bridge mode: can reach internet but not LAN peers

mcbrown

I swore to myself that I wouldn't need to ask for help... but I need to ask for help. 🙂

I want to configure my VPN such that the remote client will:
(a) have full access to my LAN (to access network drives and log in to local machines); and
(b) have the ability to route all internet traffic through the VPN (for safe browsing on insecure networks).

I started with a working routed VPN configuration and followed this guide to switch it to bridge mode: http://openvpn.net/index.php/open-source/documentation/miscellaneous/76-ethernet-bridging.html.

My LAN IP range is 192.168.1.x. The VPN server is at 192.168.1.19.

The remote client is able to connect to the VPN server. It receives an IP address on the local network (192.168.1.x). It can ping 192.168.1.19. It can ping the outside world (e.g. http://www.google.com) through the VPN. It cannot, however, ping anything else on the local network.

server.conf (on Raspberry Pi running raspbian):

port 1194
proto udp
dev tap0
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/keyserver.crt
key /etc/openvpn/easy-rsa/keys/keyserver.key
dh /etc/openvpn/easy-rsa/keys/dh2048.pem
ifconfig-pool-persist ipp.txt
server-bridge 192.168.1.19 255.255.255.0 192.168.1.240 192.168.1.254
push "route 192.168.1.0 255.255.255.0"
push "dhcp-option DNS 192.168.1.1"
push "dhcp-option WINS 192.168.1.1"
keepalive 10 120
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
cipher AES-256-CBC
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn-status.log 20
log /var/log/openvpn.log
verb 5
mute 10

client.conf (for Windows client; Mac client with identical configuration behaves the same):

client
dev tap0
proto udp
remote X.X.X.X 1194
resolv-retry infinite
nobind
persist-key
persist-tun
mute-replay-warnings
ns-cert-type server
key-direction 1
cipher AES-256-CBC
comp-lzo
verb 1
mute 20

I am omitting log files since I'm not having a connectivity problem.

Are there any other files that would be helpful in diagnosing the issue?

Thanks in advance!

mcbrown

debbie10t wrote
mcbrown wroteServer Config:
server-bridge 192.168.1.19 255.255.255.0 192.168.1.240 192.168.1.254
This may be incorrect.

Good catch - the gateway is in fact 192.168.1.1. But that is not the source of the problem - I have tried it both ways and just left the server.conf file in the wrong state before posting here.

To be 100% sure this isn't the problem I changed this line just now to:

server-bridge 192.168.1.1 255.255.255.0 192.168.1.240 192.168.1.254

I restarted the server and reconnected the remote client. The results are the same: I can reach the VPN server but nothing else on the local network.

mcbrown

debbie10t wroteIs IP Forwarding enabled ?

Yes:

/etc/openvpn $ cat /proc/sys/net/ipv4/ip_forward
1

mcbrown

Server log from last connection:

Mon Jul 28 15:12:28 2014 us=235469 Current Parameter Settings:
Mon Jul 28 15:12:28 2014 us=236354   config = '/etc/openvpn/server.conf'
Mon Jul 28 15:12:28 2014 us=236553   mode = 1
Mon Jul 28 15:12:28 2014 us=236744   persist_config = DISABLED
Mon Jul 28 15:12:28 2014 us=236915   persist_mode = 1
Mon Jul 28 15:12:28 2014 us=237075   show_ciphers = DISABLED
Mon Jul 28 15:12:28 2014 us=237238   show_digests = DISABLED
Mon Jul 28 15:12:28 2014 us=237574   show_engines = DISABLED
Mon Jul 28 15:12:28 2014 us=237744   genkey = DISABLED
Mon Jul 28 15:12:28 2014 us=237902   key_pass_file = '[UNDEF]'
Mon Jul 28 15:12:28 2014 us=238058 NOTE: --mute triggered...
Mon Jul 28 15:12:28 2014 us=238332 269 variation(s) on previous 10 message(s) suppressed by --mute
Mon Jul 28 15:12:28 2014 us=238515 OpenVPN 2.2.1 arm-linux-gnueabihf [SSL] [LZO2] [EPOLL] [PKCS11] [
eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Oct 12 2013
Mon Jul 28 15:12:28 2014 us=239784 NOTE: when bridging your LAN adapter with the TAP adapter, note t
hat the new bridge adapter will often take on its own IP address that is different from what the LAN
 adapter was previously set to
Mon Jul 28 15:12:28 2014 us=240658 NOTE: your local LAN uses the extremely common subnet address 192
.168.0.x or 192.168.1.x.  Be aware that this might create routing conflicts if you connect to the VP
N server from public locations such as internet cafes that use the same subnet.
Mon Jul 28 15:12:28 2014 us=240890 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to cal
l user-defined scripts or executables
Mon Jul 28 15:12:28 2014 us=508016 Diffie-Hellman initialized with 2048 bit key
Mon Jul 28 15:12:28 2014 us=522399 Control Channel Authentication: using '/etc/openvpn/easy-rsa/keys
/ta.key' as a OpenVPN static key file
Mon Jul 28 15:12:28 2014 us=522807 Outgoing Control Channel Authentication: Using 160 bit message ha
sh 'SHA1' for HMAC authentication
Mon Jul 28 15:12:28 2014 us=523037 Incoming Control Channel Authentication: Using 160 bit message ha
sh 'SHA1' for HMAC authentication
Mon Jul 28 15:12:28 2014 us=523315 TLS-Auth MTU parms [ L:1590 D:166 EF:66 EB:0 ET:0 EL:0 ]
Mon Jul 28 15:12:28 2014 us=523684 Socket Buffers: R=[163840->131072] S=[163840->131072]
Mon Jul 28 15:12:28 2014 us=524976 TUN/TAP device tap0 opened
Mon Jul 28 15:12:28 2014 us=525297 TUN/TAP TX queue length set to 100
Mon Jul 28 15:12:28 2014 us=525682 Data Channel MTU parms [ L:1590 D:1450 EF:58 EB:135 ET:32 EL:0 AF
:3/1 ]
Mon Jul 28 15:12:28 2014 us=537992 GID set to nogroup
Mon Jul 28 15:12:28 2014 us=538616 UID set to nobody
Mon Jul 28 15:12:28 2014 us=538958 UDPv4 link local (bound): [undef]
Mon Jul 28 15:12:28 2014 us=539146 UDPv4 link remote: [undef]
Mon Jul 28 15:12:28 2014 us=539368 MULTI: multi_init called, r=256 v=256
Mon Jul 28 15:12:28 2014 us=540407 IFCONFIG POOL: base=192.168.1.240 size=15, ipv6=0
Mon Jul 28 15:12:28 2014 us=540644 ifconfig_pool_read(), in='Client1,192.168.1.240', TODO: IPv6
Mon Jul 28 15:12:28 2014 us=540975 succeeded -> ifconfig_pool_set()
Mon Jul 28 15:12:28 2014 us=541155 ifconfig_pool_read(), in='Client2,192.168.1.241', TODO: IPv
6
Mon Jul 28 15:12:28 2014 us=541327 succeeded -> ifconfig_pool_set()
Mon Jul 28 15:12:28 2014 us=541505 IFCONFIG POOL LIST
Mon Jul 28 15:12:28 2014 us=541689 Client1,192.168.1.240
Mon Jul 28 15:12:28 2014 us=541859 Client2,192.168.1.241
Mon Jul 28 15:12:28 2014 us=542317 Initialization Sequence Completed
Mon Jul 28 15:12:37 2014 us=501535 MULTI: multi_create_instance called
Mon Jul 28 15:12:37 2014 us=502145 X.X.X.X:7478 Re-using SSL/TLS context
Mon Jul 28 15:12:37 2014 us=502592 X.X.X.X:7478 LZO compression initialized
Mon Jul 28 15:12:37 2014 us=504517 X.X.X.X:7478 Control Channel MTU parms [ L:1590 D:166 EF:66
 EB:0 ET:0 EL:0 ]
Mon Jul 28 15:12:37 2014 us=504784 X.X.X.X:7478 Data Channel MTU parms [ L:1590 D:1450 EF:58 E
B:135 ET:32 EL:0 AF:3/1 ]
Mon Jul 28 15:12:37 2014 us=505207 X.X.X.X:7478 Local Options String: 'V4,dev-type tap,link-mt
u 1590,tun-mtu 1532,proto UDPv4,comp-lzo,keydir 0,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,
key-method 2,tls-server'
Mon Jul 28 15:12:37 2014 us=505492 X.X.X.X:7478 Expected Remote Options String: 'V4,dev-type t
ap,link-mtu 1590,tun-mtu 1532,proto UDPv4,comp-lzo,keydir 1,cipher AES-256-CBC,auth SHA1,keysize 256
,tls-auth,key-method 2,tls-client'
Mon Jul 28 15:12:37 2014 us=506003 X.X.X.X:7478 Local Options hash (VER=V4): '44bd8b5e'
Mon Jul 28 15:12:37 2014 us=506272 X.X.X.X:7478 Expected Remote Options hash (VER=V4): '485275
33'
RMon Jul 28 15:12:37 2014 us=506921 X.X.X.X:7478 TLS: Initial packet from [AF_INET]Y.Y.Y.Y:7478, sid=cc7313c6 c3f8bd98
WRRWWWWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRRRRWRWRWRWRWRWRWRWRWRWRWRWRW
RWRWRWRWRWRWRWRWRWRWRWRMon Jul 28 15:12:38 2014 us=151020 X.X.X.X:7478 VERIFY OK: depth=1, /C=
**/ST=**/L=***/O=***/OU=***/CN=***/name=***/emailAddress=BLAH@FAKEMAIL.com
Mon Jul 28 15:12:38 2014 us=155288 X.X.X.X:7478 VERIFY OK: depth=0, /C=**/ST=**/L=***/O=***/OU=***/CN=***/name=***/emailAddress=BLAH@FAKEMAIL.com
WRWRWRWRWRWRWWWWRWRWRWRWRWRWRWRWRWRWRWRWRRRRWRWRWRWRMon Jul 28 15:12:38 2014 us=514868 X.X.X.X:7478 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Mon Jul 28 15:12:38 2014 us=515179 X.X.X.X:7478 Data Channel Encrypt: Using 160 bit message ha
sh 'SHA1' for HMAC authentication
Mon Jul 28 15:12:38 2014 us=515379 X.X.X.X:7478 Data Channel Decrypt: Cipher 'AES-256-CBC' ini
tialized with 256 bit key
Mon Jul 28 15:12:38 2014 us=515589 X.X.X.X:7478 Data Channel Decrypt: Using 160 bit message ha
sh 'SHA1' for HMAC authentication
WWWRRRMon Jul 28 15:12:38 2014 us=531308 X.X.X.X:7478 Control Channel: TLSv1, cipher TLSv1/SSL
v3 DHE-RSA-AES256-SHA, 2048 bit RSA
Mon Jul 28 15:12:38 2014 us=531683 X.X.X.X:7478 [Client1] Peer Connection Initiated with [AF_I
NET]X.X.X.X:7478
Mon Jul 28 15:12:38 2014 us=532164 Client1/X.X.X.X:7478 MULTI_sva: pool returned IPv4=192.168.
1.240, IPv6=bccd:800:8ced:200:14c2:700:f4ac:4c01
WRMon Jul 28 15:12:40 2014 us=682440 Client1/X.X.X.X:7478 PUSH: Received control message: 'PUS
H_REQUEST'
Mon Jul 28 15:12:40 2014 us=682703 Client1/X.X.X.X:7478 send_push_reply(): safe_cap=960
Mon Jul 28 15:12:40 2014 us=683259 Client1/X.X.X.X:7478 SENT CONTROL [Client1]: 'PUSH_REPLY,ro
ute 192.168.1.0 255.255.255.0,dhcp-option DNS 192.168.1.1,dhcp-option WINS 192.168.1.1,route-gateway
 192.168.1.1,ping 10,ping-restart 120,ifconfig 192.168.1.240 255.255.255.0' (status=1)
WWWWRRRRMon Jul 28 15:12:40 2014 us=742529 Client1/X.X.X.X:7478 MULTI: Learn: 00:ff:97:74:a4:5
6 -> Client1/X.X.X.X:7478
wRwRwRwRwRwRwRwRwRwrWRwRwWRwrWRwRwRwrWrWrWRwRwRwrWRwrWRwRwRwRwRwRwRwRwRwRwRwRwWRwRwRwRwRwRwRwRwRwRwR
wRwRwRwRwRwrWRwRwRwRwRwRwRwRwRwRwRwRwRwRwrWRwRwRwRwWRwRwRwRwRwRwRwRwRwRwRwrWRwRwRwRwRwRwRwRwRwRwRwRw
RwRwRwRwRwRwRwRwWRwRwrWRwRwRwRwRwRwRwRwRwRwRwRwrWRwRwRwRwRwRwRwRwRwRwRwRwRwRwRwRwRwRwWRwRwRwRwRwRwRw
RwrWRwRwRwRwRwRwrWRwRwRwRwRwWRwRwrWRwrWRwRwRwRwRwRwRwRwRwRwRwRwRwRwRwWRwrWRwRwRwRwRwRwRwrWRwRwRwRwRw
RwRwRwRwRwRwRwRwRwWRwRwRwrWRwRwRwRwRwRwRwRwRwRwRwRwrWRwRwRwRwRwRwRwRwRwRwRwRwRwRwRwrWWRwRwRwRwRwrWRw
rWRwrWRwRwRwRwRwrWRwRwRwRwRwRwRwrWRwRwRwrWRwWRwRwrWRwRwRwRwrWRwRwrWRwRwRwRwRwRwWRwRwrWRwRwRwrWRwRwRw
RwWRwrWRwRwRwRwrWWRwrWRwRwRwRwRwrWRwRwRwWRwRwRwrWRwRwRwRwRwrWRwRwWRwRwRwRwRwRwWRwRwRwRwRwRwWRwRwRwRw
RwRwrWRwrWRwrWRwRwrWrWRwRwRwRwRwWRwRwRwrWRwrWRwRwRwWRwRwRwWRwRwRwRwRwRwRwRwRwWRwRwRwRwRwrWWRwrWRwWRw
rWWRwrWRwRwRwrWRwWRwRwrWRwrWRwrWRwrWRwrWRwRwrWRwRwRwRwRwRwrWrWRwRwrWRwRwWRwRwRwRwRwrWRwRwrWWRwRwRwrW
RwRwRwRwWRwRwRwRwRwWRwRwRwrWRwrWRwRwWRwRwRwWRwRwRwWRwRwWRwRwrWRwrWRwrWRwrWWRwWWWWRwrWRwrWWWWWWRWRwRw
rWrWRwrWRwrWRwrWWRwrWWRwrWRwWRwRwRwWWWWRwRwWRwWWWWWRWWWWWRWRwrWRwrWRwRwrWRwrWWRwrWRwrWWRwrWRwrWRwRwW
RwRwWWRwrWWRwrWRwrWWWWRwrWWRwrWWRwrWWWWRwRwrWWRwrWRwrWWWRwrWRwrWWRwrWWRwrWWRwrWWWWRwrWWRwrWRwrWWRwrW
rWRwWWWWWRWWWRwrWWRwrWWRwrWRwWRwRwWWWWWRWWWWWRWWWRwrWRwrWRwrWRwrWWWWRwrWrWRwWWWWWRWWWRwrWWRwrWWRwrWW
WWRwrWWRwrWRwrWWWWRwrWWRwrWWRwrWRwRwRwRwWRwRwRwRwWRwRwrWrWRwrWRwrWRwrWWRwrWRwRwRwRwWRwrWRwrWrWRwWRwr
WWWRwrWWRwrWWRwrWWWWRwrWWRwrWRwrWWWWWWRWWWWWRWWWWWRWWWWWRWWWWWRWWWWWRWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW
WWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWMon Jul 28 
15:22:32 2014 us=840152 Client1/X.X.X.X:7478 [Client1] Inactivity timeout (--ping-restart), re
starting
Mon Jul 28 15:22:32 2014 us=840531 Client1/X.X.X.X:7478 SIGUSR1[soft,ping-restart] received, c
lient-instance restarting

Client log will have to come later...

Thanks for your help!

mcbrown

Server and client logs from a fresh connection this morning:

Server:

Tue Jul 29 07:57:31 2014 us=514826 Current Parameter Settings:
Tue Jul 29 07:57:31 2014 us=515685   config = '/etc/openvpn/server.conf'
Tue Jul 29 07:57:31 2014 us=515884   mode = 1
Tue Jul 29 07:57:31 2014 us=516076   persist_config = DISABLED
Tue Jul 29 07:57:31 2014 us=516246   persist_mode = 1
Tue Jul 29 07:57:31 2014 us=516410   show_ciphers = DISABLED
Tue Jul 29 07:57:31 2014 us=516569   show_digests = DISABLED
Tue Jul 29 07:57:31 2014 us=516727   show_engines = DISABLED
Tue Jul 29 07:57:31 2014 us=516886   genkey = DISABLED
Tue Jul 29 07:57:31 2014 us=517047   key_pass_file = '[UNDEF]'
Tue Jul 29 07:57:31 2014 us=517205 NOTE: --mute triggered...
Tue Jul 29 07:57:31 2014 us=517608 269 variation(s) on previous 10 message(s) suppressed by --mute
Tue Jul 29 07:57:31 2014 us=517798 OpenVPN 2.2.1 arm-linux-gnueabihf [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Oct 12 2013
Tue Jul 29 07:57:31 2014 us=519039 NOTE: when bridging your LAN adapter with the TAP adapter, note that the new bridge adapter will often take on its own IP address that is different from what the LAN adapter was previously set to
Tue Jul 29 07:57:31 2014 us=519903 NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x.  Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
Tue Jul 29 07:57:31 2014 us=520128 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Tue Jul 29 07:57:31 2014 us=788307 Diffie-Hellman initialized with 2048 bit key
Tue Jul 29 07:57:31 2014 us=802459 Control Channel Authentication: using '/etc/openvpn/easy-rsa/keys/ta.key' as a OpenVPN static key file
Tue Jul 29 07:57:31 2014 us=802868 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jul 29 07:57:31 2014 us=803095 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jul 29 07:57:31 2014 us=803368 TLS-Auth MTU parms [ L:1590 D:166 EF:66 EB:0ET:0 EL:0 ]
Tue Jul 29 07:57:31 2014 us=803733 Socket Buffers: R=[163840->131072] S=[163840>131072]
Tue Jul 29 07:57:31 2014 us=805012 TUN/TAP device tap0 opened
Tue Jul 29 07:57:31 2014 us=805322 TUN/TAP TX queue length set to 100
Tue Jul 29 07:57:31 2014 us=805695 Data Channel MTU parms [ L:1590 D:1450 EF:58EB:135 ET:32 EL:0 AF:3/1 ]
Tue Jul 29 07:57:31 2014 us=818136 GID set to nogroup
Tue Jul 29 07:57:31 2014 us=818765 UID set to nobody
Tue Jul 29 07:57:31 2014 us=819104 UDPv4 link local (bound): [undef]
Tue Jul 29 07:57:31 2014 us=819284 UDPv4 link remote: [undef]
Tue Jul 29 07:57:31 2014 us=819503 MULTI: multi_init called, r=256 v=256
Tue Jul 29 07:57:31 2014 us=820527 IFCONFIG POOL: base=192.168.1.240 size=15, ipv6=0
Tue Jul 29 07:57:31 2014 us=820760 ifconfig_pool_read(), in='Client1,192.168.1.240', TODO: IPv6
Tue Jul 29 07:57:31 2014 us=821094 succeeded -> ifconfig_pool_set()
Tue Jul 29 07:57:31 2014 us=821271 ifconfig_pool_read(), in='Client2,192.1
68.1.241', TODO: IPv6
Tue Jul 29 07:57:31 2014 us=821449 succeeded -> ifconfig_pool_set()
Tue Jul 29 07:57:31 2014 us=821627 IFCONFIG POOL LIST
Tue Jul 29 07:57:31 2014 us=821803 Client1,192.168.1.240
Tue Jul 29 07:57:31 2014 us=821976 Client2,192.168.1.241
Tue Jul 29 07:57:31 2014 us=822440 Initialization Sequence Completed
Tue Jul 29 07:57:46 2014 us=632788 MULTI: multi_create_instance called
Tue Jul 29 07:57:46 2014 us=633391 38.96.165.241:55907 Re-using SSL/TLS context
Tue Jul 29 07:57:46 2014 us=633850 38.96.165.241:55907 LZO compression initialized
Tue Jul 29 07:57:46 2014 us=635843 38.96.165.241:55907 Control Channel MTU parms [ L:1590 D:166 EF:66 EB:0 ET:0 EL:0 ]
Tue Jul 29 07:57:46 2014 us=636110 38.96.165.241:55907 Data Channel MTU parms [L:1590 D:1450 EF:58 EB:135 ET:32 EL:0 AF:3/1 ]
Tue Jul 29 07:57:46 2014 us=636531 38.96.165.241:55907 Local Options String: 'V4,dev-type tap,link-mtu 1590,tun-mtu 1532,proto UDPv4,comp-lzo,keydir 0,cipher AE
S-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-server'
Tue Jul 29 07:57:46 2014 us=636803 38.96.165.241:55907 Expected Remote Options String: 'V4,dev-type tap,link-mtu 1590,tun-mtu 1532,proto UDPv4,comp-lzo,keydir 1
,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client'
Tue Jul 29 07:57:46 2014 us=637208 38.96.165.241:55907 Local Options hash (VER=V4): '44bd8b5e'
Tue Jul 29 07:57:46 2014 us=637591 38.96.165.241:55907 Expected Remote Options hash (VER=V4): '48527533'
Tue Jul 29 07:57:46 2014 us=638130 38.96.165.241:55907 TLS: Initial packet from[AF_INET]38.96.165.241:55907, sid=f37a8dfd 60f1ab23
Tue Jul 29 07:57:47 2014 us=263410 38.96.165.241:55907 VERIFY OK: depth=1, /C=US/ST=NY/L=NewYork/O=***/OU=changeme/CN=changeme/name=changeme/emailAddress=BLAH@FAKEMAIL.com
Tue Jul 29 07:57:47 2014 us=267767 38.96.165.241:55907 VERIFY OK: depth=0, /C=US/ST=NY/L=NewYork/O=***/OU=changeme/CN=Client1/name=changeme/emailAddress=BLAH@FAKEMAIL.com
Tue Jul 29 07:57:47 2014 us=616281 38.96.165.241:55907 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Tue Jul 29 07:57:47 2014 us=616611 38.96.165.241:55907 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jul 29 07:57:47 2014 us=616814 38.96.165.241:55907 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Tue Jul 29 07:57:47 2014 us=617017 38.96.165.241:55907 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jul 29 07:57:47 2014 us=633392 38.96.165.241:55907 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Tue Jul 29 07:57:47 2014 us=633806 38.96.165.241:55907 [Client1] Peer Connection Initiated with [AF_INET]38.96.165.241:55907
Tue Jul 29 07:57:47 2014 us=634272 Client1/38.96.165.241:55907 MULTI_sva: pool returned IPv4=192.168.1.240, IPv6=bccd:800:8ced:200:14c2:700:f4ac:e100
Tue Jul 29 07:57:50 2014 us=315627 Client1/38.96.165.241:55907 PUSH: Received control message: 'PUSH_REQUEST'
Tue Jul 29 07:57:50 2014 us=315934 Client1/38.96.165.241:55907 send_push_reply(): safe_cap=960
Tue Jul 29 07:57:50 2014 us=316477 Client1/38.96.165.241:55907 SENT CONTROL [Client1]: 'PUSH_REPLY,route 192.168.1.0 255.255.255.0,dhcp-option DNS 192.168.1.1,d
hcp-option WINS 192.168.1.1,route-gateway 192.168.1.1,ping 10,ping-restart 120,ifconfig 192.168.1.240 255.255.255.0' (status=1)
Tue Jul 29 07:57:50 2014 us=385185 Client1/38.96.165.241:55907 MULTI: Learn: 00:ff:97:74:a4:56 -> Client1/38.96.165.241:55907

Client:

Tue Jul 29 07:57:41 2014 us=209000 Note: option http-proxy-fallback ignored because no TCP-based connection profiles are defined
Tue Jul 29 07:57:41 2014 us=209000 Current Parameter Settings:
Tue Jul 29 07:57:41 2014 us=209000   config = 'stdin'
Tue Jul 29 07:57:41 2014 us=209000   mode = 0
Tue Jul 29 07:57:41 2014 us=209000   show_ciphers = DISABLED
Tue Jul 29 07:57:41 2014 us=209000   show_digests = DISABLED
Tue Jul 29 07:57:41 2014 us=209000   show_engines = DISABLED
Tue Jul 29 07:57:41 2014 us=209000   genkey = DISABLED
Tue Jul 29 07:57:41 2014 us=209000   key_pass_file = '[UNDEF]'
Tue Jul 29 07:57:41 2014 us=209000   show_tls_ciphers = DISABLED
Tue Jul 29 07:57:41 2014 us=209000 Connection profiles [default]:
Tue Jul 29 07:57:41 2014 us=209000   proto = udp
Tue Jul 29 07:57:41 2014 us=209000   local = '[UNDEF]'
Tue Jul 29 07:57:41 2014 us=209000   local_port = 1194
Tue Jul 29 07:57:41 2014 us=209000   remote = '[UNDEF]'
Tue Jul 29 07:57:41 2014 us=209000   remote_port = 1194
Tue Jul 29 07:57:41 2014 us=209000   remote_float = DISABLED
Tue Jul 29 07:57:41 2014 us=209000   bind_defined = DISABLED
Tue Jul 29 07:57:41 2014 us=209000   bind_local = DISABLED
Tue Jul 29 07:57:41 2014 us=209000   connect_retry_seconds = 5
Tue Jul 29 07:57:41 2014 us=209000   connect_timeout = 10
Tue Jul 29 07:57:41 2014 us=209000 NOTE: --mute triggered...
Tue Jul 29 07:57:41 2014 us=209000 182 variation(s) on previous 20 message(s) suppressed by --mute
Tue Jul 29 07:57:41 2014 us=209000 OpenVPNAS 2.1.1oOAS Win32-MSVC++ [SSL] [LZO2] built on Jul 29 2010
Tue Jul 29 07:57:41 2014 us=209000 MANAGEMENT: Connected to management server at 127.0.0.1:46586
Tue Jul 29 07:57:41 2014 us=209000 MANAGEMENT: CMD 'log on'
Tue Jul 29 07:57:41 2014 us=209000 MANAGEMENT: CMD 'state on'
Tue Jul 29 07:57:41 2014 us=209000 MANAGEMENT: CMD 'echo on'
Tue Jul 29 07:57:41 2014 us=209000 MANAGEMENT: CMD 'bytecount 5'
Tue Jul 29 07:57:41 2014 us=209000 MANAGEMENT: CMD 'hold off'
Tue Jul 29 07:57:41 2014 us=209000 MANAGEMENT: CMD 'hold release'
Tue Jul 29 07:57:41 2014 us=209000 NOTE: OpenVPNAS 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Tue Jul 29 07:57:45 2014 us=952000 MANAGEMENT: CMD 'password [...]'
Tue Jul 29 07:57:45 2014 us=967000 Control Channel Authentication: tls-auth using INLINE static key file
Tue Jul 29 07:57:45 2014 us=967000 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jul 29 07:57:45 2014 us=967000 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jul 29 07:57:45 2014 us=967000 LZO compression initialized
Tue Jul 29 07:57:45 2014 us=967000 Control Channel MTU parms [ L:1590 D:166 EF:66 EB:0 ET:0 EL:0 ]
Tue Jul 29 07:57:45 2014 us=967000 Socket Buffers: R=[8192->8192] S=[64512->64512]
Tue Jul 29 07:57:45 2014 us=967000 MANAGEMENT: >STATE:1406635065,RESOLVE,,,
Tue Jul 29 07:57:46 2014 us=45000 Data Channel MTU parms [ L:1590 D:1450 EF:58 EB:135 ET:32 EL:0 AF:3/1 ]
Tue Jul 29 07:57:46 2014 us=45000 Local Options String: 'V4,dev-type tap,link-mtu 1590,tun-mtu 1532,proto UDPv4,comp-lzo,keydir 1,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client'
Tue Jul 29 07:57:46 2014 us=45000 Expected Remote Options String: 'V4,dev-type tap,link-mtu 1590,tun-mtu 1532,proto UDPv4,comp-lzo,keydir 0,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-server'
Tue Jul 29 07:57:46 2014 us=45000 Local Options hash (VER=V4): '48527533'
Tue Jul 29 07:57:46 2014 us=45000 Expected Remote Options hash (VER=V4): '44bd8b5e'
Tue Jul 29 07:57:46 2014 us=45000 UDPv4 link local: [undef]
Tue Jul 29 07:57:46 2014 us=45000 UDPv4 link remote: #.#.#.#:1194
Tue Jul 29 07:57:46 2014 us=45000 MANAGEMENT: >STATE:1406635066,WAIT,,,
Tue Jul 29 07:57:46 2014 us=61000 MANAGEMENT: >STATE:1406635066,AUTH,,,
Tue Jul 29 07:57:46 2014 us=61000 TLS: Initial packet from #.#.#.#:1194, sid=6be2fb35 4ed383d4
Tue Jul 29 07:57:46 2014 us=529000 VERIFY OK: depth=1, /C=US/ST=NY/L=NewYork/O=***/OU=changeme/CN=changeme/name=changeme/emailAddress=BLAH@FAKEMAIL.com
Tue Jul 29 07:57:46 2014 us=529000 VERIFY OK: nsCertType=SERVER
Tue Jul 29 07:57:46 2014 us=529000 VERIFY OK: depth=0, /C=US/ST=NY/L=NewYork/O=***/OU=changeme/CN=keyserver/name=changeme/emailAddress=BLAH@FAKEMAIL.com
Tue Jul 29 07:57:47 2014 us=44000 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Tue Jul 29 07:57:47 2014 us=44000 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jul 29 07:57:47 2014 us=44000 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Tue Jul 29 07:57:47 2014 us=44000 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jul 29 07:57:47 2014 us=44000 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Tue Jul 29 07:57:47 2014 us=44000 [keyserver] Peer Connection Initiated with #.#.#.#:1194
Tue Jul 29 07:57:48 2014 us=307000 MANAGEMENT: >STATE:1406635068,GET_CONFIG,,,
Tue Jul 29 07:57:49 2014 us=727000 SENT CONTROL [keyserver]: 'PUSH_REQUEST' (status=1)
Tue Jul 29 07:57:49 2014 us=742000 PUSH: Received control message: 'PUSH_REPLY,route 192.168.1.0 255.255.255.0,dhcp-option DNS 192.168.1.1,dhcp-option WINS 192.168.1.1,route-gateway 192.168.1.1,ping 10,ping-restart 120,ifconfig 192.168.1.240 255.255.255.0'
Tue Jul 29 07:57:49 2014 us=742000 OPTIONS IMPORT: timers and/or timeouts modified
Tue Jul 29 07:57:49 2014 us=742000 OPTIONS IMPORT: --ifconfig/up options modified
Tue Jul 29 07:57:49 2014 us=742000 OPTIONS IMPORT: route options modified
Tue Jul 29 07:57:49 2014 us=742000 OPTIONS IMPORT: route-related options modified
Tue Jul 29 07:57:49 2014 us=742000 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Tue Jul 29 07:57:49 2014 us=758000 ROUTE default_gateway=10.3.11.250
Tue Jul 29 07:57:49 2014 us=758000 MANAGEMENT: >STATE:1406635069,ASSIGN_IP,,192.168.1.240,
Tue Jul 29 07:57:49 2014 us=758000 TAP-WIN32 device [Local Area Connection 3] opened: \\.\Global\{9774A456-5AB7-495B-9B3F-B3FEA8CB5059}.tap
Tue Jul 29 07:57:49 2014 us=758000 TAP-Win32 Driver Version 9.7 
Tue Jul 29 07:57:49 2014 us=758000 TAP-Win32 MTU=1500
Tue Jul 29 07:57:49 2014 us=758000 Notified TAP-Win32 driver to set a DHCP IP/netmask of 192.168.1.240/255.255.255.0 on interface {9774A456-5AB7-495B-9B3F-B3FEA8CB5059} [DHCP-serv: 192.168.1.0, lease-time: 31536000]
Tue Jul 29 07:57:49 2014 us=758000 DHCP option string: 0604c0a8 01012c04 c0a80101
Tue Jul 29 07:57:49 2014 us=758000 Successful ARP Flush on interface [17] {9774A456-5AB7-495B-9B3F-B3FEA8CB5059}
Tue Jul 29 07:57:54 2014 us=220000 TEST ROUTES: 1/1 succeeded len=1 ret=1 a=0 u/d=up
Tue Jul 29 07:57:54 2014 us=220000 MANAGEMENT: >STATE:1406635074,ADD_ROUTES,,,
Tue Jul 29 07:57:54 2014 us=220000 C:\Windows\system32\route.exe ADD 192.168.1.0 MASK 255.255.255.0 192.168.1.1
Tue Jul 29 07:57:54 2014 us=220000 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Tue Jul 29 07:57:54 2014 us=220000 Route addition via IPAPI succeeded [adaptive]
Tue Jul 29 07:57:54 2014 us=220000 Initialization Sequence Completed
Tue Jul 29 07:57:54 2014 us=220000 MANAGEMENT: >STATE:1406635074,CONNECTED,SUCCESS,192.168.1.240,#.#.#.#

Waiting on a timeout to check the log entries for that, but in the meantime the ping test fails even before there has been a timeout.

debbie10t wrote What real IP address does your client have ?

38.96.165.241

debbie10t wrote One last thing, it may be worth you changing your LAN address from 192.168.1.0/24 as this is one of the most common subnets in use and will definitely cause you problems with remote access in the future.

Next on the to-do list after I get this working... it is not interfering at the moment (client's local subnet is 10.3.11.X).

mcbrown

debbie10t wroteHere is why we ask for logs:

Server log:
OpenVPN 2.2.1 arm-linux-gnueabihf [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Oct 12 2013
I strongly recommend you get this up to date.

Wow, great catch. I see now that trying to run this on a Raspberry Pi is screwing me over a bit... I install updates at least weekly, but after some research I see that the Raspbian policy is to NOT push out updates of non-broken versions.

[edit: this appears to be a Debian policy, not a difference between Raspbian and Debian...]

Ok, I will tackle this and come back.

debbie10t wroteThis is the Access Server Client .. which is not Open source software.

For the purpose of fixing this you will have to use OpenVPN Community Edition v234 on your client as well.

Well now I just feel silly. Thanks for the catch.

mcbrown

I updated the server to 2.3.2 (the latest "test" package available through Raspbian) and the Windows client to the latest Community Edition version.

Something has changed - it is now failing more severely, but this feels like progress (I'm assuming the version issue you noticed was obfuscating my configuration problems).

On the Windows client, the connection fails (can't ping the VPN server) though the server sees the connection; there is probably a Windows firewall issue I need to fix.

On the Mac client, I can connect to the VPN, ping the VPN server, and ping 8.8.8.8, but I can't ping google.com. You can see from the Mac client log that it fails to get IP info from the VPN, and obviously it isn't forwarding DNS queries to my router (192.168.1.1), or perhaps isn't forwarding the replies back. Pings are getting to the outside world, but the following line from the Mac log makes me suspicious that they are coming from outside the VPN:

2014-07-29 13:39:24 us=950128 ROUTE default_gateway=192.168.15.200

Anyway, the issues seem to be revealing themselves, but I am beyond my depth to interpret them properly. Thank you for your continued help and patience...

Server log:

Tue Jul 29 13:23:33 2014 us=677021 Current Parameter Settings:
Tue Jul 29 13:23:33 2014 us=677757   config = '/etc/openvpn/server.conf'
Tue Jul 29 13:23:33 2014 us=677955   mode = 1
Tue Jul 29 13:23:33 2014 us=678133   persist_config = DISABLED
Tue Jul 29 13:23:33 2014 us=678304   persist_mode = 1
Tue Jul 29 13:23:33 2014 us=678472   show_ciphers = DISABLED
Tue Jul 29 13:23:33 2014 us=678642   show_digests = DISABLED
Tue Jul 29 13:23:33 2014 us=678812   show_engines = DISABLED
Tue Jul 29 13:23:33 2014 us=679091   genkey = DISABLED
Tue Jul 29 13:23:33 2014 us=679274   key_pass_file = '[UNDEF]'
Tue Jul 29 13:23:33 2014 us=679448 NOTE: --mute triggered...
Tue Jul 29 13:23:33 2014 us=679735 271 variation(s) on previous 10 message(s) suppressed by --mute
Tue Jul 29 13:23:33 2014 us=679924 OpenVPN 2.3.2 arm-unknown-linux-gnueabihf [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [eurephia] [MH] [IPv6] built on Mar 23 2014
Tue Jul 29 13:23:33 2014 us=681229 NOTE: when bridging your LAN adapter with the TAP adapter, note that the new bridge adapter will often take on its own IP address that is different from what the LAN adapter was previously set to
Tue Jul 29 13:23:33 2014 us=682374 NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x.  Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
Tue Jul 29 13:23:33 2014 us=949671 Diffie-Hellman initialized with 2048 bit key
Tue Jul 29 13:23:33 2014 us=958433 Control Channel Authentication: using '/etc/openvpn/easy-rsa/keys/ta.key' as a OpenVPN static key file
Tue Jul 29 13:23:33 2014 us=958819 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jul 29 13:23:33 2014 us=959176 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jul 29 13:23:33 2014 us=959443 TLS-Auth MTU parms [ L:1590 D:166 EF:66 EB:0 ET:0 EL:0 ]
Tue Jul 29 13:23:33 2014 us=959725 Socket Buffers: R=[163840->131072] S=[163840->131072]
Tue Jul 29 13:23:33 2014 us=962055 TUN/TAP device tap0 opened
Tue Jul 29 13:23:33 2014 us=962386 TUN/TAP TX queue length set to 100
Tue Jul 29 13:23:33 2014 us=962889 Data Channel MTU parms [ L:1590 D:1450 EF:58 EB:135 ET:32 EL:0 AF:3/1 ]
Tue Jul 29 13:23:33 2014 us=973305 GID set to nogroup
Tue Jul 29 13:23:33 2014 us=973859 UID set to nobody
Tue Jul 29 13:23:33 2014 us=974172 UDPv4 link local (bound): [undef]
Tue Jul 29 13:23:33 2014 us=974357 UDPv4 link remote: [undef]
Tue Jul 29 13:23:33 2014 us=974582 MULTI: multi_init called, r=256 v=256
Tue Jul 29 13:23:33 2014 us=975578 IFCONFIG POOL: base=192.168.1.240 size=15, ipv6=0
Tue Jul 29 13:23:33 2014 us=975828 ifconfig_pool_read(), in='Client1,192.168.1.240', TODO: IPv6
Tue Jul 29 13:23:33 2014 us=976171 succeeded -> ifconfig_pool_set()
Tue Jul 29 13:23:33 2014 us=976358 ifconfig_pool_read(), in='Client2,192.168.1.241', TODO: IPv6
Tue Jul 29 13:23:33 2014 us=976541 succeeded -> ifconfig_pool_set()
Tue Jul 29 13:23:33 2014 us=976745 IFCONFIG POOL LIST
Tue Jul 29 13:23:33 2014 us=976944 Client1,192.168.1.240
Tue Jul 29 13:23:33 2014 us=977123 Client2,192.168.1.241
Tue Jul 29 13:23:33 2014 us=977624 Initialization Sequence Completed
Tue Jul 29 13:23:42 2014 us=705969 MULTI: multi_create_instance called
Tue Jul 29 13:23:42 2014 us=706617 38.96.165.241:58380 Re-using SSL/TLS context
Tue Jul 29 13:23:42 2014 us=707097 38.96.165.241:58380 LZO compression initialized
Tue Jul 29 13:23:42 2014 us=709036 38.96.165.241:58380 Control Channel MTU parms [ L:1590 D:166 EF:66 EB:0 ET:0 EL:0 ]
Tue Jul 29 13:23:42 2014 us=709300 38.96.165.241:58380 Data Channel MTU parms [ L:1590 D:1450 EF:58 EB:135 ET:32 EL:0 AF:3/1 ]
Tue Jul 29 13:23:42 2014 us=709730 38.96.165.241:58380 Local Options String: 'V4,dev-type tap,link-mtu 1590,tun-mtu 1532,proto UDPv4,comp-lzo,keydir 0,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-server'
Tue Jul 29 13:23:42 2014 us=709911 38.96.165.241:58380 Expected Remote Options String: 'V4,dev-type tap,link-mtu 1590,tun-mtu 1532,proto UDPv4,comp-lzo,keydir 1,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client'
Tue Jul 29 13:23:42 2014 us=710494 38.96.165.241:58380 Local Options hash (VER=V4): '44bd8b5e'
Tue Jul 29 13:23:42 2014 us=710904 38.96.165.241:58380 Expected Remote Options hash (VER=V4): '48527533'
Tue Jul 29 13:23:42 2014 us=711511 38.96.165.241:58380 TLS: Initial packet from [AF_INET]38.96.165.241:58380, sid=b3c55286 5b68b05f
Tue Jul 29 13:23:43 2014 us=385538 38.96.165.241:58380 VERIFY OK: depth=1, C=US, ST=NY, L=NewYork, O=***, OU=changeme, CN=changeme, name=changeme, emailAddress=BLAH@FAKEMAIL.com
Tue Jul 29 13:23:43 2014 us=389479 38.96.165.241:58380 VERIFY OK: depth=0, C=US, ST=NY, L=NewYork, O=***, OU=changeme, CN=Client1, name=changeme, emailAddress=BLAH@FAKEMAIL.com
Tue Jul 29 13:23:43 2014 us=699942 38.96.165.241:58380 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Tue Jul 29 13:23:43 2014 us=700289 38.96.165.241:58380 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jul 29 13:23:43 2014 us=700506 38.96.165.241:58380 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Tue Jul 29 13:23:43 2014 us=700830 38.96.165.241:58380 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jul 29 13:23:43 2014 us=716147 38.96.165.241:58380 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Tue Jul 29 13:23:43 2014 us=716578 38.96.165.241:58380 [Client1] Peer Connection Initiated with [AF_INET]38.96.165.241:58380
Tue Jul 29 13:23:43 2014 us=717016 Client1/38.96.165.241:58380 MULTI_sva: pool returned IPv4=192.168.1.240, IPv6=(Not enabled)
Tue Jul 29 13:23:45 2014 us=619045 Client1/38.96.165.241:58380 PUSH: Received control message: 'PUSH_REQUEST'
Tue Jul 29 13:23:45 2014 us=619361 Client1/38.96.165.241:58380 send_push_reply(): safe_cap=940
Tue Jul 29 13:23:45 2014 us=619894 Client1/38.96.165.241:58380 SENT CONTROL [Client1]: 'PUSH_REPLY,route 192.168.1.0 255.255.255.0,dhcp-option DNS 192.168.1.1,dhcp-option WINS 192.168.1.1,route-gateway 192.168.1.1,ping 10,ping-restart 120,ifconfig 192.168.1.240 255.255.255.0' (status=1)
Tue Jul 29 13:23:45 2014 us=665605 Client1/38.96.165.241:58380 MULTI: Learn: 00:ff:16:0f:38:b2 -> Client1/38.96.165.241:58380
Tue Jul 29 13:39:19 2014 us=324787 MULTI: multi_create_instance called
Tue Jul 29 13:39:19 2014 us=333554 38.96.165.244:28342 Re-using SSL/TLS context
Tue Jul 29 13:39:19 2014 us=333922 38.96.165.244:28342 LZO compression initialized
Tue Jul 29 13:39:19 2014 us=334873 38.96.165.244:28342 Control Channel MTU parms [ L:1590 D:166 EF:66 EB:0 ET:0 EL:0 ]
Tue Jul 29 13:39:19 2014 us=335127 38.96.165.244:28342 Data Channel MTU parms [ L:1590 D:1450 EF:58 EB:135 ET:32 EL:0 AF:3/1 ]
Tue Jul 29 13:39:19 2014 us=335463 38.96.165.244:28342 Local Options String: 'V4,dev-type tap,link-mtu 1590,tun-mtu 1532,proto UDPv4,comp-lzo,keydir 0,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-server'
Tue Jul 29 13:39:19 2014 us=335655 38.96.165.244:28342 Expected Remote Options String: 'V4,dev-type tap,link-mtu 1590,tun-mtu 1532,proto UDPv4,comp-lzo,keydir 1,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client'
Tue Jul 29 13:39:19 2014 us=335968 38.96.165.244:28342 Local Options hash (VER=V4): '44bd8b5e'
Tue Jul 29 13:39:19 2014 us=336258 38.96.165.244:28342 Expected Remote Options hash (VER=V4): '48527533'
Tue Jul 29 13:39:19 2014 us=336693 38.96.165.244:28342 TLS: Initial packet from [AF_INET]38.96.165.244:28342, sid=5ba8a0b9 303fa893
Tue Jul 29 13:39:20 2014 us=239971 38.96.165.244:28342 VERIFY OK: depth=1, C=US, ST=NY, L=NewYork, O=***, OU=changeme, CN=changeme, name=changeme, emailAddress=BLAH@FAKEMAIL.com
Tue Jul 29 13:39:20 2014 us=244854 38.96.165.244:28342 VERIFY OK: depth=0, C=US, ST=NY, L=NewYork, O=***, OU=changeme, CN=Client2, name=changeme, emailAddress=BLAH@FAKEMAIL.com
Tue Jul 29 13:39:20 2014 us=602942 38.96.165.244:28342 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Tue Jul 29 13:39:20 2014 us=603409 38.96.165.244:28342 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jul 29 13:39:20 2014 us=603646 38.96.165.244:28342 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Tue Jul 29 13:39:20 2014 us=603876 38.96.165.244:28342 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jul 29 13:39:20 2014 us=623971 38.96.165.244:28342 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Tue Jul 29 13:39:20 2014 us=624408 38.96.165.244:28342 [Client2] Peer Connection Initiated with [AF_INET]38.96.165.244:28342
Tue Jul 29 13:39:20 2014 us=624832 Client2/38.96.165.244:28342 MULTI_sva: pool returned IPv4=192.168.1.241, IPv6=(Not enabled)
Tue Jul 29 13:39:22 2014 us=906893 Client2/38.96.165.244:28342 PUSH: Received control message: 'PUSH_REQUEST'
Tue Jul 29 13:39:22 2014 us=907212 Client2/38.96.165.244:28342 send_push_reply(): safe_cap=940
Tue Jul 29 13:39:22 2014 us=908002 Client2/38.96.165.244:28342 SENT CONTROL [Client2]: 'PUSH_REPLY,route 192.168.1.0 255.255.255.0,dhcp-option DNS 192.168.1.1,dhcp-option WINS 192.168.1.1,route-gateway 192.168.1.1,ping 10,ping-restart 120,ifconfig 192.168.1.241 255.255.255.0' (status=1)
Tue Jul 29 13:39:26 2014 us=354989 Client2/38.96.165.244:28342 MULTI: Learn: 5a:93:41:4a:fd:91 -> Client2/38.96.165.244:28342

Windows client log:

Tue Jul 29 13:23:38 2014 us=954737 Current Parameter Settings:
Tue Jul 29 13:23:38 2014 us=955737   config = 'Client1.ovpn'
Tue Jul 29 13:23:38 2014 us=955737   mode = 0
Tue Jul 29 13:23:38 2014 us=955737   show_ciphers = DISABLED
Tue Jul 29 13:23:38 2014 us=955737   show_digests = DISABLED
Tue Jul 29 13:23:38 2014 us=955737   show_engines = DISABLED
Tue Jul 29 13:23:38 2014 us=955737   genkey = DISABLED
Tue Jul 29 13:23:38 2014 us=955737   key_pass_file = '[UNDEF]'
Tue Jul 29 13:23:38 2014 us=955737   show_tls_ciphers = DISABLED
Tue Jul 29 13:23:38 2014 us=955737 Connection profiles [default]:
Tue Jul 29 13:23:38 2014 us=955737   proto = udp
Tue Jul 29 13:23:38 2014 us=955737   local = '[UNDEF]'
Tue Jul 29 13:23:38 2014 us=955737   local_port = 0
Tue Jul 29 13:23:38 2014 us=955737   remote = '1.2.3.4'
Tue Jul 29 13:23:38 2014 us=955737   remote_port = 1194
Tue Jul 29 13:23:38 2014 us=955737   remote_float = DISABLED
Tue Jul 29 13:23:38 2014 us=955737   bind_defined = DISABLED
Tue Jul 29 13:23:38 2014 us=955737   bind_local = DISABLED
Tue Jul 29 13:23:38 2014 us=955737   connect_retry_seconds = 5
Tue Jul 29 13:23:38 2014 us=955737   connect_timeout = 10
Tue Jul 29 13:23:38 2014 us=955737 NOTE: --mute triggered...
Tue Jul 29 13:23:38 2014 us=955737 265 variation(s) on previous 20 message(s) suppressed by --mute
Tue Jul 29 13:23:38 2014 us=955737 OpenVPN 2.3.4 i686-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Jun  5 2014
Tue Jul 29 13:23:38 2014 us=955737 library versions: OpenSSL 1.0.1h 5 Jun 2014, LZO 2.05
Enter Management Password:
Tue Jul 29 13:23:38 2014 us=956737 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Tue Jul 29 13:23:38 2014 us=956737 Need hold release from management interface, waiting...
Tue Jul 29 13:23:39 2014 us=456837 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Tue Jul 29 13:23:39 2014 us=557858 MANAGEMENT: CMD 'state on'
Tue Jul 29 13:23:39 2014 us=558858 MANAGEMENT: CMD 'log all on'
Tue Jul 29 13:23:39 2014 us=581862 MANAGEMENT: CMD 'hold off'
Tue Jul 29 13:23:39 2014 us=582863 MANAGEMENT: CMD 'hold release'
Tue Jul 29 13:23:42 2014 us=599466 MANAGEMENT: CMD 'password [...]'
Tue Jul 29 13:23:42 2014 us=599466 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Tue Jul 29 13:23:42 2014 us=599466 Control Channel Authentication: tls-auth using INLINE static key file
Tue Jul 29 13:23:42 2014 us=599466 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jul 29 13:23:42 2014 us=599466 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jul 29 13:23:42 2014 us=599466 LZO compression initialized
Tue Jul 29 13:23:42 2014 us=599466 Control Channel MTU parms [ L:1590 D:166 EF:66 EB:0 ET:0 EL:0 ]
Tue Jul 29 13:23:42 2014 us=599466 Socket Buffers: R=[8192->8192] S=[64512->64512]
Tue Jul 29 13:23:42 2014 us=599466 MANAGEMENT: >STATE:1406654622,RESOLVE,,,
Tue Jul 29 13:23:42 2014 us=683483 Data Channel MTU parms [ L:1590 D:1450 EF:58 EB:135 ET:32 EL:0 AF:3/1 ]
Tue Jul 29 13:23:42 2014 us=683483 Local Options String: 'V4,dev-type tap,link-mtu 1590,tun-mtu 1532,proto UDPv4,comp-lzo,keydir 1,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client'
Tue Jul 29 13:23:42 2014 us=683483 Expected Remote Options String: 'V4,dev-type tap,link-mtu 1590,tun-mtu 1532,proto UDPv4,comp-lzo,keydir 0,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-server'
Tue Jul 29 13:23:42 2014 us=683483 Local Options hash (VER=V4): '48527533'
Tue Jul 29 13:23:42 2014 us=683483 Expected Remote Options hash (VER=V4): '44bd8b5e'
Tue Jul 29 13:23:42 2014 us=683483 UDPv4 link local: [undef]
Tue Jul 29 13:23:42 2014 us=683483 UDPv4 link remote: [AF_INET]1.2.3.4:1194
Tue Jul 29 13:23:42 2014 us=683483 MANAGEMENT: >STATE:1406654622,WAIT,,,
Tue Jul 29 13:23:42 2014 us=701486 MANAGEMENT: >STATE:1406654622,AUTH,,,
Tue Jul 29 13:23:42 2014 us=702486 TLS: Initial packet from [AF_INET]1.2.3.4:1194, sid=e1252c59 bffedcc2
Tue Jul 29 13:23:43 2014 us=172580 VERIFY OK: depth=1, C=US, ST=NY, L=NewYork, O=***, OU=changeme, CN=changeme, name=changeme, emailAddress=BLAH@FAKEMAIL.com
Tue Jul 29 13:23:43 2014 us=172580 VERIFY OK: nsCertType=SERVER
Tue Jul 29 13:23:43 2014 us=172580 VERIFY OK: depth=0, C=US, ST=NY, L=NewYork, O=***, OU=changeme, CN=keyserver, name=changeme, emailAddress=BLAH@FAKEMAIL.com
Tue Jul 29 13:23:43 2014 us=693685 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Tue Jul 29 13:23:43 2014 us=693685 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jul 29 13:23:43 2014 us=693685 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Tue Jul 29 13:23:43 2014 us=694685 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jul 29 13:23:43 2014 us=694685 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Tue Jul 29 13:23:43 2014 us=694685 [keyserver] Peer Connection Initiated with [AF_INET]1.2.3.4:1194
Tue Jul 29 13:23:44 2014 us=840914 MANAGEMENT: >STATE:1406654624,GET_CONFIG,,,
Tue Jul 29 13:23:45 2014 us=597065 SENT CONTROL [keyserver]: 'PUSH_REQUEST' (status=1)
Tue Jul 29 13:23:45 2014 us=615069 PUSH: Received control message: 'PUSH_REPLY,route 192.168.1.0 255.255.255.0,dhcp-option DNS 192.168.1.1,dhcp-option WINS 192.168.1.1,route-gateway 192.168.1.1,ping 10,ping-restart 120,ifconfig 192.168.1.240 255.255.255.0'
Tue Jul 29 13:23:45 2014 us=615069 OPTIONS IMPORT: timers and/or timeouts modified
Tue Jul 29 13:23:45 2014 us=615069 OPTIONS IMPORT: --ifconfig/up options modified
Tue Jul 29 13:23:45 2014 us=615069 OPTIONS IMPORT: route options modified
Tue Jul 29 13:23:45 2014 us=615069 OPTIONS IMPORT: route-related options modified
Tue Jul 29 13:23:45 2014 us=615069 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Tue Jul 29 13:23:45 2014 us=619070 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Tue Jul 29 13:23:45 2014 us=619070 MANAGEMENT: >STATE:1406654625,ASSIGN_IP,,192.168.1.240,
Tue Jul 29 13:23:45 2014 us=619070 open_tun, tt->ipv6=0
Tue Jul 29 13:23:45 2014 us=620070 TAP-WIN32 device [Local Area Connection 4] opened: \\.\Global\{160F38B2-857C-41B9-8434-7A471A5BC807}.tap
Tue Jul 29 13:23:45 2014 us=620070 TAP-Windows Driver Version 9.9 
Tue Jul 29 13:23:45 2014 us=620070 TAP-Windows MTU=1500
Tue Jul 29 13:23:45 2014 us=622070 Notified TAP-Windows driver to set a DHCP IP/netmask of 192.168.1.240/255.255.255.0 on interface {160F38B2-857C-41B9-8434-7A471A5BC807} [DHCP-serv: 192.168.1.0, lease-time: 31536000]
Tue Jul 29 13:23:45 2014 us=622070 DHCP option string: 0604c0a8 01012c04 c0a80101
Tue Jul 29 13:23:45 2014 us=622070 Successful ARP Flush on interface [30] {160F38B2-857C-41B9-8434-7A471A5BC807}
Tue Jul 29 13:23:50 2014 us=166979 TEST ROUTES: 0/0 succeeded len=1 ret=0 a=0 u/d=down
Tue Jul 29 13:23:50 2014 us=166979 Route: Waiting for TUN/TAP interface to come up...
Tue Jul 29 13:23:55 2014 us=7947 TEST ROUTES: 0/0 succeeded len=1 ret=0 a=0 u/d=down
Tue Jul 29 13:23:55 2014 us=8947 Route: Waiting for TUN/TAP interface to come up...
Tue Jul 29 13:23:56 2014 us=587263 TEST ROUTES: 0/0 succeeded len=1 ret=0 a=0 u/d=down
Tue Jul 29 13:23:56 2014 us=587263 Route: Waiting for TUN/TAP interface to come up...
Tue Jul 29 13:23:57 2014 us=171380 TEST ROUTES: 0/0 succeeded len=1 ret=0 a=0 u/d=down
Tue Jul 29 13:23:57 2014 us=171380 Route: Waiting for TUN/TAP interface to come up...
Tue Jul 29 13:23:58 2014 us=86563 TEST ROUTES: 0/0 succeeded len=1 ret=0 a=0 u/d=down
Tue Jul 29 13:23:58 2014 us=86563 Route: Waiting for TUN/TAP interface to come up...
Tue Jul 29 13:23:59 2014 us=504846 TEST ROUTES: 0/0 succeeded len=1 ret=0 a=0 u/d=down
Tue Jul 29 13:23:59 2014 us=504846 Route: Waiting for TUN/TAP interface to come up...
Tue Jul 29 13:24:00 2014 us=337013 TEST ROUTES: 0/0 succeeded len=1 ret=0 a=0 u/d=down
Tue Jul 29 13:24:00 2014 us=337013 Route: Waiting for TUN/TAP interface to come up...
Tue Jul 29 13:24:01 2014 us=35152 TEST ROUTES: 0/0 succeeded len=1 ret=0 a=0 u/d=down
Tue Jul 29 13:24:01 2014 us=35152 Route: Waiting for TUN/TAP interface to come up...
Tue Jul 29 13:24:02 2014 us=599465 TEST ROUTES: 0/0 succeeded len=1 ret=0 a=0 u/d=down
Tue Jul 29 13:24:02 2014 us=599465 Route: Waiting for TUN/TAP interface to come up...
Tue Jul 29 13:24:03 2014 us=347615 TEST ROUTES: 0/0 succeeded len=1 ret=0 a=0 u/d=down
Tue Jul 29 13:24:03 2014 us=347615 Route: Waiting for TUN/TAP interface to come up...
Tue Jul 29 13:24:04 2014 us=98765 TEST ROUTES: 0/0 succeeded len=1 ret=0 a=0 u/d=down
Tue Jul 29 13:24:04 2014 us=98765 Route: Waiting for TUN/TAP interface to come up...
Tue Jul 29 13:24:05 2014 us=45954 TEST ROUTES: 0/0 succeeded len=1 ret=0 a=0 u/d=down
Tue Jul 29 13:24:05 2014 us=45954 Route: Waiting for TUN/TAP interface to come up...
Tue Jul 29 13:24:06 2014 us=170179 TEST ROUTES: 0/0 succeeded len=1 ret=0 a=0 u/d=down
Tue Jul 29 13:24:06 2014 us=170179 Route: Waiting for TUN/TAP interface to come up...
Tue Jul 29 13:24:07 2014 us=170379 TEST ROUTES: 0/0 succeeded len=1 ret=0 a=0 u/d=down
Tue Jul 29 13:24:07 2014 us=170379 Route: Waiting for TUN/TAP interface to come up...
Tue Jul 29 13:24:08 2014 us=7546 TEST ROUTES: 0/0 succeeded len=1 ret=0 a=0 u/d=down
Tue Jul 29 13:24:08 2014 us=7546 Route: Waiting for TUN/TAP interface to come up...
Tue Jul 29 13:24:09 2014 us=23750 TEST ROUTES: 0/0 succeeded len=1 ret=0 a=0 u/d=down
Tue Jul 29 13:24:09 2014 us=23750 Route: Waiting for TUN/TAP interface to come up...
Tue Jul 29 13:24:10 2014 us=185982 TEST ROUTES: 0/0 succeeded len=1 ret=0 a=0 u/d=down
Tue Jul 29 13:24:10 2014 us=185982 Route: Waiting for TUN/TAP interface to come up...
Tue Jul 29 13:24:11 2014 us=35152 TEST ROUTES: 0/0 succeeded len=1 ret=0 a=0 u/d=down
Tue Jul 29 13:24:11 2014 us=35152 Route: Waiting for TUN/TAP interface to come up...
Tue Jul 29 13:24:12 2014 us=171379 TEST ROUTES: 0/0 succeeded len=1 ret=0 a=0 u/d=down
Tue Jul 29 13:24:12 2014 us=171379 Route: Waiting for TUN/TAP interface to come up...
Tue Jul 29 13:24:13 2014 us=171579 TEST ROUTES: 0/0 succeeded len=1 ret=0 a=0 u/d=down
Tue Jul 29 13:24:13 2014 us=171579 Route: Waiting for TUN/TAP interface to come up...
Tue Jul 29 13:24:14 2014 us=46754 TEST ROUTES: 0/0 succeeded len=1 ret=0 a=0 u/d=down
Tue Jul 29 13:24:14 2014 us=46754 Route: Waiting for TUN/TAP interface to come up...
Tue Jul 29 13:24:15 2014 us=611067 TEST ROUTES: 0/0 succeeded len=1 ret=0 a=0 u/d=down
Tue Jul 29 13:24:15 2014 us=611067 Route: Waiting for TUN/TAP interface to come up...
Tue Jul 29 13:24:16 2014 us=172179 TEST ROUTES: 0/0 succeeded len=1 ret=0 a=0 u/d=down
Tue Jul 29 13:24:16 2014 us=173179 Route: Waiting for TUN/TAP interface to come up...
Tue Jul 29 13:24:17 2014 us=202385 TEST ROUTES: 0/0 succeeded len=1 ret=0 a=0 u/d=down
Tue Jul 29 13:24:17 2014 us=202385 Route: Waiting for TUN/TAP interface to come up...
Tue Jul 29 13:24:18 2014 us=171579 TEST ROUTES: 0/0 succeeded len=1 ret=0 a=0 u/d=down
Tue Jul 29 13:24:18 2014 us=171579 Route: Waiting for TUN/TAP interface to come up...
Tue Jul 29 13:24:19 2014 us=172779 TEST ROUTES: 0/0 succeeded len=1 ret=0 a=0 u/d=down
Tue Jul 29 13:24:19 2014 us=172779 Route: Waiting for TUN/TAP interface to come up...
Tue Jul 29 13:24:20 2014 us=172979 TEST ROUTES: 0/0 succeeded len=1 ret=0 a=0 u/d=down
Tue Jul 29 13:24:20 2014 us=172979 MANAGEMENT: >STATE:1406654660,ADD_ROUTES,,,
Tue Jul 29 13:24:20 2014 us=172979 C:\Windows\system32\route.exe ADD 192.168.1.0 MASK 255.255.255.0 192.168.1.1
Tue Jul 29 13:24:20 2014 us=174979 Warning: route gateway is not reachable on any active network adapters: 192.168.1.1
Tue Jul 29 13:24:20 2014 us=174979 Route addition via IPAPI failed [adaptive]
Tue Jul 29 13:24:20 2014 us=174979 Route addition fallback to route.exe
Tue Jul 29 13:24:20 2014 us=174979 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
SYSTEM ROUTING TABLE
0.0.0.0 0.0.0.0 10.3.11.250 p=0 i=10 t=4 pr=3 a=1713145 h=0 m=20/0/0/0/0
0.0.0.0 0.0.0.0 25.0.0.1 p=0 i=16 t=4 pr=3 a=398548 h=0 m=9256/0/0/0/0
10.3.11.0 255.255.255.0 10.3.11.125 p=0 i=10 t=3 pr=3 a=1713145 h=0 m=276/0/0/0/0
10.3.11.125 255.255.255.255 10.3.11.125 p=0 i=10 t=3 pr=3 a=1713145 h=0 m=276/0/0/0/0
10.3.11.255 255.255.255.255 10.3.11.125 p=0 i=10 t=3 pr=3 a=1713145 h=0 m=276/0/0/0/0
25.0.0.0 255.0.0.0 25.128.144.125 p=0 i=16 t=3 pr=3 a=398547 h=0 m=9256/0/0/0/0
25.128.144.125 255.255.255.255 25.128.144.125 p=0 i=16 t=3 pr=3 a=398547 h=0 m=9256/0/0/0/0
25.255.255.255 255.255.255.255 25.128.144.125 p=0 i=16 t=3 pr=3 a=398547 h=0 m=9256/0/0/0/0
127.0.0.0 255.0.0.0 127.0.0.1 p=0 i=1 t=3 pr=3 a=1713232 h=0 m=306/0/0/0/0
127.0.0.1 255.255.255.255 127.0.0.1 p=0 i=1 t=3 pr=3 a=1713232 h=0 m=306/0/0/0/0
127.255.255.255 255.255.255.255 127.0.0.1 p=0 i=1 t=3 pr=3 a=1713232 h=0 m=306/0/0/0/0
192.168.1.0 255.255.255.0 192.168.1.1 p=0 i=10 t=4 pr=3 a=0 h=0 m=21/0/0/0/0
224.0.0.0 240.0.0.0 127.0.0.1 p=0 i=1 t=3 pr=3 a=1713232 h=0 m=306/0/0/0/0
224.0.0.0 240.0.0.0 10.3.11.125 p=0 i=10 t=3 pr=3 a=1713167 h=0 m=276/0/0/0/0
224.0.0.0 240.0.0.0 25.128.144.125 p=0 i=16 t=3 pr=3 a=398548 h=0 m=9256/0/0/0/0
224.0.0.0 240.0.0.0 0.0.0.0 p=0 i=30 t=3 pr=3 a=8396 h=0 m=286/0/0/0/0
255.255.255.255 255.255.255.255 127.0.0.1 p=0 i=1 t=3 pr=3 a=1713232 h=0 m=306/0/0/0/0
255.255.255.255 255.255.255.255 10.3.11.125 p=0 i=10 t=3 pr=3 a=1713167 h=0 m=276/0/0/0/0
255.255.255.255 255.255.255.255 25.128.144.125 p=0 i=16 t=3 pr=3 a=398548 h=0 m=9256/0/0/0/0
255.255.255.255 255.255.255.255 0.0.0.0 p=0 i=30 t=3 pr=3 a=8396 h=0 m=286/0/0/0/0
SYSTEM ADAPTER LIST
TAP-Windows Adapter V9
  Index = 30
  GUID = {160F38B2-857C-41B9-8434-7A471A5BC807}
  IP = 0.0.0.0/0.0.0.0 
  MAC = 00:ff:16:0f:38:b2
  GATEWAY = 0.0.0.0/255.255.255.255 
  DHCP SERV = 0.0.0.0/255.255.255.255 
  DHCP LEASE OBTAINED = Tue Jul 29 13:24:20 2014
  DHCP LEASE EXPIRES  = Tue Jul 29 13:24:20 2014
  DNS SERV =  
TAP-Win32 Adapter OAS
  Index = 17
  GUID = {9774A456-5AB7-495B-9B3F-B3FEA8CB5059}
  IP = 0.0.0.0/0.0.0.0 
  MAC = 00:ff:97:74:a4:56
  GATEWAY = 0.0.0.0/255.255.255.255 
  DHCP SERV =  
  DHCP LEASE OBTAINED = Tue Jul 29 13:24:20 2014
  DHCP LEASE EXPIRES  = Tue Jul 29 13:24:20 2014
  PRI WINS = 192.168.1.1/255.255.255.255 
  SEC WINS =  
  DNS SERV =  
Broadcom NetXtreme 57xx Gigabit Controller
  Index = 10
  GUID = {D580E1B5-5B93-4886-89CD-7085509522AA}
  IP = 10.3.11.125/255.255.255.0 
  MAC = b8:ac:6f:80:e4:32
  GATEWAY = 10.3.11.250/255.255.255.255 
  DHCP SERV = 10.3.11.220/255.255.255.255 
  DHCP LEASE OBTAINED = Mon Jul 28 17:31:40 2014
  DHCP LEASE EXPIRES  = Wed Jul 30 17:31:40 2014
  DNS SERV = 10.3.11.220/255.255.255.255 10.3.11.230/255.255.255.255 
Hamachi Network Interface
  Index = 16
  GUID = {C494C48C-FBE5-4656-A63C-E690622AB06D}
  IP = 25.6.7.8/255.0.0.0 
  MAC = 7a:79:19:80:90:7d
  GATEWAY = 25.0.0.1/255.255.255.255 
  DHCP SERV = 25.0.0.1/255.255.255.255 
  DHCP LEASE OBTAINED = Thu Jul 24 22:41:46 2014
  DHCP LEASE EXPIRES  = Fri Jul 24 22:41:46 2015
  DNS SERV =  
Tue Jul 29 13:24:20 2014 us=241993 Initialization Sequence Completed With Errors ( see http://openvpn.net/faq.html#dhcpclientserv )
Tue Jul 29 13:24:20 2014 us=241993 MANAGEMENT: >STATE:1406654660,CONNECTED,ERROR,192.168.1.240,1.2.3.4

Mac client log:

2014-07-29 13:39:17 *Tunnelblick: openvpnstart starting OpenVPN
2014-07-29 13:39:18 us=451867 Current Parameter Settings:
2014-07-29 13:39:18 us=452117   config = '/Library/Application Support/Tunnelblick/Users/***/config.ovpn'
2014-07-29 13:39:18 us=452136   mode = 0
2014-07-29 13:39:18 us=452152   show_ciphers = DISABLED
2014-07-29 13:39:18 us=452175   show_digests = DISABLED
2014-07-29 13:39:18 us=452192   show_engines = DISABLED
2014-07-29 13:39:18 us=452208   genkey = DISABLED
2014-07-29 13:39:18 us=452224   key_pass_file = '[UNDEF]'
2014-07-29 13:39:18 us=452245   show_tls_ciphers = DISABLED
2014-07-29 13:39:18 us=452259 Connection profiles [default]:
2014-07-29 13:39:18 us=452274   proto = udp
2014-07-29 13:39:18 us=452288   local = '[UNDEF]'
2014-07-29 13:39:18 us=452303   local_port = 0
2014-07-29 13:39:18 us=452317   remote = '1.2.3.4'
2014-07-29 13:39:18 us=452331   remote_port = 1194
2014-07-29 13:39:18 us=452345   remote_float = DISABLED
2014-07-29 13:39:18 us=452360   bind_defined = DISABLED
2014-07-29 13:39:18 us=452374   bind_local = DISABLED
2014-07-29 13:39:18 us=452389   connect_retry_seconds = 5
2014-07-29 13:39:18 us=452403   connect_timeout = 10
2014-07-29 13:39:18 us=452417 NOTE: --mute triggered...
2014-07-29 13:39:18 us=452448 240 variation(s) on previous 20 message(s) suppressed by --mute
2014-07-29 13:39:18 us=452467 OpenVPN 2.2.1 i386-apple-darwin [SSL] [LZO2] [PKCS11] [eurephia] built on Jul 8 2014
2014-07-29 13:39:18 us=452613 MANAGEMENT: TCP Socket listening on 127.0.0.1:1337
2014-07-29 13:39:18 us=453463 Need hold release from management interface, waiting...
2014-07-29 13:39:18 us=572096 MANAGEMENT: Client connected from 127.0.0.1:1337
2014-07-29 13:39:18 us=579229 MANAGEMENT: CMD 'pid'
2014-07-29 13:39:18 us=579555 MANAGEMENT: CMD 'state on'
2014-07-29 13:39:18 us=579729 MANAGEMENT: CMD 'state'
2014-07-29 13:39:18 us=580121 MANAGEMENT: CMD 'bytecount 1'
2014-07-29 13:39:18 us=580303 MANAGEMENT: CMD 'hold release'
2014-07-29 13:39:18 *Tunnelblick: Established communication with OpenVPN
2014-07-29 13:39:18 us=580760 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2014-07-29 13:39:21 us=209849 MANAGEMENT: CMD 'password [...]'
2014-07-29 13:39:21 us=210470 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
2014-07-29 13:39:21 us=211557 Control Channel Authentication: tls-auth using INLINE static key file
2014-07-29 13:39:21 us=211717 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
2014-07-29 13:39:21 us=211825 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
2014-07-29 13:39:21 us=211955 LZO compression initialized
2014-07-29 13:39:21 us=212206 Control Channel MTU parms [ L:1590 D:166 EF:66 EB:0 ET:0 EL:0 ]
2014-07-29 13:39:21 us=212387 Socket Buffers: R=[196724->65536] S=[9216->65536]
2014-07-29 13:39:21 us=212500 MANAGEMENT: >STATE:1406655561,RESOLVE,,,
2014-07-29 13:39:21 us=347392 Data Channel MTU parms [ L:1590 D:1450 EF:58 EB:135 ET:32 EL:0 AF:3/1 ]
2014-07-29 13:39:21 us=347590 Local Options String: 'V4,dev-type tap,link-mtu 1590,tun-mtu 1532,proto UDPv4,comp-lzo,keydir 1,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client'
2014-07-29 13:39:21 us=347705 Expected Remote Options String: 'V4,dev-type tap,link-mtu 1590,tun-mtu 1532,proto UDPv4,comp-lzo,keydir 0,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-server'
2014-07-29 13:39:21 us=347855 Local Options hash (VER=V4): '48527533'
2014-07-29 13:39:21 us=347964 Expected Remote Options hash (VER=V4): '44bd8b5e'
2014-07-29 13:39:21 us=348080 UDPv4 link local: [undef]
2014-07-29 13:39:21 us=348185 UDPv4 link remote: 1.2.3.4:1194
2014-07-29 13:39:21 us=348325 MANAGEMENT: >STATE:1406655561,WAIT,,,
                                        RTue Jul 29 13:39:21 2014 us=389894 MANAGEMENT: >STATE:1406655561,AUTH,,,
2014-07-29 13:39:21 us=390109 TLS: Initial packet from 1.2.3.4:1194, sid=3c579e49 6bf82de5
                                     WWWWRRRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRTue Jul 29 13:39:21 2014 us=863392 VERIFY OK: depth=1, /C=US/ST=NY/L=NewYork/O=***/OU=changeme/CN=changeme/name=changeme/emailAddress=BLAH@FAKEMAIL.com
2014-07-29 13:39:21 us=865186 VERIFY OK: nsCertType=SERVER
2014-07-29 13:39:21 us=865411 VERIFY OK: depth=0, /C=US/ST=NY/L=NewYork/O=***/OU=changeme/CN=keyserver/name=changeme/emailAddress=BLAH@FAKEMAIL.com
                                        RRRRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWWWWRRRRWRWRTue Jul 29 13:39:22 2014 us=647095 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
2014-07-29 13:39:22 us=647289 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
2014-07-29 13:39:22 us=647499 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
2014-07-29 13:39:22 us=647685 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
                                        WTue Jul 29 13:39:22 2014 us=647923 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
2014-07-29 13:39:22 us=648135 [keyserver] Peer Connection Initiated with 1.2.3.4:1194
                                        RTue Jul 29 13:39:23 2014 us=754571 MANAGEMENT: >STATE:1406655563,GET_CONFIG,,,
2014-07-29 13:39:24 us=928992 SENT CONTROL [keyserver]: 'PUSH_REQUEST' (status=1)
                                        RWRTue Jul 29 13:39:24 2014 us=949225 PUSH: Received control message: 'PUSH_REPLY,route 192.168.1.0 255.255.255.0,dhcp-option DNS 192.168.1.1,dhcp-option WINS 192.168.1.1,route-gateway 192.168.1.1,ping 10,ping-restart 120,ifconfig 192.168.1.241 255.255.255.0'
2014-07-29 13:39:24 us=949518 OPTIONS IMPORT: timers and/or timeouts modified
2014-07-29 13:39:24 us=949624 OPTIONS IMPORT: --ifconfig/up options modified
2014-07-29 13:39:24 us=949725 OPTIONS IMPORT: route options modified
2014-07-29 13:39:24 us=949825 OPTIONS IMPORT: route-related options modified
2014-07-29 13:39:24 us=949925 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
2014-07-29 13:39:24 us=950128 ROUTE default_gateway=192.168.15.200
2014-07-29 13:39:24 us=950416 TUN/TAP device /dev/tap0 opened
2014-07-29 13:39:24 us=950531 MANAGEMENT: >STATE:1406655564,ASSIGN_IP,,192.168.1.241,
2014-07-29 13:39:24 us=950645 /sbin/ifconfig tap0 delete
                                        ifconfig: ioctl (SIOCDIFADDR): Can't assign requested address
2014-07-29 13:39:24 us=961367 NOTE: Tried to delete pre-existing tun/tap instance -- No Problem if failure
2014-07-29 13:39:24 us=961720 /sbin/ifconfig tap0 192.168.1.241 netmask 255.255.255.0 mtu 1500 up
2014-07-29 13:39:24 us=971567 /Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -m -w -d -a -f -ptADGNWradsgnw tap0 1500 1590 192.168.1.241 255.255.255.0 init
                                        **********************************************
                                        Start of output from client.up.tunnelblick.sh
                                        Configuring tap DNS via OpenVPN
                                        Retrieved from OpenVPN: name server(s) [ 192.168.1.1 ], search domain(s) [  ] and SMB server(s) [ 192.168.1.1 ] and using default domain name [ openvpn ]
                                        Not aggregating ServerAddresses because running on OS X 10.6 or higher
                                        Not aggregating WINSAddresses because running on OS X 10.6 or higher
                                        Setting search domains to 'openvpn' because running under OS X 10.6 or higher and the search domains were not set manually and 'Prepend domain name to search domains' was not selected
                                        Saved the DNS and SMB configurations so they can be restored
                                        Set ServerAddresses to 192.168.1.1
                                        Set SearchDomains   to openvpn
                                        Set DomainName       to openvpn
                                        Set WINSAddresses   to 192.168.1.1
                                        Flushed the DNS cache via dscacheutil
                                        Notified mDNSResponder that the DNS cache was flushed
                                        Setting up to monitor system configuration with process-network-changes
                                        End of output from client.up.tunnelblick.sh
                                        **********************************************
2014-07-29 13:39:26 *Tunnelblick: No 'connected.sh' script to execute
2014-07-29 13:39:26 us=306034 MANAGEMENT: >STATE:1406655566,ADD_ROUTES,,,
2014-07-29 13:39:26 us=306342 /sbin/route add -net 192.168.1.0 192.168.1.1 255.255.255.0
                                        route: writing to routing socket: File exists
                                        add net 192.168.1.0: gateway 192.168.1.1: File exists
2014-07-29 13:39:26 us=314602 Initialization Sequence Completed
2014-07-29 13:39:26 us=314830 MANAGEMENT: >STATE:1406655566,CONNECTED,SUCCESS,192.168.1.241,1.2.3.4
2014-07-29 13:40:01 *Tunnelblick: After 30.0 seconds, gave up trying to fetch IP address information using the ipInfo host's name after connecting.
2014-07-29 13:40:01 *Tunnelblick process-network-changes: A system configuration change was ignored
2014-07-29 13:40:31 *Tunnelblick: After 30.0 seconds, gave up trying to fetch IP address information using the ipInfo host's IP address after connecting.

mcbrown

And I just noticed this in the Mac client log:

2014-07-29 13:39:18 us=452467 OpenVPN 2.2.1 i386-apple-darwin [SSL] [LZO2] [PKCS11] [eurephia] built on Jul 8 2014

But changing the OpenVPN version leads to the same result:

2014-07-29 14:56:31 us=695794 Current Parameter Settings:
2014-07-29 14:56:31 us=696103   config = '/Library/Application Support/Tunnelblick/Users/***/config.ovpn'
2014-07-29 14:56:31 us=696123   mode = 0
2014-07-29 14:56:31 us=696140   show_ciphers = DISABLED
2014-07-29 14:56:31 us=696157   show_digests = DISABLED
2014-07-29 14:56:31 us=696173   show_engines = DISABLED
2014-07-29 14:56:31 us=696190   genkey = DISABLED
2014-07-29 14:56:31 us=696207   key_pass_file = '[UNDEF]'
2014-07-29 14:56:31 us=696223   show_tls_ciphers = DISABLED
2014-07-29 14:56:31 us=696239 Connection profiles [default]:
2014-07-29 14:56:31 us=696256   proto = udp
2014-07-29 14:56:31 us=696273   local = '[UNDEF]'
2014-07-29 14:56:31 us=696289   local_port = 0
2014-07-29 14:56:31 us=696306   remote = '1.2.3.4'
2014-07-29 14:56:31 us=696322   remote_port = 1194
2014-07-29 14:56:31 us=696339   remote_float = DISABLED
2014-07-29 14:56:31 us=696355   bind_defined = DISABLED
2014-07-29 14:56:31 us=696372   bind_local = DISABLED
2014-07-29 14:56:31 us=696388   connect_retry_seconds = 5
2014-07-29 14:56:31 us=696405   connect_timeout = 10
2014-07-29 14:56:31 us=696421 NOTE: --mute triggered...
2014-07-29 14:56:31 us=696485 251 variation(s) on previous 20 message(s) suppressed by --mute
2014-07-29 14:56:31 us=696525 OpenVPN 2.3.4 x86_64-apple-darwin [SSL (OpenSSL)] [LZO] [PKCS11] [MH] [IPv6] built on Jul  8 2014
2014-07-29 14:56:31 us=697649 library versions: OpenSSL 1.0.1h 5 Jun 2014, LZO 2.08
2014-07-29 14:56:31 us=698986 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:1337
2014-07-29 14:56:31 us=700935 Need hold release from management interface, waiting...
2014-07-29 14:56:31 us=799813 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:1337
2014-07-29 14:56:31 us=817252 MANAGEMENT: CMD 'pid'
2014-07-29 14:56:31 us=817707 MANAGEMENT: CMD 'state on'
2014-07-29 14:56:31 us=817858 MANAGEMENT: CMD 'state'
2014-07-29 14:56:31 us=818143 MANAGEMENT: CMD 'bytecount 1'
2014-07-29 14:56:31 us=818292 MANAGEMENT: CMD 'hold release'
2014-07-29 14:56:31 *Tunnelblick: openvpnstart starting OpenVPN
2014-07-29 14:56:31 *Tunnelblick: Established communication with OpenVPN
2014-07-29 14:56:31 us=822341 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2014-07-29 14:56:35 us=593224 MANAGEMENT: CMD 'password [...]'
2014-07-29 14:56:35 us=593847 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
2014-07-29 14:56:35 us=594639 Control Channel Authentication: tls-auth using INLINE static key file
2014-07-29 14:56:35 us=594805 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
2014-07-29 14:56:35 us=594911 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
2014-07-29 14:56:35 us=595041 LZO compression initialized
2014-07-29 14:56:35 us=595360 Control Channel MTU parms [ L:1590 D:166 EF:66 EB:0 ET:0 EL:0 ]
2014-07-29 14:56:35 us=595561 Socket Buffers: R=[196724->65536] S=[9216->65536]
2014-07-29 14:56:35 us=595899 MANAGEMENT: >STATE:1406660195,RESOLVE,,,
2014-07-29 14:56:35 us=675222 Data Channel MTU parms [ L:1590 D:1450 EF:58 EB:135 ET:32 EL:0 AF:3/1 ]
2014-07-29 14:56:35 us=675651 Local Options String: 'V4,dev-type tap,link-mtu 1590,tun-mtu 1532,proto UDPv4,comp-lzo,keydir 1,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client'
2014-07-29 14:56:35 us=675828 Expected Remote Options String: 'V4,dev-type tap,link-mtu 1590,tun-mtu 1532,proto UDPv4,comp-lzo,keydir 0,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-server'
2014-07-29 14:56:35 us=675964 Local Options hash (VER=V4): '48527533'
2014-07-29 14:56:35 us=676074 Expected Remote Options hash (VER=V4): '44bd8b5e'
2014-07-29 14:56:35 us=676183 UDPv4 link local: [undef]
2014-07-29 14:56:35 us=676309 UDPv4 link remote: [AF_INET]1.2.3.4:1194
2014-07-29 14:56:35 us=676641 MANAGEMENT: >STATE:1406660195,WAIT,,,
                                        WRTue Jul 29 14:56:35 2014 us=769419 MANAGEMENT: >STATE:1406660195,AUTH,,,
2014-07-29 14:56:35 us=769705 TLS: Initial packet from [AF_INET]1.2.3.4:1194, sid=8c60247c 29d0402a
                                        RWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRWRTue Jul 29 14:56:36 2014 us=288264 VERIFY OK: depth=1, C=US, ST=NY, L=NewYork, O=***, OU=changeme, CN=changeme, name=changeme, emailAddress=BLAH@FAKEMAIL.com
2014-07-29 14:56:36 us=289315 VERIFY OK: nsCertType=SERVER
2014-07-29 14:56:36 us=289467 VERIFY OK: depth=0, C=US, ST=NY, L=NewYork, O=***, OU=changeme, CN=keyserver, name=changeme, emailAddress=BLAH@FAKEMAIL.com
                                        RRRRWWWWRRRRWRWRTue Jul 29 14:56:36 2014 us=968930 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
2014-07-29 14:56:36 us=969149 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
2014-07-29 14:56:36 us=969289 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
2014-07-29 14:56:36 us=969433 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
                                        WTue Jul 29 14:56:36 2014 us=970958 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
2014-07-29 14:56:36 us=971168 [keyserver] Peer Connection Initiated with [AF_INET]1.2.3.4:1194
2014-07-29 14:56:38 us=143009 MANAGEMENT: >STATE:1406660198,GET_CONFIG,,,
2014-07-29 14:56:39 us=433015 SENT CONTROL [keyserver]: 'PUSH_REQUEST' (status=1)
2014-07-29 14:56:39 us=455635 PUSH: Received control message: 'PUSH_REPLY,route 192.168.1.0 255.255.255.0,dhcp-option DNS 192.168.1.1,dhcp-option WINS 192.168.1.1,route-gateway 192.168.1.1,ping 10,ping-restart 120,ifconfig 192.168.1.241 255.255.255.0'
2014-07-29 14:56:39 us=456359 OPTIONS IMPORT: timers and/or timeouts modified
2014-07-29 14:56:39 us=456639 OPTIONS IMPORT: --ifconfig/up options modified
2014-07-29 14:56:39 us=456805 OPTIONS IMPORT: route options modified
2014-07-29 14:56:39 us=456971 OPTIONS IMPORT: route-related options modified
2014-07-29 14:56:39 us=457120 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
2014-07-29 14:56:39 us=458431 TUN/TAP device /dev/tap0 opened
2014-07-29 14:56:39 us=458618 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
2014-07-29 14:56:39 us=458766 MANAGEMENT: >STATE:1406660199,ASSIGN_IP,,192.168.1.241,
2014-07-29 14:56:39 us=458917 /sbin/ifconfig tap0 delete
                                        ifconfig: ioctl (SIOCDIFADDR): Can't assign requested address
2014-07-29 14:56:39 us=475225 NOTE: Tried to delete pre-existing tun/tap instance -- No Problem if failure
2014-07-29 14:56:39 us=475545 /sbin/ifconfig tap0 192.168.1.241 netmask 255.255.255.0 mtu 1500 up
2014-07-29 14:56:39 us=485724 /Applications/Tunnelblick.app/Contents/Resources/client.up.tunnelblick.sh -m -w -d -a -f -ptADGNWradsgnw tap0 1500 1590 192.168.1.241 255.255.255.0 init
                                        **********************************************
                                        Start of output from client.up.tunnelblick.sh
                                        Configuring tap DNS via OpenVPN
                                        Retrieved from OpenVPN: name server(s) [ 192.168.1.1 ], search domain(s) [  ] and SMB server(s) [ 192.168.1.1 ] and using default domain name [ openvpn ]
                                        Not aggregating ServerAddresses because running on OS X 10.6 or higher
                                        Not aggregating WINSAddresses because running on OS X 10.6 or higher
                                        Setting search domains to 'openvpn' because running under OS X 10.6 or higher and the search domains were not set manually and 'Prepend domain name to search domains' was not selected
                                        Saved the DNS and SMB configurations so they can be restored
                                        Set ServerAddresses to 192.168.1.1
                                        Set SearchDomains   to openvpn
                                        Set DomainName       to openvpn
                                        Set WINSAddresses   to 192.168.1.1
                                        Flushed the DNS cache via dscacheutil
                                        Notified mDNSResponder that the DNS cache was flushed
                                        Setting up to monitor system configuration with process-network-changes
                                        End of output from client.up.tunnelblick.sh
                                        **********************************************
2014-07-29 14:56:42 *Tunnelblick: No 'connected.sh' script to execute
2014-07-29 14:56:42 us=855541 MANAGEMENT: >STATE:1406660202,ADD_ROUTES,,,
2014-07-29 14:56:42 us=855757 /sbin/route add -net 192.168.1.0 192.168.1.1 255.255.255.0
                                        route: writing to routing socket: File exists
                                        add net 192.168.1.0: gateway 192.168.1.1: File exists
2014-07-29 14:56:42 us=865812 Initialization Sequence Completed
2014-07-29 14:56:42 us=866258 MANAGEMENT: >STATE:1406660202,CONNECTED,SUCCESS,192.168.1.241,1.2.3.4
2014-07-29 14:57:17 *Tunnelblick process-network-changes: A system configuration change was ignored
2014-07-29 14:57:18 *Tunnelblick: After 30.0 seconds, gave up trying to fetch IP address information using the ipInfo host's name after connecting.

mcbrown

Ok, I made the requested changes on the Windows machine. This time the connection worked, but still no path to 192.168.1.1.

Here is the client config file:

client
dev tap
dev-node OpenVPN
proto udp
remote 1.2.3.4 1194
resolv-retry infinite
nobind
persist-key
persist-tun
mute-replay-warnings
ns-cert-type server
key-direction 1
cipher AES-256-CBC
comp-lzo
verb 4
mute 20

There are NO errors in the client log file. I am therefore not posting it per your instructions - let me know if you'd like to see the full file or any extracts.

Here are the details of ipconfig /all (mildly redacted to remove personal information):

Windows IP Configuration

   Host Name . . . . . . . . . . . . : WS-zzz
   Primary Dns Suffix  . . . . . . . : yyy.com
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No
   DNS Suffix Search List. . . . . . : yyy.com

Ethernet adapter OpenVPN:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : TAP-Windows Adapter V9
   Physical Address. . . . . . . . . : 00-FF-16-0F-38-B2
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::8d93:e22a:6df4:540%30(Preferred)
   IPv4 Address. . . . . . . . . . . : 192.168.1.240(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Lease Obtained. . . . . . . . . . : Wednesday, July 30, 2014 11:08:26 AM
   Lease Expires . . . . . . . . . . : Thursday, July 30, 2015 11:08:26 AM
   Default Gateway . . . . . . . . . :
   DHCP Server . . . . . . . . . . . : 192.168.1.0
   DHCPv6 IAID . . . . . . . . . . . : 503381782
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-13-A0-21-AE-B8-AC-6F-80-E4-32

   DNS Servers . . . . . . . . . . . : 192.168.1.1
   Primary WINS Server . . . . . . . : 192.168.1.1
   NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter Local Area Connection:

   Connection-specific DNS Suffix  . : yyy.com
   Description . . . . . . . . . . . : Broadcom NetXtreme 57xx Gigabit Controlle
r
   Physical Address. . . . . . . . . : B8-AC-6F-80-E4-32
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::c4f7:b3c4:d6dd:dae3%10(Preferred)
   IPv4 Address. . . . . . . . . . . : 10.3.11.125(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Lease Obtained. . . . . . . . . . : Wednesday, July 09, 2014 5:29:43 PM
   Lease Expires . . . . . . . . . . : Thursday, July 31, 2014 5:31:53 PM
   Default Gateway . . . . . . . . . : 10.3.11.250
   DHCP Server . . . . . . . . . . . : 10.3.11.220
   DHCPv6 IAID . . . . . . . . . . . : 263761007
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-13-A0-21-AE-B8-AC-6F-80-E4-32

   DNS Servers . . . . . . . . . . . : 10.3.11.220
                                       10.3.11.230
   NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter Hamachi:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Hamachi Network Interface
   Physical Address. . . . . . . . . : 7A-79-19-80-90-7D
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   IPv6 Address. . . . . . . . . . . : 2620:9b::1980:907d(Preferred)
   Link-local IPv6 Address . . . . . : fe80::d25:c606:ac02:5948%16(Preferred)
   IPv4 Address. . . . . . . . . . . : 25.#.#.# (Preferred)
   Subnet Mask . . . . . . . . . . . : 255.0.0.0
   Lease Obtained. . . . . . . . . . : Thursday, July 24, 2014 10:41:43 PM
   Lease Expires . . . . . . . . . . : Friday, July 24, 2015 10:42:10 PM
   Default Gateway . . . . . . . . . : 2620:9b::1900:1
                                       25.0.0.1
   DHCP Server . . . . . . . . . . . : 25.0.0.1
   DHCPv6 IAID . . . . . . . . . . . : 393902513
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-13-A0-21-AE-B8-AC-6F-80-E4-32

   DNS Servers . . . . . . . . . . . : fec0:0:0:ffff::1%1
                                       fec0:0:0:ffff::2%1
                                       fec0:0:0:ffff::3%1
   NetBIOS over Tcpip. . . . . . . . : Enabled

Tunnel adapter isatap.yyy.com:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : yyy.com
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter isatap.{C494C48C-FBE5-4656-A63C-E690622AB06D}:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter #2
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter isatap.{160F38B2-857C-41B9-8434-7A471A5BC807}:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter #4
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

My bridge script is below. I took it from an online tutorial but checked its content against the openvpn.net guide.

#!/bin/sh

# Define Bridge Interface
br="br0"

# Define list of TAP interfaces to be bridged,
# for example tap="tap0 tap1 tap2".
tap="tap0"

# Define physical ethernet interface to be bridged
# with TAP interface(s) above.
eth="eth0"
eth_ip="192.168.1.19"
eth_netmask="255.255.255.0"
eth_broadcast="192.168.1.255"
eth_gateway="192.168.1.1"

case "$1" in
start)
    for t in $tap; do
        openvpn --mktun --dev $t
    done

    brctl addbr $br
    brctl addif $br $eth

    for t in $tap; do
        brctl addif $br $t
    done

    for t in $tap; do
        ifconfig $t 0.0.0.0 promisc up
    done

    sleep 2
    ifconfig $eth 0.0.0.0 promisc up

    sleep 2
    ifconfig $br $eth_ip netmask $eth_netmask broadcast $eth_broadcast

    sleep 2
    route add default gw $eth_gateway
    ;;
stop)
    ifconfig $br down
    brctl delbr $br

    for t in $tap; do
        openvpn --rmtun --dev $t
    done

    ifconfig $eth $eth_ip netmask $eth_netmask broadcast $eth_broadcast

    route add default gw $eth_gateway
    ;;
*)
    echo "Usage:  bridge {start|stop}"
    exit 1
    ;;
esac
exit 0

mcbrown

debbie10t wroteAnd check your machine firewalls.

Firewall rules on the server were the culprit. Silly... I never flushed the iptables rules from the routed setup. Once I did so and entered just the rules I needed for the bridged setup it (not so) magically started working.

Lesson (for any future readers of this thread): if you have a working routed configuration in Linux and switch to a bridged setup, flush the old rules from iptables then create new ones.

Sorry for the ordeal, and thank you very much for the help!