Cannot access router configuration web from client

miisch

I cannot ping the router or access its web site from OpenVPN client. I can access other computers in the router intranet without any problem.

OpenVPN tun/udp
Intranet 192.168.1.0/24
Router 192.168.1.200
Client 192.168.2.6
OpenVPN DHCP 192.168.2.5
I have tried to access directly http://192.168.1.200, than also 192.168.2.1 or 2.5 or https://192.168.1.200:8888

I'll be happy for any hint, thank you

miisch

@debbie10t: you mean configs? ok

I use as the server dd-wrt router:

mode server
proto udp
port 8015
dev tun0
server 192.168.2.0 255.255.255.0
push "route 192.168.1.0 255.255.255.0"
push "dhcp-option DNS 192.168.2.5"
push "route-gateway 192.168.2.5"
keepalive 10 120
dh /tmp/openvpn/dh.pem
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem
management 127.0.0.1 5002

and client:

remote ******** ****
client
dev tun0
proto udp
resolv-retry infinite
nobind
persist-key
persist-tun
float
ca ca.crt
cert client2.crt
key client2.key
ns-cert-type server

miisch

client log:

Tue Jul 29 15:01:37 2014 us=518003 Current Parameter Settings:
Tue Jul 29 15:01:37 2014 us=518003 config = 'client2.ovpn'
Tue Jul 29 15:01:37 2014 us=518003 mode = 0
Tue Jul 29 15:01:37 2014 us=518003 show_ciphers = DISABLED
Tue Jul 29 15:01:37 2014 us=518003 show_digests = DISABLED
Tue Jul 29 15:01:37 2014 us=518003 show_engines = DISABLED
Tue Jul 29 15:01:37 2014 us=518003 genkey = DISABLED
Tue Jul 29 15:01:37 2014 us=518003 key_pass_file = '[UNDEF]'
Tue Jul 29 15:01:37 2014 us=518003 show_tls_ciphers = DISABLED
Tue Jul 29 15:01:37 2014 us=518003 Connection profiles [default]:
Tue Jul 29 15:01:37 2014 us=518003 proto = udp
Tue Jul 29 15:01:37 2014 us=518003 local = '[UNDEF]'
Tue Jul 29 15:01:37 2014 us=518003 local_port = 0
Tue Jul 29 15:01:37 2014 us=518003 remote = '193.85.1.1'
Tue Jul 29 15:01:37 2014 us=518003 remote_port = 8888
Tue Jul 29 15:01:37 2014 us=518003 remote_float = ENABLED
Tue Jul 29 15:01:37 2014 us=518003 bind_defined = DISABLED
Tue Jul 29 15:01:37 2014 us=518003 bind_local = DISABLED
Tue Jul 29 15:01:37 2014 us=518003 connect_retry_seconds = 5
Tue Jul 29 15:01:37 2014 us=518003 connect_timeout = 10
Tue Jul 29 15:01:37 2014 us=518003 connect_retry_max = 0
Tue Jul 29 15:01:37 2014 us=518003 socks_proxy_server = '[UNDEF]'
Tue Jul 29 15:01:37 2014 us=518003 socks_proxy_port = 0
Tue Jul 29 15:01:37 2014 us=518003 socks_proxy_retry = DISABLED
Tue Jul 29 15:01:37 2014 us=518003 tun_mtu = 1500
Tue Jul 29 15:01:37 2014 us=518003 tun_mtu_defined = ENABLED
Tue Jul 29 15:01:37 2014 us=518003 link_mtu = 1500
Tue Jul 29 15:01:37 2014 us=518003 link_mtu_defined = DISABLED
Tue Jul 29 15:01:37 2014 us=518003 tun_mtu_extra = 0
Tue Jul 29 15:01:37 2014 us=518003 tun_mtu_extra_defined = DISABLED
Tue Jul 29 15:01:37 2014 us=518003 mtu_discover_type = -1
Tue Jul 29 15:01:37 2014 us=518003 fragment = 0
Tue Jul 29 15:01:37 2014 us=518003 mssfix = 1450
Tue Jul 29 15:01:37 2014 us=518003 explicit_exit_notification = 0
Tue Jul 29 15:01:37 2014 us=518003 Connection profiles END
Tue Jul 29 15:01:37 2014 us=518003 remote_random = DISABLED
Tue Jul 29 15:01:37 2014 us=518003 ipchange = '[UNDEF]'
Tue Jul 29 15:01:37 2014 us=518003 dev = 'tun0'
Tue Jul 29 15:01:37 2014 us=518003 dev_type = '[UNDEF]'
Tue Jul 29 15:01:37 2014 us=518003 dev_node = '[UNDEF]'
Tue Jul 29 15:01:37 2014 us=518003 lladdr = '[UNDEF]'
Tue Jul 29 15:01:37 2014 us=518003 topology = 1
Tue Jul 29 15:01:37 2014 us=518003 tun_ipv6 = DISABLED
Tue Jul 29 15:01:37 2014 us=518003 ifconfig_local = '[UNDEF]'
Tue Jul 29 15:01:37 2014 us=518003 ifconfig_remote_netmask = '[UNDEF]'
Tue Jul 29 15:01:37 2014 us=518003 ifconfig_noexec = DISABLED
Tue Jul 29 15:01:37 2014 us=518003 ifconfig_nowarn = DISABLED
Tue Jul 29 15:01:37 2014 us=518003 ifconfig_ipv6_local = '[UNDEF]'
Tue Jul 29 15:01:37 2014 us=518003 ifconfig_ipv6_netbits = 0
Tue Jul 29 15:01:37 2014 us=518003 ifconfig_ipv6_remote = '[UNDEF]'
Tue Jul 29 15:01:37 2014 us=518003 shaper = 0
Tue Jul 29 15:01:37 2014 us=518003 mtu_test = 0
Tue Jul 29 15:01:37 2014 us=518003 mlock = DISABLED
Tue Jul 29 15:01:37 2014 us=519003 keepalive_ping = 0
Tue Jul 29 15:01:37 2014 us=519003 keepalive_timeout = 0
Tue Jul 29 15:01:37 2014 us=519003 inactivity_timeout = 0
Tue Jul 29 15:01:37 2014 us=519003 ping_send_timeout = 0
Tue Jul 29 15:01:37 2014 us=519003 ping_rec_timeout = 0
Tue Jul 29 15:01:37 2014 us=519003 ping_rec_timeout_action = 0
Tue Jul 29 15:01:37 2014 us=519003 ping_timer_remote = DISABLED
Tue Jul 29 15:01:37 2014 us=519003 remap_sigusr1 = 0
Tue Jul 29 15:01:37 2014 us=519003 persist_tun = ENABLED
Tue Jul 29 15:01:37 2014 us=519003 persist_local_ip = DISABLED
Tue Jul 29 15:01:37 2014 us=519003 persist_remote_ip = DISABLED
Tue Jul 29 15:01:37 2014 us=519003 persist_key = ENABLED
Tue Jul 29 15:01:37 2014 us=519003 passtos = DISABLED
Tue Jul 29 15:01:37 2014 us=519003 resolve_retry_seconds = 1000000000
Tue Jul 29 15:01:37 2014 us=519003 username = '[UNDEF]'
Tue Jul 29 15:01:37 2014 us=519003 groupname = '[UNDEF]'
Tue Jul 29 15:01:37 2014 us=519003 chroot_dir = '[UNDEF]'
Tue Jul 29 15:01:37 2014 us=519003 cd_dir = '[UNDEF]'
Tue Jul 29 15:01:37 2014 us=519003 writepid = '[UNDEF]'
Tue Jul 29 15:01:37 2014 us=519003 up_script = '[UNDEF]'
Tue Jul 29 15:01:37 2014 us=519003 down_script = '[UNDEF]'
Tue Jul 29 15:01:37 2014 us=519003 down_pre = DISABLED
Tue Jul 29 15:01:37 2014 us=519003 up_restart = DISABLED
Tue Jul 29 15:01:37 2014 us=519003 up_delay = DISABLED
Tue Jul 29 15:01:37 2014 us=519003 daemon = DISABLED
Tue Jul 29 15:01:37 2014 us=519003 inetd = 0
Tue Jul 29 15:01:37 2014 us=519003 log = ENABLED
Tue Jul 29 15:01:37 2014 us=519003 suppress_timestamps = DISABLED
Tue Jul 29 15:01:37 2014 us=519003 nice = 0
Tue Jul 29 15:01:37 2014 us=519003 verbosity = 4
Tue Jul 29 15:01:37 2014 us=519003 mute = 0
Tue Jul 29 15:01:37 2014 us=519003 status_file = '[UNDEF]'
Tue Jul 29 15:01:37 2014 us=519003 status_file_version = 1
Tue Jul 29 15:01:37 2014 us=519003 status_file_update_freq = 60
Tue Jul 29 15:01:37 2014 us=519003 occ = ENABLED
Tue Jul 29 15:01:37 2014 us=519003 rcvbuf = 0
Tue Jul 29 15:01:37 2014 us=519003 sndbuf = 0
Tue Jul 29 15:01:37 2014 us=519003 sockflags = 0
Tue Jul 29 15:01:37 2014 us=519003 fast_io = DISABLED
Tue Jul 29 15:01:37 2014 us=519003 lzo = 0
Tue Jul 29 15:01:37 2014 us=519003 route_script = '[UNDEF]'
Tue Jul 29 15:01:37 2014 us=519003 route_default_gateway = '[UNDEF]'
Tue Jul 29 15:01:37 2014 us=519003 route_default_metric = 0
Tue Jul 29 15:01:37 2014 us=519003 route_noexec = DISABLED
Tue Jul 29 15:01:37 2014 us=519003 route_delay = 5
Tue Jul 29 15:01:37 2014 us=519003 route_delay_window = 30
Tue Jul 29 15:01:37 2014 us=519003 route_delay_defined = ENABLED
Tue Jul 29 15:01:37 2014 us=519003 route_nopull = DISABLED
Tue Jul 29 15:01:37 2014 us=519003 route_gateway_via_dhcp = DISABLED
Tue Jul 29 15:01:37 2014 us=519003 max_routes = 100
Tue Jul 29 15:01:37 2014 us=519003 allow_pull_fqdn = DISABLED
Tue Jul 29 15:01:37 2014 us=519003 management_addr = '127.0.0.1'
Tue Jul 29 15:01:37 2014 us=519003 management_port = 25340
Tue Jul 29 15:01:37 2014 us=519003 management_user_pass = 'stdin'
Tue Jul 29 15:01:37 2014 us=519003 management_log_history_cache = 250
Tue Jul 29 15:01:37 2014 us=519003 management_echo_buffer_size = 100
Tue Jul 29 15:01:37 2014 us=519003 management_write_peer_info_file = '[UNDEF]'
Tue Jul 29 15:01:37 2014 us=519003 management_client_user = '[UNDEF]'
Tue Jul 29 15:01:37 2014 us=519003 management_client_group = '[UNDEF]'
Tue Jul 29 15:01:37 2014 us=519003 management_flags = 6
Tue Jul 29 15:01:37 2014 us=519003 shared_secret_file = '[UNDEF]'
Tue Jul 29 15:01:37 2014 us=519003 key_direction = 0
Tue Jul 29 15:01:37 2014 us=519003 ciphername_defined = ENABLED
Tue Jul 29 15:01:37 2014 us=519003 ciphername = 'BF-CBC'
Tue Jul 29 15:01:37 2014 us=519003 authname_defined = ENABLED
Tue Jul 29 15:01:37 2014 us=519003 authname = 'SHA1'
Tue Jul 29 15:01:37 2014 us=519003 prng_hash = 'SHA1'
Tue Jul 29 15:01:37 2014 us=519003 prng_nonce_secret_len = 16
Tue Jul 29 15:01:37 2014 us=519003 keysize = 0
Tue Jul 29 15:01:37 2014 us=519003 engine = DISABLED
Tue Jul 29 15:01:37 2014 us=519003 replay = ENABLED
Tue Jul 29 15:01:37 2014 us=519003 mute_replay_warnings = DISABLED
Tue Jul 29 15:01:37 2014 us=519003 replay_window = 64
Tue Jul 29 15:01:37 2014 us=519003 replay_time = 15
Tue Jul 29 15:01:37 2014 us=519003 packet_id_file = '[UNDEF]'
Tue Jul 29 15:01:37 2014 us=519003 use_iv = ENABLED
Tue Jul 29 15:01:37 2014 us=519003 test_crypto = DISABLED
Tue Jul 29 15:01:37 2014 us=519003 tls_server = DISABLED
Tue Jul 29 15:01:37 2014 us=519003 tls_client = ENABLED
Tue Jul 29 15:01:37 2014 us=519003 key_method = 2
Tue Jul 29 15:01:37 2014 us=519003 ca_file = 'ca.crt'
Tue Jul 29 15:01:37 2014 us=519003 ca_path = '[UNDEF]'
Tue Jul 29 15:01:37 2014 us=519003 dh_file = '[UNDEF]'
Tue Jul 29 15:01:37 2014 us=519003 cert_file = 'client2.crt'
Tue Jul 29 15:01:37 2014 us=519003 priv_key_file = 'client2.key'
Tue Jul 29 15:01:37 2014 us=519003 pkcs12_file = '[UNDEF]'
Tue Jul 29 15:01:37 2014 us=519003 cryptoapi_cert = '[UNDEF]'
Tue Jul 29 15:01:37 2014 us=519003 cipher_list = '[UNDEF]'
Tue Jul 29 15:01:37 2014 us=519003 tls_verify = '[UNDEF]'
Tue Jul 29 15:01:37 2014 us=519003 tls_export_cert = '[UNDEF]'
Tue Jul 29 15:01:37 2014 us=519003 verify_x509_type = 0
Tue Jul 29 15:01:37 2014 us=519003 verify_x509_name = '[UNDEF]'
Tue Jul 29 15:01:37 2014 us=519003 crl_file = '[UNDEF]'
Tue Jul 29 15:01:37 2014 us=519003 ns_cert_type = 1
Tue Jul 29 15:01:37 2014 us=519003 remote_cert_ku = 0
Tue Jul 29 15:01:37 2014 us=519003 remote_cert_ku = 0
Tue Jul 29 15:01:37 2014 us=519003 remote_cert_ku = 0
Tue Jul 29 15:01:37 2014 us=519003 remote_cert_ku = 0
Tue Jul 29 15:01:37 2014 us=519003 remote_cert_ku = 0
Tue Jul 29 15:01:37 2014 us=519003 remote_cert_ku = 0
Tue Jul 29 15:01:37 2014 us=519003 remote_cert_ku = 0
Tue Jul 29 15:01:37 2014 us=519003 remote_cert_ku = 0
Tue Jul 29 15:01:37 2014 us=519003 remote_cert_ku = 0
Tue Jul 29 15:01:37 2014 us=519003 remote_cert_ku = 0
Tue Jul 29 15:01:37 2014 us=519003 remote_cert_ku[i] = 0
Tue Jul 29 15:01:37 2014 us=519003 remote_cert_ku[i] = 0
Tue Jul 29 15:01:37 2014 us=519003 remote_cert_ku[i] = 0
Tue Jul 29 15:01:37 2014 us=519003 remote_cert_ku[i] = 0
Tue Jul 29 15:01:37 2014 us=519003 remote_cert_ku[i] = 0
Tue Jul 29 15:01:37 2014 us=519003 remote_cert_ku[i] = 0
Tue Jul 29 15:01:37 2014 us=519003 remote_cert_eku = '[UNDEF]'
Tue Jul 29 15:01:37 2014 us=519003 ssl_flags = 0
Tue Jul 29 15:01:37 2014 us=519003 tls_timeout = 2
Tue Jul 29 15:01:37 2014 us=519003 renegotiate_bytes = 0
Tue Jul 29 15:01:37 2014 us=519003 renegotiate_packets = 0
Tue Jul 29 15:01:37 2014 us=519003 renegotiate_seconds = 3600
Tue Jul 29 15:01:37 2014 us=519003 handshake_window = 60
Tue Jul 29 15:01:37 2014 us=519003 transition_window = 3600
Tue Jul 29 15:01:37 2014 us=519003 single_session = DISABLED
Tue Jul 29 15:01:37 2014 us=519003 push_peer_info = DISABLED
Tue Jul 29 15:01:37 2014 us=519003 tls_exit = DISABLED
Tue Jul 29 15:01:37 2014 us=519003 tls_auth_file = '[UNDEF]'
Tue Jul 29 15:01:37 2014 us=519003 pkcs11_protected_authentication = DISABLED
Tue Jul 29 15:01:37 2014 us=519003 pkcs11_protected_authentication = DISABLED
Tue Jul 29 15:01:37 2014 us=519003 pkcs11_protected_authentication = DISABLED
Tue Jul 29 15:01:37 2014 us=519003 pkcs11_protected_authentication = DISABLED
Tue Jul 29 15:01:37 2014 us=519003 pkcs11_protected_authentication = DISABLED
Tue Jul 29 15:01:37 2014 us=519003 pkcs11_protected_authentication = DISABLED
Tue Jul 29 15:01:37 2014 us=519003 pkcs11_protected_authentication = DISABLED
Tue Jul 29 15:01:37 2014 us=519003 pkcs11_protected_authentication = DISABLED
Tue Jul 29 15:01:37 2014 us=519003 pkcs11_protected_authentication = DISABLED
Tue Jul 29 15:01:37 2014 us=519003 pkcs11_protected_authentication = DISABLED
Tue Jul 29 15:01:37 2014 us=519003 pkcs11_protected_authentication = DISABLED
Tue Jul 29 15:01:37 2014 us=519003 pkcs11_protected_authentication = DISABLED
Tue Jul 29 15:01:37 2014 us=519003 pkcs11_protected_authentication = DISABLED
Tue Jul 29 15:01:37 2014 us=519003 pkcs11_protected_authentication = DISABLED
Tue Jul 29 15:01:37 2014 us=519003 pkcs11_protected_authentication = DISABLED
Tue Jul 29 15:01:37 2014 us=519003 pkcs11_protected_authentication = DISABLED
Tue Jul 29 15:01:37 2014 us=519003 pkcs11_private_mode = 00000000
Tue Jul 29 15:01:37 2014 us=519003 pkcs11_private_mode = 00000000
Tue Jul 29 15:01:37 2014 us=519003 pkcs11_private_mode = 00000000
Tue Jul 29 15:01:37 2014 us=519003 pkcs11_private_mode = 00000000
Tue Jul 29 15:01:37 2014 us=519003 pkcs11_private_mode = 00000000
Tue Jul 29 15:01:37 2014 us=519003 pkcs11_private_mode = 00000000
Tue Jul 29 15:01:37 2014 us=519003 pkcs11_private_mode = 00000000
Tue Jul 29 15:01:37 2014 us=519003 pkcs11_private_mode = 00000000
Tue Jul 29 15:01:37 2014 us=519003 pkcs11_private_mode = 00000000
Tue Jul 29 15:01:37 2014 us=519003 pkcs11_private_mode = 00000000
Tue Jul 29 15:01:37 2014 us=519003 pkcs11_private_mode = 00000000
Tue Jul 29 15:01:37 2014 us=519003 pkcs11_private_mode = 00000000
Tue Jul 29 15:01:37 2014 us=519003 pkcs11_private_mode = 00000000
Tue Jul 29 15:01:37 2014 us=519003 pkcs11_private_mode = 00000000
Tue Jul 29 15:01:37 2014 us=519003 pkcs11_private_mode = 00000000
Tue Jul 29 15:01:37 2014 us=519003 pkcs11_private_mode = 00000000
Tue Jul 29 15:01:37 2014 us=519003 pkcs11_cert_private = DISABLED
Tue Jul 29 15:01:37 2014 us=519003 pkcs11_cert_private = DISABLED
Tue Jul 29 15:01:37 2014 us=519003 pkcs11_cert_private = DISABLED
Tue Jul 29 15:01:37 2014 us=519003 pkcs11_cert_private = DISABLED
Tue Jul 29 15:01:37 2014 us=519003 pkcs11_cert_private = DISABLED
Tue Jul 29 15:01:37 2014 us=519003 pkcs11_cert_private = DISABLED
Tue Jul 29 15:01:37 2014 us=519003 pkcs11_cert_private = DISABLED
Tue Jul 29 15:01:37 2014 us=519003 pkcs11_cert_private = DISABLED
Tue Jul 29 15:01:37 2014 us=519003 pkcs11_cert_private = DISABLED
Tue Jul 29 15:01:37 2014 us=519003 pkcs11_cert_private = DISABLED
Tue Jul 29 15:01:37 2014 us=519003 pkcs11_cert_private = DISABLED
Tue Jul 29 15:01:37 2014 us=519003 pkcs11_cert_private = DISABLED
Tue Jul 29 15:01:37 2014 us=519003 pkcs11_cert_private = DISABLED
Tue Jul 29 15:01:37 2014 us=519003 pkcs11_cert_private = DISABLED
Tue Jul 29 15:01:37 2014 us=519003 pkcs11_cert_private = DISABLED
Tue Jul 29 15:01:37 2014 us=519003 pkcs11_cert_private = DISABLED
Tue Jul 29 15:01:37 2014 us=519003 pkcs11_pin_cache_period = -1
Tue Jul 29 15:01:37 2014 us=519003 pkcs11_id = '[UNDEF]'
Tue Jul 29 15:01:37 2014 us=519003 pkcs11_id_management = DISABLED
Tue Jul 29 15:01:37 2014 us=519003 server_network = 0.0.0.0
Tue Jul 29 15:01:37 2014 us=519003 server_netmask = 0.0.0.0
Tue Jul 29 15:01:37 2014 us=520003 server_network_ipv6 = ::
Tue Jul 29 15:01:37 2014 us=520003 server_netbits_ipv6 = 0
Tue Jul 29 15:01:37 2014 us=520003 server_bridge_ip = 0.0.0.0
Tue Jul 29 15:01:37 2014 us=520003 server_bridge_netmask = 0.0.0.0
Tue Jul 29 15:01:37 2014 us=520003 server_bridge_pool_start = 0.0.0.0
Tue Jul 29 15:01:37 2014 us=520003 server_bridge_pool_end = 0.0.0.0
Tue Jul 29 15:01:37 2014 us=520003 ifconfig_pool_defined = DISABLED
Tue Jul 29 15:01:37 2014 us=520003 ifconfig_pool_start = 0.0.0.0
Tue Jul 29 15:01:37 2014 us=520003 ifconfig_pool_end = 0.0.0.0
Tue Jul 29 15:01:37 2014 us=520003 ifconfig_pool_netmask = 0.0.0.0
Tue Jul 29 15:01:37 2014 us=520003 ifconfig_pool_persist_filename = '[UNDEF]'
Tue Jul 29 15:01:37 2014 us=520003 ifconfig_pool_persist_refresh_freq = 600
Tue Jul 29 15:01:37 2014 us=520003 ifconfig_ipv6_pool_defined = DISABLED
Tue Jul 29 15:01:37 2014 us=520003 ifconfig_ipv6_pool_base = ::
Tue Jul 29 15:01:37 2014 us=520003 ifconfig_ipv6_pool_netbits = 0
Tue Jul 29 15:01:37 2014 us=520003 n_bcast_buf = 256
Tue Jul 29 15:01:37 2014 us=520003 tcp_queue_limit = 64
Tue Jul 29 15:01:37 2014 us=520003 real_hash_size = 256
Tue Jul 29 15:01:37 2014 us=520003 virtual_hash_size = 256
Tue Jul 29 15:01:37 2014 us=520003 client_connect_script = '[UNDEF]'
Tue Jul 29 15:01:37 2014 us=520003 learn_address_script = '[UNDEF]'
Tue Jul 29 15:01:37 2014 us=520003 client_disconnect_script = '[UNDEF]'
Tue Jul 29 15:01:37 2014 us=520003 client_config_dir = '[UNDEF]'
Tue Jul 29 15:01:37 2014 us=520003 ccd_exclusive = DISABLED
Tue Jul 29 15:01:37 2014 us=520003 tmp_dir = 'C:\Users\M\AppData\Local\Temp\'
Tue Jul 29 15:01:37 2014 us=520003 push_ifconfig_defined = DISABLED
Tue Jul 29 15:01:37 2014 us=520003 push_ifconfig_local = 0.0.0.0
Tue Jul 29 15:01:37 2014 us=520003 push_ifconfig_remote_netmask = 0.0.0.0
Tue Jul 29 15:01:37 2014 us=520003 push_ifconfig_ipv6_defined = DISABLED
Tue Jul 29 15:01:37 2014 us=520003 push_ifconfig_ipv6_local = ::/0
Tue Jul 29 15:01:37 2014 us=520003 push_ifconfig_ipv6_remote = ::
Tue Jul 29 15:01:37 2014 us=520003 enable_c2c = DISABLED
Tue Jul 29 15:01:37 2014 us=520003 duplicate_cn = DISABLED
Tue Jul 29 15:01:37 2014 us=520003 cf_max = 0
Tue Jul 29 15:01:37 2014 us=520003 cf_per = 0
Tue Jul 29 15:01:37 2014 us=520003 max_clients = 1024
Tue Jul 29 15:01:37 2014 us=520003 max_routes_per_client = 256
Tue Jul 29 15:01:37 2014 us=520003 auth_user_pass_verify_script = '[UNDEF]'
Tue Jul 29 15:01:37 2014 us=520003 auth_user_pass_verify_script_via_file = DISABLED
Tue Jul 29 15:01:37 2014 us=520003 client = ENABLED
Tue Jul 29 15:01:37 2014 us=520003 pull = ENABLED
Tue Jul 29 15:01:37 2014 us=520003 auth_user_pass_file = '[UNDEF]'
Tue Jul 29 15:01:37 2014 us=520003 show_net_up = DISABLED
Tue Jul 29 15:01:37 2014 us=520003 route_method = 0
Tue Jul 29 15:01:37 2014 us=520003 ip_win32_defined = DISABLED
Tue Jul 29 15:01:37 2014 us=520003 ip_win32_type = 3
Tue Jul 29 15:01:37 2014 us=520003 dhcp_masq_offset = 0
Tue Jul 29 15:01:37 2014 us=520003 dhcp_lease_time = 31536000
Tue Jul 29 15:01:37 2014 us=520003 tap_sleep = 0
Tue Jul 29 15:01:37 2014 us=520003 dhcp_options = DISABLED
Tue Jul 29 15:01:37 2014 us=520003 dhcp_renew = DISABLED
Tue Jul 29 15:01:37 2014 us=520003 dhcp_pre_release = DISABLED
Tue Jul 29 15:01:37 2014 us=520003 dhcp_release = DISABLED
Tue Jul 29 15:01:37 2014 us=520003 domain = '[UNDEF]'
Tue Jul 29 15:01:37 2014 us=520003 netbios_scope = '[UNDEF]'
Tue Jul 29 15:01:37 2014 us=520003 netbios_node_type = 0
Tue Jul 29 15:01:37 2014 us=520003 disable_nbt = DISABLED
Tue Jul 29 15:01:37 2014 us=520003 OpenVPN 2.3.4 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Jun 5 2014
Tue Jul 29 15:01:37 2014 us=520003 library versions: OpenSSL 1.0.1h 5 Jun 2014, LZO 2.05
Enter Management Password:
Tue Jul 29 15:01:37 2014 us=521002 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Tue Jul 29 15:01:37 2014 us=521002 Need hold release from management interface, waiting...
Tue Jul 29 15:01:38 2014 us=9856 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Tue Jul 29 15:01:38 2014 us=109826 MANAGEMENT: CMD 'state on'
Tue Jul 29 15:01:38 2014 us=109826 MANAGEMENT: CMD 'log all on'
Tue Jul 29 15:01:38 2014 us=175806 MANAGEMENT: CMD 'hold off'
Tue Jul 29 15:01:38 2014 us=175806 MANAGEMENT: CMD 'hold release'
Tue Jul 29 15:01:38 2014 us=286772 Control Channel MTU parms [ L:1541 D:138 EF:38 EB:0 ET:0 EL:0 ]
Tue Jul 29 15:01:38 2014 us=286772 Socket Buffers: R=[8192->8192] S=[8192->8192]
Tue Jul 29 15:01:38 2014 us=286772 Data Channel MTU parms [ L:1541 D:1450 EF:41 EB:4 ET:0 EL:0 ]
Tue Jul 29 15:01:38 2014 us=286772 Local Options String: 'V4,dev-type tun,link-mtu 1541,tun-mtu 1500,proto UDPv4,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Tue Jul 29 15:01:38 2014 us=286772 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1541,tun-mtu 1500,proto UDPv4,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Tue Jul 29 15:01:38 2014 us=286772 Local Options hash (VER=V4): '3514370b'
Tue Jul 29 15:01:38 2014 us=286772 Expected Remote Options hash (VER=V4): '239669a8'
Tue Jul 29 15:01:38 2014 us=286772 UDPv4 link local: [undef]
Tue Jul 29 15:01:38 2014 us=286772 UDPv4 link remote: [AF_INET]193.85.1.1:8888
Tue Jul 29 15:01:38 2014 us=286772 MANAGEMENT: >STATE:1406638898,WAIT,,,
Tue Jul 29 15:01:38 2014 us=310765 MANAGEMENT: >STATE:1406638898,AUTH,,,
Tue Jul 29 15:01:38 2014 us=310765 TLS: Initial packet from [AF_INET]193.85.1.1:8888, sid=35cf47f7 909924d7
Tue Jul 29 15:01:38 2014 us=597679 VERIFY OK: depth=1, C=CZ, ST=PR, L=Prague, O=Miis, OU=me, CN=myvpn, name=Michal, emailAddress=me@me.cz
Tue Jul 29 15:01:38 2014 us=597679 VERIFY OK: nsCertType=SERVER
Tue Jul 29 15:01:38 2014 us=597679 VERIFY OK: depth=0, C=CZ, ST=PR, L=Prague, O=Miis, OU=me, CN=myvpn, name=Michal, emailAddress=me@me.cz
Tue Jul 29 15:01:38 2014 us=954572 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Jul 29 15:01:38 2014 us=954572 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jul 29 15:01:38 2014 us=954572 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Jul 29 15:01:38 2014 us=954572 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jul 29 15:01:38 2014 us=954572 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Tue Jul 29 15:01:38 2014 us=954572 [myvpn] Peer Connection Initiated with [AF_INET]193.85.1.1:8888
Tue Jul 29 15:01:40 2014 us=210195 MANAGEMENT: >STATE:1406638900,GET_CONFIG,,,
Tue Jul 29 15:01:41 2014 us=465818 SENT CONTROL [myvpn]: 'PUSH_REQUEST' (status=1)
Tue Jul 29 15:01:41 2014 us=512804 PUSH: Received control message: 'PUSH_REPLY,route 192.168.1.0 255.255.255.0,dhcp-option DNS 192.168.2.5,route-gateway 192.168.2.5,route 192.168.2.1,topology net30,ping 10,ping-restart 120,ifconfig 192.168.2.6 192.168.2.5'
Tue Jul 29 15:01:41 2014 us=512804 OPTIONS IMPORT: timers and/or timeouts modified
Tue Jul 29 15:01:41 2014 us=512804 OPTIONS IMPORT: --ifconfig/up options modified
Tue Jul 29 15:01:41 2014 us=512804 OPTIONS IMPORT: route options modified
Tue Jul 29 15:01:41 2014 us=512804 OPTIONS IMPORT: route-related options modified
Tue Jul 29 15:01:41 2014 us=512804 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Tue Jul 29 15:01:41 2014 us=514804 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Tue Jul 29 15:01:41 2014 us=514804 MANAGEMENT: >STATE:1406638901,ASSIGN_IP,,192.168.2.6,
Tue Jul 29 15:01:41 2014 us=514804 open_tun, tt->ipv6=0
Tue Jul 29 15:01:41 2014 us=515803 TAP-WIN32 device [OpenVPN] opened: \\.\Global\{D5195E66-8C34-4856-BAFF-077DAD8ABAD0}.tap
Tue Jul 29 15:01:41 2014 us=515803 TAP-Windows Driver Version 9.9
Tue Jul 29 15:01:41 2014 us=515803 TAP-Windows MTU=1500
Tue Jul 29 15:01:41 2014 us=516803 Notified TAP-Windows driver to set a DHCP IP/netmask of 192.168.2.6/255.255.255.252 on interface {D5195E66-8C34-4856-BAFF-077DAD8ABAD0} [DHCP-serv: 192.168.2.5, lease-time: 31536000]
Tue Jul 29 15:01:41 2014 us=516803 DHCP option string: 0604c0a8 0205
Tue Jul 29 15:01:41 2014 us=516803 Successful ARP Flush on interface [19] {D5195E66-8C34-4856-BAFF-077DAD8ABAD0}
Tue Jul 29 15:01:46 2014 us=21828 TEST ROUTES: 2/2 succeeded len=2 ret=1 a=0 u/d=up
Tue Jul 29 15:01:46 2014 us=21828 MANAGEMENT: >STATE:1406638906,ADD_ROUTES,,,
Tue Jul 29 15:01:46 2014 us=21828 C:\Windows\system32\route.exe ADD 192.168.1.0 MASK 255.255.255.0 192.168.2.5
Tue Jul 29 15:01:46 2014 us=22828 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Tue Jul 29 15:01:46 2014 us=22828 Route addition via IPAPI succeeded [adaptive]
Tue Jul 29 15:01:46 2014 us=22828 C:\Windows\system32\route.exe ADD 192.168.2.1 MASK 255.255.255.255 192.168.2.5
Tue Jul 29 15:01:46 2014 us=23828 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Tue Jul 29 15:01:46 2014 us=23828 Route addition via IPAPI succeeded [adaptive]
Tue Jul 29 15:01:46 2014 us=23828 Initialization Sequence Completed
Tue Jul 29 15:01:46 2014 us=23828 MANAGEMENT: >STATE:1406638906,CONNECTED,SUCCESS,192.168.2.6,193.85.1.1
Tue Jul 29 15:03:03 2014 us=971622 TCP/UDP: Closing socket
Tue Jul 29 15:03:03 2014 us=971622 C:\Windows\system32\route.exe DELETE 192.168.2.1 MASK 255.255.255.255 192.168.2.5
Tue Jul 29 15:03:03 2014 us=972622 Route deletion via IPAPI succeeded [adaptive]
Tue Jul 29 15:03:03 2014 us=972622 C:\Windows\system32\route.exe DELETE 192.168.1.0 MASK 255.255.255.0 192.168.2.5
Tue Jul 29 15:03:03 2014 us=973622 Route deletion via IPAPI succeeded [adaptive]
Tue Jul 29 15:03:03 2014 us=973622 Closing TUN/TAP interface
Tue Jul 29 15:03:03 2014 us=973622 SIGTERM[hard,] received, process exiting
Tue Jul 29 15:03:03 2014 us=973622 MANAGEMENT: >STATE:1406638983,EXITING,SIGTERM,,

miisch

From the client 192.168.2.6 I cannot ping the router 192.168.1.200, but I can ping computers behind the router (e.g. 192.168.1.100 and .101).
From 192.168.1.101 I can ping the router at 192.168.1.200.

miisch

Thank you debbie10t, but the pings results are without any change.

btw these are my firewall rules:
iptables -I INPUT -p udp --dport 8888 -j ACCEPT
iptables -A INPUT -i tun+ -j ACCEPT
iptables -I OUTPUT -o tun+ -j ACCEPT
iptables -I FORWARD -i tun+ -j ACCEPT
iptables -A FORWARD -i eth0 -o tun0 -j ACCEPT
iptables -A FORWARD -i tun0 -o eth0 -j ACCEPT
iptables -t nat -A POSTROUTING -s 192.168.2.0/24 -j MASQUERADE

miisch

hello debbie, unfortunately I dont think so: :-/
[!] -o, --out-interface name .... If this option is omitted, any interface name will match.

miisch

Sure, here it is (finally I want to use it on Android, but I have the same problem at windows client):

Ethernet adapter OpenVPN:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : TAP-Windows Adapter V9
Physical Address. . . . . . . . . : 00-FF-D5-19-5E-66
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::f9ae:74c9:b8b3:41dc%19(Preferred)
IPv4 Address. . . . . . . . . . . : 192.168.2.6(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.252
Lease Obtained. . . . . . . . . . : 4. srpna 2014 11:42:34
Lease Expires . . . . . . . . . . : 4. srpna 2015 11:42:34
Default Gateway . . . . . . . . . :
DHCP Server . . . . . . . . . . . : 192.168.2.5
DHCPv6 IAID . . . . . . . . . . . : 536936405
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-18-4F-AA-DC-78-2B-CB-AC-94-9E
DNS Servers . . . . . . . . . . . : fec0:0:0:ffff::1%1
fec0:0:0:ffff::2%1
fec0:0:0:ffff::3%1
NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter Local Area Connection:
IPv4 Address. . . . . . . . . . . : 10.4.161.183(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.254.0

miisch

after I removed ipv6:

Ethernet adapter OpenVPN:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : TAP-Windows Adapter V9
Physical Address. . . . . . . . . : 00-FF-D5-19-5E-66
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IPv4 Address. . . . . . . . . . . : 192.168.2.6(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.252
Lease Obtained. . . . . . . . . . : 4. srpna 2014 11:49:26
Lease Expires . . . . . . . . . . : 4. srpna 2015 11:49:26
Default Gateway . . . . . . . . . :
DHCP Server . . . . . . . . . . . : 192.168.2.5
NetBIOS over Tcpip. . . . . . . . : Enabled

maikcat

if your ddwrt DEFAULT rules are drop then your firewall drops icmp messages (ping)

can you for testing disable iptables?

Michael.

miisch

maikcat, great idea, thank you! I disabled SPI Firewal and ping did work, so it is because of firewall - by a chance don't you know what to set better there?

maikcat

by a chance don't you know what to set better there?

firewall rules are designed based on your security policy...

you must sit down and decide what you want to filter out or not.

This is entirely up to you i am afraid.....

Regards,

Michael.

maikcat

upon users request i unlocked the topic

btw i didnt closed it.

Michael.

miisch

I've played with the firewall settings and finally this configuration works.
I had to use -I at the INPUT/OUTPUT lines - I don't understand why, so if anybody can explain, I ll be happy to figure out.
Thank you guys, your comments helped me to move on with that!

iptables -I INPUT -p udp --dport 8888 -j ACCEPT
iptables -I OUTPUT -o tun+ -j ACCEPT
iptables -I INPUT -i tun+ -j ACCEPT
iptables -I FORWARD -i tun+ -j ACCEPT
iptables -I FORWARD -o tun+ -j ACCEPT
iptables -t nat -A POSTROUTING -s 192.168.2.0/24 -j MASQUERADE

Anyway there is still a problem that I cannot ping client from server (even directly from the router). Do you have any hint for that? I have already tried to google and try hard, but :-(. Disabling firewall does not help in this case, so it is probably routing problem, but there seems to be right rules from both sites...
Firewall is disabled on the client (Windows7).

Current server configuration (client is without changes):
proto udp
port 8888
dev tun
server 192.168.2.0 255.255.255.0
push "route 192.168.1.0 255.255.255.0"
keepalive 10 120
dh /tmp/openvpn/dh.pem
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem
management 127.0.0.1 5002

root@ASUS:~# route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default 192.168.235.129 0.0.0.0 UG 0 0 0 vlan2
127.0.0.0 * 255.0.0.0 U 0 0 0 lo
169.254.0.0 * 255.255.0.0 U 0 0 0 br0
192.168.1.0 * 255.255.255.0 U 0 0 0 br0
192.168.2.0 192.168.2.2 255.255.255.0 UG 0 0 0 tun0
192.168.2.2 * 255.255.255.255 UH 0 0 0 tun0
192.168.235.128 * 255.255.255.248 U 0 0 0 vlan2
root@ASUS:~# ping 192.168.2.6
PING 192.168.2.6 (192.168.2.6): 56 data bytes
^C
--- 192.168.2.6 ping statistics ---
14 packets transmitted, 0 packets received, 100% packet loss

root@ASUS:~# ifconfig
tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:192.168.2.1 P-t-P:192.168.2.2 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:382 errors:0 dropped:0 overruns:0 frame:0
TX packets:609 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:26528 (25.9 KiB) TX bytes:47328 (46.2 KiB)

and client route:
C:\>route print
===========================================================================
Interface List
19...00 ff d5 19 5e 66 ......TAP-Windows Adapter V9
===========================================================================
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 10.4.160.1 10.4.161.183 20
10.4.160.0 255.255.254.0 On-link 10.4.161.183 276
10.4.161.183 255.255.255.255 On-link 10.4.161.183 276
10.4.161.255 255.255.255.255 On-link 10.4.161.183 276
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
192.168.1.0 255.255.255.0 192.168.2.5 192.168.2.6 30
192.168.2.1 255.255.255.255 192.168.2.5 192.168.2.6 30
192.168.2.4 255.255.255.252 On-link 192.168.2.6 286
192.168.2.6 255.255.255.255 On-link 192.168.2.6 286
192.168.2.7 255.255.255.255 On-link 192.168.2.6 286
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 10.4.161.183 276
224.0.0.0 240.0.0.0 On-link 192.168.2.6 286
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 10.4.161.183 276
255.255.255.255 255.255.255.255 On-link 192.168.2.6 286
===========================================================================

maikcat

glad we have help you...

I had to use -I at the INPUT/OUTPUT lines - I don't understand why, so if anybody can explain,

from iptables man page

-I, --insert chain [rulenum] rule-specification
Insert one or more rules in the selected chain as the given rule number. So, if the rule num-
ber is 1, the rule or rules are inserted at the head of the chain.This is also the default
if no rule number is specified.

in firewalls rules are parsed sequentially,so first match is applied.

also you have to fully understand what input,output chain is and when is used.

Anyway there is still a problem that I cannot ping client from server (even directly from the router).

ping is using icmp messages (echo reply,echo request) so if you want to enable ping response you must
also allow it on your firewall.

hope that helps,

Michael.

miisch

Sure, I've read the man page and know difference between -A and -I, but because I add just allow rules, the order should not make any difference... so still mysterious :-/

About server to client ping: Even the firewall is disabled on both (client and server) server still cannot reach the client. Not even ping but any other way - web server, remote desktop...

maikcat

but because I add just allow rules, the order should not make any difference...

firewall rules checked SEQUENTIALLY, first match IS applied.

Even the firewall is disabled on both (client and server) server still cannot reach the client. Not even ping but any other way - web server, remote desktop...

dont get this one...

so with firewall down on both sides server cant reach the client,client can reach server?

Michael.

miisch

rules: exactly, but when you have just ACCEPT rules, order does not matter so it does not matter whether you INSERT or ADD them

so with firewall down on both sides server cant reach the client, client can reach server?

exactly :,(

maikcat

rules: exactly, but when you have just ACCEPT rules, order does not matter so it does not matter whether you INSERT or ADD them

from iptables point of view first match IS applied,
logicaly speaking yes you are right,if everything is accept (including the default) then the decision will be accept.

exactly :,(

if ping works one-way then its NOT routing problem,its firewalling...

either the outgoing requests from the client dropped,or the openvpn client doesnt accept them.

what OS your client has?

Michael.

miisch

Maikcat, you are completely right, I had client's firewall OFF just for Domain and Private networks, but ON for Public.
So now I'm all good and working - thank you very much, hopefully this discussion also help to somebody else.

maikcat

glad everything is sorted out..

Closing topic.

Michael.