Windows client over IPv6

SanjuroE

Hi,

I am trying to setup OpenVPN to be accessible over both IPv4 and IPv6. My current setup allows me to tunnel IPv4 and IPv6 over IPv4. I changed "proto udp" to "proto udp6" and added an AAAA DNS record. Now this works perfectly for the Android client (actually it ignores the proto udp altogether and tries to connect using udp6 first before falling back to udp).

However when using the Windows client (version 2.3.6) on Windows 8.1 the connection gets established and encrypted packages are send by the client and received by the server (confirmed using Wireshark) but no messages are generated on the TUN interface of the server. No errors are logged either, neither on the server nor the client.

At first I thought this was a server configuration issue, but how can it be if the Android client can connect successfully? Does anyone have experience connecting to OpenVPN over IPv6 under Windows? I mean connecting, not tunnelling. Any suggestions on how to further diagnose the problem would be appreciated, because I am kind of stuck.

Traffic

Please see the Forum rules (top of page)

See: https://community.openvpn.net/openvpn/wiki/IPv6

SanjuroE

Sorry about that.

Here is my server config:

proto udp6
dev tun0
push "dhcp-option DOMAIN vpn.local"
push "dhcp-option DNS 172.28.0.1"
push "redirect-gateway def1"
keepalive 10 120
comp-lzo
persist-key
persist-tun
verb 4
topology subnet
mode server
tls-server
push "topology subnet"
ifconfig-pool 172.28.0.100 172.28.0.200 255.255.255.0
push "route-gateway 172.28.0.1"
ca ssl/ca.crt
dh ssl/dh2048.pem
cert ssl/server.crt
key ssl/server.key
cipher AES-256-CBC
auth SHA256
reneg-sec 900
reneg-pkts 1000000
reneg-bytes 1073741824
tun-ipv6
push tun-ipv6
ifconfig-ipv6 2001:610:730:28::1/64 2001:610:730:28::1
ifconfig-ipv6-pool 2001:610:730:28::100/64
push "route-ipv6 2000::/3"

and my client config:

verb 4
dev tun
tls-client
pull
remote vpn.blankersfamily.com
proto udp6
nobind
comp-lzo
cipher AES-256-CBC
auth SHA256
ns-cert-type server
<ca>
...
</ca>
<cert>
...
</cert>
<key>
...
</key>

log for the server when connecting over IPv6:

Feb 24 16:23:07 nyx ovpn-server[4335]: MULTI: multi_create_instance called
Feb 24 16:23:07 nyx ovpn-server[4335]: 2001:610:730:100:9cd4:712c:7b78:2bf7 Re-using SSL/TLS context
Feb 24 16:23:07 nyx ovpn-server[4335]: 2001:610:730:100:9cd4:712c:7b78:2bf7 LZO compression initialized
Feb 24 16:23:07 nyx ovpn-server[4335]: 2001:610:730:100:9cd4:712c:7b78:2bf7 Control Channel MTU parms [ L:1570 D:138 EF:38 EB:0 ET:0 EL:0 ]
Feb 24 16:23:07 nyx ovpn-server[4335]: 2001:610:730:100:9cd4:712c:7b78:2bf7 Data Channel MTU parms [ L:1570 D:1450 EF:70 EB:135 ET:0 EL:0 AF:3/1 ]
Feb 24 16:23:07 nyx ovpn-server[4335]: 2001:610:730:100:9cd4:712c:7b78:2bf7 Local Options String: 'V4,dev-type tun,link-mtu 1570,tun-mtu 1500,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA256,keysize 256,key-method 2,tls-server'
Feb 24 16:23:07 nyx ovpn-server[4335]: 2001:610:730:100:9cd4:712c:7b78:2bf7 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1570,tun-mtu 1500,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA256,keysize 256,key-method 2,tls-client'
Feb 24 16:23:07 nyx ovpn-server[4335]: 2001:610:730:100:9cd4:712c:7b78:2bf7 Local Options hash (VER=V4): '79a26cd9'
Feb 24 16:23:07 nyx ovpn-server[4335]: 2001:610:730:100:9cd4:712c:7b78:2bf7 Expected Remote Options hash (VER=V4): 'fc8ba345'
Feb 24 16:23:07 nyx ovpn-server[4335]: 2001:610:730:100:9cd4:712c:7b78:2bf7 TLS: Initial packet from [AF_INET6]2001:610:730:100:9cd4:712c:7b78:2bf7:51831, sid=c84811e0 038042f2
Feb 24 16:23:07 nyx ovpn-server[4335]: 2001:610:730:100:9cd4:712c:7b78:2bf7 VERIFY OK: depth=1, C=NL, OU=changeme, CN=vpn.blankersfamily.com
Feb 24 16:23:07 nyx ovpn-server[4335]: 2001:610:730:100:9cd4:712c:7b78:2bf7 VERIFY OK: depth=0, C=NL, OU=nyx, CN=psi
Feb 24 16:23:07 nyx ovpn-server[4335]: 2001:610:730:100:9cd4:712c:7b78:2bf7 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Feb 24 16:23:07 nyx ovpn-server[4335]: 2001:610:730:100:9cd4:712c:7b78:2bf7 Data Channel Encrypt: Using 256 bit message hash 'SHA256' for HMAC authentication
Feb 24 16:23:07 nyx ovpn-server[4335]: 2001:610:730:100:9cd4:712c:7b78:2bf7 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Feb 24 16:23:07 nyx ovpn-server[4335]: 2001:610:730:100:9cd4:712c:7b78:2bf7 Data Channel Decrypt: Using 256 bit message hash 'SHA256' for HMAC authentication
Feb 24 16:23:07 nyx ovpn-server[4335]: 2001:610:730:100:9cd4:712c:7b78:2bf7 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Feb 24 16:23:07 nyx ovpn-server[4335]: 2001:610:730:100:9cd4:712c:7b78:2bf7 [psi] Peer Connection Initiated with [AF_INET6]2001:610:730:100:9cd4:712c:7b78:2bf7:51831
Feb 24 16:23:07 nyx ovpn-server[4335]: MULTI: new connection by client 'psi' will cause previous active sessions by this client to be dropped.  Remember to use the --duplicate-cn option if you want multiple clients using the same certificate or username to concurrently connect.
Feb 24 16:23:07 nyx ovpn-server[4335]: MULTI_sva: pool returned IPv4=172.28.0.100, IPv6=2001:610:730:28::100
Feb 24 16:23:07 nyx ovpn-server[4335]: MULTI: Learn: 172.28.0.100 -> psi/2001:610:730:100:9cd4:712c:7b78:2bf7
Feb 24 16:23:07 nyx ovpn-server[4335]: MULTI: primary virtual IP for psi/2001:610:730:100:9cd4:712c:7b78:2bf7: 172.28.0.100
Feb 24 16:23:07 nyx ovpn-server[4335]: MULTI: Learn: 2001:610:730:28::100 -> psi/2001:610:730:100:9cd4:712c:7b78:2bf7
Feb 24 16:23:07 nyx ovpn-server[4335]: MULTI: primary virtual IPv6 for psi/2001:610:730:100:9cd4:712c:7b78:2bf7: 2001:610:730:28::100
Feb 24 16:23:10 nyx ovpn-server[4335]: psi/2001:610:730:100:9cd4:712c:7b78:2bf7 PUSH: Received control message: 'PUSH_REQUEST'
Feb 24 16:23:10 nyx ovpn-server[4335]: psi/2001:610:730:100:9cd4:712c:7b78:2bf7 send_push_reply(): safe_cap=940
Feb 24 16:23:10 nyx ovpn-server[4335]: psi/2001:610:730:100:9cd4:712c:7b78:2bf7 SENT CONTROL [psi]: 'PUSH_REPLY,ifconfig-ipv6 2001:610:730:28::100/64 2001:610:730:28::1,dhcp-option DOMAIN vpn.local,dhcp-option DNS 172.28.0.1,redirect-gateway def1,topology subnet,route-gateway 172.28.0.1,tun-ipv6,route-ipv6 2000::/3,ping 10,ping-restart 120,ifconfig 172.28.0.100 255.255.255.0' (status=1)
Feb 24 16:23:11 nyx ovpn-server[4335]: psi/2001:610:730:100:9cd4:712c:7b78:2bf7 MULTI: bad source address from client [fe80::8d4d:3a15:6a0:b041], packet dropped
Feb 24 16:23:11 nyx ovpn-server[4335]: psi/2001:610:730:100:9cd4:712c:7b78:2bf7 PID_ERR replay-window backtrack occurred [1] [SSL-0] [0_0000000000] 0:12 0:11 t=1424791391[0] r=[0,64,15,1,1] sl=[52,12,64,528]
Feb 24 16:23:11 nyx ovpn-server[4335]: psi/2001:610:730:100:9cd4:712c:7b78:2bf7 MULTI: bad source address from client [fe80::8d4d:3a15:6a0:b041], packet dropped
Feb 24 16:23:11 nyx ovpn-server[4335]: psi/2001:610:730:100:9cd4:712c:7b78:2bf7 MULTI: bad source address from client [::], packet dropped
Feb 24 16:23:11 nyx ovpn-server[4335]: psi/2001:610:730:100:9cd4:712c:7b78:2bf7 MULTI: bad source address from client [fe80::8d4d:3a15:6a0:b041], packet dropped
Feb 24 16:23:12 nyx ovpn-server[4335]: psi/2001:610:730:100:9cd4:712c:7b78:2bf7 PID_ERR replay-window backtrack occurred [2] [SSL-0] [00_00000000000111111111111111111111] 0:35 0:33 t=1424791392[0] r=[-1,64,15,2,1] sl=[29,35,64,528]
Feb 24 16:23:12 nyx ovpn-server[4335]: psi/2001:610:730:100:9cd4:712c:7b78:2bf7 MULTI: bad source address from client [fe80::8d4d:3a15:6a0:b041], packet dropped

and log for the client:

Tue Feb 24 16:22:49 2015 us=902118 Current Parameter Settings:
Tue Feb 24 16:22:49 2015 us=903118   config = 'nyx.ovpn'
Tue Feb 24 16:22:49 2015 us=903118   mode = 0
Tue Feb 24 16:22:49 2015 us=903118   show_ciphers = DISABLED
Tue Feb 24 16:22:49 2015 us=903118   show_digests = DISABLED
Tue Feb 24 16:22:49 2015 us=903118   show_engines = DISABLED
Tue Feb 24 16:22:49 2015 us=903118   genkey = DISABLED
Tue Feb 24 16:22:49 2015 us=903118   key_pass_file = '[UNDEF]'
Tue Feb 24 16:22:49 2015 us=903118   show_tls_ciphers = DISABLED
Tue Feb 24 16:22:49 2015 us=903118 Connection profiles [default]:
Tue Feb 24 16:22:49 2015 us=903118   proto = udp6
Tue Feb 24 16:22:49 2015 us=903118   local = '[UNDEF]'
Tue Feb 24 16:22:49 2015 us=903118   local_port = 0
Tue Feb 24 16:22:49 2015 us=903118   remote = 'vpn.blankersfamily.com'
Tue Feb 24 16:22:49 2015 us=903118   remote_port = 1194
Tue Feb 24 16:22:49 2015 us=903118   remote_float = DISABLED
Tue Feb 24 16:22:49 2015 us=903118   bind_defined = DISABLED
Tue Feb 24 16:22:49 2015 us=903118   bind_local = DISABLED
Tue Feb 24 16:22:49 2015 us=903118   connect_retry_seconds = 5
Tue Feb 24 16:22:49 2015 us=903118   connect_timeout = 10
Tue Feb 24 16:22:49 2015 us=903118   connect_retry_max = 0
Tue Feb 24 16:22:49 2015 us=903118   socks_proxy_server = '[UNDEF]'
Tue Feb 24 16:22:49 2015 us=903118   socks_proxy_port = 0
Tue Feb 24 16:22:49 2015 us=903118   socks_proxy_retry = DISABLED
Tue Feb 24 16:22:49 2015 us=903118   tun_mtu = 1500
Tue Feb 24 16:22:49 2015 us=903118   tun_mtu_defined = ENABLED
Tue Feb 24 16:22:49 2015 us=903118   link_mtu = 1500
Tue Feb 24 16:22:49 2015 us=903118   link_mtu_defined = DISABLED
Tue Feb 24 16:22:49 2015 us=903118   tun_mtu_extra = 0
Tue Feb 24 16:22:49 2015 us=903118   tun_mtu_extra_defined = DISABLED
Tue Feb 24 16:22:49 2015 us=903118   mtu_discover_type = -1
Tue Feb 24 16:22:49 2015 us=903118   fragment = 0
Tue Feb 24 16:22:49 2015 us=903118   mssfix = 1450
Tue Feb 24 16:22:49 2015 us=903118   explicit_exit_notification = 0
Tue Feb 24 16:22:49 2015 us=903118 Connection profiles END
Tue Feb 24 16:22:49 2015 us=903118   remote_random = DISABLED
Tue Feb 24 16:22:49 2015 us=903118   ipchange = '[UNDEF]'
Tue Feb 24 16:22:49 2015 us=903118   dev = 'tun'
Tue Feb 24 16:22:49 2015 us=903118   dev_type = '[UNDEF]'
Tue Feb 24 16:22:49 2015 us=903118   dev_node = '[UNDEF]'
Tue Feb 24 16:22:49 2015 us=903118   lladdr = '[UNDEF]'
Tue Feb 24 16:22:49 2015 us=903118   topology = 1
Tue Feb 24 16:22:49 2015 us=903118   tun_ipv6 = DISABLED
Tue Feb 24 16:22:49 2015 us=903118   ifconfig_local = '[UNDEF]'
Tue Feb 24 16:22:49 2015 us=903118   ifconfig_remote_netmask = '[UNDEF]'
Tue Feb 24 16:22:49 2015 us=903118   ifconfig_noexec = DISABLED
Tue Feb 24 16:22:49 2015 us=903118   ifconfig_nowarn = DISABLED
Tue Feb 24 16:22:49 2015 us=903118   ifconfig_ipv6_local = '[UNDEF]'
Tue Feb 24 16:22:49 2015 us=903118   ifconfig_ipv6_netbits = 0
Tue Feb 24 16:22:49 2015 us=903118   ifconfig_ipv6_remote = '[UNDEF]'
Tue Feb 24 16:22:49 2015 us=903118   shaper = 0
Tue Feb 24 16:22:49 2015 us=903118   mtu_test = 0
Tue Feb 24 16:22:49 2015 us=903118   mlock = DISABLED
Tue Feb 24 16:22:49 2015 us=903118   keepalive_ping = 0
Tue Feb 24 16:22:49 2015 us=903118   keepalive_timeout = 0
Tue Feb 24 16:22:49 2015 us=903118   inactivity_timeout = 0
Tue Feb 24 16:22:49 2015 us=903118   ping_send_timeout = 0
Tue Feb 24 16:22:49 2015 us=903118   ping_rec_timeout = 0
Tue Feb 24 16:22:49 2015 us=903118   ping_rec_timeout_action = 0
Tue Feb 24 16:22:49 2015 us=903118   ping_timer_remote = DISABLED
Tue Feb 24 16:22:49 2015 us=903118   remap_sigusr1 = 0
Tue Feb 24 16:22:49 2015 us=903118   persist_tun = DISABLED
Tue Feb 24 16:22:49 2015 us=903118   persist_local_ip = DISABLED
Tue Feb 24 16:22:49 2015 us=903118   persist_remote_ip = DISABLED
Tue Feb 24 16:22:49 2015 us=903118   persist_key = DISABLED
Tue Feb 24 16:22:49 2015 us=903118   passtos = DISABLED
Tue Feb 24 16:22:49 2015 us=903118   resolve_retry_seconds = 1000000000
Tue Feb 24 16:22:49 2015 us=903118   username = '[UNDEF]'
Tue Feb 24 16:22:49 2015 us=903118   groupname = '[UNDEF]'
Tue Feb 24 16:22:49 2015 us=903118   chroot_dir = '[UNDEF]'
Tue Feb 24 16:22:49 2015 us=903118   cd_dir = '[UNDEF]'
Tue Feb 24 16:22:49 2015 us=903118   writepid = '[UNDEF]'
Tue Feb 24 16:22:49 2015 us=903118   up_script = '[UNDEF]'
Tue Feb 24 16:22:49 2015 us=903118   down_script = '[UNDEF]'
Tue Feb 24 16:22:49 2015 us=903118   down_pre = DISABLED
Tue Feb 24 16:22:49 2015 us=903118   up_restart = DISABLED
Tue Feb 24 16:22:49 2015 us=903118   up_delay = DISABLED
Tue Feb 24 16:22:49 2015 us=903118   daemon = DISABLED
Tue Feb 24 16:22:49 2015 us=903118   inetd = 0
Tue Feb 24 16:22:49 2015 us=903118   log = ENABLED
Tue Feb 24 16:22:49 2015 us=903118   suppress_timestamps = DISABLED
Tue Feb 24 16:22:49 2015 us=903118   nice = 0
Tue Feb 24 16:22:49 2015 us=903118   verbosity = 4
Tue Feb 24 16:22:49 2015 us=903118   mute = 0
Tue Feb 24 16:22:49 2015 us=903118   status_file = '[UNDEF]'
Tue Feb 24 16:22:49 2015 us=903118   status_file_version = 1
Tue Feb 24 16:22:49 2015 us=904118   status_file_update_freq = 60
Tue Feb 24 16:22:49 2015 us=904118   occ = ENABLED
Tue Feb 24 16:22:49 2015 us=904118   rcvbuf = 0
Tue Feb 24 16:22:49 2015 us=904118   sndbuf = 0
Tue Feb 24 16:22:49 2015 us=904118   sockflags = 0
Tue Feb 24 16:22:49 2015 us=904118   fast_io = DISABLED
Tue Feb 24 16:22:49 2015 us=904118   lzo = 7
Tue Feb 24 16:22:49 2015 us=904118   route_script = '[UNDEF]'
Tue Feb 24 16:22:49 2015 us=904118   route_default_gateway = '[UNDEF]'
Tue Feb 24 16:22:49 2015 us=904118   route_default_metric = 0
Tue Feb 24 16:22:49 2015 us=904118   route_noexec = DISABLED
Tue Feb 24 16:22:49 2015 us=904118   route_delay = 5
Tue Feb 24 16:22:49 2015 us=904118   route_delay_window = 30
Tue Feb 24 16:22:49 2015 us=904118   route_delay_defined = ENABLED
Tue Feb 24 16:22:49 2015 us=904118   route_nopull = DISABLED
Tue Feb 24 16:22:49 2015 us=904118   route_gateway_via_dhcp = DISABLED
Tue Feb 24 16:22:49 2015 us=904118   max_routes = 100
Tue Feb 24 16:22:49 2015 us=904118   allow_pull_fqdn = DISABLED
Tue Feb 24 16:22:49 2015 us=904118   management_addr = '127.0.0.1'
Tue Feb 24 16:22:49 2015 us=904118   management_port = 25340
Tue Feb 24 16:22:49 2015 us=904118   management_user_pass = 'stdin'
Tue Feb 24 16:22:49 2015 us=904118   management_log_history_cache = 250
Tue Feb 24 16:22:49 2015 us=904118   management_echo_buffer_size = 100
Tue Feb 24 16:22:49 2015 us=904118   management_write_peer_info_file = '[UNDEF]'
Tue Feb 24 16:22:49 2015 us=904118   management_client_user = '[UNDEF]'
Tue Feb 24 16:22:49 2015 us=904118   management_client_group = '[UNDEF]'
Tue Feb 24 16:22:49 2015 us=904118   management_flags = 6
Tue Feb 24 16:22:49 2015 us=904118   shared_secret_file = '[UNDEF]'
Tue Feb 24 16:22:49 2015 us=904118   key_direction = 0
Tue Feb 24 16:22:49 2015 us=904118   ciphername_defined = ENABLED
Tue Feb 24 16:22:49 2015 us=904118   ciphername = 'AES-256-CBC'
Tue Feb 24 16:22:49 2015 us=904118   authname_defined = ENABLED
Tue Feb 24 16:22:49 2015 us=904118   authname = 'SHA256'
Tue Feb 24 16:22:49 2015 us=904118   prng_hash = 'SHA1'
Tue Feb 24 16:22:49 2015 us=904118   prng_nonce_secret_len = 16
Tue Feb 24 16:22:49 2015 us=904118   keysize = 0
Tue Feb 24 16:22:49 2015 us=904118   engine = DISABLED
Tue Feb 24 16:22:49 2015 us=904118   replay = ENABLED
Tue Feb 24 16:22:49 2015 us=904118   mute_replay_warnings = DISABLED
Tue Feb 24 16:22:49 2015 us=904118   replay_window = 64
Tue Feb 24 16:22:49 2015 us=904118   replay_time = 15
Tue Feb 24 16:22:49 2015 us=904118   packet_id_file = '[UNDEF]'
Tue Feb 24 16:22:49 2015 us=904118   use_iv = ENABLED
Tue Feb 24 16:22:49 2015 us=904118   test_crypto = DISABLED
Tue Feb 24 16:22:49 2015 us=904118   tls_server = DISABLED
Tue Feb 24 16:22:49 2015 us=904118   tls_client = ENABLED
Tue Feb 24 16:22:49 2015 us=904118   key_method = 2
Tue Feb 24 16:22:49 2015 us=904118   ca_file = '[[INLINE]]'
Tue Feb 24 16:22:49 2015 us=904118   ca_path = '[UNDEF]'
Tue Feb 24 16:22:49 2015 us=904118   dh_file = '[UNDEF]'
Tue Feb 24 16:22:49 2015 us=904118   cert_file = '[[INLINE]]'
Tue Feb 24 16:22:49 2015 us=904118   priv_key_file = '[[INLINE]]'
Tue Feb 24 16:22:49 2015 us=904118   pkcs12_file = '[UNDEF]'
Tue Feb 24 16:22:49 2015 us=904118   cryptoapi_cert = '[UNDEF]'
Tue Feb 24 16:22:49 2015 us=904118   cipher_list = '[UNDEF]'
Tue Feb 24 16:22:49 2015 us=904118   tls_verify = '[UNDEF]'
Tue Feb 24 16:22:49 2015 us=904118   tls_export_cert = '[UNDEF]'
Tue Feb 24 16:22:49 2015 us=904118   verify_x509_type = 0
Tue Feb 24 16:22:49 2015 us=904118   verify_x509_name = '[UNDEF]'
Tue Feb 24 16:22:49 2015 us=904118   crl_file = '[UNDEF]'
Tue Feb 24 16:22:49 2015 us=904118   ns_cert_type = 1
Tue Feb 24 16:22:49 2015 us=904118   remote_cert_ku[i] = 0
Tue Feb 24 16:22:49 2015 us=904118   remote_cert_ku[i] = 0
Tue Feb 24 16:22:49 2015 us=904118   remote_cert_ku[i] = 0
Tue Feb 24 16:22:49 2015 us=904118   remote_cert_ku[i] = 0
Tue Feb 24 16:22:49 2015 us=904118   remote_cert_ku[i] = 0
Tue Feb 24 16:22:49 2015 us=904118   remote_cert_ku[i] = 0
Tue Feb 24 16:22:49 2015 us=904118   remote_cert_ku[i] = 0
Tue Feb 24 16:22:49 2015 us=904118   remote_cert_ku[i] = 0
Tue Feb 24 16:22:49 2015 us=904118   remote_cert_ku[i] = 0
Tue Feb 24 16:22:49 2015 us=904118   remote_cert_ku[i] = 0
Tue Feb 24 16:22:49 2015 us=904118   remote_cert_ku[i] = 0
Tue Feb 24 16:22:49 2015 us=904118   remote_cert_ku[i] = 0
Tue Feb 24 16:22:49 2015 us=904118   remote_cert_ku[i] = 0
Tue Feb 24 16:22:49 2015 us=904118   remote_cert_ku[i] = 0
Tue Feb 24 16:22:49 2015 us=904118   remote_cert_ku[i] = 0
Tue Feb 24 16:22:49 2015 us=904118   remote_cert_ku[i] = 0
Tue Feb 24 16:22:49 2015 us=904118   remote_cert_eku = '[UNDEF]'
Tue Feb 24 16:22:49 2015 us=904118   ssl_flags = 0
Tue Feb 24 16:22:49 2015 us=904118   tls_timeout = 2
Tue Feb 24 16:22:49 2015 us=904118   renegotiate_bytes = 0
Tue Feb 24 16:22:49 2015 us=904118   renegotiate_packets = 0
Tue Feb 24 16:22:49 2015 us=904118   renegotiate_seconds = 3600
Tue Feb 24 16:22:49 2015 us=904118   handshake_window = 60
Tue Feb 24 16:22:49 2015 us=904118   transition_window = 3600
Tue Feb 24 16:22:49 2015 us=904118   single_session = DISABLED
Tue Feb 24 16:22:49 2015 us=904118   push_peer_info = DISABLED
Tue Feb 24 16:22:49 2015 us=904118   tls_exit = DISABLED
Tue Feb 24 16:22:49 2015 us=904118   tls_auth_file = '[UNDEF]'
Tue Feb 24 16:22:49 2015 us=904118   pkcs11_protected_authentication = DISABLED
Tue Feb 24 16:22:49 2015 us=904118   pkcs11_protected_authentication = DISABLED
Tue Feb 24 16:22:49 2015 us=904118   pkcs11_protected_authentication = DISABLED
Tue Feb 24 16:22:49 2015 us=904118   pkcs11_protected_authentication = DISABLED
Tue Feb 24 16:22:49 2015 us=904118   pkcs11_protected_authentication = DISABLED
Tue Feb 24 16:22:49 2015 us=904118   pkcs11_protected_authentication = DISABLED
Tue Feb 24 16:22:49 2015 us=904118   pkcs11_protected_authentication = DISABLED
Tue Feb 24 16:22:49 2015 us=904118   pkcs11_protected_authentication = DISABLED
Tue Feb 24 16:22:49 2015 us=904118   pkcs11_protected_authentication = DISABLED
Tue Feb 24 16:22:49 2015 us=904118   pkcs11_protected_authentication = DISABLED
Tue Feb 24 16:22:49 2015 us=904118   pkcs11_protected_authentication = DISABLED
Tue Feb 24 16:22:49 2015 us=904118   pkcs11_protected_authentication = DISABLED
Tue Feb 24 16:22:49 2015 us=904118   pkcs11_protected_authentication = DISABLED
Tue Feb 24 16:22:49 2015 us=904118   pkcs11_protected_authentication = DISABLED
Tue Feb 24 16:22:49 2015 us=904118   pkcs11_protected_authentication = DISABLED
Tue Feb 24 16:22:49 2015 us=904118   pkcs11_protected_authentication = DISABLED
Tue Feb 24 16:22:49 2015 us=904118   pkcs11_private_mode = 00000000
Tue Feb 24 16:22:49 2015 us=904118   pkcs11_private_mode = 00000000
Tue Feb 24 16:22:49 2015 us=904118   pkcs11_private_mode = 00000000
Tue Feb 24 16:22:49 2015 us=904118   pkcs11_private_mode = 00000000
Tue Feb 24 16:22:49 2015 us=904118   pkcs11_private_mode = 00000000
Tue Feb 24 16:22:49 2015 us=904118   pkcs11_private_mode = 00000000
Tue Feb 24 16:22:49 2015 us=904118   pkcs11_private_mode = 00000000
Tue Feb 24 16:22:49 2015 us=904118   pkcs11_private_mode = 00000000
Tue Feb 24 16:22:49 2015 us=904118   pkcs11_private_mode = 00000000
Tue Feb 24 16:22:49 2015 us=904118   pkcs11_private_mode = 00000000
Tue Feb 24 16:22:49 2015 us=904118   pkcs11_private_mode = 00000000
Tue Feb 24 16:22:49 2015 us=904118   pkcs11_private_mode = 00000000
Tue Feb 24 16:22:49 2015 us=904118   pkcs11_private_mode = 00000000
Tue Feb 24 16:22:49 2015 us=904118   pkcs11_private_mode = 00000000
Tue Feb 24 16:22:49 2015 us=904118   pkcs11_private_mode = 00000000
Tue Feb 24 16:22:49 2015 us=904118   pkcs11_private_mode = 00000000
Tue Feb 24 16:22:49 2015 us=904118   pkcs11_cert_private = DISABLED
Tue Feb 24 16:22:49 2015 us=904118   pkcs11_cert_private = DISABLED
Tue Feb 24 16:22:49 2015 us=904118   pkcs11_cert_private = DISABLED
Tue Feb 24 16:22:49 2015 us=904118   pkcs11_cert_private = DISABLED
Tue Feb 24 16:22:49 2015 us=904118   pkcs11_cert_private = DISABLED
Tue Feb 24 16:22:49 2015 us=904118   pkcs11_cert_private = DISABLED
Tue Feb 24 16:22:49 2015 us=904118   pkcs11_cert_private = DISABLED
Tue Feb 24 16:22:49 2015 us=904118   pkcs11_cert_private = DISABLED
Tue Feb 24 16:22:49 2015 us=904118   pkcs11_cert_private = DISABLED
Tue Feb 24 16:22:49 2015 us=905118   pkcs11_cert_private = DISABLED
Tue Feb 24 16:22:49 2015 us=905118   pkcs11_cert_private = DISABLED
Tue Feb 24 16:22:49 2015 us=905118   pkcs11_cert_private = DISABLED
Tue Feb 24 16:22:49 2015 us=905118   pkcs11_cert_private = DISABLED
Tue Feb 24 16:22:49 2015 us=905118   pkcs11_cert_private = DISABLED
Tue Feb 24 16:22:49 2015 us=905118   pkcs11_cert_private = DISABLED
Tue Feb 24 16:22:49 2015 us=905118   pkcs11_cert_private = DISABLED
Tue Feb 24 16:22:49 2015 us=905118   pkcs11_pin_cache_period = -1
Tue Feb 24 16:22:49 2015 us=905118   pkcs11_id = '[UNDEF]'
Tue Feb 24 16:22:49 2015 us=905118   pkcs11_id_management = DISABLED
Tue Feb 24 16:22:49 2015 us=905118   server_network = 0.0.0.0
Tue Feb 24 16:22:49 2015 us=905118   server_netmask = 0.0.0.0
Tue Feb 24 16:22:49 2015 us=905118   server_network_ipv6 = ::
Tue Feb 24 16:22:49 2015 us=905118   server_netbits_ipv6 = 0
Tue Feb 24 16:22:49 2015 us=905118   server_bridge_ip = 0.0.0.0
Tue Feb 24 16:22:49 2015 us=905118   server_bridge_netmask = 0.0.0.0
Tue Feb 24 16:22:49 2015 us=905118   server_bridge_pool_start = 0.0.0.0
Tue Feb 24 16:22:49 2015 us=905118   server_bridge_pool_end = 0.0.0.0
Tue Feb 24 16:22:49 2015 us=905118   ifconfig_pool_defined = DISABLED
Tue Feb 24 16:22:49 2015 us=905118   ifconfig_pool_start = 0.0.0.0
Tue Feb 24 16:22:49 2015 us=905118   ifconfig_pool_end = 0.0.0.0
Tue Feb 24 16:22:49 2015 us=905118   ifconfig_pool_netmask = 0.0.0.0
Tue Feb 24 16:22:49 2015 us=905118   ifconfig_pool_persist_filename = '[UNDEF]'
Tue Feb 24 16:22:49 2015 us=905118   ifconfig_pool_persist_refresh_freq = 600
Tue Feb 24 16:22:49 2015 us=905118   ifconfig_ipv6_pool_defined = DISABLED
Tue Feb 24 16:22:49 2015 us=905118   ifconfig_ipv6_pool_base = ::
Tue Feb 24 16:22:49 2015 us=905118   ifconfig_ipv6_pool_netbits = 0
Tue Feb 24 16:22:49 2015 us=905118   n_bcast_buf = 256
Tue Feb 24 16:22:49 2015 us=905118   tcp_queue_limit = 64
Tue Feb 24 16:22:49 2015 us=905118   real_hash_size = 256
Tue Feb 24 16:22:49 2015 us=905118   virtual_hash_size = 256
Tue Feb 24 16:22:49 2015 us=905118   client_connect_script = '[UNDEF]'
Tue Feb 24 16:22:49 2015 us=905118   learn_address_script = '[UNDEF]'
Tue Feb 24 16:22:49 2015 us=905118   client_disconnect_script = '[UNDEF]'
Tue Feb 24 16:22:49 2015 us=905118   client_config_dir = '[UNDEF]'
Tue Feb 24 16:22:49 2015 us=905118   ccd_exclusive = DISABLED
Tue Feb 24 16:22:49 2015 us=905118   tmp_dir = 'C:\Users\Laurens\AppData\Local\Temp\'
Tue Feb 24 16:22:49 2015 us=905118   push_ifconfig_defined = DISABLED
Tue Feb 24 16:22:49 2015 us=905118   push_ifconfig_local = 0.0.0.0
Tue Feb 24 16:22:49 2015 us=905118   push_ifconfig_remote_netmask = 0.0.0.0
Tue Feb 24 16:22:49 2015 us=905118   push_ifconfig_ipv6_defined = DISABLED
Tue Feb 24 16:22:49 2015 us=905118   push_ifconfig_ipv6_local = ::/0
Tue Feb 24 16:22:49 2015 us=905118   push_ifconfig_ipv6_remote = ::
Tue Feb 24 16:22:49 2015 us=905118   enable_c2c = DISABLED
Tue Feb 24 16:22:49 2015 us=905118   duplicate_cn = DISABLED
Tue Feb 24 16:22:49 2015 us=905118   cf_max = 0
Tue Feb 24 16:22:49 2015 us=905118   cf_per = 0
Tue Feb 24 16:22:49 2015 us=905118   max_clients = 1024
Tue Feb 24 16:22:49 2015 us=905118   max_routes_per_client = 256
Tue Feb 24 16:22:49 2015 us=905118   auth_user_pass_verify_script = '[UNDEF]'
Tue Feb 24 16:22:49 2015 us=905118   auth_user_pass_verify_script_via_file = DISABLED
Tue Feb 24 16:22:49 2015 us=905118   client = DISABLED
Tue Feb 24 16:22:49 2015 us=905118   pull = ENABLED
Tue Feb 24 16:22:49 2015 us=905118   auth_user_pass_file = '[UNDEF]'
Tue Feb 24 16:22:49 2015 us=905118   show_net_up = DISABLED
Tue Feb 24 16:22:49 2015 us=905118   route_method = 0
Tue Feb 24 16:22:49 2015 us=905118   ip_win32_defined = DISABLED
Tue Feb 24 16:22:49 2015 us=905118   ip_win32_type = 3
Tue Feb 24 16:22:49 2015 us=905118   dhcp_masq_offset = 0
Tue Feb 24 16:22:49 2015 us=905118   dhcp_lease_time = 31536000
Tue Feb 24 16:22:49 2015 us=905118   tap_sleep = 0
Tue Feb 24 16:22:49 2015 us=905118   dhcp_options = DISABLED
Tue Feb 24 16:22:49 2015 us=905118   dhcp_renew = DISABLED
Tue Feb 24 16:22:49 2015 us=905118   dhcp_pre_release = DISABLED
Tue Feb 24 16:22:49 2015 us=905118   dhcp_release = DISABLED
Tue Feb 24 16:22:49 2015 us=905118   domain = '[UNDEF]'
Tue Feb 24 16:22:49 2015 us=905118   netbios_scope = '[UNDEF]'
Tue Feb 24 16:22:49 2015 us=905118   netbios_node_type = 0
Tue Feb 24 16:22:49 2015 us=905118   disable_nbt = DISABLED
Tue Feb 24 16:22:49 2015 us=906118 OpenVPN 2.3.6 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Dec  1 2014
Tue Feb 24 16:22:49 2015 us=906118 library versions: OpenSSL 1.0.1j 15 Oct 2014, LZO 2.08
Enter Management Password:
Tue Feb 24 16:22:49 2015 us=906118 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Tue Feb 24 16:22:49 2015 us=906118 Need hold release from management interface, waiting...
Tue Feb 24 16:22:50 2015 us=389146 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Tue Feb 24 16:22:50 2015 us=490152 MANAGEMENT: CMD 'state on'
Tue Feb 24 16:22:50 2015 us=490152 MANAGEMENT: CMD 'log all on'
Tue Feb 24 16:22:50 2015 us=572156 MANAGEMENT: CMD 'hold off'
Tue Feb 24 16:22:50 2015 us=573156 MANAGEMENT: CMD 'hold release'
Tue Feb 24 16:22:50 2015 us=670162 LZO compression initialized
Tue Feb 24 16:22:50 2015 us=670162 Control Channel MTU parms [ L:1570 D:138 EF:38 EB:0 ET:0 EL:0 ]
Tue Feb 24 16:22:50 2015 us=670162 Socket Buffers: R=[65536->65536] S=[65536->65536]
Tue Feb 24 16:22:50 2015 us=670162 MANAGEMENT: >STATE:1424791370,RESOLVE,,,
Tue Feb 24 16:22:50 2015 us=673162 Data Channel MTU parms [ L:1570 D:1450 EF:70 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Feb 24 16:22:50 2015 us=673162 Local Options String: 'V4,dev-type tun,link-mtu 1570,tun-mtu 1500,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA256,keysize 256,key-method 2,tls-client'
Tue Feb 24 16:22:50 2015 us=673162 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1570,tun-mtu 1500,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA256,keysize 256,key-method 2,tls-server'
Tue Feb 24 16:22:50 2015 us=673162 Local Options hash (VER=V4): 'fc8ba345'
Tue Feb 24 16:22:50 2015 us=673162 Expected Remote Options hash (VER=V4): '79a26cd9'
Tue Feb 24 16:22:50 2015 us=673162 UDPv6 link local: [undef]
Tue Feb 24 16:22:50 2015 us=673162 UDPv6 link remote: [AF_INET6]2001:610:730:30::105:1194
Tue Feb 24 16:22:50 2015 us=673162 MANAGEMENT: >STATE:1424791370,WAIT,,,
Tue Feb 24 16:22:50 2015 us=693164 MANAGEMENT: >STATE:1424791370,AUTH,,,
Tue Feb 24 16:22:50 2015 us=693164 TLS: Initial packet from [AF_INET6]2001:610:730:30::105:1194, sid=c95ee1f5 af31fb2c
Tue Feb 24 16:22:50 2015 us=813170 VERIFY OK: depth=1, C=NL, OU=changeme, CN=vpn.blankersfamily.com
Tue Feb 24 16:22:50 2015 us=813170 VERIFY OK: nsCertType=SERVER
Tue Feb 24 16:22:50 2015 us=813170 VERIFY OK: depth=0, C=NL, CN=vpn.blankersfamily.com
Tue Feb 24 16:22:51 2015 us=24182 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Tue Feb 24 16:22:51 2015 us=24182 Data Channel Encrypt: Using 256 bit message hash 'SHA256' for HMAC authentication
Tue Feb 24 16:22:51 2015 us=24182 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Tue Feb 24 16:22:51 2015 us=24182 Data Channel Decrypt: Using 256 bit message hash 'SHA256' for HMAC authentication
Tue Feb 24 16:22:51 2015 us=24182 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Tue Feb 24 16:22:51 2015 us=24182 [vpn.blankersfamily.com] Peer Connection Initiated with [AF_INET6]2001:610:730:30::105:1194
Tue Feb 24 16:22:52 2015 us=255253 MANAGEMENT: >STATE:1424791372,GET_CONFIG,,,
Tue Feb 24 16:22:53 2015 us=485324 SENT CONTROL [vpn.blankersfamily.com]: 'PUSH_REQUEST' (status=1)
Tue Feb 24 16:22:53 2015 us=505325 PUSH: Received control message: 'PUSH_REPLY,ifconfig-ipv6 2001:610:730:28::100/64 2001:610:730:28::1,dhcp-option DOMAIN vpn.local,dhcp-option DNS 172.28.0.1,redirect-gateway def1,topology subnet,route-gateway 172.28.0.1,tun-ipv6,route-ipv6 2000::/3,ping 10,ping-restart 120,ifconfig 172.28.0.100 255.255.255.0'
Tue Feb 24 16:22:53 2015 us=505325 OPTIONS IMPORT: timers and/or timeouts modified
Tue Feb 24 16:22:53 2015 us=505325 OPTIONS IMPORT: --ifconfig/up options modified
Tue Feb 24 16:22:53 2015 us=505325 OPTIONS IMPORT: route options modified
Tue Feb 24 16:22:53 2015 us=505325 OPTIONS IMPORT: route-related options modified
Tue Feb 24 16:22:53 2015 us=505325 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Tue Feb 24 16:22:53 2015 us=514326 do_ifconfig, tt->ipv6=1, tt->did_ifconfig_ipv6_setup=1
Tue Feb 24 16:22:53 2015 us=514326 MANAGEMENT: >STATE:1424791373,ASSIGN_IP,,172.28.0.100,
Tue Feb 24 16:22:54 2015 us=514383 NETSH: C:\Windows\system32\netsh.exe interface ipv6 set address Local Area Connection 2001:610:730:28::100 store=active
Tue Feb 24 16:22:54 2015 us=576387 add_route_ipv6(2001:610:730:28::/64 -> 2001:610:730:28::100 metric 0) dev Local Area Connection
Tue Feb 24 16:22:54 2015 us=576387 C:\Windows\system32\netsh.exe interface ipv6 add route 2001:610:730:28::/64 Local Area Connection fe80::8 store=active
Tue Feb 24 16:22:54 2015 us=576387 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Tue Feb 24 16:22:54 2015 us=639390 open_tun, tt->ipv6=1
Tue Feb 24 16:22:54 2015 us=640390 TAP-WIN32 device [Local Area Connection] opened: \\.\Global\{FAF7432A-A514-4C80-9CD8-4B07A528756B}.tap
Tue Feb 24 16:22:54 2015 us=640390 TAP-Windows Driver Version 9.21 
Tue Feb 24 16:22:54 2015 us=640390 TAP-Windows MTU=1500
Tue Feb 24 16:22:54 2015 us=641390 Set TAP-Windows TUN subnet mode network/local/netmask = 172.28.0.0/172.28.0.100/255.255.255.0 [SUCCEEDED]
Tue Feb 24 16:22:54 2015 us=641390 Notified TAP-Windows driver to set a DHCP IP/netmask of 172.28.0.100/255.255.255.0 on interface {FAF7432A-A514-4C80-9CD8-4B07A528756B} [DHCP-serv: 172.28.0.254, lease-time: 31536000]
Tue Feb 24 16:22:54 2015 us=641390 DHCP option string: 0f097670 6e2e6c6f 63616c06 04ac1c00 01
Tue Feb 24 16:22:54 2015 us=641390 Successful ARP Flush on interface [6] {FAF7432A-A514-4C80-9CD8-4B07A528756B}
Tue Feb 24 16:22:59 2015 us=10642 TEST ROUTES: 1/1 succeeded len=0 ret=1 a=0 u/d=up
Tue Feb 24 16:22:59 2015 us=10642 C:\Windows\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 172.28.0.1
Tue Feb 24 16:22:59 2015 us=11641 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Tue Feb 24 16:22:59 2015 us=11641 Route addition via IPAPI succeeded [adaptive]
Tue Feb 24 16:22:59 2015 us=11641 C:\Windows\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 172.28.0.1
Tue Feb 24 16:22:59 2015 us=13642 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Tue Feb 24 16:22:59 2015 us=13642 Route addition via IPAPI succeeded [adaptive]
Tue Feb 24 16:22:59 2015 us=13642 add_route_ipv6(2000::/3 -> 2001:610:730:28::1 metric -1) dev Local Area Connection
Tue Feb 24 16:22:59 2015 us=13642 C:\Windows\system32\netsh.exe interface ipv6 add route 2000::/3 Local Area Connection fe80::8 store=active
Tue Feb 24 16:22:59 2015 us=13642 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Tue Feb 24 16:22:59 2015 us=78646 Initialization Sequence Completed
Tue Feb 24 16:22:59 2015 us=78646 MANAGEMENT: >STATE:1424791379,CONNECTED,SUCCESS,172.28.0.100,
Tue Feb 24 16:23:04 2015 us=795974 TCP/UDP: Closing socket
Tue Feb 24 16:23:04 2015 us=795974 C:\Windows\system32\route.exe DELETE 0.0.0.0 MASK 128.0.0.0 172.28.0.1
Tue Feb 24 16:23:04 2015 us=796974 Route deletion via IPAPI succeeded [adaptive]
Tue Feb 24 16:23:04 2015 us=797974 C:\Windows\system32\route.exe DELETE 128.0.0.0 MASK 128.0.0.0 172.28.0.1
Tue Feb 24 16:23:04 2015 us=799974 Route deletion via IPAPI succeeded [adaptive]
Tue Feb 24 16:23:04 2015 us=799974 delete_route_ipv6(2000::/3)
Tue Feb 24 16:23:04 2015 us=799974 C:\Windows\system32\netsh.exe interface ipv6 delete route 2000::/3 Local Area Connection fe80::8 store=active
Tue Feb 24 16:23:04 2015 us=799974 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Tue Feb 24 16:23:04 2015 us=865978 Closing TUN/TAP interface
Tue Feb 24 16:23:04 2015 us=865978 delete_route_ipv6(2001:610:730:28::/64)
Tue Feb 24 16:23:04 2015 us=865978 C:\Windows\system32\netsh.exe interface ipv6 delete route 2001:610:730:28::/64 Local Area Connection fe80::8 store=active
Tue Feb 24 16:23:04 2015 us=928982 NETSH: C:\Windows\system32\netsh.exe interface ipv6 delete address Local Area Connection 2001:610:730:28::100 store=active
Tue Feb 24 16:23:05 2015 us=8986 SIGTERM[hard,] received, process exiting
Tue Feb 24 16:23:05 2015 us=8986 MANAGEMENT: >STATE:1424791385,EXITING,SIGTERM,,

Traffic

SanjuroE wroteHowever when using the Windows client (version 2.3.6) on Windows 8.1 the connection gets established and encrypted packages are send by the client and received by the server (confirmed using Wireshark) but no messages are generated on the TUN interface of the server. No errors are logged either, neither on the server nor the client.

Presumably, you can ping6 the server ?

Windows applications "randomly" bind to local addresses, windows does not use the interface associated with the destination address.

Example: Windows client (10.8.0.6) you use Internet Explorer connect to the server (eg. "http://10.8.0.1:80") windows client does not always use 10.8.0.6/tun as source address .. Windows client could just as likely use 192.168.10.21/eth as source address ..

SanjuroE wroteFeb 24 16:23:11 nyx ovpn-server[4335]: psi/2001:610:730:100:9cd4:712c:7b78:2bf7 MULTI: bad source address from client [fe80::8d4d:3a15:6a0:b041], packet dropped
Feb 24 16:23:11 nyx ovpn-server[4335]: psi/2001:610:730:100:9cd4:712c:7b78:2bf7 MULTI: bad source address from client [::], packet dropped
Feb 24 16:23:11 nyx ovpn-server[4335]: psi/2001:610:730:100:9cd4:712c:7b78:2bf7 MULTI: bad source address from client [fe80::8d4d:3a15:6a0:b041], packet dropped

This may be the cause of the problem you are seeing.

See this HOWTO to implement iroute/iroute-ipv6 for your client.
HOWTO: Expanding the scope of the VPN to include additional machines

I also strongly suggest you use unique cert/keys for all your clients.

Sorry, I cannot be more help .. I $%^&*£@ hate ipv6 .. it so so UGLY !