Hey guys, I figured you might be able to answer my question in better depth here than anywhere else I've posted this. Sorry if it seems like I'm spamming. If I can ever figure this out I'd love to write a little post on it for everyone else to reference. Without further ado: I would like to set up an OpenVPN server using TAP mode to facilitate the game-streaming capabilities built into Steam to stream from a Windows 7 gaming machine, through an openvpn server, to an externally located Ubuntu 14.04 laptop at work or school. This would allow an Ubuntu user to connect to their steam account on their Windows machines and stream non-linux games to their Ubuntu hardware! [b]Here is the general idea of what I want to accomplish:[/b] Just so you know, means it goes through the internet! Ubuntu Laptop (Steam) Ubuntu OpenVPN server Windows Machine (Steam) We will want to use OpenVPN to create a VPN network on the server that both our Ubuntu Laptop and Windows client can connect to. We must use TAP to forward the full Ethernet frame data as Steam's in-home streaming service does not play well with IP tunnels (TUN). Once both machines are connected to the VPN they will begin broadcasting that their libraries are available for streaming. [b]Current Network Topography:[/b] School/work Ubuntu 14.04 laptop hostname chimaera-linux dynamic internet ip (ipv4) dynamic local ip (10.1.10.x) hardwired connection to eth0 Ubuntu 14.04 KVM virtual machine running OpenVPN hostname cerberus-vm public static internet ip (x.y.145.133) on eth0 (ipv4, hardwired) no local ip or local network Windows 7 Pro desktop hostname windoze dynamic internet ip (ipv4) dynamic local ip (192.168.0.x) hardwired connection to eth0 [b]Requirements:[/b] 1. The clients connected to the VPN must be able to use TAP adapters to send traffic to/from the VPN network. TUN WILL NOT WORK! 2. The VPN network should also be able to forward traffic from the clients to the internet and back (so that we can connect to the VPN and use it as a secure method of browsing). 3. Connection settings should be as secure as possible to prevent MITM attacks or other shenanigannary. 4. The internal VPN network should be stand-alone meaning that it does not allow or interface with either client's or server's respective local networks. I'm not looking to set up a VPN network that allows me to ping other local devices on the server's network - only to be able to connect to other VPN clients using their internal VPN IPs. [b]Steps towards success![/b] Found and used https://help.ubuntu.com/lts/serverguide/openvpn.html as a guide to install OpenVPN on the server and set up certificates. No issues! Found and adapted http://www.slsmk.com/getting-started-with-openvpn/installing-openvpn-on-ubuntu-server-12-04-or-14-04-using-tap/ because the server docs talk about setting up a TUN instead of a TAP. At this point, clients CAN connect and authenticate with the VPN server but traffic does not flow between clients and clients cannot access the internet through the VPN! [b]Relevant configs/system info[/b] The ubuntu VPN client is configure through network-manager according to the LTS server docs. The Windows 7 client is using the OpenVPN-gui package from openvpn.net Can provide any config files at request. Please note that any ip beginning with x.y is just obscured because they are publically accessible ips. I just felt a little naked posting the actual ips on the internet for bots or people to search for. [i]/etc/network/interfaces on cerberus-vm (openvpn server)[/i] [code]## vpn config # The loopback network interface auto lo iface lo inet loopback # The primary network interface auto eth0 auto br0 iface br0 inet static address x.y.145.133 netmask 255.255.255.240 gateway x.y.145.142 network x.y.145.128 broadcast x.y.145.143 bridge_ports eth0 #### NOTE: If you are running OpenVPN in a virtual machine, then uncomment these lines: bridge_fd 9 bridge_hello 2 bridge_maxage 12 bridge_stp off iface eth0 inet manual up ifconfig $IFACE 0.0.0.0 up up ip link set $IFACE promisc on down ip link set $IFACE promisc off down ifconfig $IFACE down [/code] [i]/etc/openvpn/up.sh[/i] [code]#!/bin/sh BR=$1 DEV=$2 MTU=$3 /sbin/ifconfig $DEV mtu $MTU promisc up /sbin/brctl addif $BR $DEV [/code] [i]/etc/openvpn/down.sh[/i] [code]#!/bin/sh BR=$1 DEV=$2 /sbin/brctl delif $BR $DEV /sbin/ifconfig $DEV down [/code] [i]/etc/openvpn/server.conf[/i] [code]proto udp dev tap ca ca.crt cert cerberus-vm.crt key cerberus-vm.key dh dh2048.pem server 10.8.0.0 255.255.255.0 push "redirect-gateway def1" ifconfig-pool-persist ipp.txt keepalive 10 120 tls-auth ta.key 0 # Compress data to save bandwidth comp-lzo user nobody group nogroup persist-key persist-tun # Logs are useful for debugging log-append openvpn-log verb 3 mute 10[/code] [i]ifconfig[/i] [code]br0 Link encap:Ethernet HWaddr 52:54:00:b9:0b:27 inet addr:x.y.145.133 Bcast:x.y.145.143 Mask:255.255.255.240 inet6 addr: fe80::5054:ff:feb9:b27/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:498 errors:0 dropped:0 overruns:0 frame:0 TX packets:493 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:45480 (45.4 KB) TX bytes:66240 (66.2 KB) eth0 Link encap:Ethernet HWaddr 52:54:00:b9:0b:27 UP BROADCAST RUNNING PROMISC MULTICAST MTU:1500 Metric:1 RX packets:522 errors:0 dropped:0 overruns:0 frame:0 TX packets:494 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:56234 (56.2 KB) TX bytes:66302 (66.3 KB) lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MTU:65536 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:0 (0.0 B) TX bytes:0 (0.0 B) tap0 Link encap:Ethernet HWaddr 16:34:3a:0d:4e:7a inet addr:10.8.0.1 Bcast:10.8.0.255 Mask:255.255.255.0 inet6 addr: fe80::1434:3aff:fe0d:4e7a/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:8 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:100 RX bytes:0 (0.0 B) TX bytes:648 (648.0 B)[/code] [i]cat /proc/sys/net/ipv4/ip_forward[/i] [code]1[/code] [i]netstat -rn[/i] [code]Kernel IP routing table Destination Gateway Genmask Flags MSS Window irtt Iface 0.0.0.0 x.y.145.142 0.0.0.0 UG 0 0 0 br0 10.8.0.0 0.0.0.0 255.255.255.0 U 0 0 0 tap0 x.y.145.128 0.0.0.0 255.255.255.240 U 0 0 0 br0 [/code] [i]iptables --list -xvn[/i] [code] Chain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination [/code] [i]windows 7 (windoze) client.ovpn[/i] [code]client remote x.y.145.133 ca keys/ca.crt cert keys/windoze.crt key keys/windoze.key comp-lzo yes dev tap proto udp tls-auth keys/ta.key 1 nobind auth-nocache script-security 2 persist-key persist-tun route-method exe route-delay 2 redirect-gateway def1 remote-cert-tls server [/code] [b]Problem Areas and Mysteries[/b] I just cannot seem to wrap my head around the vpn routes or "push" commands in server.conf for openvpn. I suspect that this is the main reason why I can connect but can't seem to get traffic in our out of the vpn to other clients or to the internet. I'm really fuzzy on the whole routing thing because the server has a static ip and I'm not trying to route clients to any sort of mixed internal lan/vpn lan network like in most of the examples. I just want clients to connect and be put on their own vpn network where only the vpn server or other clients exist. From there they can reach out to other vpn clients or to the internet. Also it seems like half the people doing bridged TAP devices use the "server 10.8.0.0 255.255.255.0" line in their server.conf but mine comes with a comment that says you should comment that out if you are doing ethernet bridging (I am, right?!). I have played with iptables and masquerading and all that to no avail. At this point I don't think that's the problem. Right now iptables is completely unconfigured and accepts all traffic. I have not configured (and don't need?) any bridging or special network settings on any of the clients. Lastly my windows 7 client freezes upon attempt to disconnect and when I view the "status" of the TAP adapter it never says that it receives any packets. It looks like it connects fine and says that it get's a vpn local ip but any attempt to reconnect or kill it after that and it will hang. I have been banging my head for probably 2 days trying to figure this out and at this point I think I've tried so many different things that I've probably compounded my problem and I'm so deep into this thing that I can't see the forest for the trees. Does anyone have suggestions?

[quote="Asmo"] Yes I have absolutely read that page in it's entirety[/quote]So did you see the bit that starts...[quote][b]Ethernet Bridging Notes[/b] When using an ethernet bridging configuration . . .[/quote]

[quote="Traffic"][quote="Asmo"] Yes I have absolutely read that page in it's entirety[/quote]So did you see the bit that starts...[quote][b]Ethernet Bridging Notes[/b] When using an ethernet bridging configuration . . .[/quote][/quote] Hey thanks again for the pointers Traffic! Which point specifically are you wanting me to key in on? I believe the bridge is correctly set up as i have an up.sh and down.sh script that is called by the openvpn server.conf file. Let me know if I'm on the wrong track here...

[quote="Asmo"] Which point specifically are you wanting me to key in on? [/quote]This bit:[quote]The ethernet bridge interface must be set up [u][b]before[/b] OpenVPN is actually started[/u].[/quote]See what i mean ?

You clearly do not understand what a network bridge is and how to use it ... Your OpenVPN Server instance:[quote="Asmo"]server-bridge [b]10.8.0.4[/b] 255.255.255.0 10.8.0.50 10.8.0.100[/quote] Your Network Bridge:[quote="Asmo"]br0 Link encap:Ethernet HWaddr 52:54:00:b9:0b:27 [b]inet addr:x.y.145.133[/b] Bcast:x.y.145.143 Mask:255.255.255.240[/quote] Also, it is entirely possible that if you setup your bridge properly your [i]Ubuntu 14.04 KVM virtual machine running OpenVPN[/i] will start handing out IP addresses on your ISP network (x.y.145.133) and your ISP will terminate your connection completely. The only suggestion I can offer is that you have a second ethernet card (real or virtual) to provide your server with a network (eg: 192.168.89.0/24) into which you can successfully bridge your clients.

Serious issues with TAP adapters and VPN lan clients

Asmo

Hey guys, I figured you might be able to answer my question in better depth here than anywhere else I've posted this. Sorry if it seems like I'm spamming. If I can ever figure this out I'd love to write a little post on it for everyone else to reference.

Without further ado:

I would like to set up an OpenVPN server using TAP mode to facilitate the game-streaming capabilities built into Steam to stream from a Windows 7 gaming machine, through an openvpn server, to an externally located Ubuntu 14.04 laptop at work or school. This would allow an Ubuntu user to connect to their steam account on their Windows machines and stream non-linux games to their Ubuntu hardware!

Here is the general idea of what I want to accomplish:

Just so you know, <---> means it goes through the internet!
Ubuntu Laptop (Steam) <---> Ubuntu OpenVPN server <---> Windows Machine (Steam)

We will want to use OpenVPN to create a VPN network on the server that both our Ubuntu Laptop and Windows client can connect to. We must use TAP to forward the full Ethernet frame data as Steam's in-home streaming service does not play well with IP tunnels (TUN). Once both machines are connected to the VPN they will begin broadcasting that their libraries are available for streaming.

Current Network Topography:

School/work Ubuntu 14.04 laptop
hostname chimaera-linux
dynamic internet ip (ipv4)
dynamic local ip (10.1.10.x)
hardwired connection to eth0

Ubuntu 14.04 KVM virtual machine running OpenVPN
hostname cerberus-vm
public static internet ip (x.y.145.133) on eth0 (ipv4, hardwired)
no local ip or local network

Windows 7 Pro desktop
hostname windoze
dynamic internet ip (ipv4)
dynamic local ip (192.168.0.x)
hardwired connection to eth0

Requirements:

1. The clients connected to the VPN must be able to use TAP adapters to send traffic to/from the VPN network. TUN WILL NOT WORK!
2. The VPN network should also be able to forward traffic from the clients to the internet and back (so that we can connect to the VPN and use it as a secure method of browsing).
3. Connection settings should be as secure as possible to prevent MITM attacks or other shenanigannary.
4. The internal VPN network should be stand-alone meaning that it does not allow or interface with either client's or server's respective local networks. I'm not looking to set up a VPN network that allows me to ping other local devices on the server's network - only to be able to connect to other VPN clients using their internal VPN IPs.

Steps towards success!

Found and used https://help.ubuntu.com/lts/serverguide/openvpn.html as a guide to install OpenVPN on the server and set up certificates. No issues!
Found and adapted http://www.slsmk.com/getting-started-with-openvpn/installing-openvpn-on-ubuntu-server-12-04-or-14-04-using-tap/ because the server docs talk about setting up a TUN instead of a TAP. At this point, clients CAN connect and authenticate with the VPN server but traffic does not flow between clients and clients cannot access the internet through the VPN!

Relevant configs/system info

The ubuntu VPN client is configure through network-manager according to the LTS server docs.

The Windows 7 client is using the OpenVPN-gui package from openvpn.net

Can provide any config files at request.

Please note that any ip beginning with x.y is just obscured because they are publically accessible ips. I just felt a little naked posting the actual ips on the internet for bots or people to search for.

/etc/network/interfaces on cerberus-vm (openvpn server)

## vpn config
# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
auto eth0

auto br0
iface br0 inet static
        address x.y.145.133
        netmask 255.255.255.240
        gateway x.y.145.142
        network x.y.145.128
        broadcast x.y.145.143
        bridge_ports eth0
#### NOTE: If you are running OpenVPN in a virtual machine, then uncomment these lines:
        bridge_fd 9
        bridge_hello 2
        bridge_maxage 12
        bridge_stp off

iface eth0 inet manual
        up ifconfig $IFACE 0.0.0.0 up
        up ip link set $IFACE promisc on
        down ip link set $IFACE promisc off
        down ifconfig $IFACE down

/etc/openvpn/up.sh

#!/bin/sh
BR=$1
DEV=$2
MTU=$3
/sbin/ifconfig $DEV mtu $MTU promisc up
/sbin/brctl addif $BR $DEV

/etc/openvpn/down.sh

#!/bin/sh
BR=$1
DEV=$2
/sbin/brctl delif $BR $DEV
/sbin/ifconfig $DEV down

/etc/openvpn/server.conf

proto udp
dev tap
ca ca.crt
cert cerberus-vm.crt
key cerberus-vm.key
dh dh2048.pem
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1"
ifconfig-pool-persist ipp.txt
keepalive 10 120
tls-auth ta.key 0
# Compress data to save bandwidth
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
# Logs are useful for debugging
log-append openvpn-log
verb 3
mute 10

ifconfig

br0       Link encap:Ethernet  HWaddr 52:54:00:b9:0b:27
          inet addr:x.y.145.133  Bcast:x.y.145.143  Mask:255.255.255.240
          inet6 addr: fe80::5054:ff:feb9:b27/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:498 errors:0 dropped:0 overruns:0 frame:0
          TX packets:493 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:45480 (45.4 KB)  TX bytes:66240 (66.2 KB)

eth0      Link encap:Ethernet  HWaddr 52:54:00:b9:0b:27
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:522 errors:0 dropped:0 overruns:0 frame:0
          TX packets:494 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:56234 (56.2 KB)  TX bytes:66302 (66.3 KB)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

tap0      Link encap:Ethernet  HWaddr 16:34:3a:0d:4e:7a
          inet addr:10.8.0.1  Bcast:10.8.0.255  Mask:255.255.255.0
          inet6 addr: fe80::1434:3aff:fe0d:4e7a/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:8 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:0 (0.0 B)  TX bytes:648 (648.0 B)

cat /proc/sys/net/ipv4/ip_forward

netstat -rn

Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         x.y.145.142  0.0.0.0         UG        0 0          0 br0
10.8.0.0        0.0.0.0         255.255.255.0   U         0 0          0 tap0
x.y.145.128  0.0.0.0         255.255.255.240 U         0 0          0 br0

iptables --list -xvn

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
    pkts      bytes target     prot opt in     out     source               destination

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
    pkts      bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
    pkts      bytes target     prot opt in     out     source               destination

windows 7 (windoze) client.ovpn

client
remote x.y.145.133
ca keys/ca.crt
cert keys/windoze.crt
key keys/windoze.key
comp-lzo yes
dev tap
proto udp
tls-auth keys/ta.key 1
nobind
auth-nocache
script-security 2
persist-key
persist-tun
route-method exe
route-delay 2
redirect-gateway def1
remote-cert-tls server

Problem Areas and Mysteries

I just cannot seem to wrap my head around the vpn routes or "push" commands in server.conf for openvpn. I suspect that this is the main reason why I can connect but can't seem to get traffic in our out of the vpn to other clients or to the internet. I'm really fuzzy on the whole routing thing because the server has a static ip and I'm not trying to route clients to any sort of mixed internal lan/vpn lan network like in most of the examples. I just want clients to connect and be put on their own vpn network where only the vpn server or other clients exist. From there they can reach out to other vpn clients or to the internet.

Also it seems like half the people doing bridged TAP devices use the "server 10.8.0.0 255.255.255.0" line in their server.conf but mine comes with a comment that says you should comment that out if you are doing ethernet bridging (I am, right?!).

I have played with iptables and masquerading and all that to no avail. At this point I don't think that's the problem. Right now iptables is completely unconfigured and accepts all traffic.

I have not configured (and don't need?) any bridging or special network settings on any of the clients.

Lastly my windows 7 client freezes upon attempt to disconnect and when I view the "status" of the TAP adapter it never says that it receives any packets. It looks like it connects fine and says that it get's a vpn local ip but any attempt to reconnect or kill it after that and it will hang.

I have been banging my head for probably 2 days trying to figure this out and at this point I think I've tried so many different things that I've probably compounded my problem and I'm so deep into this thing that I can't see the forest for the trees. Does anyone have suggestions?

Traffic

Have you read this:
http://openvpn.net/index.php/open-source/documentation/miscellaneous/76-ethernet-bridging.html

Use --server-bridge not --server ...

Asmo

Traffic wroteHave you read this:
http://openvpn.net/index.php/open-source/documentation/miscellaneous/76-ethernet-bridging.html

Use --server-bridge not --server ...

Hey thanks for helping Traffic! Yes I have absolutely read that page in it's entirety. I've been through so many different help sites and howtos that at this point my configs are a bad mixture of everything that doesn't work.

I've gone back through and made some changes to try and be as close to that tutorial as possible.

/etc/openvpn/server.conf

proto udp
dev tap0
up "/etc/openvpn/up.sh br0"
down "/etc/openvpn/down.sh br0"
ca ca.crt
cert cerberus-vm.crt
key cerberus-vm.key
dh dh2048.pem
;server 10.8.0.0 255.255.255.0
server-bridge 10.8.0.4 255.255.255.0 10.8.0.50 10.8.0.100
push "redirect-gateway def1"
ifconfig-pool-persist ipp.txt
keepalive 10 120
tls-auth ta.key 0
# Compress data to save bandwidth
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
# Logs are useful for debugging
log-append openvpn-log
status openvpn-status.log
verb 4
mute 10

iptables --list -xvn

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
    pkts      bytes target     prot opt in     out     source               destination
       0        0 ACCEPT     all  --  tap0   *       0.0.0.0/0            0.0.0.0/0
      57     4410 ACCEPT     all  --  br0    *       0.0.0.0/0            0.0.0.0/0

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
    pkts      bytes target     prot opt in     out     source               destination
       0        0 ACCEPT     all  --  br0    *       0.0.0.0/0            0.0.0.0/0

Chain OUTPUT (policy ACCEPT 51 packets, 7316 bytes)
    pkts      bytes target     prot opt in     out     source               destination

netstat -rn

Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         x.y.145.142  0.0.0.0         UG        0 0          0 br0
x.y.145.128  0.0.0.0         255.255.255.240 U         0 0          0 br0

Here's what openvpn-log looks like on cerberus-vm when the windows client connects
/etc/openvpn/openvpn-log

Tue Oct  7 07:38:57 2014 us=9968 MULTI: multi_create_instance called
Tue Oct  7 07:38:57 2014 us=10077 67.190.99.141:51670 Re-using SSL/TLS context
Tue Oct  7 07:38:57 2014 us=10128 67.190.99.141:51670 LZO compression initialized
Tue Oct  7 07:38:57 2014 us=10271 67.190.99.141:51670 Control Channel MTU parms [ L:1574 D:166 EF:66 EB:0 ET:0 EL:0 ]
Tue Oct  7 07:38:57 2014 us=10297 67.190.99.141:51670 Data Channel MTU parms [ L:1574 D:1450 EF:42 EB:135 ET:32 EL:0 AF:3/1 ]
Tue Oct  7 07:38:57 2014 us=10331 67.190.99.141:51670 Local Options String: 'V4,dev-type tap,link-mtu 1574,tun-mtu 1532,proto UDPv4,comp-lzo,keydir 0,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-server'
Tue Oct  7 07:38:57 2014 us=10345 67.190.99.141:51670 Expected Remote Options String: 'V4,dev-type tap,link-mtu 1574,tun-mtu 1532,proto UDPv4,comp-lzo,keydir 1,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-client'
Tue Oct  7 07:38:57 2014 us=10375 67.190.99.141:51670 Local Options hash (VER=V4): '360696c5'
Tue Oct  7 07:38:57 2014 us=10398 67.190.99.141:51670 Expected Remote Options hash (VER=V4): '13a273ba'
Tue Oct  7 07:38:57 2014 us=10441 67.190.99.141:51670 TLS: Initial packet from [AF_INET]67.190.99.141:51670, sid=3cf38c08 c8eb31cb
Tue Oct  7 07:38:57 2014 us=339766 67.190.99.141:51670 VERIFY OK: depth=1, C=US, ST=CO, L=Colorado Springs, O=xxx yyy, OU=xxxvpn, CN=xxxvpn, name=xxxvpn, emailAddress=xxx.yyy@xxx.org
Tue Oct  7 07:38:57 2014 us=340211 67.190.99.141:51670 VERIFY OK: depth=0, C=US, ST=CO, L=Colorado Springs, O=xxx yyy, OU=xxxvpn, CN=windoze, name=xxxvpn, emailAddress=xxx.yyy@xxx.org
Tue Oct  7 07:38:57 2014 us=400389 67.190.99.141:51670 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Oct  7 07:38:57 2014 us=400410 67.190.99.141:51670 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Oct  7 07:38:57 2014 us=400448 67.190.99.141:51670 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Oct  7 07:38:57 2014 us=400454 67.190.99.141:51670 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Oct  7 07:38:57 2014 us=417848 67.190.99.141:51670 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Tue Oct  7 07:38:57 2014 us=417907 67.190.99.141:51670 [windoze] Peer Connection Initiated with [AF_INET]67.190.99.141:51670
Tue Oct  7 07:38:57 2014 us=417923 windoze/67.190.99.141:51670 MULTI_sva: pool returned IPv4=10.8.0.51, IPv6=(Not enabled)
Tue Oct  7 07:38:59 2014 us=905988 windoze/67.190.99.141:51670 PUSH: Received control message: 'PUSH_REQUEST'
Tue Oct  7 07:38:59 2014 us=906049 windoze/67.190.99.141:51670 send_push_reply(): safe_cap=940
Tue Oct  7 07:38:59 2014 us=906105 windoze/67.190.99.141:51670 SENT CONTROL [windoze]: 'PUSH_REPLY,redirect-gateway def1,route-gateway 10.8.0.4,ping 10,ping-restart 120,ifconfig 10.8.0.51 255.255.255.0' (status=1)
Tue Oct  7 07:38:59 2014 us=944258 windoze/67.190.99.141:51670 MULTI: Learn: 00:ff:9f:93:22:39 -> windoze/67.190.99.141:51670
Tue Oct  7 07:40:27 2014 us=380554 windoze/67.190.99.141:51670 PID_ERR replay-window backtrack occurred [6] [SSL-0] [00000__05>EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE] 0:323 0:317 t=1412689227[0] r=[0,64,15,6,1] sl=[61,64,64,528]
Tue Oct  7 07:41:42 2014 us=649190 MULTI: multi_create_instance called
Tue Oct  7 07:41:42 2014 us=649281 67.190.99.141:59645 Re-using SSL/TLS context
Tue Oct  7 07:41:42 2014 us=649332 67.190.99.141:59645 LZO compression initialized
Tue Oct  7 07:41:42 2014 us=649471 67.190.99.141:59645 Control Channel MTU parms [ L:1574 D:166 EF:66 EB:0 ET:0 EL:0 ]
Tue Oct  7 07:41:42 2014 us=649497 67.190.99.141:59645 Data Channel MTU parms [ L:1574 D:1450 EF:42 EB:135 ET:32 EL:0 AF:3/1 ]
Tue Oct  7 07:41:42 2014 us=649530 67.190.99.141:59645 Local Options String: 'V4,dev-type tap,link-mtu 1574,tun-mtu 1532,proto UDPv4,comp-lzo,keydir 0,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-server'
Tue Oct  7 07:41:42 2014 us=649545 67.190.99.141:59645 Expected Remote Options String: 'V4,dev-type tap,link-mtu 1574,tun-mtu 1532,proto UDPv4,comp-lzo,keydir 1,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-client'
Tue Oct  7 07:41:42 2014 us=649574 67.190.99.141:59645 Local Options hash (VER=V4): '360696c5'
Tue Oct  7 07:41:42 2014 us=649596 67.190.99.141:59645 Expected Remote Options hash (VER=V4): '13a273ba'
Tue Oct  7 07:41:42 2014 us=649648 67.190.99.141:59645 TLS: Initial packet from [AF_INET]67.190.99.141:59645, sid=fa9c7821 2eb08ce3
Tue Oct  7 07:41:42 2014 us=995835 67.190.99.141:59645 VERIFY OK: depth=1, C=US, ST=CO, L=Colorado Springs, O=xxx yyy, OU=xxxvpn, CN=xxxvpn, name=xxxvpn, emailAddress=xxx.yyy@xxx.org
Tue Oct  7 07:41:42 2014 us=996228 67.190.99.141:59645 VERIFY OK: depth=0, C=US, ST=CO, L=Colorado Springs, O=xxx yyy, OU=xxxvpn, CN=windoze, name=xxxvpn, emailAddress=xxx.yyy@xxx.org
Tue Oct  7 07:41:43 2014 us=48511 67.190.99.141:59645 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Oct  7 07:41:43 2014 us=48558 67.190.99.141:59645 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Oct  7 07:41:43 2014 us=48673 67.190.99.141:59645 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Oct  7 07:41:43 2014 us=48690 67.190.99.141:59645 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Oct  7 07:41:43 2014 us=65672 67.190.99.141:59645 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Tue Oct  7 07:41:43 2014 us=65732 67.190.99.141:59645 [windoze] Peer Connection Initiated with [AF_INET]67.190.99.141:59645
Tue Oct  7 07:41:43 2014 us=65979 MULTI: new connection by client 'windoze' will cause previous active sessions by this client to be dropped.  Remember to use the --duplicate-cn option if you want multiple clients using the same certificate or username to concurrently connect.
Tue Oct  7 07:41:43 2014 us=66012 MULTI_sva: pool returned IPv4=10.8.0.51, IPv6=(Not enabled)
Tue Oct  7 07:41:45 2014 us=580954 windoze/67.190.99.141:59645 PUSH: Received control message: 'PUSH_REQUEST'
Tue Oct  7 07:41:45 2014 us=581025 windoze/67.190.99.141:59645 send_push_reply(): safe_cap=940
Tue Oct  7 07:41:45 2014 us=581083 windoze/67.190.99.141:59645 SENT CONTROL [windoze]: 'PUSH_REPLY,redirect-gateway def1,route-gateway 10.8.0.4,ping 10,ping-restart 120,ifconfig 10.8.0.51 255.255.255.0' (status=1)
Tue Oct  7 07:42:10 2014 us=185192 windoze/67.190.99.141:59645 MULTI: Learn: 00:ff:9f:93:22:39 -> windoze/67.190.99.141:59645

and here's what the windows client log shows
windoze client.log

Tue Oct 07 07:38:53 2014 OpenVPN 2.3.4 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Aug  7 2014
Tue Oct 07 07:38:53 2014 library versions: OpenSSL 1.0.1i 6 Aug 2014, LZO 2.05
Enter Management Password:
Tue Oct 07 07:38:53 2014 Control Channel Authentication: using 'keys/ta.key' as a OpenVPN static key file
Tue Oct 07 07:38:53 2014 UDPv4 link local: [undef]
Tue Oct 07 07:38:53 2014 UDPv4 link remote: [AF_INET]x.y.145.133:1194
Tue Oct 07 07:38:54 2014 [cerberus-vm] Peer Connection Initiated with [AF_INET]x.y.145.133:1194
Tue Oct 07 07:38:56 2014 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Tue Oct 07 07:38:56 2014 open_tun, tt->ipv6=0
Tue Oct 07 07:38:56 2014 TAP-WIN32 device [Local Area Connection 2] opened: \\.\Global\{9F932239-A888-49CB-B349-468F50AC7431}.tap
Tue Oct 07 07:38:56 2014 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.51/255.255.255.0 on interface {9F932239-A888-49CB-B349-468F50AC7431} [DHCP-serv: 10.8.0.0, lease-time: 31536000]
Tue Oct 07 07:38:56 2014 Successful ARP Flush on interface [17] {9F932239-A888-49CB-B349-468F50AC7431}
Tue Oct 07 07:38:58 2014 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Tue Oct 07 07:38:58 2014 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Tue Oct 07 07:38:58 2014 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Tue Oct 07 07:38:58 2014 Initialization Sequence Completed
Tue Oct 07 07:41:37 2014 [cerberus-vm] Inactivity timeout (--ping-restart), restarting
Tue Oct 07 07:41:37 2014 SIGUSR1[soft,ping-restart] received, process restarting
Tue Oct 07 07:41:39 2014 UDPv4 link local: [undef]
Tue Oct 07 07:41:39 2014 UDPv4 link remote: [AF_INET]x.y.145.133:1194
Tue Oct 07 07:41:39 2014 [cerberus-vm] Peer Connection Initiated with [AF_INET]x.y.145.133:1194
Tue Oct 07 07:41:42 2014 Preserving previous TUN/TAP instance: Local Area Connection 2
Tue Oct 07 07:41:42 2014 Initialization Sequence Completed

So I can definitely see the client connecting! And it is being served an address of 10.8.0.51! Great! But it seems like I can't ping anything from the windows client. Ping fails to 10.8.0.1 and 10.8.0.4?
I also can't ping the other client on 10.8.0.50 (chimaera-linux). Also eventually after a minute or two the windows client will appear to be disconnected again from the vpn. Probably because the keepalive packets aren't flowing? Then it will try and reconnect again and turn green for a little while.

/etc/openvpn/openvpn-status.log

OpenVPN CLIENT LIST
Updated,Tue Oct  7 07:58:46 2014
Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since
windoze,67.190.99.141:58207,7937,8484,Tue Oct  7 07:58:15 2014
chimaera-linux,10.1.10.12:48638,8520,10297,Tue Oct  7 07:58:37 2014
ROUTING TABLE
Virtual Address,Common Name,Real Address,Last Ref
00:ff:9f:93:22:39,windoze,67.190.99.141:58207,Tue Oct  7 07:58:28 2014
GLOBAL STATS
Max bcast/mcast queue length,2
END

/etc/openvpn/ipp.txt

chimaera-linux,10.8.0.50
windoze,10.8.0.51

Why doesn't the openvpn-status.log show the VPN ip for windoze of 10.8.0.51? How come the other client didn't even show up in the routing table above? I'm so confused. Going to whatismyip.com from the windows client after connecting to the vpn server still shows the original home dynamic ip instead of the public ip of the server. No traffic seems to be getting out or going anywhere. Why is the gateway from the config file 10.8.0.4? What even is that? Sorry if I'm all over the place here!

Traffic

Asmo wrote Yes I have absolutely read that page in it's entirety

So did you see the bit that starts...

Ethernet Bridging Notes

When using an ethernet bridging configuration . . .

Asmo

Traffic wrote
Asmo wrote Yes I have absolutely read that page in it's entirety
So did you see the bit that starts...
Ethernet Bridging Notes

When using an ethernet bridging configuration . . .

Hey thanks again for the pointers Traffic! Which point specifically are you wanting me to key in on? I believe the bridge is correctly set up as i have an up.sh and down.sh script that is called by the openvpn server.conf file. Let me know if I'm on the wrong track here...

Traffic

Asmo wrote Which point specifically are you wanting me to key in on?

This bit:

The ethernet bridge interface must be set up before OpenVPN is actually started.

See what i mean ?

Asmo

Traffic wrote
Asmo wrote Which point specifically are you wanting me to key in on?
This bit:
The ethernet bridge interface must be set up before OpenVPN is actually started.
See what i mean ?

Hah you are right! I did have problems with the up.sh and down.sh scripts. The server.conf up and down directives were not calling them correctly so they would fail. I think I've fixed that with the new server.conf. According to the logs it does look like the bridging is successfully established this time.
/etc/openvpn/server.conf

mode server
tls-server

local x.y.145.133
port 1194
proto udp

dev tap0
up "/etc/openvpn/up.sh br0 tap0 1500"
down "/etc/openvpn/down.sh br0 tap0"

ca ca.crt
cert cerberus-vm.crt
key cerberus-vm.key
dh dh2048.pem
tls-auth ta.key 0

server-bridge 10.8.0.4 255.255.255.0 10.8.0.50 10.8.0.100
;push "route 10.8.0.0 255.255.255.0"
;client-to-client
push "redirect-gateway def1"

ifconfig-pool-persist ipp.txt
keepalive 10 120


# Compress data to save bandwidth
comp-lzo

user nobody
group nogroup
persist-key
persist-tun

# Logs are useful for debugging
log openvpn-log
status openvpn-status.log
verb 4
mute 10

ifconfig on cerberus-vm before openvpn starts

br0       Link encap:Ethernet  HWaddr 52:54:00:b9:0b:27
          inet addr:x.y.145.133  Bcast:x.y.145.143  Mask:255.255.255.240
          inet6 addr: fe80::5054:ff:feb9:b27/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:4122 errors:0 dropped:0 overruns:0 frame:0
          TX packets:3517 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:622683 (622.6 KB)  TX bytes:670508 (670.5 KB)

eth0      Link encap:Ethernet  HWaddr 52:54:00:b9:0b:27
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:3511 errors:0 dropped:0 overruns:0 frame:0
          TX packets:4193 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:538178 (538.1 KB)  TX bytes:819744 (819.7 KB)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

/etc/openvpn/openvpn-log output showing successful bridge initialization with the up.sh script

Tue Oct  7 21:29:10 2014 us=548690 Current Parameter Settings:
Tue Oct  7 21:29:10 2014 us=548736   config = '/etc/openvpn/server.conf'
Tue Oct  7 21:29:10 2014 us=548743   mode = 1
Tue Oct  7 21:29:10 2014 us=548748   persist_config = DISABLED
Tue Oct  7 21:29:10 2014 us=548752   persist_mode = 1
Tue Oct  7 21:29:10 2014 us=548757   show_ciphers = DISABLED
Tue Oct  7 21:29:10 2014 us=548761   show_digests = DISABLED
Tue Oct  7 21:29:10 2014 us=548766   show_engines = DISABLED
Tue Oct  7 21:29:10 2014 us=548770   genkey = DISABLED
Tue Oct  7 21:29:10 2014 us=548774   key_pass_file = '[UNDEF]'
Tue Oct  7 21:29:10 2014 us=548779 NOTE: --mute triggered...
Tue Oct  7 21:29:10 2014 us=548794 269 variation(s) on previous 10 message(s) suppressed by --mute
Tue Oct  7 21:29:10 2014 us=548800 OpenVPN 2.3.2 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [eurephia] [MH] [IPv6] built on Feb  4 2014
Tue Oct  7 21:29:10 2014 us=548860 NOTE: when bridging your LAN adapter with the TAP adapter, note that the new bridge adapter will often take on its own IP address that is different from what the LAN adapter was previously set to
Tue Oct  7 21:29:10 2014 us=548933 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Tue Oct  7 21:29:10 2014 us=553580 Diffie-Hellman initialized with 2048 bit key
Tue Oct  7 21:29:10 2014 us=553891 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
Tue Oct  7 21:29:10 2014 us=553903 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Oct  7 21:29:10 2014 us=553910 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Oct  7 21:29:10 2014 us=553919 TLS-Auth MTU parms [ L:1574 D:166 EF:66 EB:0 ET:0 EL:0 ]
Tue Oct  7 21:29:10 2014 us=553934 Socket Buffers: R=[212992->131072] S=[212992->131072]
Tue Oct  7 21:29:10 2014 us=557806 TUN/TAP device tap0 opened
Tue Oct  7 21:29:10 2014 us=557823 TUN/TAP TX queue length set to 100
Tue Oct  7 21:29:10 2014 us=557846 /etc/openvpn/up.sh br0 tap0 1500 tap0 1500 1574   init
Tue Oct  7 21:29:10 2014 us=560109 Data Channel MTU parms [ L:1574 D:1450 EF:42 EB:135 ET:32 EL:0 AF:3/1 ]
Tue Oct  7 21:29:10 2014 us=561138 GID set to nogroup
Tue Oct  7 21:29:10 2014 us=561166 UID set to nobody
Tue Oct  7 21:29:10 2014 us=561183 UDPv4 link local (bound): [AF_INET]x.y.145.133:1194
Tue Oct  7 21:29:10 2014 us=561189 UDPv4 link remote: [undef]
Tue Oct  7 21:29:10 2014 us=561196 MULTI: multi_init called, r=256 v=256
Tue Oct  7 21:29:10 2014 us=561228 IFCONFIG POOL: base=10.8.0.50 size=51, ipv6=0
Tue Oct  7 21:29:10 2014 us=561238 ifconfig_pool_read(), in='chimaera-linux,10.8.0.50', TODO: IPv6
Tue Oct  7 21:29:10 2014 us=561251 succeeded -> ifconfig_pool_set()
Tue Oct  7 21:29:10 2014 us=561256 ifconfig_pool_read(), in='windoze,10.8.0.51', TODO: IPv6
Tue Oct  7 21:29:10 2014 us=561261 succeeded -> ifconfig_pool_set()
Tue Oct  7 21:29:10 2014 us=561266 IFCONFIG POOL LIST
Tue Oct  7 21:29:10 2014 us=561271 chimaera-linux,10.8.0.50
Tue Oct  7 21:29:10 2014 us=561276 windoze,10.8.0.51
Tue Oct  7 21:29:10 2014 us=561311 Initialization Sequence Completed
Tue Oct  7 21:29:12 2014 us=793485 MULTI: multi_create_instance called

ifconfig on cerberus-vm after openvpn starts

br0       Link encap:Ethernet  HWaddr 52:54:00:b9:0b:27
          inet addr:x.y.145.133  Bcast:x.y.145.143  Mask:255.255.255.240
          inet6 addr: fe80::5054:ff:feb9:b27/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:4276 errors:0 dropped:0 overruns:0 frame:0
          TX packets:3663 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:639664 (639.6 KB)  TX bytes:693369 (693.3 KB)

eth0      Link encap:Ethernet  HWaddr 52:54:00:b9:0b:27
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:3663 errors:0 dropped:0 overruns:0 frame:0
          TX packets:4342 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:556775 (556.7 KB)  TX bytes:843127 (843.1 KB)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

tap0      Link encap:Ethernet  HWaddr da:a0:3a:d5:37:0b
          inet6 addr: fe80::d8a0:3aff:fed5:370b/64 Scope:Link
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:3 errors:0 dropped:0 overruns:0 frame:0
          TX packets:7 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:624 (624.0 B)  TX bytes:578 (578.0 B)

And clients are still able to connect successfully it looks like. Thanks for pointing me in the right direction on that one! Now that that's done (I hope) I think we can begin to tackle some of the other problems like clients can't seem to ping each other or anywhere on the vpn, TAP adapter on windows client never shows any received packets and constantly disconnects with either

Tue Oct 07 21:34:40 2014 No reply from server after sending 12 push requests
Tue Oct 07 21:34:40 2014 SIGUSR1[soft,no-push-reply] received, process restarting
Tue Oct 07 21:34:42 2014 UDPv4 link local: [undef]
Tue Oct 07 21:34:42 2014 UDPv4 link remote: [AF_INET]x.y.145.133:1194

Tue Oct 07 21:33:34 2014 [cerberus-vm] Inactivity timeout (--ping-restart), restarting
Tue Oct 07 21:33:34 2014 SIGUSR1[soft,ping-restart] received, process restarting
Tue Oct 07 21:33:36 2014 UDPv4 link local: [undef]
Tue Oct 07 21:33:36 2014 UDPv4 link remote: [AF_INET]x.y.145.133:1194

Now I have several misunderstandings about the server config file at this point which I'll try to explain and can't seem to wrap my head around. Some involve push commands and routes, some involve server.conf command usage.

1. At the top of server.conf the local directive gives me pause... is it OK to have a public static ip in that declaration? I assume so or else how else would internet clients be able to connect to the vpn?

local x.y.145.133

2. What in the heck is the server-bridge directive actually doing? I copied and pasted it from someone else's usage and I think that's what is partially screwing me up. I'd write my own but like I said I'm not confident that I'm actually grasping what this directive is supposed to be doing. What the heck is 10.8.0.4? According to docs it seems like that is the gateway? Should this be x.y.145.142, the gateway in /etc/network/interfaces for br0? Or should it be the IP of the openvpn server itself (e.g. x.y.145.133). The rest of the line seems to make sense to me... it's giving out vpn addresses to clients as they connect from 10.8.0.50-100. That's what I want - to have clients connect and get a vpn ip of some local network so that they all think they are on a local network and can communicate with each other.

server-bridge 10.8.0.4 255.255.255.0 10.8.0.50 10.8.0.100

3. The push commands seem like another area where a mis or non-configuration might cause network traffic to not flow right (or at all). I tried starting the openvpn service with the push command below uncommented and then with the client-to-client directive also uncommented. Neither seemed to make a lick of difference. Clients still couldn't ping or see each other. openvpn-status also never showed any evidence of vpn ips in the routing table, just what looks like MAC addresses. I know in TUN mode there are the vpn ips of all the clients listed. I was hoping the behavior would be the same for a TAP server/client configuration, otherwise how can you tell what client has what internal ip?

;push "route 10.8.0.0 255.255.255.0"
;client-to-client

4. The redirect-gateway def1 directive appears both in the client and server configurations. I understand that using this directive means that in theory ALL TRAFFIC (including DNS requests) should flow over the VPN. Thus clients could go to a site like whatismyip.com and the site would show the ip of remote clients as the openvpn public server ip. This is exactly what I want (in addition to also being able to see local clients and traffic through the vpn). However, it seems like this directive is completely ignored because even through my vpn-connected windows clients I still see my dynamic internet IP everywhere with no evidence that anything is actually going through the VPN. Not really sure how to remedy this and I'm hoping its because some other command above is malformed and this directive with "automagically" work when the other one is fixed.

push "redirect-gateway def1"

5. iptables is unconfigured at this point but ipv4 forwarding is enabled. I see a lot of people doing forwarding and all of that but it seems like that is mostly for TUN adapters. If the server.conf is absolutely right then this would be the last thing I'd try to fix.

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
    pkts      bytes target     prot opt in     out     source               destination

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
    pkts      bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
    pkts      bytes target     prot opt in     out     source               destination

So there you go. I can't seem to ping or be pinged from or to the client and the traffic doesn't seem to actually be flowing through the vpn. BUT thanks to your earlier tips it looks like at least the bridge is correctly created and used. Any more ideas?

Traffic

You clearly do not understand what a network bridge is and how to use it ...

Your OpenVPN Server instance:

Asmo wroteserver-bridge 10.8.0.4 255.255.255.0 10.8.0.50 10.8.0.100

Your Network Bridge:

Asmo wrotebr0 Link encap:Ethernet HWaddr 52:54:00:b9:0b:27
inet addr:x.y.145.133 Bcast:x.y.145.143 Mask:255.255.255.240

Also, it is entirely possible that if you setup your bridge properly your Ubuntu 14.04 KVM virtual machine running OpenVPN will start handing out IP addresses on your ISP network (x.y.145.133) and your ISP will terminate your connection completely.

The only suggestion I can offer is that you have a second ethernet card (real or virtual) to provide your server with a network (eg: 192.168.89.0/24) into which you can successfully bridge your clients.