
Thu Aug 14 06:43:40 2014 open_tun, tt->ipv6=0
Thu Aug 14 06:43:40 2014 TAP-WIN32 device [OpenVPN] opened: \\.\Global\{1A9D01CC-590C-4D12-B6C7-A974AEF4A715}.tap
Thu Aug 14 06:43:40 2014 TAP-Windows Driver Version 9.9 
Thu Aug 14 06:43:40 2014 Set TAP-Windows TUN subnet mode network/local/netmask = 172.27.232.0/172.27.232.32/255.255.248.0 [SUCCEEDED]
Thu Aug 14 06:43:40 2014 Notified TAP-Windows driver to set a DHCP IP/netmask of 172.27.232.32/255.255.248.0 on interface {1A9D01CC-590C-4D12-B6C7-A974AEF4A715} [DHCP-serv: 172.27.239.254, lease-time: 31536000]
Thu Aug 14 06:43:40 2014 Successful ARP Flush on interface [12] {1A9D01CC-590C-4D12-B6C7-A974AEF4A715}
Thu Aug 14 06:43:41 2014 TAP: DHCP address released
Thu Aug 14 06:43:48 2014 TAP: DHCP address renewal succeeded
Thu Aug 14 06:43:53 2014 TEST ROUTES: 1/1 succeeded len=0 ret=1 a=0 u/d=up
Thu Aug 14 06:43:53 2014 C:\WINDOWS\system32\route.exe ADD <redacted> MASK 255.255.255.255 30.146.64.1
Thu Aug 14 06:43:53 2014 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=25 and dwForwardType=4
Thu Aug 14 06:43:53 2014 Route addition via IPAPI succeeded [adaptive]
Thu Aug 14 06:43:53 2014 C:\WINDOWS\system32\route.exe ADD 159.68.62.11 MASK 255.255.255.255 30.146.64.1
Thu Aug 14 06:43:53 2014 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=25 and dwForwardType=4
Thu Aug 14 06:43:53 2014 Route addition via IPAPI succeeded [adaptive]
Thu Aug 14 06:43:53 2014 C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 172.27.232.1
Thu Aug 14 06:43:53 2014 Route addition via IPAPI succeeded [adaptive]
Thu Aug 14 06:43:53 2014 C:\WINDOWS\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 172.27.232.1
Thu Aug 14 06:43:53 2014 Route addition via IPAPI succeeded [adaptive]
Thu Aug 14 06:43:53 2014 Initialization Sequence Completed
Thu Aug 14 06:43:53 2014 MANAGEMENT: >STATE:1407995033,CONNECTED,SUCCESS,172.27.232.32,<redacted>
Thu Aug 14 06:43:53 2014 Start net commands...
Thu Aug 14 06:43:53 2014 C:\WINDOWS\system32\net.exe stop dnscache
Thu Aug 14 06:43:58 2014 C:\WINDOWS\system32\net.exe start dnscache
Thu Aug 14 06:44:00 2014 C:\WINDOWS\system32\ipconfig.exe /flushdns
Thu Aug 14 06:44:00 2014 C:\WINDOWS\system32\ipconfig.exe /registerdns
Thu Aug 14 06:44:03 2014 End net commands...
Thu Aug 14 06:48:17 2014 SIGTERM received, sending exit notification to peer
Thu Aug 14 06:48:18 2014 C:\WINDOWS\system32\route.exe DELETE <redacted> MASK 255.255.255.255 30.146.64.1
Thu Aug 14 06:48:18 2014 Route deletion via IPAPI succeeded [adaptive]
Thu Aug 14 06:48:18 2014 C:\WINDOWS\system32\route.exe DELETE 159.68.62.11 MASK 255.255.255.255 30.146.64.1
Thu Aug 14 06:48:18 2014 Route deletion via IPAPI succeeded [adaptive]
Thu Aug 14 06:48:18 2014 C:\WINDOWS\system32\route.exe DELETE 0.0.0.0 MASK 128.0.0.0 172.27.232.1
Thu Aug 14 06:48:18 2014 Route deletion via IPAPI succeeded [adaptive]
Thu Aug 14 06:48:18 2014 C:\WINDOWS\system32\route.exe DELETE 128.0.0.0 MASK 128.0.0.0 172.27.232.1
Thu Aug 14 06:48:18 2014 Route deletion via IPAPI succeeded [adaptive]
Thu Aug 14 06:48:18 2014 Closing TUN/TAP interface
Thu Aug 14 06:48:18 2014 TAP: DHCP address released
Thu Aug 14 06:48:18 2014 SIGTERM[soft,exit-with-notification] received, process exiting
Thu Aug 14 06:48:18 2014 MANAGEMENT: >STATE:1407995298,EXITING,exit-with-notification,,

I suspect there might be a clue in the different lines which begin with "Received control message:"; I'm currently working through the documentation at http://openvpn.net/index.php/open-source/documentation.html to find out more.

Alex Morris

Good grief. Typo after typo after typo. After spending several hours this past week scouring the OpenVPN documentation but learning nothing which helped, I spotted yet another mistake in my router's OpenVPN config file.

The directive option should have been "bypass-dhcp", with a hyphen, and not "bypass_dhcp", with an underscore.

Serves me right for trying to do this stuff when I'm tired. Anyway, I'll correct the config file - again - and let's see if it works this time.

Alex Morris

The routing appears to have been stable and consistent for the last few hours this evening, unlike the behaviour witnessed before. It looks like "bypass-dhcp" (with the hyphen) may have done the trick.