This issue has been resolved.
The following configuration errors were:
1) There were two copies of client.conf appeared both on the OpenVPN server and client creating two conflicting tunnels (tun0 and tun1) After removing client.conf from the OpenVPN server, the conflict ended.
2) Removed route entries from server.conf and the ccd directory. These were unnecessary. The server IP sent to the client was acceptable.
root@vpn:/etc/openvpn# cat server.conf
local a.b.c.d
port 49152
;proto tcp
proto udp
;dev tap
dev tun
ca ca.crt
cert interconit.crt
key interconit.key # This file should be kept secret
dh dh2048.pem
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 10.8.0.1"
keepalive 10 120
cipher AES-256-CBC
comp-lzo
;max-clients 100
;user nobody
;group nogroup
persist-key
persist-tun
status openvpn-status.log
log-append /etc/openvpn/log/openvpn.log
verb 4
;mute 20
C:\Program Files (x86)\OpenVPN\config\>type client.conf
client
;dev tap
dev tun
;dev-node MyTap
;proto tcp
proto udp
remote a.b.c.d 49152
;remote my-server-2 1194
;remote-random
;user nobody
;group nogroup
persist-key
persist-tun
;http-proxy-retry # retry on connection failures
;http-proxy [proxy server] [proxy port #]
;mute-replay-warnings
resolv-retry infinite
nobind
;http-proxy-retry # retry on connection failures
;http-proxy [proxy server] [proxy port #]
;mute-replay-warnings
ca "C:\\Program Files (x86)\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files (x86)\\OpenVPN\\config\\client.crt"
key "C:\\Program Files (x86)\\OpenVPN\\config\\client.key"
ns-cert-type server
cipher AES-256-CBC
comp-lzo
verb 3
;mute 20
OpenVPN Log:
root@vpn:/etc/openvpn/log# service openvpn restart
* Stopping virtual private network daemon(s)... * Stopping VPN 'server' [ OK ]
* Starting virtual private network daemon(s)... * Autostarting VPN 'server'
root@vpn:/etc/openvpn/log# tail -f openvpn-server.log
Wed Apr 8 08:33:41 2015 us=995966 MULTI: multi_init called, r=256 v=256
Wed Apr 8 08:33:41 2015 us=996041 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Wed Apr 8 08:33:41 2015 us=996057 ifconfig_pool_read(), in='client,10.8.0.4', TODO: IPv6
Wed Apr 8 08:33:41 2015 us=996089 succeeded -> ifconfig_pool_set()
Wed Apr 8 08:33:41 2015 us=996100 ifconfig_pool_read(), in='client,10.8.0.8', TODO: IPv6
Wed Apr 8 08:33:41 2015 us=996109 succeeded -> ifconfig_pool_set()
Wed Apr 8 08:33:41 2015 us=996121 IFCONFIG POOL LIST
Wed Apr 8 08:33:41 2015 us=996131 client,10.8.0.4
Wed Apr 8 08:33:41 2015 us=996141 client,10.8.0.8
Wed Apr 8 08:33:41 2015 us=996175 Initialization Sequence Completed
Wed Apr 8 08:34:15 2015 us=697598 MULTI: multi_create_instance called
Wed Apr 8 08:34:15 2015 us=697741 a.b.c.d:50384 Re-using SSL/TLS context
Wed Apr 8 08:34:15 2015 us=697805 a.b.c.d:50384 LZO compression initialized
Wed Apr 8 08:34:15 2015 us=698126 a.b.c.d:50384 Control Channel MTU parms [ L:1558 D:138 EF:38 EB:0 ET:0 EL:0 ]
Wed Apr 8 08:34:15 2015 us=698146 a.b.c.d:50384 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]
Wed Apr 8 08:34:15 2015 us=698201 a.b.c.d:50384 Local Options String: 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-server'
Wed Apr 8 08:34:15 2015 us=698226 a.b.c.d:50384 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-client'
Wed Apr 8 08:34:15 2015 us=698264 a.b.c.d:50384 Local Options hash (VER=V4): 'a8f55717'
Wed Apr 8 08:34:15 2015 us=698279 a.b.c.d:50384 Expected Remote Options hash (VER=V4): '22188c5b'
Wed Apr 8 08:34:15 2015 us=698317 a.b.c.d:50384 TLS: Initial packet from [AF_INET]a.b.c.d:50384, sid=916c1629 acf857fe
Wed Apr 8 08:34:21 2015 us=937544 a.b.c.d:50384 VERIFY OK: depth=1, C=US, ST=CA, L=SanFrancisco, O=***********, OU=MyOrganizationalUnit, CN=client, name=***********, emailAddress=michael.haley@intertconit.com
Wed Apr 8 08:34:21 2015 us=937926 a.b.c.d:50384 VERIFY OK: depth=0, C=US, ST=CA, L=SanFrancisco, O=***********, OU=MyOrganizationalUnit, CN=client, name=***********, emailAddress=michael@client.com
Wed Apr 8 08:34:27 2015 us=382231 a.b.c.d:50384 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Wed Apr 8 08:34:27 2015 us=382295 a.b.c.d:50384 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Apr 8 08:34:27 2015 us=382309 a.b.c.d:50384 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Wed Apr 8 08:34:27 2015 us=382321 a.b.c.d:50384 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Apr 8 08:34:27 2015 us=578831 a.b.c.d:50384 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Wed Apr 8 08:34:27 2015 us=578909 a.b.c.d:50384 [client] Peer Connection Initiated with [AF_INET]a.b.c.d:50384
Wed Apr 8 08:34:27 2015 us=578939 client/a.b.c.d:50384 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled)
Wed Apr 8 08:34:27 2015 us=578986 client/a.b.c.d:50384 MULTI: Learn: 10.8.0.6 -> client/a.b.c.d:50384
Wed Apr 8 08:34:27 2015 us=579001 client/a.b.c.d:50384 MULTI: primary virtual IP for client/a.b.c.d:50384: 10.8.0.6
Wed Apr 8 08:34:29 2015 us=641256 client/a.b.c.d:50384 PUSH: Received control message: 'PUSH_REQUEST'
Wed Apr 8 08:34:29 2015 us=641340 client/a.b.c.d:50384 send_push_reply(): safe_cap=940
Wed Apr 8 08:34:29 2015 us=641385 client/a.b.c.d:50384 SENT CONTROL [client]: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 10.8.0.1,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)
Client Log:
Wed Apr 08 23:28:03 2015 OpenVPN 2.3.5 i686-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Nov 7 2014
Wed Apr 08 23:28:03 2015 library versions: OpenSSL 1.0.1j 15 Oct 2014, LZO 2.05
Enter Management Password:
Wed Apr 08 23:28:03 2015 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Wed Apr 08 23:28:03 2015 Need hold release from management interface, waiting...
Wed Apr 08 23:28:03 2015 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Wed Apr 08 23:28:03 2015 MANAGEMENT: CMD 'state on'
Wed Apr 08 23:28:03 2015 MANAGEMENT: CMD 'log all on'
Wed Apr 08 23:28:03 2015 MANAGEMENT: CMD 'hold off'
Wed Apr 08 23:28:03 2015 MANAGEMENT: CMD 'hold release'
Wed Apr 08 23:28:03 2015 Socket Buffers: R=[65536->65536] S=[65536->65536]
Wed Apr 08 23:28:03 2015 UDPv4 link local: [undef]
Wed Apr 08 23:28:03 2015 UDPv4 link remote: [AF_INET]a.b.c.d:49152
Wed Apr 08 23:28:03 2015 MANAGEMENT: >STATE:1428506883,WAIT,,,
Wed Apr 08 23:28:04 2015 MANAGEMENT: >STATE:1428506884,AUTH,,,
Wed Apr 08 23:28:04 2015 TLS: Initial packet from [AF_INET]a.b.c.d:49152, sid=3a031192 886ef87c
Wed Apr 08 23:28:14 2015 VERIFY OK: depth=1, C=US, ST=CA, L=SanFrancisco, O=***********, OU=MyOrganizationalUnit, CN=server, name=***********, emailAddress=client@server.com
Wed Apr 08 23:28:14 2015 VERIFY OK: nsCertType=SERVER
Wed Apr 08 23:28:14 2015 VERIFY OK: depth=0, C=US, ST=CA, L=SanFrancisco, O=***********, OU=MyOrganizationalUnit, CN=server, name=***********, emailAddress=client@server.com
Wed Apr 08 23:28:23 2015 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Wed Apr 08 23:28:23 2015 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Apr 08 23:28:23 2015 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Wed Apr 08 23:28:23 2015 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Apr 08 23:28:23 2015 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Wed Apr 08 23:28:23 2015 [server] Peer Connection Initiated with [AF_INET]a.b.c.d:49152
Wed Apr 08 23:28:24 2015 MANAGEMENT: >STATE:1428506904,GET_CONFIG,,,
Wed Apr 08 23:28:25 2015 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Wed Apr 08 23:28:26 2015 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 10.8.0.1,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Wed Apr 08 23:28:26 2015 OPTIONS IMPORT: timers and/or timeouts modified
Wed Apr 08 23:28:26 2015 OPTIONS IMPORT: --ifconfig/up options modified
Wed Apr 08 23:28:26 2015 OPTIONS IMPORT: route options modified
Wed Apr 08 23:28:26 2015 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Wed Apr 08 23:28:26 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Apr 08 23:28:26 2015 MANAGEMENT: >STATE:1428506906,ASSIGN_IP,,10.8.0.6,
Wed Apr 08 23:28:26 2015 open_tun, tt->ipv6=0
Wed Apr 08 23:28:26 2015 TAP-WIN32 device [Ethernet 2] opened: \\.\Global\{39A46701-2F60-46BF-B96A-9D1A6D4365DE}.tap
Wed Apr 08 23:28:26 2015 TAP-Windows Driver Version 9.9
Wed Apr 08 23:28:26 2015 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.6/255.255.255.252 on interface {39A46701-2F60-46BF-B96A-9D1A6D4365DE} [DHCP-serv: 10.8.0.5, lease-time: 31536000]
Wed Apr 08 23:28:26 2015 Successful ARP Flush on interface [19] {39A46701-2F60-46BF-B96A-9D1A6D4365DE}
Wed Apr 08 23:28:31 2015 TEST ROUTES: 2/2 succeeded len=1 ret=1 a=0 u/d=up
Wed Apr 08 23:28:31 2015 C:\windows\system32\route.exe ADD a.b.c.d MASK 255.255.255.255 10.8.0.106
Wed Apr 08 23:28:31 2015 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=25 and dwForwardType=4
Wed Apr 08 23:28:31 2015 Route addition via IPAPI succeeded [adaptive]
Wed Apr 08 23:28:31 2015 C:\windows\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.8.0.5
Wed Apr 08 23:28:31 2015 ROUTE: route addition failed using CreateIpForwardEntry: One or more arguments are not correct. [status=160 if_index=19]
Wed Apr 08 23:28:31 2015 Route addition via IPAPI failed [adaptive]
Wed Apr 08 23:28:31 2015 Route addition fallback to route.exe
Wed Apr 08 23:28:31 2015 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Wed Apr 08 23:28:31 2015 C:\windows\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.8.0.5
Wed Apr 08 23:28:31 2015 ROUTE: route addition failed using CreateIpForwardEntry: One or more arguments are not correct. [status=160 if_index=19]
Wed Apr 08 23:28:31 2015 Route addition via IPAPI failed [adaptive]
Wed Apr 08 23:28:31 2015 Route addition fallback to route.exe
Wed Apr 08 23:28:31 2015 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Wed Apr 08 23:28:32 2015 MANAGEMENT: >STATE:1428506912,ADD_ROUTES,,,
Wed Apr 08 23:28:32 2015 C:\windows\system32\route.exe ADD 10.8.0.1 MASK 255.255.255.255 10.8.0.5
Wed Apr 08 23:28:32 2015 ROUTE: route addition failed using CreateIpForwardEntry: One or more arguments are not correct. [status=160 if_index=19]
Wed Apr 08 23:28:32 2015 Route addition via IPAPI failed [adaptive]
Wed Apr 08 23:28:32 2015 Route addition fallback to route.exe
Wed Apr 08 23:28:32 2015 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Wed Apr 08 23:28:32 2015 Initialization Sequence Completed
Wed Apr 08 23:28:32 2015 MANAGEMENT: >STATE:1428506912,CONNECTED,SUCCESS,10.8.0.6,a.b.c.d
root@vpn:~# service openvpn status
* VPN 'server' is running
root@vpn:~# service dnsmasq status
* Checking DNS forwarder and DHCP server dnsmasq * (running)
root@vpn:/etc/openvpn# cat /etc/resolv.conf
# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
# DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN
nameserver 127.0.0.1
search example.com
root@vpn:/etc/openvpn# route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default gw-li220.abc 0.0.0.0 UG 0 0 0 eth0
10.8.0.0 10.8.0.2 255.255.255.0 UG 0 0 0 tun0
10.8.0.2 * 255.255.255.255 UH 0 0 0 tun0
a.b.c.0 * 255.255.255.0 U 0 0 0 eth0
x.y.z.0 * 255.255.255.0 U 0 0 0 eth0
root@vpn:/etc/openvpn# cat ipp.txt
client,10.8.0.4
client,10.8.0.8
root@vpn:/etc/openvpn# cat openvpn-status.log
OpenVPN CLIENT LIST
Updated,Wed Apr 8 08:55:53 2015
Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since
client,a.b.c.d:56191,2404422,23872316,Wed Apr 8 08:41:34 2015
ROUTING TABLE
Virtual Address,Common Name,Real Address,Last Ref
10.8.0.6,client,a.b.c.d:56191,Wed Apr 8 08:55:52 2015
GLOBAL STATS
Max bcast/mcast queue length,0
END
Any additional suggestions? Thanks again for all your support these past few months!
