[Solved]Windows 8.1 - Openvpn TUN - cannot ping gateway

feeling

Hello,

Here is my set-up:

Server installed on openwrt, nothing very special ...
The version is "openvpn-openssl - 2.3.2-3"

The tun0 address is 10.8.0.1

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:10.8.0.1  P-t-P:10.8.0.2  Mask:255.255.255.255

port 1194
proto udp
dev tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/homeserver.crt
key /etc/openvpn/homeserver.key  # This file should be kept secret
dh /etc/openvpn/dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist /tmp/ipp.txt

client-config-dir ccd
route 10.8.0.0 255.255.255.0
route 10.8.1.0 255.255.255.0

keepalive 10 120
comp-lzo
persist-key
persist-tun
status /tmp/openvpn-status.log
verb 3

I have four client, the android clients work like a charm.
Linux clients work like a charm.

But the windows client didn't work 🙁

It connects, assign an ip (10.8.0.10), i get 10.8.0.9 as gw -> 10.8.0.9 is not pingable
if i add a route to 10.8.0.1 via 10.8.0.9, 10.8.0.1 is also not pingable

client
dev tun
proto udp
remote my.server.fqdn 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client7.crt
key client7.key
remote-cert-tls server
comp-lzo
verb 3
route-method exe
route-delay 2
route 0.0.0.0 0.0.0.0 vpn_gateway

any idea ?

Regards.

maikcat

are you running your win client with admin rights?

Michael.

feeling

Hello, Yess!! of course, the client is running in admin mode.

Only the local assigned ip is pingable, not the gateway

regards.

maikcat

please post:

your client log
output of netstat -nr on your client before & after openvpn is up.

Michael.

Traffic

feeling wroteOnly the local assigned ip is pingable, not the gateway

Note: With --topology net30 the gateway address in your case:

feeling wroteassign an ip (10.8.0.10), i get 10.8.0.9 as gw -> 10.8.0.9 is not pingable

This is correct function .. the gateway is not pingable by design.

Instead ping 10.8.0.1 .. the server address.

feeling

Hello ,

Before eveything, thanx for your answers !!!

Here is my routing table before connecting OPENVPN

C:\>netstat -nr
===========================================================================
Interface List
 25...00 ff 1a 39 xx xx ......TAP-Windows Adapter V9
 19...8c bf 9d 50 xx xx ......Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card
  6...e8 b1 fc 23 xx xx ......Microsoft Wi-Fi Direct Virtual Adapter
  5...e8 b1 fc 23 xx xx ......Intel(R) Dual Band Wireless-AC 7260
  4...e8 b1 fc 23 xx xx ......Bluetooth Device (Personal Area Network)
  1...........................Software Loopback Interface 1
  7...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
  8...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      10.32.253.1    10.32.253.174     25
      10.32.253.0    255.255.255.0         On-link     10.32.253.174    281
    10.32.253.174  255.255.255.255         On-link     10.32.253.174    281
    10.32.253.255  255.255.255.255         On-link     10.32.253.174    281
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link     10.32.253.174    281
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link     10.32.253.174    281
===========================================================================
Persistent Routes:
  None

After I connect openvpn, I get two default route (Ugly I know, but the 10.8.0.1 should ping and didn't ping)

C:\>netstat -nr
===========================================================================
Interface List
 25...00 ff 1a 39 xx xx ......TAP-Windows Adapter V9
 19...8c bf 9d 50 xx xx ......Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband
  6...e8 b1 fc 23 xx xx ......Microsoft Wi-Fi Direct Virtual Adapter
  5...e8 b1 fc 23 xx xx ......Intel(R) Dual Band Wireless-AC 7260
  4...e8 b1 fc 23 xx xx ......Bluetooth Device (Personal Area Network)
  1...........................Software Loopback Interface 1
  7...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
  8...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
  9...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      10.32.253.1    10.32.253.174     25
          0.0.0.0          0.0.0.0         10.8.0.9        10.8.0.10     21
         10.8.0.1  255.255.255.255         10.8.0.9        10.8.0.10     21
         10.8.0.8  255.255.255.252         On-link         10.8.0.10    276
        10.8.0.10  255.255.255.255         On-link         10.8.0.10    276
        10.8.0.11  255.255.255.255         On-link         10.8.0.10    276
      10.32.253.0    255.255.255.0         On-link     10.32.253.174    281
    10.32.253.174  255.255.255.255         On-link     10.32.253.174    281
    10.32.253.255  255.255.255.255         On-link     10.32.253.174    281
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link         10.8.0.10    276
        224.0.0.0        240.0.0.0         On-link     10.32.253.174    281
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link         10.8.0.10    276
  255.255.255.255  255.255.255.255         On-link     10.32.253.174    281
===========================================================================
Persistent Routes:
  None

So, I delete the 2 default route ( route delete 0.0.0.0 )
and add by the hand the correct route ( default 0.0.0.0 netmask 0.0.0.0 via 10.8.0.9 )

I get now

C:\>route add 0.0.0.0 mask 0.0.0.0  10.8.0.9
 OK!

C:\>route print -4

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0         10.8.0.9        10.8.0.10     21
         10.8.0.1  255.255.255.255         10.8.0.9        10.8.0.10     21
         10.8.0.8  255.255.255.252         On-link         10.8.0.10    276
        10.8.0.10  255.255.255.255         On-link         10.8.0.10    276
        10.8.0.11  255.255.255.255         On-link         10.8.0.10    276
      10.32.253.0    255.255.255.0         On-link     10.32.253.174    281
    10.32.253.174  255.255.255.255         On-link     10.32.253.174    281
    10.32.253.255  255.255.255.255         On-link     10.32.253.174    281
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link         10.8.0.10    276
        224.0.0.0        240.0.0.0         On-link     10.32.253.174    281
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link         10.8.0.10    276
  255.255.255.255  255.255.255.255         On-link     10.32.253.174    281
===========================================================================
Persistent Routes:
  None

C:\>ping 10.8.0.1

Pinging 10.8.0.1 with 32 bytes of data:
Request timed out.

Ping statistics for 10.8.0.1:
    Packets: Sent = 1, Received = 0, Lost = 1 (100% loss),
Control-C
^C
C:\>ping 10.8.0.9

Pinging 10.8.0.9 with 32 bytes of data:
Control-C
^C
C:\>

Edit: and the client side log :

Mon Feb 02 16:08:24 2015 OpenVPN 2.3.6 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Dec  1 2014
Mon Feb 02 16:08:24 2015 library versions: OpenSSL 1.0.1j 15 Oct 2014, LZO 2.08
Mon Feb 02 16:08:24 2015 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Mon Feb 02 16:08:24 2015 Need hold release from management interface, waiting...
Mon Feb 02 16:08:24 2015 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Mon Feb 02 16:08:25 2015 MANAGEMENT: CMD 'state on'
Mon Feb 02 16:08:25 2015 MANAGEMENT: CMD 'log all on'
Mon Feb 02 16:08:25 2015 MANAGEMENT: CMD 'hold off'
Mon Feb 02 16:08:25 2015 MANAGEMENT: CMD 'hold release'
Mon Feb 02 16:08:25 2015 Socket Buffers: R=[65536->65536] S=[65536->65536]
Mon Feb 02 16:08:25 2015 MANAGEMENT: >STATE:1422889705,RESOLVE,,,
Mon Feb 02 16:08:25 2015 UDPv4 link local: [undef]
Mon Feb 02 16:08:25 2015 UDPv4 link remote: [AF_INET]109.129.xxx.xxx:1194
Mon Feb 02 16:08:25 2015 MANAGEMENT: >STATE:1422889705,WAIT,,,
Mon Feb 02 16:08:25 2015 MANAGEMENT: >STATE:1422889705,AUTH,,,
Mon Feb 02 16:08:25 2015 TLS: Initial packet from [AF_INET]109.129.xxx.xxx:1194, sid=bc65359f 769f9715
Mon Feb 02 16:08:25 2015 VERIFY OK: depth=1, C=BE, ST=BE, L=Brussels, O=azerty, OU=ICT, CN=azerty CA, name=EasyRSA, emailAddress=webmaster@azerty.be
Mon Feb 02 16:08:25 2015 Validating certificate key usage
Mon Feb 02 16:08:25 2015 ++ Certificate has key usage  00a0, expects 00a0
Mon Feb 02 16:08:25 2015 VERIFY KU OK
Mon Feb 02 16:08:25 2015 Validating certificate extended key usage
Mon Feb 02 16:08:25 2015 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Mon Feb 02 16:08:25 2015 VERIFY EKU OK
Mon Feb 02 16:08:25 2015 VERIFY OK: depth=0, C=BE, ST=BE, L=Brussels, O=azerty, OU=ICT, CN=myfqdn.ip.be, name=EasyRSA, emailAddress=webmaster@azerty.be
Mon Feb 02 16:08:26 2015 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Feb 02 16:08:26 2015 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Feb 02 16:08:26 2015 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Feb 02 16:08:26 2015 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Feb 02 16:08:26 2015 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Mon Feb 02 16:08:26 2015 [myfqdn.ip.be] Peer Connection Initiated with [AF_INET]109.129.xxx.xxx:1194
Mon Feb 02 16:08:27 2015 MANAGEMENT: >STATE:1422889707,GET_CONFIG,,,
Mon Feb 02 16:08:28 2015 SENT CONTROL [myfqdn.ip.be]: 'PUSH_REQUEST' (status=1)
Mon Feb 02 16:08:28 2015 PUSH: Received control message: 'PUSH_REPLY,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.10 10.8.0.9'
Mon Feb 02 16:08:28 2015 OPTIONS IMPORT: timers and/or timeouts modified
Mon Feb 02 16:08:28 2015 OPTIONS IMPORT: --ifconfig/up options modified
Mon Feb 02 16:08:28 2015 OPTIONS IMPORT: route options modified
Mon Feb 02 16:08:28 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Mon Feb 02 16:08:28 2015 MANAGEMENT: >STATE:1422889708,ASSIGN_IP,,10.8.0.10,
Mon Feb 02 16:08:28 2015 open_tun, tt->ipv6=0
Mon Feb 02 16:08:28 2015 TAP-WIN32 device [Ethernet 2] opened: \\.\Global\{1A395F7B-8910-4EAA-85DC-362CBCFB12B0}.tap
Mon Feb 02 16:08:28 2015 TAP-Windows Driver Version 9.21
Mon Feb 02 16:08:28 2015 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.10/255.255.255.252 on interface {1A395F7B-8910-4EAA-85DC-362CBCFB0000} [DHCP-serv: 10.8.0.9, lease-time: 31536000]
Mon Feb 02 16:08:28 2015 Successful ARP Flush on interface [25] {1A395F7B-8910-4EAA-85DC-362CBCFB0000}
Mon Feb 02 16:08:31 2015 TEST ROUTES: 2/2 succeeded len=2 ret=1 a=0 u/d=up
Mon Feb 02 16:08:31 2015 MANAGEMENT: >STATE:1422889711,ADD_ROUTES,,,
Mon Feb 02 16:08:31 2015 C:\Windows\system32\route.exe ADD 0.0.0.0 MASK 0.0.0.0 10.8.0.9
Mon Feb 02 16:08:31 2015 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Mon Feb 02 16:08:31 2015 C:\Windows\system32\route.exe ADD 10.8.0.1 MASK 255.255.255.255 10.8.0.9
Mon Feb 02 16:08:31 2015 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Mon Feb 02 16:08:31 2015 Initialization Sequence Completed
Mon Feb 02 16:08:31 2015 MANAGEMENT: >STATE:1422889711,CONNECTED,SUCCESS,10.8.0.10,109.129.xxx.xxx

MMmh, not funny.

Regards.

feeling

I was not aware about the different topologies ....

Do you recommand to upgrade my server side to use a subnet topology ?

https://community.openvpn.net/openvpn/wiki/Topology

regards.
Laurent.

feeling

Hello Again, ....

I tried the subnet topologies, restarted the server side, and I get this routing table (I prefer this kind of routing method).
But the result is the same, .... the gateway is not pingable

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0         10.8.0.1         10.8.0.8     21
         10.8.0.0    255.255.255.0         On-link          10.8.0.8    276
         10.8.0.8  255.255.255.255         On-link          10.8.0.8    276
       10.8.0.255  255.255.255.255         On-link          10.8.0.8    276
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link          10.8.0.8    276
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link          10.8.0.8    276
===========================================================================
Persistent Routes:
  None

C:\>ping 10.8.0.1

Pinging 10.8.0.1 with 32 bytes of data:
Request timed out.

Ping statistics for 10.8.0.1:
    Packets: Sent = 1, Received = 0, Lost = 1 (100% loss),
Control-C
^C
C:\>

Damned .... windows windows ....

Regards.

maikcat

which openvpn version did you installed?
write please the name of the installer used...

Michael.

feeling

Hello,

Client side, we have :

Operating System : Windows Pro 8.1

C:\>ver

Microsoft Windows [Version 6.3.9600]

Installer : openvpn-install-2.3.6-I601-x86_64
OpenVpn Version :

C:\Program Files\OpenVPN\bin>openvpn.exe --version
OpenVPN 2.3.6 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Dec  1 2014
library versions: OpenSSL 1.0.1j 15 Oct 2014, LZO 2.08
Originally developed by James Yonan
Copyright (C) 2002-2010 OpenVPN Technologies, Inc. <sales@openvpn.net>
Compile time defines: enable_crypto=yes enable_crypto_ofb_cfb=yes enable_debug=no enable_def_auth=yes enable_dlopen=unknown enable_dlopen_self=unknown enable_dl
open_self_static=unknown enable_fast_install=needless enable_fragment=yes enable_http_proxy=yes enable_iproute2=no enable_libtool_lock=yes enable_lzo=yes enable
_lzo_stub=no enable_management=yes enable_multi=yes enable_multihome=yes enable_pam_dlopen=no enable_password_save=yes enable_pedantic=no enable_pf=yes enable_p
kcs11=yes enable_plugin_auth_pam=no enable_plugin_down_root=no enable_plugins=yes enable_port_share=yes enable_selinux=no enable_server=yes enable_shared=yes en
able_shared_with_static_runtimes=yes enable_small=no enable_snappy=no enable_socks=yes enable_ssl=yes enable_static=yes enable_strict=no enable_strict_options=n
o enable_systemd=no enable_win32_dll=yes enable_x509_alt_username=no with_crypto_library=openssl with_gnu_ld=yes with_mem_check=no with_plugindir='$(libdir)/ope
nvpn/plugins' with_special_build= with_sysroot=no

And Server side ... We have :

Operating System : OpenWrt

root@router:~# uname -a
Linux router 3.10.34 #5 Mon Apr 7 20:01:39 CEST 2014 mips GNU/Linux
root@router:~# cat /etc/openwrt_*
DISTRIB_ID="OpenWrt"
DISTRIB_RELEASE="Bleeding Edge"
DISTRIB_REVISION="r40380"
DISTRIB_CODENAME="barrier_breaker"
DISTRIB_TARGET="ar71xx/generic"
DISTRIB_DESCRIPTION="OpenWrt Barrier Breaker r40380"
DISTRIB_TAINTS="no-all"
r40380

OpenVPN Version :

root@router:~# openvpn --version
OpenVPN 2.3.2 mips-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Apr 16 2014
Originally developed by James Yonan
Copyright (C) 2002-2010 OpenVPN Technologies, Inc. <sales@openvpn.net>

Regards

feeling

For Information,

I noticed that when I run a capture server side :

tcpdump -i pppoe-wan 'udp port 1194' ...

There is almost no traffic, and when I run a ping 10.8.0.1, I see packets on the interface ... but no answer to the ping request ...

I m'blocked no more idea 🙁

Regards.

Traffic

feeling wroteHello Again, ....

I tried the subnet topologies

Probably worth posting your new configs and logs .. thanks

feeling

Hello,

I didn't change anything except adding " topology subnet " in the server.conf

So changed server.conf to :

port 1194
proto udp
dev tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/homeserver.crt
key /etc/openvpn/homeserver.key  # This file should be kept secret
dh /etc/openvpn/dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist /tmp/ipp.txt
topology subnet
client-config-dir ccd
route 10.8.0.0 255.255.255.0
route 10.8.1.0 255.255.255.0
keepalive 10 120
comp-lzo
persist-key
persist-tun
status /tmp/openvpn-status.log
verb 3

maikcat

just a thought....

for testing can you disable all antivirus/firewall software running on win 8?

also can you run a tcpdump on your server while trying to ping it from win 8?

i am curious to see if packets reach your openvpns server tun interface or not...

Michael.

feeling

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.

Traffic

Traffic wroteProbably worth posting your new configs and logs .. thanks

--verb 4 please.

feeling

Hello, here is anything :

Server Side
Version & Operating System

root@router:~# openvpn --version
OpenVPN 2.3.2 mips-openwrt-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Apr 16 2014
Originally developed by James Yonan
Copyright (C) 2002-2010 OpenVPN Technologies, Inc. <sales@openvpn.net>
root@router:~# cat /etc/openwrt_release
DISTRIB_ID="OpenWrt"
DISTRIB_RELEASE="Bleeding Edge"
DISTRIB_REVISION="r40380"
DISTRIB_CODENAME="barrier_breaker"
DISTRIB_TARGET="ar71xx/generic"
DISTRIB_DESCRIPTION="OpenWrt Barrier Breaker r40380"
DISTRIB_TAINTS="no-all"

Configuration

port 1194
proto udp
dev tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/homeserver.crt
key /etc/openvpn/homeserver.key  # This file should be kept secret
dh /etc/openvpn/dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist /tmp/ipp.txt
topology subnet
client-config-dir ccd
route 10.8.0.0 255.255.255.0
route 10.8.1.0 255.255.255.0
keepalive 10 120
comp-lzo
persist-key
persist-tun
status /tmp/openvpn-status.log
verb 3

ClientSide
Version & Operating System

C:\Program Files\OpenVPN\bin>ver

Microsoft Windows [Version 6.3.9600]

C:\Program Files\OpenVPN\bin>openvpn.exe --version
OpenVPN 2.3.6 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Dec  1 2014
library versions: OpenSSL 1.0.1j 15 Oct 2014, LZO 2.08
Originally developed by James Yonan
Copyright (C) 2002-2010 OpenVPN Technologies, Inc. <sales@openvpn.net>
Compile time defines: enable_crypto=yes enable_crypto_ofb_cfb=yes enable_debug=no enable_def_auth=yes enable_dlopen=unknown enable_dlopen_self=unknown enable_dl
open_self_static=unknown enable_fast_install=needless enable_fragment=yes enable_http_proxy=yes enable_iproute2=no enable_libtool_lock=yes enable_lzo=yes enable
_lzo_stub=no enable_management=yes enable_multi=yes enable_multihome=yes enable_pam_dlopen=no enable_password_save=yes enable_pedantic=no enable_pf=yes enable_p
kcs11=yes enable_plugin_auth_pam=no enable_plugin_down_root=no enable_plugins=yes enable_port_share=yes enable_selinux=no enable_server=yes enable_shared=yes en
able_shared_with_static_runtimes=yes enable_small=no enable_snappy=no enable_socks=yes enable_ssl=yes enable_static=yes enable_strict=no enable_strict_options=n
o enable_systemd=no enable_win32_dll=yes enable_x509_alt_username=no with_crypto_library=openssl with_gnu_ld=yes with_mem_check=no with_plugindir='$(libdir)/ope
nvpn/plugins' with_special_build= with_sysroot=no

Configuration

client
dev tun
proto udp
remote myserver.fqdn.be 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert venue11.crt
key venue11.key
remote-cert-tls server
comp-lzo
verb 4
route-method exe
route-delay 2
route 0.0.0.0 0.0.0.0 vpn_gateway

Log's

Wed Feb 04 13:10:26 2015   pkcs11_protected_authentication = DISABLED
Wed Feb 04 13:10:26 2015   pkcs11_protected_authentication = DISABLED
Wed Feb 04 13:10:26 2015   pkcs11_protected_authentication = DISABLED
Wed Feb 04 13:10:26 2015   pkcs11_protected_authentication = DISABLED
Wed Feb 04 13:10:26 2015   pkcs11_private_mode = 00000000
Wed Feb 04 13:10:26 2015   pkcs11_private_mode = 00000000
Wed Feb 04 13:10:26 2015   pkcs11_private_mode = 00000000
Wed Feb 04 13:10:26 2015   pkcs11_private_mode = 00000000
Wed Feb 04 13:10:26 2015   pkcs11_private_mode = 00000000
Wed Feb 04 13:10:26 2015   pkcs11_private_mode = 00000000
Wed Feb 04 13:10:26 2015   pkcs11_private_mode = 00000000
Wed Feb 04 13:10:26 2015   pkcs11_private_mode = 00000000
Wed Feb 04 13:10:26 2015   pkcs11_private_mode = 00000000
Wed Feb 04 13:10:26 2015   pkcs11_private_mode = 00000000
Wed Feb 04 13:10:26 2015   pkcs11_private_mode = 00000000
Wed Feb 04 13:10:26 2015   pkcs11_private_mode = 00000000
Wed Feb 04 13:10:26 2015   pkcs11_private_mode = 00000000
Wed Feb 04 13:10:26 2015   pkcs11_private_mode = 00000000
Wed Feb 04 13:10:26 2015   pkcs11_private_mode = 00000000
Wed Feb 04 13:10:26 2015   pkcs11_private_mode = 00000000
Wed Feb 04 13:10:26 2015   pkcs11_cert_private = DISABLED
Wed Feb 04 13:10:26 2015   pkcs11_cert_private = DISABLED
Wed Feb 04 13:10:26 2015   pkcs11_cert_private = DISABLED
Wed Feb 04 13:10:26 2015   pkcs11_cert_private = DISABLED
Wed Feb 04 13:10:26 2015   pkcs11_cert_private = DISABLED
Wed Feb 04 13:10:26 2015   pkcs11_cert_private = DISABLED
Wed Feb 04 13:10:26 2015   pkcs11_cert_private = DISABLED
Wed Feb 04 13:10:26 2015   pkcs11_cert_private = DISABLED
Wed Feb 04 13:10:26 2015   pkcs11_cert_private = DISABLED
Wed Feb 04 13:10:26 2015   pkcs11_cert_private = DISABLED
Wed Feb 04 13:10:26 2015   pkcs11_cert_private = DISABLED
Wed Feb 04 13:10:26 2015   pkcs11_cert_private = DISABLED
Wed Feb 04 13:10:26 2015   pkcs11_cert_private = DISABLED
Wed Feb 04 13:10:26 2015   pkcs11_cert_private = DISABLED
Wed Feb 04 13:10:26 2015   pkcs11_cert_private = DISABLED
Wed Feb 04 13:10:26 2015   pkcs11_cert_private = DISABLED
Wed Feb 04 13:10:26 2015   pkcs11_pin_cache_period = -1
Wed Feb 04 13:10:26 2015   pkcs11_id = '[UNDEF]'
Wed Feb 04 13:10:26 2015   pkcs11_id_management = DISABLED
Wed Feb 04 13:10:26 2015   server_network = 0.0.0.0
Wed Feb 04 13:10:26 2015   server_netmask = 0.0.0.0
Wed Feb 04 13:10:26 2015   server_network_ipv6 = ::
Wed Feb 04 13:10:26 2015   server_netbits_ipv6 = 0
Wed Feb 04 13:10:26 2015   server_bridge_ip = 0.0.0.0
Wed Feb 04 13:10:26 2015   server_bridge_netmask = 0.0.0.0
Wed Feb 04 13:10:26 2015   server_bridge_pool_start = 0.0.0.0
Wed Feb 04 13:10:26 2015   server_bridge_pool_end = 0.0.0.0
Wed Feb 04 13:10:26 2015   ifconfig_pool_defined = DISABLED
Wed Feb 04 13:10:26 2015   ifconfig_pool_start = 0.0.0.0
Wed Feb 04 13:10:26 2015   ifconfig_pool_end = 0.0.0.0
Wed Feb 04 13:10:26 2015   ifconfig_pool_netmask = 0.0.0.0
Wed Feb 04 13:10:26 2015   ifconfig_pool_persist_filename = '[UNDEF]'
Wed Feb 04 13:10:26 2015   ifconfig_pool_persist_refresh_freq = 600
Wed Feb 04 13:10:26 2015   ifconfig_ipv6_pool_defined = DISABLED
Wed Feb 04 13:10:26 2015   ifconfig_ipv6_pool_base = ::
Wed Feb 04 13:10:26 2015   ifconfig_ipv6_pool_netbits = 0
Wed Feb 04 13:10:26 2015   n_bcast_buf = 256
Wed Feb 04 13:10:26 2015   tcp_queue_limit = 64
Wed Feb 04 13:10:26 2015   real_hash_size = 256
Wed Feb 04 13:10:26 2015   virtual_hash_size = 256
Wed Feb 04 13:10:26 2015   client_connect_script = '[UNDEF]'
Wed Feb 04 13:10:26 2015   learn_address_script = '[UNDEF]'
Wed Feb 04 13:10:26 2015   client_disconnect_script = '[UNDEF]'
Wed Feb 04 13:10:26 2015   client_config_dir = '[UNDEF]'
Wed Feb 04 13:10:26 2015   ccd_exclusive = DISABLED
Wed Feb 04 13:10:26 2015   tmp_dir = 'C:\Users\lade\AppData\Local\Temp\'
Wed Feb 04 13:10:26 2015   push_ifconfig_defined = DISABLED
Wed Feb 04 13:10:26 2015   push_ifconfig_local = 0.0.0.0
Wed Feb 04 13:10:26 2015   push_ifconfig_remote_netmask = 0.0.0.0
Wed Feb 04 13:10:26 2015   push_ifconfig_ipv6_defined = DISABLED
Wed Feb 04 13:10:26 2015   push_ifconfig_ipv6_local = ::/0
Wed Feb 04 13:10:26 2015   push_ifconfig_ipv6_remote = ::
Wed Feb 04 13:10:26 2015   enable_c2c = DISABLED
Wed Feb 04 13:10:26 2015   duplicate_cn = DISABLED
Wed Feb 04 13:10:26 2015   cf_max = 0
Wed Feb 04 13:10:26 2015   cf_per = 0
Wed Feb 04 13:10:26 2015   max_clients = 1024
Wed Feb 04 13:10:26 2015   max_routes_per_client = 256
Wed Feb 04 13:10:26 2015   auth_user_pass_verify_script = '[UNDEF]'
Wed Feb 04 13:10:26 2015   auth_user_pass_verify_script_via_file = DISABLED
Wed Feb 04 13:10:26 2015   client = ENABLED
Wed Feb 04 13:10:26 2015   pull = ENABLED
Wed Feb 04 13:10:26 2015   auth_user_pass_file = '[UNDEF]'
Wed Feb 04 13:10:26 2015   show_net_up = DISABLED
Wed Feb 04 13:10:26 2015   route_method = 2
Wed Feb 04 13:10:26 2015   ip_win32_defined = DISABLED
Wed Feb 04 13:10:26 2015   ip_win32_type = 3
Wed Feb 04 13:10:26 2015   dhcp_masq_offset = 0
Wed Feb 04 13:10:26 2015   dhcp_lease_time = 31536000
Wed Feb 04 13:10:26 2015   tap_sleep = 0
Wed Feb 04 13:10:26 2015   dhcp_options = DISABLED
Wed Feb 04 13:10:26 2015   dhcp_renew = DISABLED
Wed Feb 04 13:10:26 2015   dhcp_pre_release = DISABLED
Wed Feb 04 13:10:26 2015   dhcp_release = DISABLED
Wed Feb 04 13:10:26 2015   domain = '[UNDEF]'
Wed Feb 04 13:10:26 2015   netbios_scope = '[UNDEF]'
Wed Feb 04 13:10:26 2015   netbios_node_type = 0
Wed Feb 04 13:10:26 2015   disable_nbt = DISABLED
Wed Feb 04 13:10:26 2015 OpenVPN 2.3.6 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Dec  1 2014
Wed Feb 04 13:10:26 2015 library versions: OpenSSL 1.0.1j 15 Oct 2014, LZO 2.08
Wed Feb 04 13:10:26 2015 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Wed Feb 04 13:10:26 2015 Need hold release from management interface, waiting...
Wed Feb 04 13:10:26 2015 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Wed Feb 04 13:10:26 2015 MANAGEMENT: CMD 'state on'
Wed Feb 04 13:10:26 2015 MANAGEMENT: CMD 'log all on'
Wed Feb 04 13:10:27 2015 MANAGEMENT: CMD 'hold off'
Wed Feb 04 13:10:27 2015 MANAGEMENT: CMD 'hold release'
Wed Feb 04 13:10:27 2015 LZO compression initialized
Wed Feb 04 13:10:27 2015 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Wed Feb 04 13:10:27 2015 Socket Buffers: R=[65536->65536] S=[65536->65536]
Wed Feb 04 13:10:27 2015 MANAGEMENT: >STATE:1423051827,RESOLVE,,,
Wed Feb 04 13:10:28 2015 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Wed Feb 04 13:10:28 2015 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Wed Feb 04 13:10:28 2015 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Wed Feb 04 13:10:28 2015 Local Options hash (VER=V4): '41690919'
Wed Feb 04 13:10:28 2015 Expected Remote Options hash (VER=V4): '530fdded'
Wed Feb 04 13:10:28 2015 UDPv4 link local: [undef]
Wed Feb 04 13:10:28 2015 UDPv4 link remote: [AF_INET]109.128.241.9:1194
Wed Feb 04 13:10:28 2015 MANAGEMENT: >STATE:1423051828,WAIT,,,
Wed Feb 04 13:10:28 2015 MANAGEMENT: >STATE:1423051828,AUTH,,,
Wed Feb 04 13:10:28 2015 TLS: Initial packet from [AF_INET]109.128.241.9:1194, sid=94e0dc35 f1e9f563
Wed Feb 04 13:10:29 2015 VERIFY OK: depth=1, C=BE, ST=BE, L=Brussels, O=DeleersProjects, OU=ICT, CN=DeleersProjects CA, name=EasyRSA, emailAddress=webmaster@deleersprojects.be
Wed Feb 04 13:10:29 2015 Validating certificate key usage
Wed Feb 04 13:10:29 2015 ++ Certificate has key usage  00a0, expects 00a0
Wed Feb 04 13:10:29 2015 VERIFY KU OK
Wed Feb 04 13:10:29 2015 Validating certificate extended key usage
Wed Feb 04 13:10:29 2015 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Wed Feb 04 13:10:29 2015 VERIFY EKU OK
Wed Feb 04 13:10:29 2015 VERIFY OK: depth=0, C=BE, ST=BE, L=Brussels, O=DeleersProjects, OU=ICT, CN=myserver.fqdn.be, name=EasyRSA, emailAddress=webmaster@deleersprojects.be
Wed Feb 04 13:10:31 2015 NOTE: Options consistency check may be skewed by version differences
Wed Feb 04 13:10:31 2015 WARNING: 'version' is used inconsistently, local='version V4', remote='version V0 UNDEF'
Wed Feb 04 13:10:31 2015 WARNING: 'dev-type' is present in local config but missing in remote config, local='dev-type tun'
Wed Feb 04 13:10:31 2015 WARNING: 'link-mtu' is present in local config but missing in remote config, local='link-mtu 1542'
Wed Feb 04 13:10:31 2015 WARNING: 'tun-mtu' is present in local config but missing in remote config, local='tun-mtu 1500'
Wed Feb 04 13:10:31 2015 WARNING: 'comp-lzo' is present in local config but missing in remote config, local='comp-lzo'
Wed Feb 04 13:10:31 2015 WARNING: 'cipher' is present in local config but missing in remote config, local='cipher BF-CBC'
Wed Feb 04 13:10:31 2015 WARNING: 'auth' is present in local config but missing in remote config, local='auth SHA1'
Wed Feb 04 13:10:31 2015 WARNING: 'keysize' is present in local config but missing in remote config, local='keysize 128'
Wed Feb 04 13:10:31 2015 WARNING: 'key-method' is present in local config but missing in remote config, local='key-method 2'
Wed Feb 04 13:10:31 2015 WARNING: 'tls-server' is present in local config but missing in remote config, local='tls-server'
Wed Feb 04 13:10:31 2015 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Feb 04 13:10:31 2015 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Feb 04 13:10:31 2015 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Feb 04 13:10:31 2015 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Feb 04 13:10:31 2015 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Wed Feb 04 13:10:31 2015 [myserver.fqdn.be] Peer Connection Initiated with [AF_INET]109.128.241.9:1194
Wed Feb 04 13:10:32 2015 MANAGEMENT: >STATE:1423051832,GET_CONFIG,,,
Wed Feb 04 13:10:34 2015 SENT CONTROL [myserver.fqdn.be]: 'PUSH_REQUEST' (status=1)
Wed Feb 04 13:10:34 2015 PUSH: Received control message: 'PUSH_REPLY,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.8.0.8 255.255.255.0'
Wed Feb 04 13:10:34 2015 OPTIONS IMPORT: timers and/or timeouts modified
Wed Feb 04 13:10:34 2015 OPTIONS IMPORT: --ifconfig/up options modified
Wed Feb 04 13:10:34 2015 OPTIONS IMPORT: route-related options modified
Wed Feb 04 13:10:34 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Feb 04 13:10:34 2015 MANAGEMENT: >STATE:1423051834,ASSIGN_IP,,10.8.0.8,
Wed Feb 04 13:10:34 2015 open_tun, tt->ipv6=0
Wed Feb 04 13:10:34 2015 TAP-WIN32 device [Ethernet 2] opened: \\.\Global\{1A395F7B-8910-4EAA-85DC-362CBCFB12B0}.tap
Wed Feb 04 13:10:34 2015 TAP-Windows Driver Version 9.21
Wed Feb 04 13:10:34 2015 TAP-Windows MTU=1500
Wed Feb 04 13:10:34 2015 Set TAP-Windows TUN subnet mode network/local/netmask = 10.8.0.0/10.8.0.8/255.255.255.0 [SUCCEEDED]
Wed Feb 04 13:10:34 2015 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.8/255.255.255.0 on interface {1A395F7B-8910-4EAA-85DC-362CBCFB12B0} [DHCP-serv: 10.8.0.254, lease-time: 31536000]
Wed Feb 04 13:10:34 2015 Successful ARP Flush on interface [25] {1A395F7B-8910-4EAA-85DC-362CBCFB12B0}
Wed Feb 04 13:10:36 2015 TEST ROUTES: 1/1 succeeded len=1 ret=1 a=0 u/d=up
Wed Feb 04 13:10:36 2015 MANAGEMENT: >STATE:1423051836,ADD_ROUTES,,,
Wed Feb 04 13:10:36 2015 C:\Windows\system32\route.exe ADD 0.0.0.0 MASK 0.0.0.0 10.8.0.1
Wed Feb 04 13:10:36 2015 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Wed Feb 04 13:10:36 2015 Initialization Sequence Completed
Wed Feb 04 13:10:36 2015 MANAGEMENT: >STATE:1423051836,CONNECTED,SUCCESS,10.8.0.8,109.128.241.9

Routing Table Before connect

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0   100.67.177.141   100.67.177.140    281
   100.67.177.140  255.255.255.252         On-link    100.67.177.140    281
   100.67.177.140  255.255.255.255         On-link    100.67.177.140    281
   100.67.177.143  255.255.255.255         On-link    100.67.177.140    281
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link    100.67.177.140    281
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link    100.67.177.140    281
===========================================================================
Persistent Routes:
  None

Routing Table After connect

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0   100.67.177.141   100.67.177.140    281
          0.0.0.0          0.0.0.0         10.8.0.1         10.8.0.8     21
         10.8.0.0    255.255.255.0         On-link          10.8.0.8    276
         10.8.0.8  255.255.255.255         On-link          10.8.0.8    276
       10.8.0.255  255.255.255.255         On-link          10.8.0.8    276
   100.67.177.140  255.255.255.252         On-link    100.67.177.140    281
   100.67.177.140  255.255.255.255         On-link    100.67.177.140    281
   100.67.177.143  255.255.255.255         On-link    100.67.177.140    281
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link          10.8.0.8    276
        224.0.0.0        240.0.0.0         On-link    100.67.177.140    281
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link          10.8.0.8    276
  255.255.255.255  255.255.255.255         On-link    100.67.177.140    281
===========================================================================
Persistent Routes:
  None

And the test ...

C:\>ping 10.8.0.1

Pinging 10.8.0.1 with 32 bytes of data:
Control-C
^C

From a linux client, the same test succeed.

Regards.

feeling

High Level Summary

Server openwrt - openvpn 2.3.2 - topology subnet
Client - Android Openvpn
Connect Openvpn : OK
Ping gateway : OK
Correct routing via 10.8.0.1 : OK
Client - Linux ubuntu 14.04 - Openvpn 2.3.2
Connect Openvpn : OK
Ping gateway : OK
Correct routing via 10.8.0.1 : OK
Client - windows 8.1 pro - Openvpn 2.3.6
Connect Openvpn : OK
Ping gateway : NOK
Correct routing via 10.8.0.1 : NOK
Client - windows 8.1 pro - Openvpn 2.3.2
Connect Openvpn : OK
Ping gateway : NOK
Correct routing via 10.8.0.1 : NOK

Server linux ubuntu 14.04 - openvpn 2.3.2 - topology subnet
Client - Android Openvpn
Connect Openvpn : OK
Ping gateway : OK
Correct routing via 10.8.0.1 : OK
Client - Linux ubuntu 14.04 - Openvpn 2.3.2
Connect Openvpn : OK
Ping gateway : OK
Correct routing via 10.8.0.1 : OK
Client - windows 8.1 pro - Openvpn 2.3.6
Connect Openvpn : OK
Ping gateway : NOK
Correct routing via 10.8.0.1 : NOK
Client - windows 8.1 pro - Openvpn 2.3.2
Connect Openvpn : OK
Ping gateway : NOK
Correct routing via 10.8.0.1 : NOK

And I've revert anything to the precedent post configuration

feeling

No Idea ? :-)

I'm in the deep dark ....

Traffic

Out of sheer curiosity I have just now setup Openwrt in a VirtualBox and configured a working OpenVPN.

I cannot reproduce your problem because I do not have access to W81

However:

With Windows 7 [and so probably 8] if you use the OpenVPN-GUI to start openvpn
you must <Right-click>:Run as Administrator even if you are logged on as administrator.

Personally, i would use the Openvpn Service and start Openvpn automatically.