Thank you for your quick reply. I read the manual but I got no clue to make it... I changed the configuration file (server side) a bit so now it reads:
port 51555
proto udp
dev tun
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist /etc/openvpn/ipp.txt
user nobody
group nobody
keepalive 10 120
comp-lzo
persist-key
persist-tun
verb 3
mode server
tls-server
dh /etc/openvpn/dh1024.pem
ca /etc/openvpn/ca.crt
cert /etc/openvpn/laye.vpnserver.crt
key /etc/openvpn/laye.vpnserver.key
duplicate-cn
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
In the meanwhile, the server log:
Sat Nov 1 23:11:37 2014 OpenVPN 2.3.2 x86_64-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [eurephia] [MH] [IPv6] built on Sep 4 2013
Sat Nov 1 23:11:37 2014 WARNING: --ifconfig-pool-persist will not work with --duplicate-cn
Sat Nov 1 23:11:37 2014 Diffie-Hellman initialized with 1024 bit key
Sat Nov 1 23:11:37 2014 Socket Buffers: R=[212992->131072] S=[212992->131072]
Sat Nov 1 23:11:37 2014 ROUTE_GATEWAY 172.31.0.1/255.255.240.0 IFACE=eth0 HWADDR=06:95:8b:e9:4c:91
Sat Nov 1 23:11:37 2014 TUN/TAP device tun0 opened
Sat Nov 1 23:11:37 2014 TUN/TAP TX queue length set to 100
Sat Nov 1 23:11:37 2014 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Sat Nov 1 23:11:37 2014 /sbin/ip link set dev tun0 up mtu 1500
Sat Nov 1 23:11:37 2014 /sbin/ip addr add dev tun0 local 10.8.0.1 peer 10.8.0.2
Sat Nov 1 23:11:37 2014 /sbin/ip route add 10.8.0.0/24 via 10.8.0.2
Sat Nov 1 23:11:37 2014 GID set to nobody
Sat Nov 1 23:11:37 2014 UID set to nobody
Sat Nov 1 23:11:37 2014 UDPv4 link local (bound): [undef]
Sat Nov 1 23:11:37 2014 UDPv4 link remote: [undef]
Sat Nov 1 23:11:37 2014 MULTI: multi_init called, r=256 v=256
Sat Nov 1 23:11:37 2014 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Sat Nov 1 23:11:37 2014 IFCONFIG POOL LIST
Sat Nov 1 23:11:37 2014 Initialization Sequence Completed
Sat Nov 1 23:11:46 2014 27.191.85.171:1194 TLS: Initial packet from [AF_INET]27.191.85.171:1194, sid=c46d7055 d8a11f00
Sat Nov 1 23:11:49 2014 27.191.85.171:1194 VERIFY OK: depth=1, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=Fort-Funston CA, name=EasyRSA, emailAddress=me@myhost.mydomain
Sat Nov 1 23:11:49 2014 27.191.85.171:1194 VERIFY OK: depth=0, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=laye.vpnclient.key, name=EasyRSA, emailAddress=me@myhost.mydomain
Sat Nov 1 23:11:49 2014 27.191.85.171:1194 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sat Nov 1 23:11:49 2014 27.191.85.171:1194 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Nov 1 23:11:49 2014 27.191.85.171:1194 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sat Nov 1 23:11:49 2014 27.191.85.171:1194 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Nov 1 23:11:49 2014 27.191.85.171:1194 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Sat Nov 1 23:11:49 2014 27.191.85.171:1194 [laye.vpnclient.key] Peer Connection Initiated with [AF_INET]27.191.85.171:1194
Sat Nov 1 23:11:49 2014 laye.vpnclient.key/27.191.85.171:1194 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled)
Sat Nov 1 23:11:49 2014 laye.vpnclient.key/27.191.85.171:1194 MULTI: Learn: 10.8.0.6 -> laye.vpnclient.key/27.191.85.171:1194
Sat Nov 1 23:11:49 2014 laye.vpnclient.key/27.191.85.171:1194 MULTI: primary virtual IP for laye.vpnclient.key/27.191.85.171:1194: 10.8.0.6
Sat Nov 1 23:11:51 2014 laye.vpnclient.key/27.191.85.171:1194 PUSH: Received control message: 'PUSH_REQUEST'
Sat Nov 1 23:11:51 2014 laye.vpnclient.key/27.191.85.171:1194 send_push_reply(): safe_cap=940
Sat Nov 1 23:11:51 2014 laye.vpnclient.key/27.191.85.171:1194 SENT CONTROL [laye.vpnclient.key]: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 8.8.8.8,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)
Sat Nov 1 23:13:37 2014 laye.vpnclient.key/27.191.85.171:1194 TLS: new session incoming connection from [AF_INET]27.191.85.171:1194
Sat Nov 1 23:13:43 2014 laye.vpnclient.key/27.191.85.171:1194 VERIFY OK: depth=1, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=Fort-Funston CA, name=EasyRSA, emailAddress=me@myhost.mydomain
Sat Nov 1 23:13:43 2014 laye.vpnclient.key/27.191.85.171:1194 VERIFY OK: depth=0, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=laye.vpnclient.key, name=EasyRSA, emailAddress=me@myhost.mydomain
Sat Nov 1 23:13:43 2014 laye.vpnclient.key/27.191.85.171:1194 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sat Nov 1 23:13:43 2014 laye.vpnclient.key/27.191.85.171:1194 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Nov 1 23:13:43 2014 laye.vpnclient.key/27.191.85.171:1194 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sat Nov 1 23:13:43 2014 laye.vpnclient.key/27.191.85.171:1194 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Nov 1 23:13:43 2014 laye.vpnclient.key/27.191.85.171:1194 TLS: move_session: dest=TM_ACTIVE src=TM_UNTRUSTED reinit_src=1
Sat Nov 1 23:13:43 2014 laye.vpnclient.key/27.191.85.171:1194 TLS: tls_multi_process: untrusted session promoted to semi-trusted
Sat Nov 1 23:13:43 2014 laye.vpnclient.key/27.191.85.171:1194 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Sat Nov 1 23:13:45 2014 laye.vpnclient.key/27.191.85.171:1194 PUSH: Received control message: 'PUSH_REQUEST'
Sat Nov 1 23:13:45 2014 laye.vpnclient.key/27.191.85.171:1194 send_push_reply(): safe_cap=940
Sat Nov 1 23:13:45 2014 laye.vpnclient.key/27.191.85.171:1194 SENT CONTROL [laye.vpnclient.key]: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 8.8.8.8,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)
The corresponding client side log:
Sat Nov 01 23:13:35 2014 OpenVPN 2.3.5 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Oct 28 2014
Sat Nov 01 23:13:35 2014 library versions: OpenSSL 1.0.1j 15 Oct 2014, LZO 2.05
Sat Nov 01 23:13:35 2014 Socket Buffers: R=[65536->65536] S=[65536->65536]
Sat Nov 01 23:13:35 2014 UDPv4 link local (bound): [undef]
Sat Nov 01 23:13:35 2014 UDPv4 link remote: [AF_INET]54.193.71.222:51555
Sat Nov 01 23:13:35 2014 TLS: Initial packet from [AF_INET]54.193.71.222:51555, sid=748939cc 491f3fce
Sat Nov 01 23:13:40 2014 VERIFY OK: depth=1, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=Fort-Funston CA, name=EasyRSA, emailAddress=me@myhost.mydomain
Sat Nov 01 23:13:40 2014 VERIFY OK: nsCertType=SERVER
Sat Nov 01 23:13:40 2014 VERIFY OK: depth=0, C=US, ST=CA, L=SanFrancisco, O=Fort-Funston, OU=MyOrganizationalUnit, CN=laye.vpnserver, name=EasyRSA, emailAddress=me@myhost.mydomain
Sat Nov 01 23:13:41 2014 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sat Nov 01 23:13:41 2014 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Nov 01 23:13:41 2014 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sat Nov 01 23:13:41 2014 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Nov 01 23:13:41 2014 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Sat Nov 01 23:13:41 2014 [laye.vpnserver] Peer Connection Initiated with [AF_INET]54.193.71.222:51555
Sat Nov 01 23:13:43 2014 SENT CONTROL [laye.vpnserver]: 'PUSH_REQUEST' (status=1)
Sat Nov 01 23:13:43 2014 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 8.8.8.8,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Sat Nov 01 23:13:43 2014 OPTIONS IMPORT: timers and/or timeouts modified
Sat Nov 01 23:13:43 2014 OPTIONS IMPORT: --ifconfig/up options modified
Sat Nov 01 23:13:43 2014 OPTIONS IMPORT: route options modified
Sat Nov 01 23:13:43 2014 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Sat Nov 01 23:13:43 2014 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Sat Nov 01 23:13:43 2014 open_tun, tt->ipv6=0
Sat Nov 01 23:13:43 2014 TAP-WIN32 device [Ethernet] opened: \\.\Global\{96B7B014-EB47-43B3-A538-A7B7E6DA3801}.tap
Sat Nov 01 23:13:43 2014 TAP-Windows Driver Version 9.21
Sat Nov 01 23:13:43 2014 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.6/255.255.255.252 on interface {96B7B014-EB47-43B3-A538-A7B7E6DA3801} [DHCP-serv: 10.8.0.5, lease-time: 31536000]
Sat Nov 01 23:13:43 2014 Successful ARP Flush on interface [37] {96B7B014-EB47-43B3-A538-A7B7E6DA3801}
Sat Nov 01 23:13:48 2014 TEST ROUTES: 2/2 succeeded len=1 ret=1 a=0 u/d=up
Sat Nov 01 23:13:48 2014 C:\Windows\system32\route.exe ADD 54.193.71.222 MASK 255.255.255.255 192.168.1.1
Sat Nov 01 23:13:48 2014 ROUTE: route addition failed using CreateIpForwardEntry: The object already exists. [status=5010 if_index=3]
Sat Nov 01 23:13:48 2014 Route addition via IPAPI failed [adaptive]
Sat Nov 01 23:13:48 2014 Route addition fallback to route.exe
Sat Nov 01 23:13:48 2014 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Sat Nov 01 23:13:48 2014 C:\Windows\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.8.0.5
Sat Nov 01 23:13:48 2014 ROUTE: route addition failed using CreateIpForwardEntry: The object already exists. [status=5010 if_index=37]
Sat Nov 01 23:13:48 2014 Route addition via IPAPI failed [adaptive]
Sat Nov 01 23:13:48 2014 Route addition fallback to route.exe
Sat Nov 01 23:13:48 2014 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Sat Nov 01 23:13:48 2014 C:\Windows\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.8.0.5
Sat Nov 01 23:13:48 2014 ROUTE: route addition failed using CreateIpForwardEntry: The object already exists. [status=5010 if_index=37]
Sat Nov 01 23:13:48 2014 Route addition via IPAPI failed [adaptive]
Sat Nov 01 23:13:48 2014 Route addition fallback to route.exe
Sat Nov 01 23:13:48 2014 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Sat Nov 01 23:13:48 2014 C:\Windows\system32\route.exe ADD 10.8.0.1 MASK 255.255.255.255 10.8.0.5
Sat Nov 01 23:13:48 2014 ROUTE: route addition failed using CreateIpForwardEntry: The object already exists. [status=5010 if_index=37]
Sat Nov 01 23:13:48 2014 Route addition via IPAPI failed [adaptive]
Sat Nov 01 23:13:48 2014 Route addition fallback to route.exe
Sat Nov 01 23:13:48 2014 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Sat Nov 01 23:13:48 2014 Initialization Sequence Completed
No idea what I need to configure - the client log shows there are a few route setting failures but I guess it should at least ping the server even the pushed routes were not set. I read the HOWTOs and manual and it was told that the failure of ping the server 10.8.0.1 is probably because of firewall blocks. I disabled my client-side Windows firewall, disabled EC2's Source/Destination check, EC2's security group is friendly to my VPN's UDP port, enabled IP forwarding on the server, checked the default policy for iptables which is ACCEPT by default... Is this more likely a routing issue or a firewall issue?
