Client repeatedly connects and then disconnects

CraftyClown

Hi there,

I'm new to OpenVPN, so this is quite possibly a stupid mistake or incredibly basic question I'm asking, so please bear with me.

I'm using OpenVPN as a server on my Netgear WNDR3700v2 router, running the latest build of dd-wrt (DD-WRT v24-sp2 (10/27/14) std - build 25179)

I have OpenVPN installed on my client laptop, running Windows 8.1. When I run it, it seems to connect but then disconnect again almost immediately. My laptop is currently on the same LAN as the server, for testing purposes. I'm not sure if that would make a difference? However I have tried connecting with OpenVPN on my Android phone via 4G and I have the same disconnection problem.

These are the log files from my client when I try to connect... (Moderator Edit: Use /code)

Sat Nov 01 10:25:47 2014 us=981865 Current Parameter Settings:
Sat Nov 01 10:25:47 2014 us=982865   config = 'laptop.ovpn'
Sat Nov 01 10:25:47 2014 us=982865   mode = 0
Sat Nov 01 10:25:47 2014 us=982865   show_ciphers = DISABLED
Sat Nov 01 10:25:47 2014 us=982865   show_digests = DISABLED
Sat Nov 01 10:25:47 2014 us=982865   show_engines = DISABLED
Sat Nov 01 10:25:47 2014 us=982865   genkey = DISABLED
Sat Nov 01 10:25:47 2014 us=982865   key_pass_file = '[UNDEF]'
Sat Nov 01 10:25:47 2014 us=982865   show_tls_ciphers = DISABLED
Sat Nov 01 10:25:47 2014 us=982865 Connection profiles [default]:
Sat Nov 01 10:25:47 2014 us=982865   proto = tcp-client
Sat Nov 01 10:25:47 2014 us=982865   local = '[UNDEF]'
Sat Nov 01 10:25:47 2014 us=982865   local_port = 0
Sat Nov 01 10:25:47 2014 us=982865   remote = '*********.dynalias.com'
Sat Nov 01 10:25:47 2014 us=982865   remote_port = 1194
Sat Nov 01 10:25:47 2014 us=982865   remote_float = DISABLED
Sat Nov 01 10:25:47 2014 us=982865   bind_defined = DISABLED
Sat Nov 01 10:25:47 2014 us=982865   bind_local = DISABLED
Sat Nov 01 10:25:47 2014 us=982865   connect_retry_seconds = 5
Sat Nov 01 10:25:47 2014 us=982865   connect_timeout = 10
Sat Nov 01 10:25:47 2014 us=982865   connect_retry_max = 0
Sat Nov 01 10:25:47 2014 us=982865   socks_proxy_server = '[UNDEF]'
Sat Nov 01 10:25:47 2014 us=982865   socks_proxy_port = 0
Sat Nov 01 10:25:47 2014 us=982865   socks_proxy_retry = DISABLED
Sat Nov 01 10:25:47 2014 us=982865   tun_mtu = 1500
Sat Nov 01 10:25:47 2014 us=982865   tun_mtu_defined = ENABLED
Sat Nov 01 10:25:47 2014 us=982865   link_mtu = 1500
Sat Nov 01 10:25:47 2014 us=982865   link_mtu_defined = DISABLED
Sat Nov 01 10:25:47 2014 us=982865   tun_mtu_extra = 0
Sat Nov 01 10:25:47 2014 us=982865   tun_mtu_extra_defined = DISABLED
Sat Nov 01 10:25:47 2014 us=982865   mtu_discover_type = -1
Sat Nov 01 10:25:47 2014 us=982865   fragment = 0
Sat Nov 01 10:25:47 2014 us=982865   mssfix = 1450
Sat Nov 01 10:25:47 2014 us=982865   explicit_exit_notification = 0
Sat Nov 01 10:25:47 2014 us=982865 Connection profiles END
Sat Nov 01 10:25:47 2014 us=982865   remote_random = DISABLED
Sat Nov 01 10:25:47 2014 us=982865   ipchange = '[UNDEF]'
Sat Nov 01 10:25:47 2014 us=982865   dev = 'tun'
Sat Nov 01 10:25:47 2014 us=982865   dev_type = '[UNDEF]'
Sat Nov 01 10:25:47 2014 us=982865   dev_node = '[UNDEF]'
Sat Nov 01 10:25:47 2014 us=982865   lladdr = '[UNDEF]'
Sat Nov 01 10:25:47 2014 us=982865   topology = 1
Sat Nov 01 10:25:47 2014 us=982865   tun_ipv6 = DISABLED
Sat Nov 01 10:25:47 2014 us=982865   ifconfig_local = '[UNDEF]'
Sat Nov 01 10:25:47 2014 us=982865   ifconfig_remote_netmask = '[UNDEF]'
Sat Nov 01 10:25:47 2014 us=982865   ifconfig_noexec = DISABLED
Sat Nov 01 10:25:47 2014 us=982865   ifconfig_nowarn = DISABLED
Sat Nov 01 10:25:47 2014 us=982865   ifconfig_ipv6_local = '[UNDEF]'
Sat Nov 01 10:25:47 2014 us=982865   ifconfig_ipv6_netbits = 0
Sat Nov 01 10:25:47 2014 us=982865   ifconfig_ipv6_remote = '[UNDEF]'
Sat Nov 01 10:25:47 2014 us=982865   shaper = 0
Sat Nov 01 10:25:47 2014 us=982865   mtu_test = 0
Sat Nov 01 10:25:47 2014 us=982865   mlock = DISABLED
Sat Nov 01 10:25:47 2014 us=982865   keepalive_ping = 0
Sat Nov 01 10:25:47 2014 us=982865   keepalive_timeout = 0
Sat Nov 01 10:25:47 2014 us=982865   inactivity_timeout = 0
Sat Nov 01 10:25:47 2014 us=982865   ping_send_timeout = 0
Sat Nov 01 10:25:47 2014 us=982865   ping_rec_timeout = 0
Sat Nov 01 10:25:47 2014 us=982865   ping_rec_timeout_action = 0
Sat Nov 01 10:25:47 2014 us=982865   ping_timer_remote = DISABLED
Sat Nov 01 10:25:47 2014 us=982865   remap_sigusr1 = 0
Sat Nov 01 10:25:47 2014 us=982865   persist_tun = ENABLED
Sat Nov 01 10:25:47 2014 us=982865   persist_local_ip = DISABLED
Sat Nov 01 10:25:47 2014 us=982865   persist_remote_ip = DISABLED
Sat Nov 01 10:25:47 2014 us=982865   persist_key = ENABLED
Sat Nov 01 10:25:47 2014 us=982865   passtos = DISABLED
Sat Nov 01 10:25:47 2014 us=982865   resolve_retry_seconds = 1000000000
Sat Nov 01 10:25:47 2014 us=982865   username = '[UNDEF]'
Sat Nov 01 10:25:47 2014 us=983866   groupname = '[UNDEF]'
Sat Nov 01 10:25:47 2014 us=983866   chroot_dir = '[UNDEF]'
Sat Nov 01 10:25:47 2014 us=983866   cd_dir = '[UNDEF]'
Sat Nov 01 10:25:47 2014 us=983866   writepid = '[UNDEF]'
Sat Nov 01 10:25:47 2014 us=983866   up_script = '[UNDEF]'
Sat Nov 01 10:25:47 2014 us=983866   down_script = '[UNDEF]'
Sat Nov 01 10:25:47 2014 us=983866   down_pre = DISABLED
Sat Nov 01 10:25:47 2014 us=983866   up_restart = DISABLED
Sat Nov 01 10:25:47 2014 us=983866   up_delay = DISABLED
Sat Nov 01 10:25:47 2014 us=983866   daemon = DISABLED
Sat Nov 01 10:25:47 2014 us=983866   inetd = 0
Sat Nov 01 10:25:47 2014 us=983866   log = ENABLED
Sat Nov 01 10:25:47 2014 us=983866   suppress_timestamps = DISABLED
Sat Nov 01 10:25:47 2014 us=983866   nice = 0
Sat Nov 01 10:25:47 2014 us=983866   verbosity = 4
Sat Nov 01 10:25:47 2014 us=983866   mute = 0
Sat Nov 01 10:25:47 2014 us=983866   status_file = '[UNDEF]'
Sat Nov 01 10:25:47 2014 us=983866   status_file_version = 1
Sat Nov 01 10:25:47 2014 us=983866   status_file_update_freq = 60
Sat Nov 01 10:25:47 2014 us=983866   occ = ENABLED
Sat Nov 01 10:25:47 2014 us=983866   rcvbuf = 0
Sat Nov 01 10:25:47 2014 us=983866   sndbuf = 0
Sat Nov 01 10:25:47 2014 us=983866   sockflags = 0
Sat Nov 01 10:25:47 2014 us=983866   fast_io = DISABLED
Sat Nov 01 10:25:47 2014 us=983866   lzo = 7
Sat Nov 01 10:25:47 2014 us=983866   route_script = '[UNDEF]'
Sat Nov 01 10:25:47 2014 us=983866   route_default_gateway = '[UNDEF]'
Sat Nov 01 10:25:47 2014 us=983866   route_default_metric = 0
Sat Nov 01 10:25:47 2014 us=983866   route_noexec = DISABLED
Sat Nov 01 10:25:47 2014 us=983866   route_delay = 5
Sat Nov 01 10:25:47 2014 us=983866   route_delay_window = 30
Sat Nov 01 10:25:47 2014 us=983866   route_delay_defined = ENABLED
Sat Nov 01 10:25:47 2014 us=983866   route_nopull = DISABLED
Sat Nov 01 10:25:47 2014 us=983866   route_gateway_via_dhcp = DISABLED
Sat Nov 01 10:25:47 2014 us=983866   max_routes = 100
Sat Nov 01 10:25:47 2014 us=983866   allow_pull_fqdn = DISABLED
Sat Nov 01 10:25:47 2014 us=983866   management_addr = '127.0.0.1'
Sat Nov 01 10:25:47 2014 us=983866   management_port = 25340
Sat Nov 01 10:25:47 2014 us=983866   management_user_pass = 'stdin'
Sat Nov 01 10:25:47 2014 us=983866   management_log_history_cache = 250
Sat Nov 01 10:25:47 2014 us=983866   management_echo_buffer_size = 100
Sat Nov 01 10:25:47 2014 us=983866   management_write_peer_info_file = '[UNDEF]'
Sat Nov 01 10:25:47 2014 us=983866   management_client_user = '[UNDEF]'
Sat Nov 01 10:25:47 2014 us=983866   management_client_group = '[UNDEF]'
Sat Nov 01 10:25:47 2014 us=983866   management_flags = 6
Sat Nov 01 10:25:47 2014 us=983866   shared_secret_file = '[UNDEF]'
Sat Nov 01 10:25:47 2014 us=983866   key_direction = 0
Sat Nov 01 10:25:47 2014 us=983866   ciphername_defined = ENABLED
Sat Nov 01 10:25:47 2014 us=983866   ciphername = 'AES-128-CBC'
Sat Nov 01 10:25:47 2014 us=983866   authname_defined = ENABLED
Sat Nov 01 10:25:47 2014 us=983866   authname = 'SHA1'
Sat Nov 01 10:25:47 2014 us=983866   prng_hash = 'SHA1'
Sat Nov 01 10:25:47 2014 us=983866   prng_nonce_secret_len = 16
Sat Nov 01 10:25:47 2014 us=983866   keysize = 0
Sat Nov 01 10:25:47 2014 us=983866   engine = DISABLED
Sat Nov 01 10:25:47 2014 us=983866   replay = ENABLED
Sat Nov 01 10:25:47 2014 us=983866   mute_replay_warnings = DISABLED
Sat Nov 01 10:25:47 2014 us=983866   replay_window = 64
Sat Nov 01 10:25:47 2014 us=983866   replay_time = 15
Sat Nov 01 10:25:47 2014 us=983866   packet_id_file = '[UNDEF]'
Sat Nov 01 10:25:47 2014 us=983866   use_iv = ENABLED
Sat Nov 01 10:25:47 2014 us=983866   test_crypto = DISABLED
Sat Nov 01 10:25:47 2014 us=983866   tls_server = DISABLED
Sat Nov 01 10:25:47 2014 us=983866   tls_client = ENABLED
Sat Nov 01 10:25:47 2014 us=983866   key_method = 2
Sat Nov 01 10:25:47 2014 us=983866   ca_file = 'ca.crt'
Sat Nov 01 10:25:47 2014 us=983866   ca_path = '[UNDEF]'
Sat Nov 01 10:25:47 2014 us=983866   dh_file = '[UNDEF]'
Sat Nov 01 10:25:47 2014 us=983866   cert_file = 'laptop.crt'
Sat Nov 01 10:25:47 2014 us=983866   priv_key_file = 'laptop.key'
Sat Nov 01 10:25:47 2014 us=983866   pkcs12_file = '[UNDEF]'
Sat Nov 01 10:25:47 2014 us=983866   cryptoapi_cert = '[UNDEF]'
Sat Nov 01 10:25:47 2014 us=983866   cipher_list = '[UNDEF]'
Sat Nov 01 10:25:47 2014 us=983866   tls_verify = '[UNDEF]'
Sat Nov 01 10:25:47 2014 us=983866   tls_export_cert = '[UNDEF]'
Sat Nov 01 10:25:47 2014 us=983866   verify_x509_type = 0
Sat Nov 01 10:25:47 2014 us=983866   verify_x509_name = '[UNDEF]'
Sat Nov 01 10:25:47 2014 us=983866   crl_file = '[UNDEF]'
Sat Nov 01 10:25:47 2014 us=983866   ns_cert_type = 1
Sat Nov 01 10:25:47 2014 us=983866   remote_cert_ku[i] = 0
Sat Nov 01 10:25:47 2014 us=983866   remote_cert_ku[i] = 0
Sat Nov 01 10:25:47 2014 us=983866   remote_cert_ku[i] = 0
Sat Nov 01 10:25:47 2014 us=983866   remote_cert_ku[i] = 0
Sat Nov 01 10:25:47 2014 us=983866   remote_cert_ku[i] = 0
Sat Nov 01 10:25:47 2014 us=983866   remote_cert_ku[i] = 0
Sat Nov 01 10:25:47 2014 us=983866   remote_cert_ku[i] = 0
Sat Nov 01 10:25:47 2014 us=983866   remote_cert_ku[i] = 0
Sat Nov 01 10:25:47 2014 us=983866   remote_cert_ku[i] = 0
Sat Nov 01 10:25:47 2014 us=983866   remote_cert_ku[i] = 0
Sat Nov 01 10:25:47 2014 us=983866   remote_cert_ku[i] = 0
Sat Nov 01 10:25:47 2014 us=983866   remote_cert_ku[i] = 0
Sat Nov 01 10:25:47 2014 us=983866   remote_cert_ku[i] = 0
Sat Nov 01 10:25:47 2014 us=983866   remote_cert_ku[i] = 0
Sat Nov 01 10:25:47 2014 us=983866   remote_cert_ku[i] = 0
Sat Nov 01 10:25:47 2014 us=983866   remote_cert_ku[i] = 0
Sat Nov 01 10:25:47 2014 us=984866   remote_cert_eku = '[UNDEF]'
Sat Nov 01 10:25:47 2014 us=984866   ssl_flags = 0
Sat Nov 01 10:25:47 2014 us=984866   tls_timeout = 2
Sat Nov 01 10:25:47 2014 us=984866   renegotiate_bytes = 0
Sat Nov 01 10:25:47 2014 us=984866   renegotiate_packets = 0
Sat Nov 01 10:25:47 2014 us=984866   renegotiate_seconds = 3600
Sat Nov 01 10:25:47 2014 us=984866   handshake_window = 60
Sat Nov 01 10:25:47 2014 us=984866   transition_window = 3600
Sat Nov 01 10:25:47 2014 us=984866   single_session = DISABLED
Sat Nov 01 10:25:47 2014 us=984866   push_peer_info = DISABLED
Sat Nov 01 10:25:47 2014 us=984866   tls_exit = DISABLED
Sat Nov 01 10:25:47 2014 us=984866   tls_auth_file = '[UNDEF]'
Sat Nov 01 10:25:47 2014 us=984866   pkcs11_protected_authentication = DISABLED
Sat Nov 01 10:25:47 2014 us=984866   pkcs11_protected_authentication = DISABLED
Sat Nov 01 10:25:47 2014 us=984866   pkcs11_protected_authentication = DISABLED
Sat Nov 01 10:25:47 2014 us=984866   pkcs11_protected_authentication = DISABLED
Sat Nov 01 10:25:47 2014 us=984866   pkcs11_protected_authentication = DISABLED
Sat Nov 01 10:25:47 2014 us=984866   pkcs11_protected_authentication = DISABLED
Sat Nov 01 10:25:47 2014 us=984866   pkcs11_protected_authentication = DISABLED
Sat Nov 01 10:25:47 2014 us=984866   pkcs11_protected_authentication = DISABLED
Sat Nov 01 10:25:47 2014 us=984866   pkcs11_protected_authentication = DISABLED
Sat Nov 01 10:25:47 2014 us=984866   pkcs11_protected_authentication = DISABLED
Sat Nov 01 10:25:47 2014 us=984866   pkcs11_protected_authentication = DISABLED
Sat Nov 01 10:25:47 2014 us=984866   pkcs11_protected_authentication = DISABLED
Sat Nov 01 10:25:47 2014 us=984866   pkcs11_protected_authentication = DISABLED
Sat Nov 01 10:25:47 2014 us=984866   pkcs11_protected_authentication = DISABLED
Sat Nov 01 10:25:47 2014 us=984866   pkcs11_protected_authentication = DISABLED
Sat Nov 01 10:25:47 2014 us=984866   pkcs11_protected_authentication = DISABLED
Sat Nov 01 10:25:47 2014 us=984866   pkcs11_private_mode = 00000000
Sat Nov 01 10:25:47 2014 us=984866   pkcs11_private_mode = 00000000
Sat Nov 01 10:25:47 2014 us=984866   pkcs11_private_mode = 00000000
Sat Nov 01 10:25:47 2014 us=984866   pkcs11_private_mode = 00000000
Sat Nov 01 10:25:47 2014 us=984866   pkcs11_private_mode = 00000000
Sat Nov 01 10:25:47 2014 us=984866   pkcs11_private_mode = 00000000
Sat Nov 01 10:25:47 2014 us=984866   pkcs11_private_mode = 00000000
Sat Nov 01 10:25:47 2014 us=984866   pkcs11_private_mode = 00000000
Sat Nov 01 10:25:47 2014 us=984866   pkcs11_private_mode = 00000000
Sat Nov 01 10:25:47 2014 us=984866   pkcs11_private_mode = 00000000
Sat Nov 01 10:25:47 2014 us=984866   pkcs11_private_mode = 00000000
Sat Nov 01 10:25:47 2014 us=984866   pkcs11_private_mode = 00000000
Sat Nov 01 10:25:47 2014 us=984866   pkcs11_private_mode = 00000000
Sat Nov 01 10:25:47 2014 us=984866   pkcs11_private_mode = 00000000
Sat Nov 01 10:25:47 2014 us=984866   pkcs11_private_mode = 00000000
Sat Nov 01 10:25:47 2014 us=984866   pkcs11_private_mode = 00000000
Sat Nov 01 10:25:47 2014 us=984866   pkcs11_cert_private = DISABLED
Sat Nov 01 10:25:47 2014 us=984866   pkcs11_cert_private = DISABLED
Sat Nov 01 10:25:47 2014 us=984866   pkcs11_cert_private = DISABLED
Sat Nov 01 10:25:47 2014 us=984866   pkcs11_cert_private = DISABLED
Sat Nov 01 10:25:47 2014 us=984866   pkcs11_cert_private = DISABLED
Sat Nov 01 10:25:47 2014 us=984866   pkcs11_cert_private = DISABLED
Sat Nov 01 10:25:47 2014 us=984866   pkcs11_cert_private = DISABLED
Sat Nov 01 10:25:47 2014 us=984866   pkcs11_cert_private = DISABLED
Sat Nov 01 10:25:47 2014 us=984866   pkcs11_cert_private = DISABLED
Sat Nov 01 10:25:47 2014 us=984866   pkcs11_cert_private = DISABLED
Sat Nov 01 10:25:47 2014 us=984866   pkcs11_cert_private = DISABLED
Sat Nov 01 10:25:47 2014 us=984866   pkcs11_cert_private = DISABLED
Sat Nov 01 10:25:47 2014 us=984866   pkcs11_cert_private = DISABLED
Sat Nov 01 10:25:47 2014 us=984866   pkcs11_cert_private = DISABLED
Sat Nov 01 10:25:47 2014 us=984866   pkcs11_cert_private = DISABLED
Sat Nov 01 10:25:47 2014 us=984866   pkcs11_cert_private = DISABLED
Sat Nov 01 10:25:47 2014 us=984866   pkcs11_pin_cache_period = -1
Sat Nov 01 10:25:47 2014 us=984866   pkcs11_id = '[UNDEF]'
Sat Nov 01 10:25:47 2014 us=984866   pkcs11_id_management = DISABLED
Sat Nov 01 10:25:47 2014 us=984866   server_network = 0.0.0.0
Sat Nov 01 10:25:47 2014 us=984866   server_netmask = 0.0.0.0
Sat Nov 01 10:25:47 2014 us=985867   server_network_ipv6 = ::
Sat Nov 01 10:25:47 2014 us=985867   server_netbits_ipv6 = 0
Sat Nov 01 10:25:47 2014 us=985867   server_bridge_ip = 0.0.0.0
Sat Nov 01 10:25:47 2014 us=985867   server_bridge_netmask = 0.0.0.0
Sat Nov 01 10:25:47 2014 us=985867   server_bridge_pool_start = 0.0.0.0
Sat Nov 01 10:25:47 2014 us=985867   server_bridge_pool_end = 0.0.0.0
Sat Nov 01 10:25:47 2014 us=985867   ifconfig_pool_defined = DISABLED
Sat Nov 01 10:25:47 2014 us=985867   ifconfig_pool_start = 0.0.0.0
Sat Nov 01 10:25:47 2014 us=985867   ifconfig_pool_end = 0.0.0.0
Sat Nov 01 10:25:47 2014 us=985867   ifconfig_pool_netmask = 0.0.0.0
Sat Nov 01 10:25:47 2014 us=985867   ifconfig_pool_persist_filename = '[UNDEF]'
Sat Nov 01 10:25:47 2014 us=985867   ifconfig_pool_persist_refresh_freq = 600
Sat Nov 01 10:25:47 2014 us=985867   ifconfig_ipv6_pool_defined = DISABLED
Sat Nov 01 10:25:47 2014 us=985867   ifconfig_ipv6_pool_base = ::
Sat Nov 01 10:25:47 2014 us=985867   ifconfig_ipv6_pool_netbits = 0
Sat Nov 01 10:25:47 2014 us=985867   n_bcast_buf = 256
Sat Nov 01 10:25:47 2014 us=985867   tcp_queue_limit = 64
Sat Nov 01 10:25:47 2014 us=985867   real_hash_size = 256
Sat Nov 01 10:25:47 2014 us=985867   virtual_hash_size = 256
Sat Nov 01 10:25:47 2014 us=985867   client_connect_script = '[UNDEF]'
Sat Nov 01 10:25:47 2014 us=985867   learn_address_script = '[UNDEF]'
Sat Nov 01 10:25:47 2014 us=985867   client_disconnect_script = '[UNDEF]'
Sat Nov 01 10:25:47 2014 us=985867   client_config_dir = '[UNDEF]'
Sat Nov 01 10:25:47 2014 us=985867   ccd_exclusive = DISABLED
Sat Nov 01 10:25:47 2014 us=985867   tmp_dir = 'C:\Users\Richard\AppData\Local\Temp\'
Sat Nov 01 10:25:47 2014 us=985867   push_ifconfig_defined = DISABLED
Sat Nov 01 10:25:47 2014 us=985867   push_ifconfig_local = 0.0.0.0
Sat Nov 01 10:25:47 2014 us=985867   push_ifconfig_remote_netmask = 0.0.0.0
Sat Nov 01 10:25:47 2014 us=985867   push_ifconfig_ipv6_defined = DISABLED
Sat Nov 01 10:25:47 2014 us=985867   push_ifconfig_ipv6_local = ::/0
Sat Nov 01 10:25:47 2014 us=985867   push_ifconfig_ipv6_remote = ::
Sat Nov 01 10:25:47 2014 us=985867   enable_c2c = DISABLED
Sat Nov 01 10:25:47 2014 us=985867   duplicate_cn = DISABLED
Sat Nov 01 10:25:47 2014 us=985867   cf_max = 0
Sat Nov 01 10:25:47 2014 us=985867   cf_per = 0
Sat Nov 01 10:25:47 2014 us=985867   max_clients = 1024
Sat Nov 01 10:25:47 2014 us=985867   max_routes_per_client = 256
Sat Nov 01 10:25:47 2014 us=985867   auth_user_pass_verify_script = '[UNDEF]'
Sat Nov 01 10:25:47 2014 us=985867   auth_user_pass_verify_script_via_file = DISABLED
Sat Nov 01 10:25:47 2014 us=985867   client = ENABLED
Sat Nov 01 10:25:47 2014 us=985867   pull = ENABLED
Sat Nov 01 10:25:47 2014 us=985867   auth_user_pass_file = '[UNDEF]'
Sat Nov 01 10:25:47 2014 us=985867   show_net_up = DISABLED
Sat Nov 01 10:25:47 2014 us=985867   route_method = 0
Sat Nov 01 10:25:47 2014 us=985867   ip_win32_defined = DISABLED
Sat Nov 01 10:25:47 2014 us=985867   ip_win32_type = 3
Sat Nov 01 10:25:47 2014 us=985867   dhcp_masq_offset = 0
Sat Nov 01 10:25:47 2014 us=985867   dhcp_lease_time = 31536000
Sat Nov 01 10:25:47 2014 us=985867   tap_sleep = 0
Sat Nov 01 10:25:47 2014 us=985867   dhcp_options = DISABLED
Sat Nov 01 10:25:47 2014 us=985867   dhcp_renew = DISABLED
Sat Nov 01 10:25:47 2014 us=985867   dhcp_pre_release = DISABLED
Sat Nov 01 10:25:47 2014 us=985867   dhcp_release = DISABLED
Sat Nov 01 10:25:47 2014 us=985867   domain = '[UNDEF]'
Sat Nov 01 10:25:47 2014 us=985867   netbios_scope = '[UNDEF]'
Sat Nov 01 10:25:47 2014 us=985867   netbios_node_type = 0
Sat Nov 01 10:25:47 2014 us=985867   disable_nbt = DISABLED
Sat Nov 01 10:25:47 2014 us=985867 OpenVPN 2.3.5 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Oct 28 2014
Sat Nov 01 10:25:47 2014 us=985867 library versions: OpenSSL 1.0.1j 15 Oct 2014, LZO 2.05
Enter Management Password:
Sat Nov 01 10:25:47 2014 us=986868 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Sat Nov 01 10:25:47 2014 us=986868 Need hold release from management interface, waiting...
Sat Nov 01 10:25:48 2014 us=469266 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Sat Nov 01 10:25:48 2014 us=571334 MANAGEMENT: CMD 'state on'
Sat Nov 01 10:25:48 2014 us=571334 MANAGEMENT: CMD 'log all on'
Sat Nov 01 10:25:48 2014 us=744445 MANAGEMENT: CMD 'hold off'
Sat Nov 01 10:25:48 2014 us=745446 MANAGEMENT: CMD 'hold release'
Sat Nov 01 10:25:48 2014 us=860523 LZO compression initialized
Sat Nov 01 10:25:48 2014 us=860523 Control Channel MTU parms [ L:1560 D:140 EF:40 EB:0 ET:0 EL:0 ]
Sat Nov 01 10:25:48 2014 us=860523 Socket Buffers: R=[65536->65536] S=[65536->65536]
Sat Nov 01 10:25:48 2014 us=860523 MANAGEMENT: >STATE:1414837548,RESOLVE,,,
Sat Nov 01 10:25:48 2014 us=901551 Data Channel MTU parms [ L:1560 D:1450 EF:60 EB:135 ET:0 EL:0 AF:3/1 ]
Sat Nov 01 10:25:48 2014 us=901551 Local Options String: 'V4,dev-type tun,link-mtu 1560,tun-mtu 1500,proto TCPv4_CLIENT,comp-lzo,cipher AES-128-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Sat Nov 01 10:25:48 2014 us=901551 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1560,tun-mtu 1500,proto TCPv4_SERVER,comp-lzo,cipher AES-128-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Sat Nov 01 10:25:48 2014 us=901551 Local Options hash (VER=V4): 'bc07730e'
Sat Nov 01 10:25:48 2014 us=901551 Expected Remote Options hash (VER=V4): 'b695cb4a'
Sat Nov 01 10:25:48 2014 us=901551 Attempting to establish TCP connection with [AF_INET]151.225.16.31:1194 [nonblock]
Sat Nov 01 10:25:48 2014 us=901551 MANAGEMENT: >STATE:1414837548,TCP_CONNECT,,,
Sat Nov 01 10:25:49 2014 us=902439 TCP connection established with [AF_INET]***********:1194
Sat Nov 01 10:25:49 2014 us=902439 TCPv4_CLIENT link local: [undef]
Sat Nov 01 10:25:49 2014 us=902439 TCPv4_CLIENT link remote: [AF_INET]***********:1194
Sat Nov 01 10:25:49 2014 us=902439 MANAGEMENT: >STATE:1414837549,WAIT,,,
Sat Nov 01 10:25:49 2014 us=904440 MANAGEMENT: >STATE:1414837549,AUTH,,,
Sat Nov 01 10:25:49 2014 us=904440 TLS: Initial packet from [AF_INET]**********:1194, sid=2ef5e33c 3a38f07e
Sat Nov 01 10:25:50 2014 us=71558 VERIFY OK: depth=1, C=UK, ST=London, L=London, O=IndigoRebel, OU=changeme, CN=root, name=Richard, emailAddress=rich@*******.com
Sat Nov 01 10:25:50 2014 us=72553 VERIFY OK: nsCertType=SERVER
Sat Nov 01 10:25:50 2014 us=72553 VERIFY OK: depth=0, C=UK, ST=London, L=London, O=IndigoRebel, OU=changeme, CN=homeserver, name=Richard, emailAddress=rich@*********.com
Sat Nov 01 10:25:50 2014 us=347813 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1560', remote='link-mtu 1544'
Sat Nov 01 10:25:50 2014 us=347813 WARNING: 'cipher' is used inconsistently, local='cipher AES-128-CBC', remote='cipher BF-CBC'
Sat Nov 01 10:25:50 2014 us=348814 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Sat Nov 01 10:25:50 2014 us=348814 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Nov 01 10:25:50 2014 us=348814 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Sat Nov 01 10:25:50 2014 us=348814 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Nov 01 10:25:50 2014 us=349814 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Sat Nov 01 10:25:50 2014 us=349814 [homeserver] Peer Connection Initiated with [AF_INET]151.225.16.31:1194
Sat Nov 01 10:25:51 2014 us=385654 MANAGEMENT: >STATE:1414837551,GET_CONFIG,,,
Sat Nov 01 10:25:52 2014 us=420730 SENT CONTROL [homeserver]: 'PUSH_REQUEST' (status=1)
Sat Nov 01 10:25:52 2014 us=481766 PUSH: Received control message: 'PUSH_REPLY,route 192.168.1.0 255.255.255.0,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.8.0.2 255.255.255.0'
Sat Nov 01 10:25:52 2014 us=482768 OPTIONS IMPORT: timers and/or timeouts modified
Sat Nov 01 10:25:52 2014 us=482768 OPTIONS IMPORT: --ifconfig/up options modified
Sat Nov 01 10:25:52 2014 us=482768 OPTIONS IMPORT: route options modified
Sat Nov 01 10:25:52 2014 us=482768 OPTIONS IMPORT: route-related options modified
Sat Nov 01 10:25:52 2014 us=493774 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Sat Nov 01 10:25:52 2014 us=493774 MANAGEMENT: >STATE:1414837552,ASSIGN_IP,,10.8.0.2,
Sat Nov 01 10:25:52 2014 us=493774 open_tun, tt->ipv6=0
Sat Nov 01 10:25:52 2014 us=495778 TAP-WIN32 device [Ethernet 2] opened: \\.\Global\{9381AEE3-759F-4F52-8583-C1115751F2AE}.tap
Sat Nov 01 10:25:52 2014 us=496778 TAP-Windows Driver Version 9.21 
Sat Nov 01 10:25:52 2014 us=496778 TAP-Windows MTU=1500
Sat Nov 01 10:25:52 2014 us=500773 Set TAP-Windows TUN subnet mode network/local/netmask = 10.8.0.0/10.8.0.2/255.255.255.0 [SUCCEEDED]
Sat Nov 01 10:25:52 2014 us=500773 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.2/255.255.255.0 on interface {9381AEE3-759F-4F52-8583-C1115751F2AE} [DHCP-serv: 10.8.0.254, lease-time: 31536000]
Sat Nov 01 10:25:52 2014 us=501777 Successful ARP Flush on interface [38] {9381AEE3-759F-4F52-8583-C1115751F2AE}
Sat Nov 01 10:25:52 2014 us=562814 Connection reset, restarting [0]
Sat Nov 01 10:25:52 2014 us=562814 TCP/UDP: Closing socket
Sat Nov 01 10:25:52 2014 us=562814 SIGUSR1[soft,connection-reset] received, process restarting
Sat Nov 01 10:25:52 2014 us=563815 MANAGEMENT: >STATE:1414837552,RECONNECTING,connection-reset,,
Sat Nov 01 10:25:52 2014 us=563815 Restart pause, 5 second(s)

Below is my serverlog from dd-wrt's OpenVPN status page....

Serverlog: (Moderator Edit: Server Config)

dh /tmp/openvpn/dh.pem 
ca /tmp/openvpn/ca.crt cert 
/tmp/openvpn/cert.pem key 
/tmp/openvpn/key.pem 
keepalive 10 120 
verb 3 
mute 3 
syslog 
writepid /var/run/openvpnd.pid 
management 127.0.0.1 14 
management-log-cache 100 
topology subnet 
script-security 2 
port 1194 
proto udp 
cipher bf-cbc 
auth sha1 
client-connect /tmp/openvpn/clcon.sh 
client-disconnect /tmp/openvpn/cldiscon.sh 
client-config-dir /tmp/openvpn/ccd 
comp-lzo adaptive 
tls-server 
ifconfig-pool-persist /tmp/openvpn/ip-pool 86400 
client-to-client 
fast-io 
tun-mtu 1500 
mtu-disc yes 
server 10.8.0.0 255.255.255.0 
dev tun2 
tun-ipv6 
push "route 192.168.1.0 255.255.255.0" 
server 10.8.0.0 255.255.255.0 
dev tun0 
proto tcp 
keepalive 10 120 
dh /tmp/openvpn/dh.pem 
ca /tmp/openvpn/ca.crt 
cert /tmp/openvpn/cert.pem 
key /tmp/openvpn/key.pem 
# Only use crl-verify if you are using the revoke list - otherwise leave it commented out 
# crl-verify /tmp/openvpn/ca.crl 
# management parameter allows DD-WRTs OpenVPN Status web page to access the servers management port 
# port must be 5001 for scripts embedded in firmware to work 
management localhost 5001

I'm happy to post any logs, settings or configuration files that may help

Thanks in advance

Rich

Traffic

CraftyClown wroteI'm happy to post any logs, settings or configuration files that may help

I suggest you Double-Double check your server config file ...

As you cannot edit your posts .. re-post Correct config files .. :roll: :lol:

CraftyClown

Firstly, apologies Debbie for the formatting. I'm not used to using code. Thanks for fixing it for me.

Secondly, I have now fixed the problem by changing the encryption at the server end from Blowfish CBC (despite this being the suggested method, in several tutorials I read) to AES-128 CBC

Everything is now working perfectly 🙂

Thanks for your time and patience

Traffic

CraftyClown wroteI have now fixed the problem by changing the encryption at the server end from Blowfish CBC (despite this being the suggested method, in several tutorials I read) to AES-128 CBC

Everything is now working perfectly

The ciphers must match on both client and server .. so if you had to change your server then it is because your client is not configured to use the correct defaults.

CraftyClown wroteapologies Debbie for the formatting. I'm not used to using code. Thanks for fixing it for me

As your first post was soo awful and we do not really know what you have fixed .. and your server config is completely wrong .. why not try re-submitting your server config .. for the practice.

Here is just one of the things your server config has wrong:

...
dev tun2
...
dev tun0 
...

CraftyClown

Traffic wrote
CraftyClown wroteI have now fixed the problem by changing the encryption at the server end from Blowfish CBC (despite this being the suggested method, in several tutorials I read) to AES-128 CBC

Everything is now working perfectly
The ciphers must match on both client and server .. so if you had to change your server then it is because your client is not configured to use the correct defaults.

CraftyClown wroteapologies Debbie for the formatting. I'm not used to using code. Thanks for fixing it for me
As your first post was soo awful and we do not really know what you have fixed .. and your server config is completely wrong .. why not try re-submitting your server config .. for the practice.

Here is just one of the things your server config has wrong:
...
dev tun2
...
dev tun0 
...

I'll do my best, although I'm not quite sure how to provide it, as I use a GUI in the dd-wrt router, which doesn't show me the server config, just the server log, which in turn contains all the config details I believe

This is my client config...

client
dev tun
proto tcp
remote ********.dynalias.com 1196
resolv-retry infinite
nobind
persist-key
persist-tun

ca ca.crt
cert laptop.crt
key laptop.key
ns-cert-type server
cipher AES-128-CBC
comp-lzo
verb 4

This is my server config...

port 1196 
proto udp 
cipher aes-128-cbc 
auth sha1 
client-connect /tmp/openvpn/clcon.sh 
client-disconnect /tmp/openvpn/cldiscon.sh 
client-config-dir /tmp/openvpn/ccd 
comp-lzo yes 
tls-server 
ifconfig-pool-persist /tmp/openvpn/ip-pool 86400 
client-to-client 
fast-io 
tun-mtu 1500 
mtu-disc yes 
server 10.8.0.0 255.255.255.0 
dev tun2 
tun-ipv6 
push "route 192.168.1.0 255.255.255.0" 
server 10.8.0.0 255.255.255.0 
dev tun0 
proto tcp 
keepalive 10 120 
dh /tmp/openvpn/dh.pem 
ca /tmp/openvpn/ca.crt 
cert /tmp/openvpn/cert.pem 
key /tmp/openvpn/key.pem

If you could point our what it is I'm doing wrong I would be very grateful

CraftyClown

I've also just realised that although I can get a connection, I don't have internet access.

maikcat

I don't have internet access.

you mean via the vpn tunnel?

if yes you must:

push redirect-gateway to your clients &
perform NAT on your openvpn server side.

Michael.

CraftyClown

maikcat wrote
I don't have internet access.
you mean via the vpn tunnel?

if yes you must:

push redirect-gateway to your clients &
perform NAT on your openvpn server side.

Michael.

Hi Michael,

Yes I believe that is what I'm asking. I'm sorry this is all rather new to me, so some of the terminology escapes me.

I can successfully achieve a vpn connection from both my laptop (which is currently on the same LAN as the server. Not sure if that makes a difference) and my android handset (which is connected via 4G)

Once connected to the VPN server, I am unable to open a webpage on the laptop, however the android handset will open a webpage successfully.

You mentioned "push redirect-gateway to your clients" I have an option on my DD-WRT router to enable "redirect default gateway" I presume this would be what you mean?

You also mentioned "perform NAT on your openvpn server side" would this be a case of assigning a static gateway for my IP in the basic setup of my router?

apologies once again if these are stupid questions and thanks for the help

Rich

CraftyClown

I spoke too soon. I don't believe web pages are correctly loading on my android device after all.

maikcat

can successfully achieve a vpn connection from both my laptop (which is currently on the same LAN as the server.

Never testing a vpn setup while in the same network,try to connect from somewhere else.

You mentioned "push redirect-gateway to your clients" I have an option on my DD-WRT router to enable "redirect default gateway" I presume this would be what you mean?

well yes,if you configuring manually your openvpn this is what you need to add to your server config

push "redirect-gateway def1"

You also mentioned "perform NAT on your openvpn server side" would this be a case of assigning a static gateway for my IP in the basic setup of my router?

nop,you must enable NAT on your openvpn server side so traffic originating from tunnel to internet will be NATed...
dont know though how you can configure it on your DD-WRT router.

Michael.

CraftyClown

maikcat wrote
can successfully achieve a vpn connection from both my laptop (which is currently on the same LAN as the server.
Never testing a vpn setup while in the same network,try to connect from somewhere else.

You mentioned "push redirect-gateway to your clients" I have an option on my DD-WRT router to enable "redirect default gateway" I presume this would be what you mean?
well yes,if you configuring manually your openvpn this is what you need to add to your server config
push "redirect-gateway def1"
You also mentioned "perform NAT on your openvpn server side" would this be a case of assigning a static gateway for my IP in the basic setup of my router?
nop,you must enable NAT on your openvpn server side so traffic originating from tunnel to internet will be NATed...
dont know though how you can configure it on your DD-WRT router.

Michael.

Firstly a big thank you for everyone's assistance, getting this up and running. I now have a working VPN connection, that all my clients can successfully connect to. The internet connection is also being tunnelled through the VPN.

That being said I am aware my configuration may not be optimal (as pointed out by Traffic) I am also unsure whether said config could prove a security risk, which would obviously then defeat the point of the VPN in the first place.

I was hoping someone might take a quick glance at my configs and point out where it could be potentially improved or fixed?

Server config

dh /tmp/openvpn/dh.pem 
ca /tmp/openvpn/ca.crt 
cert /tmp/openvpn/cert.pem 
key /tmp/openvpn/key.pem 
keepalive 10 120 
verb 3 
mute 3 
syslog 
writepid /var/run/openvpnd.pid 
management 127.0.0.1 14 
management-log-cache 100 
topology subnet 
script-security 2 
port 1196 
proto udp 
cipher aes-128-cbc 
auth sha1 
client-connect /tmp/openvpn/clcon.sh 
client-disconnect /tmp/openvpn/cldiscon.sh 
client-config-dir /tmp/openvpn/ccd 
comp-lzo yes 
tls-server 
ifconfig-pool-persist /tmp/openvpn/ip-pool 86400 
client-to-client 
fast-io 
tun-mtu 1500 
mtu-disc yes 
server 10.8.0.0 255.255.255.0 
dev tun2 
tun-ipv6 
push "route 192.168.1.0 255.255.255.0" 
push "dhcp-option DNS 8.8.8.8" 
push "redirect-gateway def1" 
server 10.8.0.0 255.255.255.0 
push "dhcp-option WINS 192.168.1.1" 
dev tun0 
proto udp 
keepalive 10 120 
dh /tmp/openvpn/dh.pem 
ca /tmp/openvpn/ca.crt 
cert /tmp/openvpn/cert.pem 
key /tmp/openvpn/key.pem 
management localhost 5001 
verb 5

Client config

client
dev tun
proto udp
remote ********.dynalias.com 1196
resolv-retry infinite
nobind
persist-key
persist-tun

ca ca.crt
cert laptop.crt
key laptop.key
ns-cert-type server
cipher AES-128-CBC
comp-lzo
verb 4
float

Thanks in advance 🙂

Traffic

CraftyClown wrotetake a quick glance at my configs and point out where it could be potentially improved

I would strongly advise you read and implement this:
http://openvpn.net/index.php/open-source/documentation/howto.html#security

CraftyClown

Traffic wrote
CraftyClown wrotetake a quick glance at my configs and point out where it could be potentially improved
I would strongly advise you read and implement this:
http://openvpn.net/index.php/open-source/documentation/howto.html#security

Thanks Traffic. I will have a proper read of the documentation, but straight away I can see adding tls-auth will help.

You flagged up specific issues in my config that still seem to be there, such as

dev tun2 
tun-ipv6 
dev tun0

Would you mind explaining what the problem with that is and whether it's something I should be concerned about, despite the VPN connection working?

Traffic

Your config file is trying to create two tun devices: tun0 and tun2 .. You only require one tun device per config.

As your config file lists tun2 then tun0 I think your tun device will be tun0 so you can remove dev tun2

maikcat

also for better security you can also use these:

tls-cipher DHE-RSA-AES256-SHA
auth sha512

Michael.

CraftyClown

Traffic wroteYour config file is trying to create two tun devices: tun0 and tun2 .. You only require one tun device per config.

As your config file lists tun2 then tun0 I think your tun device will be tun0 so you can remove dev tun2

Thanks Traffic. I'm not sure how I have ended up with a second tun device on my server.

I have set up OpenVPN via my dd-wrt router's GUI, so unfortunately it isn't as easy as seeing where the incorrect line of code is and removing it.

Would it have anything to do with the wins server line of code in the below config? Someone told me to put it in there if I wanted to get samba shares working. that could well have been duff information however.

push "route 192.168.1.0 255.255.255.0"
push "dhcp-option DNS 8.8.8.8"
push "redirect-gateway def1"
server 10.8.0.0 255.255.255.0
push "dhcp-option WINS 192.168.1.1" 


dev tun0
proto udp
keepalive 10 120
dh /tmp/openvpn/dh.pem
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem
management localhost 5001

verb 5

Apologies once more if these are stupid questions. I'm new to all of this and as the owner of a small business it's down to me to get my round this as I can't afford to pay for someone else to implement it for me.

Thanks again for your time and assistance

maikcat

WINS is used for netbios name resolving,
i assume that 192.168.1.1 IS a windows server,right?

what problem exactly do you have?

Michael.

CraftyClown

maikcat wroteWINS is used for netbios name resolving,
i assume that 192.168.1.1 IS a windows server,right?

what problem exactly do you have?

Michael.

No, 192.168.1.1 is my router. Someone told me to add

 push "dhcp-option WINS 192.168.1.1"

if I wanted to be able to access samba shares, although I am starting to doubt the validity of this information.

I don't know if I have a problem per se, as everything 'seems' to be working correctly, however as Traffic pointed out, I have an erroneous tun2 in my code and I was just wondering if this was the cause?

Traffic

CraftyClown wrotehowever as Traffic pointed out, I have an erroneous tun2 in my code and I was just wondering if this was the cause?

No .. this is not a problem as the excellent OpenVPN code will simply select the last option in the config. BTW .. you also have two server directives on the same subnet ..

But your router GUI is obviously not very smart and you should go back to the router manufacturer and find out what is causing their code to behave in such a manner.

Michael asked if the router is a SAMBA/WINS server:

CraftyClown wroteNo, 192.168.1.1 is my router. Someone told me to add

Code:
push "dhcp-option WINS 192.168.1.1"

if I wanted to be able to access samba shares, although I am starting to doubt the validity of this information.

Then someone is wrong .. If the router does not have support for SAMBA/WINS ...

If you have routing and can ping the SAMBA machine then you can access its shares directly .. though not with Windows browser as that requires broadcast traffic. You would use something like:

net use x: \\192.168.1.xx\sharename