Trouble Routing from Server LAN to Client LAN

stucktoo

Thanks to all the members that help here and your patience. I realize you must repeat yourselves often and hope I can find someone here that can help me figure this out. I'm assuming this is a routing problem, I've been banging my head against this for weeks and read the docs/wiki but can't figure this out. I'm not a complete noob, but I'm missing some details somewhere.

I've read these (and more):
http://community.openvpn.net/openvpn/wiki/RoutedLans#no1
https://forums.openvpn.net/topic9465.html
http://openvpn.net/index.php/open-source/documentation/howto.html#scope

My goal is a Multi Client Server with access to LANs on both sides of VPN
*FOR ONLY 1 client*, other clients just need access to Server LAN.
I don't want to redirect all client traffic over VPN.
I'd be happy to just get that ONE client working for now and worry about others later.

I don't need access to LANs of other clients from my client or to their LANs from server.
I'd like to be able to use RDP and access SMB/Cifs shares using their IP, I can figure that part out if I can get this other part working.

My Server is Ubuntu 12.04

I've enabled IP forwarding on the server
There is no Firewall/iptables installed on server.

My Server is on 192.168.1.18
Server LAN is 192.168.1.0/27
My VPN network is 172.16.0.0/24

My Clients are Windows 7 Pro

IP Routing & Remote Routing service Enabled
All Windows Firewall software is disabled (permanently)

My Client network is 10.0.10.0/26, default gateway 10.0.10.1
My Client IP on local LAN is 10.0.10.50
My Client VPN IP is 172.16.0.4

I'm using a TUN/Routed setup and have no problems connecting, prefer not to use Bridging.

What works now:

I can ping hosts on Servers LAN 192.168.1.0
I can ping Server on VPN IP (172.16.0.1)
I can ping client on VPN IP (172.16.0.4)

What DOESN'T work:

VPN Server can't ping client's LAN IP (10.0.10.50) or any 10.0.10.0 hosts
When my client connects, it looses connection to stuff on local LAN (mapped shares) and other stuff, can't ping other hosts on client LAN.

Please be as specific as possible about which config needs what etc.

On my server I tried (you can see in the route output):

route add 10.0.10.0 dev tun0
route add -net 10.0.10.10 netmask 255.255.255.192 gw 172.16.0.4
(Won't let me do 2nd command without doing first one)

But I still couldn't ping the LAN address of the client from the server (only VPN address).

Server Config

port 1194
proto udp
dev tun

ca ca.crt
cert server.crt
key server.key

dh dh1024.pem

topology subnet
server 172.16.0.0 255.255.255.0

ifconfig-pool-persist ipp.txt

# Lan behind server
push "route 192.168.1.0 255.255.255.224"

# Lan behind client
push "route 10.0.10.0 255.255.255.192"

# Lan behind client
route 10.0.10.0 255.255.255.192

push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
push "dhcp-option DNS 8.8.8.8"

comp-lzo

max-clients 8

persist-key
persist-tun

status openvpn-status.log
verb 3

Server Routes

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         192.168.1.1     0.0.0.0         UG    100    0        0 eth0
10.0.10.0       *               255.255.255.255 UH    0      0        0 tun0
10.0.10.0       172.16.0.4      255.255.255.0   UG    0      0        0 tun0
172.16.0.0      *               255.255.255.0   U     0      0        0 tun0
192.168.1.0     *               255.255.255.224 U     0      0        0 eth0

Client Config

dev tun
remote xxx.xxx.xxx 1194
proto udp
client
ca sdcg-ca.crt
cert sdcg-client.crt
key sdcg-client.key

pull
nobind
persist-key
resolv-retry infinite
verb 3
auth-nocache

route-method adaptive
route-delay

route add 192.168.1.0 255.255.255.224
;route add 10.0.10.0 255.255.255.192 (Didn't seem to work)

comp-lzo
script-security 2 system

Client Routes

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0        10.0.10.1       172.16.0.4    286
          0.0.0.0          0.0.0.0        10.0.10.1       10.0.10.33     10
        10.0.10.0  255.255.255.192         On-link        10.0.10.33    266
        10.0.10.0  255.255.255.192       172.16.0.1       172.16.0.4     30
       10.0.10.33  255.255.255.255         On-link        10.0.10.33    266
       10.0.10.63  255.255.255.255         On-link        10.0.10.33    266
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
       172.16.0.0    255.255.255.0         On-link        172.16.0.4    286
       172.16.0.4  255.255.255.255         On-link        172.16.0.4    286
     172.16.0.255  255.255.255.255         On-link        172.16.0.4    286
      192.168.1.0  255.255.255.224       172.16.0.1       172.16.0.4     30
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link        10.0.10.33    266
        224.0.0.0        240.0.0.0         On-link        172.16.0.4    286
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link        10.0.10.33    266
  255.255.255.255  255.255.255.255         On-link        172.16.0.4    286
===========================================================================
Persistent Routes:
  Network Address          Netmask  Gateway Address  Metric
          0.0.0.0          0.0.0.0        10.0.10.1  Default
===========================================================================

stucktoo

Here's the output from Server ifconfig and Client ipconfig:

Server

eth0      Link encap:Ethernet  HWaddr 00:0c:29:5a:04:ab  
          inet addr:192.168.1.18  Bcast:192.168.1.31  Mask:255.255.255.224
          inet6 addr: fe80::20c:29ff:fe5a:4ab/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:2359 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2142 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:325214 (325.2 KB)  TX bytes:301366 (301.3 KB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:172.16.0.1  P-t-P:172.16.0.1  Mask:255.255.255.0
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:117 errors:0 dropped:0 overruns:0 frame:0
          TX packets:66 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:14966 (14.9 KB)  TX bytes:12234 (12.2 KB)

Client ipconfig/all:

Windows IP Configuration

   Host Name . . . . . . . . . . . . : Dr-J
   Primary Dns Suffix  . . . . . . . :
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : Yes
   WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Local Area Connection 2:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : TAP-Windows Adapter V9
   Physical Address. . . . . . . . . : 00-FF-1B-F6-1A-44
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   IPv4 Address. . . . . . . . . . . : 172.16.0.4(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Lease Obtained. . . . . . . . . . : Saturday, April 05, 2014 12:38:56 AM
   Lease Expires . . . . . . . . . . : Sunday, April 05, 2015 12:38:56 AM
   Default Gateway . . . . . . . . . : 10.0.10.1
   DHCP Server . . . . . . . . . . . : 172.16.0.254
   DNS Servers . . . . . . . . . . . : 208.67.222.222
                                       208.67.220.220
                                       8.8.8.8
   NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter Local Area Connection:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Intel(R) 82579LM Gigabit Network Connecti
on
   Physical Address. . . . . . . . . : F8-B1-56-CD-57-C8
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::1dc:e561:32d5:9bcb%11(Preferred)
   IPv4 Address. . . . . . . . . . . : 10.0.10.33(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.192
   Lease Obtained. . . . . . . . . . : Saturday, April 05, 2014 12:36:39 AM
   Lease Expires . . . . . . . . . . : Tuesday, April 08, 2014 12:36:39 AM
   Default Gateway . . . . . . . . . : 10.0.10.1
   DHCP Server . . . . . . . . . . . : 10.0.10.1
   DHCPv6 IAID . . . . . . . . . . . : 251179350
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-1A-A8-43-DA-F8-B1-56-CD-57-C8

   DNS Servers . . . . . . . . . . . : 208.67.222.222
                                       8.8.8.8
   NetBIOS over Tcpip. . . . . . . . : Enabled

Tunnel adapter isatap.{BD32AE7B-4AA2-498A-A20C-FA910A08DD12}:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Local Area Connection* 9:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Microsoft 6to4 Adapter
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Teredo Tunneling Pseudo-Interface:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   IPv6 Address. . . . . . . . . . . : 2001:0:9d38:6abd:385b:57:f5ff:f5de(Prefer
red)
   Link-local IPv6 Address . . . . . : fe80::385b:57:f5ff:f5de%14(Preferred)
   Default Gateway . . . . . . . . . : ::
   NetBIOS over Tcpip. . . . . . . . : Disabled

Tunnel adapter isatap.{1BF61A44-BC91-4CA7-93ED-F5E392E390E8}:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter #2
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

stucktoo

Debbie10t,

Thanks for taking time to read my post and point me in the right direction. My initial interpretation of that section lead me to believe I didn't need to do what you suggested because I only had one client needing both directions, but now it makes sense.

I don't have time tonight to test it, but tomorrow I will and will post back the results if I'm successful so others can learn.

Thanks again for your help! 😃

stucktoo

Ugghh, my brain is starting to melt from frustration....

Thanks again for help and patience

The only improvement I've seen is not losing connections to stuff on client LAN when connected to VPN, but I still can't ping clients LAN IP or client hosts from server.

Traffic from client to Server LAN seems to work perfectly.

I've added the ccd directory on the server with (clients LAN):

iroute 10.0.10.0 255.255.255.192

And updated my server.conf (seen below)

I verified from server log file that the client ccd file is being read and route updated.

As I mentioned in my first post I DO NOT USE any firewalls on client or server (The windows firewall service is disabled completely)

The strange thing is if I do a traceroute from server to client LAN IP (10.0.10.33), its trying to go to the server's LAN gateway (192.168.1.1). I thought I didn't need to do any manual routing commands on the server? It seems like the routing on the server is still wrong if it's trying to send 10.0.10.0 traffic to Server LAN default gateway.

Here is my updated server.conf:

port 1194
proto udp
dev tun

ca ca.crt
cert server.crt
key server.key  # This file should be kept secret
dh dh1024.pem

ifconfig-pool-persist ipp.txt

topology subnet
server 172.16.0.0 255.255.255.0

# Lan behind server
push "route 192.168.1.0 255.255.255.224"

# Lan behind client
push "route 10.0.10.0 255.255.255.192"

client-config-dir ccd
route 10.0.10.0 255.255.255.192

push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
push "dhcp-option DNS 8.8.8.8"

keepalive 10 120

comp-lzo

max-clients 8

persist-key
persist-tun

status openvpn-status.log
verb 8

Here's Server's route, I don't see anything for 10.0.10.0

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         192.168.1.1     0.0.0.0         UG    100    0        0 eth0
172.16.0.0      *               255.255.255.0   U     0      0        0 tun0
192.168.1.0     *               255.255.255.224 U     0      0        0 eth0

Here's my client routes before and after making connection

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0        10.0.10.1       10.0.10.33     10
        10.0.10.0  255.255.255.192         On-link        10.0.10.33    266
       10.0.10.33  255.255.255.255         On-link        10.0.10.33    266
       10.0.10.63  255.255.255.255         On-link        10.0.10.33    266
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link        10.0.10.33    266
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link        10.0.10.33    266
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0        10.0.10.1       10.0.10.33     10
        10.0.10.0  255.255.255.192         On-link        10.0.10.33    266
       10.0.10.33  255.255.255.255         On-link        10.0.10.33    266
       10.0.10.63  255.255.255.255         On-link        10.0.10.33    266
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
       172.16.0.0    255.255.255.0         On-link        172.16.0.4    286
       172.16.0.4  255.255.255.255         On-link        172.16.0.4    286
     172.16.0.255  255.255.255.255         On-link        172.16.0.4    286
      192.168.1.0  255.255.255.224       172.16.0.1       172.16.0.4     30
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link        10.0.10.33    266
        224.0.0.0        240.0.0.0         On-link        172.16.0.4    286
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link        10.0.10.33    266
  255.255.255.255  255.255.255.255         On-link        172.16.0.4    286
===========================================================================

stucktoo

Update:

I just manually added this to the server from the command line and I can now ping the client's LAN IP from the server. So that's a step ahead.

route add -net 10.0.10.0 netmask 255.255.255.192 gw 172.16.0.4

stucktoo

Somewhere I've taken a step backward and can't ping LAN IP of Client anymore.

Here's a trimmed Server log, I don't think I've removed anything significant.

Apr  6 23:59:03 sdcgvpn ovpn-server[747]: MULTI: multi_create_instance called
Apr  6 23:59:03 sdcgvpn ovpn-server[747]: 000.000.000.000:59214 Re-using SSL/TLS context
Apr  6 23:59:03 sdcgvpn ovpn-server[747]: 000.000.000.000:59214 LZO compression initialized
Apr  6 23:59:03 sdcgvpn ovpn-server[747]: 000.000.000.000:59214 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Apr  6 23:59:03 sdcgvpn ovpn-server[747]: 000.000.000.000:59214 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Apr  6 23:59:03 sdcgvpn ovpn-server[747]: 000.000.000.000:59214 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Apr  6 23:59:03 sdcgvpn ovpn-server[747]: 000.000.000.000:59214 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Apr  6 23:59:03 sdcgvpn ovpn-server[747]: 000.000.000.000:59214 Local Options hash (VER=V4): '530fdded'
Apr  6 23:59:03 sdcgvpn ovpn-server[747]: 000.000.000.000:59214 Expected Remote Options hash (VER=V4): '41690919'
Apr  6 23:59:03 sdcgvpn ovpn-server[747]: 000.000.000.000:59214 UDPv4 READ [14] from [AF_INET]000.000.000.000:59214: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 [ ] pid=0 DATA len=0
Apr  6 23:59:03 sdcgvpn ovpn-server[747]: 000.000.000.000:59214 TLS: Initial packet from [AF_INET]000.000.000.000:59214, sid=fb51fd2d 196c6c46
Apr  6 23:59:06 sdcgvpn ovpn-server[747]: 000.000.000.000:59214 VERIFY OK: depth=1, /C=US/ST=CA/L=San_Diego/O=My_VPN/CN=sdcg.no-ip.biz/emailAddress=sdcg@xxx.com
Apr  6 23:59:06 sdcgvpn ovpn-server[747]: 000.000.000.000:59214 VERIFY OK: depth=0, /C=US/ST=CA/L=San_Diego/O=My_VPN/OU=Support/CN=Client/emailAddress=support@xxx.com
Apr  6 23:59:09 sdcgvpn ovpn-server[747]: Client/000.000.000.000:59214 PUSH: Received control message: 'PUSH_REQUEST'
Apr  6 23:59:09 sdcgvpn ovpn-server[747]: Client/000.000.000.000:59214 send_push_reply(): safe_cap=960
Apr  6 23:59:09 sdcgvpn ovpn-server[747]: Client/000.000.000.000:59214 SENT CONTROL [Client]: 'PUSH_REPLY,route 192.168.1.0 255.255.255.224,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,dhcp-option DNS 8.8.8.8,route-gateway 172.16.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 172.16.0.4 255.255.255.0' (status=1)

Here's a trimmed Client log for grins:

Sun Apr 06 23:59:06 2014 [VPN Server] Peer Connection Initiated with [AF_INET]0.0.0.0:1194
Sun Apr 06 23:59:07 2014 MANAGEMENT: >STATE:1396853947,GET_CONFIG,,,
Sun Apr 06 23:59:08 2014 SENT CONTROL [VPN Server]: 'PUSH_REQUEST' (status=1)
Sun Apr 06 23:59:08 2014 PUSH: Received control message: 'PUSH_REPLY,route 192.168.1.0 255.255.255.224,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,dhcp-option DNS 8.8.8.8,route-gateway 172.16.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 172.16.0.4 255.255.255.0'
Sun Apr 06 23:59:08 2014 OPTIONS IMPORT: timers and/or timeouts modified
Sun Apr 06 23:59:08 2014 OPTIONS IMPORT: --ifconfig/up options modified
Sun Apr 06 23:59:08 2014 OPTIONS IMPORT: route options modified
Sun Apr 06 23:59:08 2014 OPTIONS IMPORT: route-related options modified
Sun Apr 06 23:59:08 2014 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Sun Apr 06 23:59:08 2014 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Sun Apr 06 23:59:08 2014 MANAGEMENT: >STATE:1396853948,ASSIGN_IP,,172.16.0.4,
Sun Apr 06 23:59:08 2014 open_tun, tt->ipv6=0
Sun Apr 06 23:59:08 2014 TAP-WIN32 device [Local Area Connection] opened: \\.\Global\{1214B1C9-F5C9-4343-83D7-0585711D0CED}.tap
Sun Apr 06 23:59:08 2014 TAP-Windows Driver Version 9.9 
Sun Apr 06 23:59:08 2014 Set TAP-Windows TUN subnet mode network/local/netmask = 172.16.0.0/172.16.0.4/255.255.255.0 [SUCCEEDED]
Sun Apr 06 23:59:08 2014 Notified TAP-Windows driver to set a DHCP IP/netmask of 172.16.0.4/255.255.255.0 on interface {1214B1C9-F5C9-4343-83D7-0585711D0CED} [DHCP-serv: 172.16.0.254, lease-time: 31536000]
Sun Apr 06 23:59:08 2014 Successful ARP Flush on interface [52] {1214B1C9-F5C9-4343-83D7-0585711D0CED}
Sun Apr 06 23:59:08 2014 TEST ROUTES: 1/1 succeeded len=1 ret=1 a=0 u/d=up
Sun Apr 06 23:59:08 2014 MANAGEMENT: >STATE:1396853948,ADD_ROUTES,,,
Sun Apr 06 23:59:08 2014 C:\Windows\system32\route.exe ADD 192.168.1.0 MASK 255.255.255.224 172.16.0.1
Sun Apr 06 23:59:08 2014 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Sun Apr 06 23:59:08 2014 Route addition via IPAPI succeeded [adaptive]
Sun Apr 06 23:59:08 2014 Initialization Sequence Completed
Sun Apr 06 23:59:08 2014 MANAGEMENT: >STATE:1396853948,CONNECTED,SUCCESS,172.16.0.4,76.x.x.x

stucktoo

debbie10t wrote
stucktoo wroteHere's a trimmed Server log, I don't think I've removed anything significant.
Unfortunately, you have trimmed off the bit i wanted to see, the addition of routes on your server (specifically adding the route for 10.0.10.0), which should appear just above where you chopped the log.

Sorry, there was some rate-limiting going on with my syslog and those message were not logged or I would have included them. I've fixed that and here is what I think you're looking for.

Apr  7 13:26:39 sdcgvpn ovpn-server[756]: 00.00.00.00:50292 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 4096 bit RSA
Apr  7 13:26:39 sdcgvpn ovpn-server[756]: 00.00.00.00:50292 [Client] Peer Connection Initiated with [AF_INET]00.00.00.00:50292
Apr  7 13:26:39 sdcgvpn ovpn-server[756]: Client/00.00.00.00:50292 OPTIONS IMPORT: reading client specific options from: ccd/Client
Apr  7 13:26:39 sdcgvpn ovpn-server[756]: Client/00.00.00.00:50292 MULTI_sva: pool returned IPv4=172.16.0.4, IPv6=101f:85c8:aa7f:0:1528:5c7:aa7f:0
Apr  7 13:26:39 sdcgvpn ovpn-server[756]: Client/00.00.00.00:50292 MULTI: Learn: 172.16.0.4 -> Client/00.00.00.00:50292
Apr  7 13:26:39 sdcgvpn ovpn-server[756]: Client/00.00.00.00:50292 MULTI: primary virtual IP for Client/00.00.00.00:50292: 172.16.0.4
Apr  7 13:26:39 sdcgvpn ovpn-server[756]: Client/00.00.00.00:50292 MULTI: internal route 10.0.10.0/26 -> Client/00.00.00.00:50292
Apr  7 13:26:39 sdcgvpn ovpn-server[756]: Client/00.00.00.00:50292 MULTI: Learn: 10.0.10.0/26 -> Client/00.00.00.00:50292
Apr  7 13:26:39 sdcgvpn ovpn-server[756]: Client/00.00.00.00:50292 REMOVE PUSH ROUTE: 'route 10.0.10.0 255.255.255.192'
Apr  7 13:26:41 sdcgvpn ovpn-server[756]: Client/00.00.00.00:50292 UDPv4 READ [104] from [AF_INET]00.00.00.00:50292: P_CONTROL_V1 kid=0 [ ] pid=52 DATA len=90
Apr  7 13:26:41 sdcgvpn ovpn-server[756]: Client/00.00.00.00:50292 PUSH: Received control message: 'PUSH_REQUEST'
Apr  7 13:26:41 sdcgvpn ovpn-server[756]: Client/00.00.00.00:50292 send_push_reply(): safe_cap=960
Apr  7 13:26:41 sdcgvpn ovpn-server[756]: Client/00.00.00.00:50292 SENT CONTROL [Client]: 'PUSH_REPLY,route 192.168.1.0 255.255.255.224,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,dhcp-option DNS 8.8.8.8,route-gateway 172.16.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 172.16.0.4 255.255.255.0' (status=1)

stucktoo

Ok, hopefully its all there this time :oops:

It seems like all that's missing is getting the server to set the route back to the client.

Thanks again for your help @debbie10t 😃

Tue Apr  8 22:03:45 2014 OpenVPN 2.2.1 x86_64-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Feb 27 2013
Tue Apr  8 22:03:45 2014 NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x.  Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
Tue Apr  8 22:03:45 2014 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Tue Apr  8 22:03:45 2014 Diffie-Hellman initialized with 1024 bit key
Tue Apr  8 22:03:45 2014 TLS-Auth MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Tue Apr  8 22:03:45 2014 Socket Buffers: R=[212992->131072] S=[212992->131072]
Tue Apr  8 22:03:45 2014 ROUTE default_gateway=192.168.1.1
Tue Apr  8 22:03:45 2014 OpenVPN ROUTE: OpenVPN needs a gateway parameter for a --route option and no default was specified by either --route-gateway or --ifconfig options
Tue Apr  8 22:03:45 2014 OpenVPN ROUTE: failed to parse/resolve route for host/network: 10.0.10.0
Tue Apr  8 22:03:45 2014 TUN/TAP device tun0 opened
Tue Apr  8 22:03:45 2014 TUN/TAP TX queue length set to 100
Tue Apr  8 22:03:45 2014 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Tue Apr  8 22:03:45 2014 /sbin/ifconfig tun0 172.16.0.1 netmask 255.255.255.0 mtu 1500 broadcast 172.16.0.255
Tue Apr  8 22:03:45 2014 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Apr  8 22:03:45 2014 UDPv4 link local (bound): [undef]
Tue Apr  8 22:03:45 2014 UDPv4 link remote: [undef]
Tue Apr  8 22:03:45 2014 MULTI: multi_init called, r=256 v=256
Tue Apr  8 22:03:45 2014 IFCONFIG POOL: base=172.16.0.2 size=252, ipv6=0
Tue Apr  8 22:03:45 2014 ifconfig_pool_read(), in='Client_NAS,172.16.0.2', TODO: IPv6
Tue Apr  8 22:03:45 2014 succeeded -> ifconfig_pool_set()
Tue Apr  8 22:03:45 2014 ifconfig_pool_read(), in='Client2_Tablet,172.16.0.3', TODO: IPv6
Tue Apr  8 22:03:45 2014 succeeded -> ifconfig_pool_set()
Tue Apr  8 22:03:45 2014 ifconfig_pool_read(), in='Client,172.16.0.4', TODO: IPv6
Tue Apr  8 22:03:45 2014 succeeded -> ifconfig_pool_set()
Tue Apr  8 22:03:45 2014 ifconfig_pool_read(), in='Client_Tablet,172.16.0.8', TODO: IPv6
Tue Apr  8 22:03:45 2014 succeeded -> ifconfig_pool_set()
Tue Apr  8 22:03:45 2014 ifconfig_pool_read(), in='Client_Phone,172.16.0.12', TODO: IPv6
Tue Apr  8 22:03:45 2014 succeeded -> ifconfig_pool_set()
Tue Apr  8 22:03:45 2014 ifconfig_pool_read(), in='Client2_Home,172.16.0.16', TODO: IPv6
Tue Apr  8 22:03:45 2014 succeeded -> ifconfig_pool_set()
Tue Apr  8 22:03:45 2014 IFCONFIG POOL LIST
Tue Apr  8 22:03:45 2014 Client_NAS,172.16.0.2
Tue Apr  8 22:03:45 2014 Client2_Tablet,172.16.0.3
Tue Apr  8 22:03:45 2014 Client,172.16.0.4
Tue Apr  8 22:03:45 2014 Client_Tablet,172.16.0.8
Tue Apr  8 22:03:45 2014 Client_Phone,172.16.0.12
Tue Apr  8 22:03:45 2014 Client2_Home,172.16.0.16
Tue Apr  8 22:03:45 2014 Initialization Sequence Completed
Tue Apr  8 22:05:56 2014 MULTI: multi_create_instance called
Tue Apr  8 22:05:56 2014 00.00.00.00:58633 Re-using SSL/TLS context
Tue Apr  8 22:05:56 2014 00.00.00.00:58633 LZO compression initialized
Tue Apr  8 22:05:56 2014 00.00.00.00:58633 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Tue Apr  8 22:05:56 2014 00.00.00.00:58633 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Apr  8 22:05:56 2014 00.00.00.00:58633 Local Options hash (VER=V4): '530fdded'
Tue Apr  8 22:05:56 2014 00.00.00.00:58633 Expected Remote Options hash (VER=V4): '41690919'
Tue Apr  8 22:05:56 2014 00.00.00.00:58633 TLS: Initial packet from [AF_INET]00.00.00.00:58633, sid=5346b640 da4dd1c5
Tue Apr  8 22:05:59 2014 00.00.00.00:58633 VERIFY OK: depth=1, /C=US/ST=CA/L=San_Diego/O=xxxx/CN=xx.xx.xx/emailAddress=sdcg@myitwiz.com
Tue Apr  8 22:05:59 2014 00.00.00.00:58633 VERIFY OK: depth=0, /C=US/ST=CA/L=San_Diego/O=xxxx/OU=Support/CN=Client/emailAddress=xxx.xxx.com
Tue Apr  8 22:05:59 2014 00.00.00.00:58633 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Apr  8 22:05:59 2014 00.00.00.00:58633 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Apr  8 22:05:59 2014 00.00.00.00:58633 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Apr  8 22:05:59 2014 00.00.00.00:58633 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Apr  8 22:06:00 2014 00.00.00.00:58633 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 4096 bit RSA
Tue Apr  8 22:06:00 2014 00.00.00.00:58633 [Client] Peer Connection Initiated with [AF_INET]00.00.00.00:58633
Tue Apr  8 22:06:00 2014 Client/00.00.00.00:58633 OPTIONS IMPORT: reading client specific options from: ccd/Client
Tue Apr  8 22:06:00 2014 Client/00.00.00.00:58633 MULTI_sva: pool returned IPv4=172.16.0.4, IPv6=f061:78c6:427f:0:1568:66c4:427f:0
Tue Apr  8 22:06:00 2014 Client/00.00.00.00:58633 MULTI: Learn: 172.16.0.4 -> Client/00.00.00.00:58633
Tue Apr  8 22:06:00 2014 Client/00.00.00.00:58633 MULTI: primary virtual IP for Client/00.00.00.00:58633: 172.16.0.4
Tue Apr  8 22:06:00 2014 Client/00.00.00.00:58633 MULTI: internal route 10.0.10.0/26 -> Client/00.00.00.00:58633
Tue Apr  8 22:06:00 2014 Client/00.00.00.00:58633 MULTI: Learn: 10.0.10.0/26 -> Client/00.00.00.00:58633
Tue Apr  8 22:06:00 2014 Client/00.00.00.00:58633 REMOVE PUSH ROUTE: 'route 10.0.10.0 255.255.255.192'
Tue Apr  8 22:06:02 2014 Client/00.00.00.00:58633 PUSH: Received control message: 'PUSH_REQUEST'
Tue Apr  8 22:06:02 2014 Client/00.00.00.00:58633 send_push_reply(): safe_cap=960
Tue Apr  8 22:06:02 2014 Client/00.00.00.00:58633 SENT CONTROL [Client]: 'PUSH_REPLY,route 192.168.1.0 255.255.255.224,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,dhcp-option DNS 8.8.8.8,route-gateway 172.16.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 172.16.0.4 255.255.255.0' (status=1)
Tue Apr  8 22:06:22 2014 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Tue Apr  8 22:06:33 2014 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Tue Apr  8 22:06:42 2014 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Tue Apr  8 22:06:52 2014 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Tue Apr  8 22:07:02 2014 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Tue Apr  8 22:07:13 2014 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Tue Apr  8 22:07:22 2014 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Tue Apr  8 22:07:32 2014 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Tue Apr  8 22:07:42 2014 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Tue Apr  8 22:07:52 2014 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Tue Apr  8 22:08:02 2014 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Tue Apr  8 22:08:12 2014 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)

stucktoo

debbie10t wrote Try this - Server Config:

# Lan behind client
route   10.0.10.0   255.255.255.192   172.16.0.4

Where 172.16.0.4 is the client VPN address of the remote client. (Customise to your required client)

This works, but its static, meaning as soon as the server starts it creates the route before the client connects. I was hoping more for something dynamic that gets added after the client connects. Just for grins I tried putting that in the CCD file for that client, no luck. I also tried "pushing" it from the client config file, no luck there either, unless I had the syntax wrong.

debbie10t wrote You can also set a fixed VPN IP address for the client in question by adding to the CCD file for the specified client:

ifconfig-push 172.16.0.x 255.255.255.0  ### Where 172.16.0.x should be set to the desired IP address

I'd already done this, which is helpful, but not with automatically generating the route on the server.

I can live with having that route in the server config if there's not any other way to accomplish it dynamically (on-demand).