Need Help with Setting Up OpenVPN with Ubuntu 14.04 server

pengyou

I am a complete newbie and have managed to successfully install my first ubuntu server. I even got as far as being able to set up a simple TUN server and client connection with OpenVPN. However, my main goal is to set up TAP so that my client devices looks and feels like it is using my internal network. This is particularly useful when travelling internationally with some countries blocking key sites or services that I need for work. I've been trying to figure everything out for days already...

Two main issues:
1) Assuming that the password required to authenticate a certificate is the one that entered when setting it up, how do I set/determine what the username is? I've searched all over with different search terms/phrases, but couldn't find an answer or connect using the authentication that requires the certificate keys as well as the username and password.

2) My /etc/network/interfaces file shows "auto p1p1" instead of "auto eth0" and all instructions that I've found use eth0, eth1 and/or br0. How do I create the bridge connection if my ethernet uses p1p1 instead of eth0?

Reference:
https://help.ubuntu.com/14.04/serverguide/openvpn.html#openvpn-advanced-config

Traffic

pengyou wrote My /etc/network/interfaces file shows "auto p1p1" instead of "auto eth0"

please post details of ifconfig

pengyou wroteReference:
https://help.ubuntu.com/14.04/servergui ... ced-config

Please see the official HOWTO:
HOWTO: For OpenVPN Community Edition

pengyou wrotemy main goal is to set up TAP

See this HOWTO:
http://openvpn.net/index.php/open-source/documentation/miscellaneous/ethernet-bridging.html

You may also find this helpful:
https://forums.openvpn.net/topic18186.html

pengyou

I've read all of the links that Traffic posted (and read them over and over for the past few days trying to get this to work, but have had no success... yet). So frustrated!

When I type ifconf, it shows this: (I typed it out, because my server only has command prompts and I don't know how to copy/save it)

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/28 Scope:Host
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:64 errors:0 dropped:0 overruns:0 frame:0
TX packets:64 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:5280 (5.2 KB) TX bytes:5280 (5.2 KB)

p1p1 Link encap:Ethernet HWaddr 00:10:c6:b8:5a:5a inet addr:192.168.88.90 Bcast:192:168.88.255 Mask:255.255.255.0
inet6 addr: fe80::210:c6ff:feb8:5a5a/64 Scope:Link
UP LOOPBACK RUNNING MTU:1500 Metric:1
RX packets:300 errors:0 dropped:0 overruns:0 frame:0
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:29890 (29.8 KB) TX bytes:680 (680.0 B)
Interrupt:16 Memory:d0080000-d00a0000

----- /etc/network/interfaces ----
I'm currently using the following line in the interfaces file, but don't know what I should be entering for the username when authenticating. Would you be able to tell me what that is?
plugin /usr/share/openvpn/plugin/lib/openvpn-auth-pam.so login

----- For the /etc/openvpn/server.conf file -----
I have one computer and one router on the server side. Is this line correct?
server-bridge 192.168.88.90 255.255.255.0 192.168.88.200 192.168.8.209

Do I need this line and is it correct?
push "route 192.168.88.1 255.255.255.0" # 192.168.88.1 is my router's ip

Shoud I be using:
push "redirect-gateway def1"
or
push "redirect-gateway def1 bypass-dhcp"

Should I use this and what IPs should I be putting in?
push "dhcp-option DNS 10.0.0.2"
push "dhcp-option DNS 10.1.0.2"

Is it possible to listen to both TCP and UDP ports on the server at the same time, or do we need to choose to comment out one of them?
proto tcp
proto udp

----- For the client.ovpn (or client.conf) file -----
If it is possible to have both TCP and UDP on the server, for the client config file, should I be using the following:
(adding "udp" or "tcp" after the port number or just leaving it out?)
remote [PublicIP] 1194 udp
remote [PublicIP] 443 tcp
or must I choose one type of connection?

If I'm using the ta.key file where I input the following line to the client config,
tls-auth ta.key 1
do I need to do anything for the line below?
remote-cert-tls server

----- Unsure -----
Are these commands required to be inputed into the server computer? If so, where?
iptables -A INPUT -i tap0 -j ACCEPT
iptables -A INPUT -i br0 -j ACCEPT
iptables -A FORWARD -i br0 -j ACCEPT

Do I need to add "routes" on my router? If so, what values should I enter and where?

With the simple connection I was able to establish, I was able to connect, but the IP of the client connection still showed their original service provider's even though I have the line below to the server.conf file. I wonder if there's an easy way of fixing that connection type to get it to work instead of having to set up TAP...
push "redirect-gateway def1"
or
push "redirect-gateway def1 bypass-dhcp"
(I tried both and they didn't work)

Traffic

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.

pengyou

I've attached the details of the key files of the last working version that I was able to connect with. I made many changes and nothing seems to work with the current version, so it's probably best to edit the existing one below to make things work.

In short, I have a user that is currently in another country and is unable to access important data and sites that we normally use for work. We would like to set up a VPN connection that routes all of the client's Internet activity through the VPN so that we can access things as usual. With the 8181 port added, we are finally able to connect, but Internet activity doesn't appear to be routing through the VPN (whatismyip.com is showing the other country's IP address). What is the best way to achieve this goal?

Since the certificates will likely be sent via the Internet, we would also like to add password authentication, just in case someone else steals the certs, they still can't get access...

----- Client Config File -----
client
dev tun
proto udp
remote [Server's PublicIP] 8181
remote [Server's PublicIP] 1194
remote [Server's PublicIP] 443
resolv-retry infinite
nobind
user nobody
group nobody
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
remote-cert-tls server
comp-lzo
verb 3
----- End of Client Config File -----

----- Server Config File (/etc/openvpn/server.conf) -----
port 8181
port 1194
port 443
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3
----- End of Server Config File -----

----- Network Interfaces File (/etc/network/interfaces) -----
auto lo
iface lo inet loopback
auto p1p1
iface p1p1 inet dhcp
----- End of Network Interfaces File -----

Aside: What does it mean to be "using verb 4 in both configs"? I've tried to Google this phrase to hopefully find a command line or detail instructions, but couldn't really figure it out. Finally, I can see separte lines on the server computer, but when I transfer the server.conf file to USB to the another computer, it all gets mashed together... no luck with copy & paste so I had to type everything out...

maikcat

What does it mean to be "using verb 4 in both configs"

in your configs there is the verb directive , set it to value 4

Michael.

Traffic

pengyou wrote----- Server Config File (/etc/openvpn/server.conf) -----
port 8181
port 1194
port 443
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3
----- End of Server Config File -----

You can only specify one port directive in the server config - Select port 1194 and remove the others.

maikcat wrotein your configs there is the verb directive , set it to value 4

verb 3 in Bold above .. change to verb 4 (In server and client config) and post your logs please.

pengyou

The standard ports were blocked by the other country so I had to use 8181 instead. Are the logs below what you are looking for? If not, please let me know where to find those files...

----- Client log -----
Wed Feb 18 11:28:41 2015 pkcs11_protected_authentication = DISABLED
Wed Feb 18 11:28:41 2015 pkcs11_protected_authentication = DISABLED
Wed Feb 18 11:28:41 2015 pkcs11_protected_authentication = DISABLED
Wed Feb 18 11:28:41 2015 pkcs11_protected_authentication = DISABLED
Wed Feb 18 11:28:41 2015 pkcs11_private_mode = 00000000
Wed Feb 18 11:28:41 2015 pkcs11_private_mode = 00000000
Wed Feb 18 11:28:41 2015 pkcs11_private_mode = 00000000
Wed Feb 18 11:28:41 2015 pkcs11_private_mode = 00000000
Wed Feb 18 11:28:41 2015 pkcs11_private_mode = 00000000
Wed Feb 18 11:28:41 2015 pkcs11_private_mode = 00000000
Wed Feb 18 11:28:41 2015 pkcs11_private_mode = 00000000
Wed Feb 18 11:28:41 2015 pkcs11_private_mode = 00000000
Wed Feb 18 11:28:41 2015 pkcs11_private_mode = 00000000
Wed Feb 18 11:28:41 2015 pkcs11_private_mode = 00000000
Wed Feb 18 11:28:41 2015 pkcs11_private_mode = 00000000
Wed Feb 18 11:28:41 2015 pkcs11_private_mode = 00000000
Wed Feb 18 11:28:41 2015 pkcs11_private_mode = 00000000
Wed Feb 18 11:28:41 2015 pkcs11_private_mode = 00000000
Wed Feb 18 11:28:41 2015 pkcs11_private_mode = 00000000
Wed Feb 18 11:28:41 2015 pkcs11_private_mode = 00000000
Wed Feb 18 11:28:41 2015 pkcs11_cert_private = DISABLED
Wed Feb 18 11:28:41 2015 pkcs11_cert_private = DISABLED
Wed Feb 18 11:28:41 2015 pkcs11_cert_private = DISABLED
Wed Feb 18 11:28:41 2015 pkcs11_cert_private = DISABLED
Wed Feb 18 11:28:41 2015 pkcs11_cert_private = DISABLED
Wed Feb 18 11:28:41 2015 pkcs11_cert_private = DISABLED
Wed Feb 18 11:28:41 2015 pkcs11_cert_private = DISABLED
Wed Feb 18 11:28:41 2015 pkcs11_cert_private = DISABLED
Wed Feb 18 11:28:41 2015 pkcs11_cert_private = DISABLED
Wed Feb 18 11:28:41 2015 pkcs11_cert_private = DISABLED
Wed Feb 18 11:28:41 2015 pkcs11_cert_private = DISABLED
Wed Feb 18 11:28:41 2015 pkcs11_cert_private = DISABLED
Wed Feb 18 11:28:41 2015 pkcs11_cert_private = DISABLED
Wed Feb 18 11:28:41 2015 pkcs11_cert_private = DISABLED
Wed Feb 18 11:28:41 2015 pkcs11_cert_private = DISABLED
Wed Feb 18 11:28:41 2015 pkcs11_cert_private = DISABLED
Wed Feb 18 11:28:41 2015 pkcs11_pin_cache_period = -1
Wed Feb 18 11:28:41 2015 pkcs11_id = '[UNDEF]'
Wed Feb 18 11:28:41 2015 pkcs11_id_management = DISABLED
Wed Feb 18 11:28:41 2015 server_network = 0.0.0.0
Wed Feb 18 11:28:41 2015 server_netmask = 0.0.0.0
Wed Feb 18 11:28:41 2015 server_network_ipv6 = ::
Wed Feb 18 11:28:41 2015 server_netbits_ipv6 = 0
Wed Feb 18 11:28:41 2015 server_bridge_ip = 0.0.0.0
Wed Feb 18 11:28:41 2015 server_bridge_netmask = 0.0.0.0
Wed Feb 18 11:28:41 2015 server_bridge_pool_start = 0.0.0.0
Wed Feb 18 11:28:41 2015 server_bridge_pool_end = 0.0.0.0
Wed Feb 18 11:28:41 2015 ifconfig_pool_defined = DISABLED
Wed Feb 18 11:28:41 2015 ifconfig_pool_start = 0.0.0.0
Wed Feb 18 11:28:41 2015 ifconfig_pool_end = 0.0.0.0
Wed Feb 18 11:28:41 2015 ifconfig_pool_netmask = 0.0.0.0
Wed Feb 18 11:28:41 2015 ifconfig_pool_persist_filename = '[UNDEF]'
Wed Feb 18 11:28:41 2015 ifconfig_pool_persist_refresh_freq = 600
Wed Feb 18 11:28:41 2015 ifconfig_ipv6_pool_defined = DISABLED
Wed Feb 18 11:28:41 2015 ifconfig_ipv6_pool_base = ::
Wed Feb 18 11:28:41 2015 ifconfig_ipv6_pool_netbits = 0
Wed Feb 18 11:28:41 2015 n_bcast_buf = 256
Wed Feb 18 11:28:41 2015 tcp_queue_limit = 64
Wed Feb 18 11:28:41 2015 real_hash_size = 256
Wed Feb 18 11:28:41 2015 virtual_hash_size = 256
Wed Feb 18 11:28:41 2015 client_connect_script = '[UNDEF]'
Wed Feb 18 11:28:41 2015 learn_address_script = '[UNDEF]'
Wed Feb 18 11:28:41 2015 client_disconnect_script = '[UNDEF]'
Wed Feb 18 11:28:41 2015 client_config_dir = '[UNDEF]'
Wed Feb 18 11:28:41 2015 ccd_exclusive = DISABLED
Wed Feb 18 11:28:41 2015 tmp_dir = 'C:\Users\GUEST\AppData\Local\Temp\'
Wed Feb 18 11:28:41 2015 push_ifconfig_defined = DISABLED
Wed Feb 18 11:28:41 2015 push_ifconfig_local = 0.0.0.0
Wed Feb 18 11:28:41 2015 push_ifconfig_remote_netmask = 0.0.0.0
Wed Feb 18 11:28:41 2015 push_ifconfig_ipv6_defined = DISABLED
Wed Feb 18 11:28:41 2015 push_ifconfig_ipv6_local = ::/0
Wed Feb 18 11:28:41 2015 push_ifconfig_ipv6_remote = ::
Wed Feb 18 11:28:41 2015 enable_c2c = DISABLED
Wed Feb 18 11:28:41 2015 duplicate_cn = DISABLED
Wed Feb 18 11:28:41 2015 cf_max = 0
Wed Feb 18 11:28:41 2015 cf_per = 0
Wed Feb 18 11:28:41 2015 max_clients = 1024
Wed Feb 18 11:28:41 2015 max_routes_per_client = 256
Wed Feb 18 11:28:41 2015 auth_user_pass_verify_script = '[UNDEF]'
Wed Feb 18 11:28:41 2015 auth_user_pass_verify_script_via_file = DISABLED
Wed Feb 18 11:28:41 2015 client = ENABLED
Wed Feb 18 11:28:41 2015 pull = ENABLED
Wed Feb 18 11:28:41 2015 auth_user_pass_file = '[UNDEF]'
Wed Feb 18 11:28:41 2015 show_net_up = DISABLED
Wed Feb 18 11:28:41 2015 route_method = 0
Wed Feb 18 11:28:41 2015 ip_win32_defined = DISABLED
Wed Feb 18 11:28:41 2015 ip_win32_type = 3
Wed Feb 18 11:28:41 2015 dhcp_masq_offset = 0
Wed Feb 18 11:28:41 2015 dhcp_lease_time = 31536000
Wed Feb 18 11:28:41 2015 tap_sleep = 0
Wed Feb 18 11:28:41 2015 dhcp_options = DISABLED
Wed Feb 18 11:28:41 2015 dhcp_renew = DISABLED
Wed Feb 18 11:28:41 2015 dhcp_pre_release = DISABLED
Wed Feb 18 11:28:41 2015 dhcp_release = DISABLED
Wed Feb 18 11:28:41 2015 domain = '[UNDEF]'
Wed Feb 18 11:28:41 2015 netbios_scope = '[UNDEF]'
Wed Feb 18 11:28:41 2015 netbios_node_type = 0
Wed Feb 18 11:28:41 2015 disable_nbt = DISABLED
Wed Feb 18 11:28:41 2015 OpenVPN 2.3.6 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Dec 1 2014
Wed Feb 18 11:28:41 2015 library versions: OpenSSL 1.0.1j 15 Oct 2014, LZO 2.08
Wed Feb 18 11:28:41 2015 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Wed Feb 18 11:28:41 2015 Need hold release from management interface, waiting...
Wed Feb 18 11:28:41 2015 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Wed Feb 18 11:28:41 2015 MANAGEMENT: CMD 'state on'
Wed Feb 18 11:28:41 2015 MANAGEMENT: CMD 'log all on'
Wed Feb 18 11:28:42 2015 MANAGEMENT: CMD 'hold off'
Wed Feb 18 11:28:42 2015 MANAGEMENT: CMD 'hold release'
Wed Feb 18 11:28:42 2015 LZO compression initialized
Wed Feb 18 11:28:42 2015 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Wed Feb 18 11:28:42 2015 Socket Buffers: R=[65536->65536] S=[65536->65536]
Wed Feb 18 11:28:42 2015 MANAGEMENT: >STATE:1424276922,RESOLVE,,,
Wed Feb 18 11:28:42 2015 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Wed Feb 18 11:28:42 2015 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Wed Feb 18 11:28:42 2015 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-

server'
Wed Feb 18 11:28:42 2015 Local Options hash (VER=V4): '41690919'
Wed Feb 18 11:28:42 2015 Expected Remote Options hash (VER=V4): '530fdded'
Wed Feb 18 11:28:42 2015 UDPv4 link local: [undef]
Wed Feb 18 11:28:42 2015 UDPv4 link remote: [AF_INET]207.112.194.131:8181
Wed Feb 18 11:28:42 2015 MANAGEMENT: >STATE:1424276922,WAIT,,,
Wed Feb 18 11:28:42 2015 MANAGEMENT: >STATE:1424276922,AUTH,,,
Wed Feb 18 11:28:42 2015 TLS: Initial packet from [AF_INET]207.112.194.131:8181, sid=ddd56f32 ffe2216d
Wed Feb 18 11:28:43 2015 VERIFY OK: depth=1, C=CA, ST=ON, L=Toronto, O=IQMobile, OU=ITSecurity, CN=IQVPN, name=IQVPN, emailAddress=OpenVPN@iqmobile.ca
Wed Feb 18 11:28:43 2015 Validating certificate key usage
Wed Feb 18 11:28:43 2015 ++ Certificate has key usage 00a0, expects 00a0
Wed Feb 18 11:28:43 2015 VERIFY KU OK
Wed Feb 18 11:28:43 2015 Validating certificate extended key usage
Wed Feb 18 11:28:43 2015 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Wed Feb 18 11:28:43 2015 VERIFY EKU OK
Wed Feb 18 11:28:43 2015 VERIFY OK: depth=0, C=US, ST=NC, L=Winston-Salem, O=Example Company, OU=MyVPN, CN=MyVPN, name=MyVPN, emailAddress=MyVPN@mydomain.com
Wed Feb 18 11:28:44 2015 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Feb 18 11:28:44 2015 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Feb 18 11:28:44 2015 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Feb 18 11:28:44 2015 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Feb 18 11:28:44 2015 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Wed Feb 18 11:28:44 2015 [server] Peer Connection Initiated with [AF_INET]207.112.194.131:8181
Wed Feb 18 11:28:45 2015 MANAGEMENT: >STATE:1424276925,GET_CONFIG,,,
Wed Feb 18 11:28:47 2015 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Wed Feb 18 11:28:47 2015 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6

10.8.0.5'
Wed Feb 18 11:28:47 2015 OPTIONS IMPORT: timers and/or timeouts modified
Wed Feb 18 11:28:47 2015 OPTIONS IMPORT: --ifconfig/up options modified
Wed Feb 18 11:28:47 2015 OPTIONS IMPORT: route options modified
Wed Feb 18 11:28:47 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Feb 18 11:28:47 2015 MANAGEMENT: >STATE:1424276927,ASSIGN_IP,,10.8.0.6,
Wed Feb 18 11:28:47 2015 open_tun, tt->ipv6=0
Wed Feb 18 11:28:47 2015 TAP-WIN32 device [Ethernet 3] opened: \\.\Global\{489D2000-CEA2-4D0E-8D96-34800EA88588}.tap
Wed Feb 18 11:28:47 2015 TAP-Windows Driver Version 9.21
Wed Feb 18 11:28:47 2015 TAP-Windows MTU=1500
Wed Feb 18 11:28:47 2015 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.6/255.255.255.252 on interface {489D2000-CEA2-4D0E-8D96-34800EA88588} [DHCP-serv:

10.8.0.5, lease-time: 31536000]
Wed Feb 18 11:28:47 2015 NOTE: FlushIpNetTable failed on interface [23] {489D2000-CEA2-4D0E-8D96-34800EA88588} (status=5) : Access is denied.
Wed Feb 18 11:28:52 2015 TEST ROUTES: 2/2 succeeded len=1 ret=1 a=0 u/d=up
Wed Feb 18 11:28:52 2015 C:\windows\system32\route.exe ADD 207.112.94.131 MASK 255.255.255.255 192.168.43.1
Wed Feb 18 11:28:52 2015 ROUTE: route addition failed using CreateIpForwardEntry: Access is denied. [status=5 if_index=3]
Wed Feb 18 11:28:52 2015 Route addition via IPAPI failed [adaptive]
Wed Feb 18 11:28:52 2015 Route addition fallback to route.exe
Wed Feb 18 11:28:52 2015 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Wed Feb 18 11:28:52 2015 ERROR: Windows route add command failed [adaptive]: returned error code 1
Wed Feb 18 11:28:52 2015 C:\windows\system32\route.exe ADD 192.168.43.1 MASK 255.255.255.255 192.168.43.1 IF 3
Wed Feb 18 11:28:52 2015 ROUTE: route addition failed using CreateIpForwardEntry: Access is denied. [status=5 if_index=3]
Wed Feb 18 11:28:52 2015 Route addition via IPAPI failed [adaptive]
Wed Feb 18 11:28:52 2015 Route addition fallback to route.exe
Wed Feb 18 11:28:52 2015 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Wed Feb 18 11:28:52 2015 ERROR: Windows route add command failed [adaptive]: returned error code 1
Wed Feb 18 11:28:52 2015 C:\windows\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.8.0.5
Wed Feb 18 11:28:52 2015 ROUTE: route addition failed using CreateIpForwardEntry: Access is denied. [status=5 if_index=23]
Wed Feb 18 11:28:52 2015 Route addition via IPAPI failed [adaptive]
Wed Feb 18 11:28:52 2015 Route addition fallback to route.exe
Wed Feb 18 11:28:52 2015 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Wed Feb 18 11:28:52 2015 ERROR: Windows route add command failed [adaptive]: returned error code 1
Wed Feb 18 11:28:52 2015 C:\windows\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.8.0.5
Wed Feb 18 11:28:52 2015 ROUTE: route addition failed using CreateIpForwardEntry: Access is denied. [status=5 if_index=23]
Wed Feb 18 11:28:52 2015 Route addition via IPAPI failed [adaptive]
Wed Feb 18 11:28:52 2015 Route addition fallback to route.exe
Wed Feb 18 11:28:52 2015 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Wed Feb 18 11:28:52 2015 ERROR: Windows route add command failed [adaptive]: returned error code 1
Wed Feb 18 11:28:52 2015 MANAGEMENT: >STATE:1424276932,ADD_ROUTES,,,
Wed Feb 18 11:28:52 2015 C:\windows\system32\route.exe ADD 10.8.0.1 MASK 255.255.255.255 10.8.0.5
Wed Feb 18 11:28:52 2015 ROUTE: route addition failed using CreateIpForwardEntry: Access is denied. [status=5 if_index=23]
Wed Feb 18 11:28:52 2015 Route addition via IPAPI failed [adaptive]
Wed Feb 18 11:28:52 2015 Route addition fallback to route.exe
Wed Feb 18 11:28:52 2015 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Wed Feb 18 11:28:52 2015 ERROR: Windows route add command failed [adaptive]: returned error code 1
Wed Feb 18 11:28:52 2015 Initialization Sequence Completed
Wed Feb 18 11:28:52 2015 MANAGEMENT: >STATE:1424276932,CONNECTED,SUCCESS,10.8.0.6,207.112.94.131
----- End of Client Log -----

----- Server - OpenVPN-Status.log -----
OpenVPN CLIENT LIST
Updated,Wed Feb 18 11:30:16 2015
Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since
client,207.219.169.156:8280,21032,6009,Wed Feb 18 11:28:41 2015
ROUTING TABLE
Virtual Address,Common Name,Real Address Last Ref
10.8.0.6,client,207.219.169.156:8280,Wed Feb 18 11:28:43 2015
GLOBAL STATS
Max bcast/mcast queue length,0
END
----- End of Server Log -----

Traffic

pengyou wroteWed Feb 18 11:28:52 2015 C:\windows\system32\route.exe ADD 207.112.94.131 MASK 255.255.255.255 192.168.43.1
Wed Feb 18 11:28:52 2015 ROUTE: route addition failed using CreateIpForwardEntry: Access is denied. [status=5 if_index=3]
Wed Feb 18 11:28:52 2015 Route addition via IPAPI failed [adaptive]
Wed Feb 18 11:28:52 2015 Route addition fallback to route.exe
Wed Feb 18 11:28:52 2015 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Wed Feb 18 11:28:52 2015 ERROR: Windows route add command failed [adaptive]: returned error code 1

You must use: <Right-Click> Run as administrator

pengyou

OK, this time I was able to connect, but then I was unable to access the Internet... What am I missing?

----- Client log -----
Wed Feb 18 17:48:01 2015 pkcs11_protected_authentication = DISABLED
Wed Feb 18 17:48:01 2015 pkcs11_protected_authentication = DISABLED
Wed Feb 18 17:48:01 2015 pkcs11_protected_authentication = DISABLED
Wed Feb 18 17:48:01 2015 pkcs11_protected_authentication = DISABLED
Wed Feb 18 17:48:01 2015 pkcs11_private_mode = 00000000
Wed Feb 18 17:48:01 2015 pkcs11_private_mode = 00000000
Wed Feb 18 17:48:01 2015 pkcs11_private_mode = 00000000
Wed Feb 18 17:48:01 2015 pkcs11_private_mode = 00000000
Wed Feb 18 17:48:01 2015 pkcs11_private_mode = 00000000
Wed Feb 18 17:48:01 2015 pkcs11_private_mode = 00000000
Wed Feb 18 17:48:01 2015 pkcs11_private_mode = 00000000
Wed Feb 18 17:48:01 2015 pkcs11_private_mode = 00000000
Wed Feb 18 17:48:01 2015 pkcs11_private_mode = 00000000
Wed Feb 18 17:48:01 2015 pkcs11_private_mode = 00000000
Wed Feb 18 17:48:01 2015 pkcs11_private_mode = 00000000
Wed Feb 18 17:48:01 2015 pkcs11_private_mode = 00000000
Wed Feb 18 17:48:01 2015 pkcs11_private_mode = 00000000
Wed Feb 18 17:48:01 2015 pkcs11_private_mode = 00000000
Wed Feb 18 17:48:01 2015 pkcs11_private_mode = 00000000
Wed Feb 18 17:48:01 2015 pkcs11_private_mode = 00000000
Wed Feb 18 17:48:01 2015 pkcs11_cert_private = DISABLED
Wed Feb 18 17:48:01 2015 pkcs11_cert_private = DISABLED
Wed Feb 18 17:48:01 2015 pkcs11_cert_private = DISABLED
Wed Feb 18 17:48:01 2015 pkcs11_cert_private = DISABLED
Wed Feb 18 17:48:01 2015 pkcs11_cert_private = DISABLED
Wed Feb 18 17:48:01 2015 pkcs11_cert_private = DISABLED
Wed Feb 18 17:48:01 2015 pkcs11_cert_private = DISABLED
Wed Feb 18 17:48:01 2015 pkcs11_cert_private = DISABLED
Wed Feb 18 17:48:01 2015 pkcs11_cert_private = DISABLED
Wed Feb 18 17:48:01 2015 pkcs11_cert_private = DISABLED
Wed Feb 18 17:48:01 2015 pkcs11_cert_private = DISABLED
Wed Feb 18 17:48:01 2015 pkcs11_cert_private = DISABLED
Wed Feb 18 17:48:01 2015 pkcs11_cert_private = DISABLED
Wed Feb 18 17:48:01 2015 pkcs11_cert_private = DISABLED
Wed Feb 18 17:48:01 2015 pkcs11_cert_private = DISABLED
Wed Feb 18 17:48:01 2015 pkcs11_cert_private = DISABLED
Wed Feb 18 17:48:01 2015 pkcs11_pin_cache_period = -1
Wed Feb 18 17:48:01 2015 pkcs11_id = '[UNDEF]'
Wed Feb 18 17:48:01 2015 pkcs11_id_management = DISABLED
Wed Feb 18 17:48:01 2015 server_network = 0.0.0.0
Wed Feb 18 17:48:01 2015 server_netmask = 0.0.0.0
Wed Feb 18 17:48:01 2015 server_network_ipv6 = ::
Wed Feb 18 17:48:01 2015 server_netbits_ipv6 = 0
Wed Feb 18 17:48:01 2015 server_bridge_ip = 0.0.0.0
Wed Feb 18 17:48:01 2015 server_bridge_netmask = 0.0.0.0
Wed Feb 18 17:48:01 2015 server_bridge_pool_start = 0.0.0.0
Wed Feb 18 17:48:01 2015 server_bridge_pool_end = 0.0.0.0
Wed Feb 18 17:48:01 2015 ifconfig_pool_defined = DISABLED
Wed Feb 18 17:48:01 2015 ifconfig_pool_start = 0.0.0.0
Wed Feb 18 17:48:01 2015 ifconfig_pool_end = 0.0.0.0
Wed Feb 18 17:48:01 2015 ifconfig_pool_netmask = 0.0.0.0
Wed Feb 18 17:48:01 2015 ifconfig_pool_persist_filename = '[UNDEF]'
Wed Feb 18 17:48:01 2015 ifconfig_pool_persist_refresh_freq = 600
Wed Feb 18 17:48:01 2015 ifconfig_ipv6_pool_defined = DISABLED
Wed Feb 18 17:48:01 2015 ifconfig_ipv6_pool_base = ::
Wed Feb 18 17:48:01 2015 ifconfig_ipv6_pool_netbits = 0
Wed Feb 18 17:48:01 2015 n_bcast_buf = 256
Wed Feb 18 17:48:01 2015 tcp_queue_limit = 64
Wed Feb 18 17:48:01 2015 real_hash_size = 256
Wed Feb 18 17:48:01 2015 virtual_hash_size = 256
Wed Feb 18 17:48:01 2015 client_connect_script = '[UNDEF]'
Wed Feb 18 17:48:01 2015 learn_address_script = '[UNDEF]'
Wed Feb 18 17:48:01 2015 client_disconnect_script = '[UNDEF]'
Wed Feb 18 17:48:01 2015 client_config_dir = '[UNDEF]'
Wed Feb 18 17:48:01 2015 ccd_exclusive = DISABLED
Wed Feb 18 17:48:01 2015 tmp_dir = 'C:\Users\GUEST\AppData\Local\Temp\'
Wed Feb 18 17:48:01 2015 push_ifconfig_defined = DISABLED
Wed Feb 18 17:48:01 2015 push_ifconfig_local = 0.0.0.0
Wed Feb 18 17:48:01 2015 push_ifconfig_remote_netmask = 0.0.0.0
Wed Feb 18 17:48:01 2015 push_ifconfig_ipv6_defined = DISABLED
Wed Feb 18 17:48:01 2015 push_ifconfig_ipv6_local = ::/0
Wed Feb 18 17:48:01 2015 push_ifconfig_ipv6_remote = ::
Wed Feb 18 17:48:01 2015 enable_c2c = DISABLED
Wed Feb 18 17:48:01 2015 duplicate_cn = DISABLED
Wed Feb 18 17:48:01 2015 cf_max = 0
Wed Feb 18 17:48:01 2015 cf_per = 0
Wed Feb 18 17:48:01 2015 max_clients = 1024
Wed Feb 18 17:48:01 2015 max_routes_per_client = 256
Wed Feb 18 17:48:01 2015 auth_user_pass_verify_script = '[UNDEF]'
Wed Feb 18 17:48:01 2015 auth_user_pass_verify_script_via_file = DISABLED
Wed Feb 18 17:48:01 2015 client = ENABLED
Wed Feb 18 17:48:01 2015 pull = ENABLED
Wed Feb 18 17:48:01 2015 auth_user_pass_file = '[UNDEF]'
Wed Feb 18 17:48:01 2015 show_net_up = DISABLED
Wed Feb 18 17:48:01 2015 route_method = 0
Wed Feb 18 17:48:01 2015 ip_win32_defined = DISABLED
Wed Feb 18 17:48:01 2015 ip_win32_type = 3
Wed Feb 18 17:48:01 2015 dhcp_masq_offset = 0
Wed Feb 18 17:48:01 2015 dhcp_lease_time = 31536000
Wed Feb 18 17:48:01 2015 tap_sleep = 0
Wed Feb 18 17:48:01 2015 dhcp_options = DISABLED
Wed Feb 18 17:48:01 2015 dhcp_renew = DISABLED
Wed Feb 18 17:48:01 2015 dhcp_pre_release = DISABLED
Wed Feb 18 17:48:01 2015 dhcp_release = DISABLED
Wed Feb 18 17:48:01 2015 domain = '[UNDEF]'
Wed Feb 18 17:48:01 2015 netbios_scope = '[UNDEF]'
Wed Feb 18 17:48:01 2015 netbios_node_type = 0
Wed Feb 18 17:48:01 2015 disable_nbt = DISABLED
Wed Feb 18 17:48:01 2015 OpenVPN 2.3.6 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Dec 1 2014
Wed Feb 18 17:48:01 2015 library versions: OpenSSL 1.0.1j 15 Oct 2014, LZO 2.08
Wed Feb 18 17:48:01 2015 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Wed Feb 18 17:48:01 2015 Need hold release from management interface, waiting...
Wed Feb 18 17:48:02 2015 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Wed Feb 18 17:48:02 2015 MANAGEMENT: CMD 'state on'
Wed Feb 18 17:48:02 2015 MANAGEMENT: CMD 'log all on'
Wed Feb 18 17:48:02 2015 MANAGEMENT: CMD 'hold off'
Wed Feb 18 17:48:02 2015 MANAGEMENT: CMD 'hold release'
Wed Feb 18 17:48:02 2015 LZO compression initialized
Wed Feb 18 17:48:02 2015 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Wed Feb 18 17:48:02 2015 Socket Buffers: R=[65536->65536] S=[65536->65536]
Wed Feb 18 17:48:02 2015 MANAGEMENT: >STATE:1424299682,RESOLVE,,,
Wed Feb 18 17:48:03 2015 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Wed Feb 18 17:48:03 2015 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Wed Feb 18 17:48:03 2015 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Wed Feb 18 17:48:03 2015 Local Options hash (VER=V4): '41690919'
Wed Feb 18 17:48:03 2015 Expected Remote Options hash (VER=V4): '530fdded'
Wed Feb 18 17:48:03 2015 UDPv4 link local: [undef]
Wed Feb 18 17:48:03 2015 UDPv4 link remote: [AF_INET]207.112.194.131:8181
Wed Feb 18 17:48:03 2015 MANAGEMENT: >STATE:1424299683,WAIT,,,
Wed Feb 18 17:48:03 2015 MANAGEMENT: >STATE:1424299683,AUTH,,,
Wed Feb 18 17:48:03 2015 TLS: Initial packet from [AF_INET]207.112.194.131:8181, sid=4b42d36c 75882f69
Wed Feb 18 17:48:07 2015 VERIFY OK: depth=1, C=US, ST=NC, L=Winston-Salem, O=Example Company, OU=MyVPN, CN=MyVPN, name=MyVPN, emailAddress=MyVPN@mydomain.com
Wed Feb 18 17:48:07 2015 Validating certificate key usage
Wed Feb 18 17:48:07 2015 ++ Certificate has key usage 00a0, expects 00a0
Wed Feb 18 17:48:07 2015 VERIFY KU OK
Wed Feb 18 17:48:07 2015 Validating certificate extended key usage
Wed Feb 18 17:48:07 2015 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Wed Feb 18 17:48:07 2015 VERIFY EKU OK
Wed Feb 18 17:48:07 2015 VERIFY OK: depth=0, C=US, ST=NC, L=Winston-Salem, O=Example Company, OU=MyVPN, CN=MyVPN, name=MyVPN, emailAddress=MyVPN@mydomain.com
Wed Feb 18 17:48:20 2015 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Feb 18 17:48:20 2015 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Feb 18 17:48:20 2015 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Feb 18 17:48:20 2015 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Feb 18 17:48:20 2015 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Wed Feb 18 17:48:20 2015 [server] Peer Connection Initiated with [AF_INET]207.112.194.131:8181
Wed Feb 18 17:48:21 2015 MANAGEMENT: >STATE:1424299701,GET_CONFIG,,,
Wed Feb 18 17:48:22 2015 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Wed Feb 18 17:48:22 2015 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Wed Feb 18 17:48:22 2015 OPTIONS IMPORT: timers and/or timeouts modified
Wed Feb 18 17:48:22 2015 OPTIONS IMPORT: --ifconfig/up options modified
Wed Feb 18 17:48:22 2015 OPTIONS IMPORT: route options modified
Wed Feb 18 17:48:22 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Feb 18 17:48:22 2015 MANAGEMENT: >STATE:1424299702,ASSIGN_IP,,10.8.0.6,
Wed Feb 18 17:48:22 2015 open_tun, tt->ipv6=0
Wed Feb 18 17:48:22 2015 TAP-WIN32 device [Ethernet 3] opened: \\.\Global\{489D2000-CEA2-4D0E-8D96-34800EA88588}.tap
Wed Feb 18 17:48:22 2015 TAP-Windows Driver Version 9.21
Wed Feb 18 17:48:22 2015 TAP-Windows MTU=1500
Wed Feb 18 17:48:22 2015 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.6/255.255.255.252 on interface {489D2000-CEA2-4D0E-8D96-34800EA88588} [DHCP-serv: 10.8.0.5, lease-time: 31536000]
Wed Feb 18 17:48:22 2015 Successful ARP Flush on interface [23] {489D2000-CEA2-4D0E-8D96-34800EA88588}
Wed Feb 18 17:48:27 2015 TEST ROUTES: 2/2 succeeded len=1 ret=1 a=0 u/d=up
Wed Feb 18 17:48:27 2015 C:\windows\system32\route.exe ADD 207.112.194.131 MASK 255.255.255.255 192.168.43.1
Wed Feb 18 17:48:27 2015 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=25 and dwForwardType=4
Wed Feb 18 17:48:27 2015 Route addition via IPAPI succeeded [adaptive]
Wed Feb 18 17:48:27 2015 C:\windows\system32\route.exe ADD 192.168.43.1 MASK 255.255.255.255 192.168.43.1 IF 3
Wed Feb 18 17:48:27 2015 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=25 and dwForwardType=4
Wed Feb 18 17:48:27 2015 Route addition via IPAPI succeeded [adaptive]
Wed Feb 18 17:48:27 2015 C:\windows\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.8.0.5
Wed Feb 18 17:48:27 2015 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Wed Feb 18 17:48:27 2015 Route addition via IPAPI succeeded [adaptive]
Wed Feb 18 17:48:27 2015 C:\windows\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.8.0.5
Wed Feb 18 17:48:27 2015 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Wed Feb 18 17:48:27 2015 Route addition via IPAPI succeeded [adaptive]
Wed Feb 18 17:48:27 2015 MANAGEMENT: >STATE:1424299707,ADD_ROUTES,,,
Wed Feb 18 17:48:27 2015 C:\windows\system32\route.exe ADD 10.8.0.1 MASK 255.255.255.255 10.8.0.5
Wed Feb 18 17:48:27 2015 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Wed Feb 18 17:48:27 2015 Route addition via IPAPI succeeded [adaptive]
Wed Feb 18 17:48:27 2015 Initialization Sequence Completed
Wed Feb 18 17:48:27 2015 MANAGEMENT: >STATE:1424299707,CONNECTED,SUCCESS,10.8.0.6,207.112.194.131
----- End of Client Log -----

----- Server - OpenVPN-Status.log -----
OpenVPN CLIENT LIST
Updated,Wed Feb 18 17:48:35 2015
Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since
client,207.219.169.250:1520,Wed Feb 18 17:48:01 2015
ROUTING TABLE
Virtual Address,Common Name,Real Address Last Ref
10.8.0.6,client,207.219.169.250:1520,Wed Feb 18 17:48:34 2015
GLOBAL STATS
Max bcast/mcast queue length,0
END
----- End of Server Log -----

Traffic

pengyou wroteWhat am I missing?

Please see the OpenVPN HOWTO:

pengyou

I just ran the following command in the server terminal, but I replaced eth0 with p1p1 and it appears to work now! I was unsure of this at first, but trial and error has proven to show success.

Used:
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o p1p1 -j MASQUERADE
instead of:
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

Also, I figured out that the username and password isn't something that corresponds with the specific certificate issued to the user, but it's the user and password that one would use to log in to the ubuntu server.

Thanks for all your help!

pengyou

One thing that is weird... my laptop works fine via wired LAN, wireless LAN, and even tethered Internet from my Android phone's cellular network. However, when I try on my Android device directly, it doesn't matter if I'm on WiFi or the 4g cellular network, I can connect, but cannot access the Internet. There's no option to copy the log from the "show log" in OpenVPN Connect, but if anyone has any idea what I can try or direct me to where I need to go. It would be greatly appreciated.

Android Version 4.4.2