OpenVPN windows client no access to internet

Jakob

I'm trying to setup my openwrt router as a openvpn server. I think I got it running correctly but it just won't work with my windows machine.

I can connect to the openvpn server using android and linux and in both cases I can access local resources and browse the internet. Checking the IP on pages on the internet (http://whatismyipaddress.com/) shows me that I am browsing through the VPN.

If I use the same .ovpn file on windows as on android I can connect and access local resources, but not access the internet.

So Android and Linux is ok, but connecting from Windows I can only access local resources and I'd like to access the internet as well like on android/linux. Can anyone see where the problem is?

Here's the windows client log.

Tue Mar 10 09:58:13 2015 OpenVPN 2.3.6 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Mar  4 2015
Tue Mar 10 09:58:13 2015 library versions: OpenSSL 1.0.1l 15 Jan 2015, LZO 2.08
Tue Mar 10 09:58:13 2015 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Tue Mar 10 09:58:13 2015 Need hold release from management interface, waiting...
Tue Mar 10 09:58:13 2015 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Tue Mar 10 09:58:13 2015 MANAGEMENT: CMD 'state on'
Tue Mar 10 09:58:13 2015 MANAGEMENT: CMD 'log all on'
Tue Mar 10 09:58:13 2015 MANAGEMENT: CMD 'hold off'
Tue Mar 10 09:58:13 2015 MANAGEMENT: CMD 'hold release'
Tue Mar 10 09:58:14 2015 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
Tue Mar 10 09:58:14 2015 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Mar 10 09:58:14 2015 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Mar 10 09:58:14 2015 Socket Buffers: R=[8192->8192] S=[8192->8192]
Tue Mar 10 09:58:14 2015 MANAGEMENT: >STATE:1425977894,RESOLVE,,,
Tue Mar 10 09:58:14 2015 UDPv4 link local: [undef]
Tue Mar 10 09:58:14 2015 UDPv4 link remote: [AF_INET]87.104.56.186:1194
Tue Mar 10 09:58:14 2015 MANAGEMENT: >STATE:1425977894,WAIT,,,
Tue Mar 10 09:58:14 2015 MANAGEMENT: >STATE:1425977894,AUTH,,,
Tue Mar 10 09:58:14 2015 TLS: Initial packet from [AF_INET]87.104.56.186:1194, sid=59b1b3b7 74bfad85
Tue Mar 10 09:58:14 2015 VERIFY OK: depth=1, C=DK, ST=Jutland, L=Aarhus, O=ArmadilloNetworks, OU=ArmadilloNetworks, CN=ArmadilloNetworks CA, name=EasyRSA, emailAddress=jakobjl@gmail.com
Tue Mar 10 09:58:14 2015 Validating certificate key usage
Tue Mar 10 09:58:14 2015 ++ Certificate has key usage  00a0, expects 00a0
Tue Mar 10 09:58:14 2015 VERIFY KU OK
Tue Mar 10 09:58:14 2015 Validating certificate extended key usage
Tue Mar 10 09:58:14 2015 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Tue Mar 10 09:58:14 2015 VERIFY EKU OK
Tue Mar 10 09:58:14 2015 VERIFY OK: depth=0, C=DK, ST=Jutland, L=Aarhus, O=ArmadilloNetworks, OU=ArmadilloNetworks, CN=router-server, name=EasyRSA, emailAddress=jakobjl@gmail.com
Tue Mar 10 09:58:14 2015 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Mar 10 09:58:14 2015 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Mar 10 09:58:14 2015 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Mar 10 09:58:14 2015 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Mar 10 09:58:14 2015 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Tue Mar 10 09:58:14 2015 [router-server] Peer Connection Initiated with [AF_INET]87.104.56.186:1194
Tue Mar 10 09:58:15 2015 MANAGEMENT: >STATE:1425977895,GET_CONFIG,,,
Tue Mar 10 09:58:16 2015 SENT CONTROL [router-server]: 'PUSH_REQUEST' (status=1)
Tue Mar 10 09:58:16 2015 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Tue Mar 10 09:58:16 2015 OPTIONS IMPORT: timers and/or timeouts modified
Tue Mar 10 09:58:16 2015 OPTIONS IMPORT: --ifconfig/up options modified
Tue Mar 10 09:58:16 2015 OPTIONS IMPORT: route options modified
Tue Mar 10 09:58:16 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Tue Mar 10 09:58:16 2015 MANAGEMENT: >STATE:1425977896,ASSIGN_IP,,10.8.0.6,
Tue Mar 10 09:58:16 2015 open_tun, tt->ipv6=0
Tue Mar 10 09:58:16 2015 TAP-WIN32 device [LAN-forbindelse 4] opened: \\.\Global\{603BD10F-754B-4B42-885C-31B832AA0124}.tap
Tue Mar 10 09:58:16 2015 TAP-Windows Driver Version 9.21 
Tue Mar 10 09:58:16 2015 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.6/255.255.255.252 on interface {603BD10F-754B-4B42-885C-31B832AA0124} [DHCP-serv: 10.8.0.5, lease-time: 31536000]
Tue Mar 10 09:58:16 2015 Successful ARP Flush on interface [55] {603BD10F-754B-4B42-885C-31B832AA0124}
Tue Mar 10 09:58:21 2015 TEST ROUTES: 2/2 succeeded len=1 ret=1 a=0 u/d=up
Tue Mar 10 09:58:21 2015 C:\Windows\system32\route.exe ADD 87.104.56.186 MASK 255.255.255.255 10.72.15.193
Tue Mar 10 09:58:21 2015 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=10 and dwForwardType=4
Tue Mar 10 09:58:21 2015 Route addition via IPAPI succeeded [adaptive]
Tue Mar 10 09:58:21 2015 C:\Windows\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.8.0.5
Tue Mar 10 09:58:21 2015 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Tue Mar 10 09:58:21 2015 Route addition via IPAPI succeeded [adaptive]
Tue Mar 10 09:58:21 2015 C:\Windows\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.8.0.5
Tue Mar 10 09:58:21 2015 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Tue Mar 10 09:58:21 2015 Route addition via IPAPI succeeded [adaptive]
Tue Mar 10 09:58:21 2015 MANAGEMENT: >STATE:1425977901,ADD_ROUTES,,,
Tue Mar 10 09:58:21 2015 C:\Windows\system32\route.exe ADD 10.8.0.1 MASK 255.255.255.255 10.8.0.5
Tue Mar 10 09:58:21 2015 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Tue Mar 10 09:58:21 2015 Route addition via IPAPI succeeded [adaptive]
Tue Mar 10 09:58:21 2015 Initialization Sequence Completed
Tue Mar 10 09:58:21 2015 MANAGEMENT: >STATE:1425977901,CONNECTED,SUCCESS,10.8.0.6,87.104.56.186

server log

Tue Mar 10 09:49:17 2015 80.62.116.20:58071 TLS: Initial packet from [AF_INET]80.62.116.20:58071, sid=a2ce95a6 f16cb7bf
Tue Mar 10 09:49:17 2015 80.62.116.20:58071 VERIFY OK: depth=1, C=DK, ST=Jutland, L=Aarhus, O=ArmadilloNetworks, OU=ArmadilloNetworks, CN=ArmadilloNetworks CA, name=EasyRSA, emailAddress=jakobjl@gmail.com
Tue Mar 10 09:49:17 2015 80.62.116.20:58071 VERIFY OK: depth=0, C=DK, ST=Jutland, L=Aarhus, O=ArmadilloNetworks, OU=ArmadilloNetworks, CN=win-client, name=EasyRSA, emailAddress=jakobjl@gmail.com
Tue Mar 10 09:49:17 2015 80.62.116.20:58071 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Mar 10 09:49:17 2015 80.62.116.20:58071 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Mar 10 09:49:17 2015 80.62.116.20:58071 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Mar 10 09:49:17 2015 80.62.116.20:58071 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Mar 10 09:49:17 2015 80.62.116.20:58071 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Tue Mar 10 09:49:17 2015 80.62.116.20:58071 [win-client] Peer Connection Initiated with [AF_INET]80.62.116.20:58071
Tue Mar 10 09:49:17 2015 win-client/80.62.116.20:58071 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled)
Tue Mar 10 09:49:17 2015 win-client/80.62.116.20:58071 MULTI: Learn: 10.8.0.6 -> win-client/80.62.116.20:58071
Tue Mar 10 09:49:17 2015 win-client/80.62.116.20:58071 MULTI: primary virtual IP for win-client/80.62.116.20:58071: 10.8.0.6
Tue Mar 10 09:49:17 2015 win-client/80.62.116.20:58071 PUSH: Received control message: 'PUSH_REQUEST'
Tue Mar 10 09:49:17 2015 win-client/80.62.116.20:58071 send_push_reply(): safe_cap=940
Tue Mar 10 09:49:17 2015 win-client/80.62.116.20:58071 SENT CONTROL [win-client]: 'PUSH_REPLY,redirect-gateway def1,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)
Tue Mar 10 09:49:46 2015 win-client/80.62.116.20:58071 IP packet with unknown IP version=2 seen
Tue Mar 10 09:53:46 2015 win-client/80.62.116.20:58071 [win-client] Inactivity timeout (--ping-restart), restarting
Tue Mar 10 09:53:46 2015 win-client/80.62.116.20:58071 SIGUSR1[soft,ping-restart] received, client-instance restarting
Tue Mar 10 09:58:13 2015 212.130.108.54:32676 TLS: Initial packet from [AF_INET]212.130.108.54:32676, sid=a1358675 2c6895a4
Tue Mar 10 09:58:14 2015 212.130.108.54:32676 VERIFY OK: depth=1, C=DK, ST=Jutland, L=Aarhus, O=ArmadilloNetworks, OU=ArmadilloNetworks, CN=ArmadilloNetworks CA, name=EasyRSA, emailAddress=jakobjl@gmail.com
Tue Mar 10 09:58:14 2015 212.130.108.54:32676 VERIFY OK: depth=0, C=DK, ST=Jutland, L=Aarhus, O=ArmadilloNetworks, OU=ArmadilloNetworks, CN=win-client, name=EasyRSA, emailAddress=jakobjl@gmail.com
Tue Mar 10 09:58:14 2015 212.130.108.54:32676 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Mar 10 09:58:14 2015 212.130.108.54:32676 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Mar 10 09:58:14 2015 212.130.108.54:32676 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Mar 10 09:58:14 2015 212.130.108.54:32676 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Mar 10 09:58:14 2015 212.130.108.54:32676 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Tue Mar 10 09:58:14 2015 212.130.108.54:32676 [win-client] Peer Connection Initiated with [AF_INET]212.130.108.54:32676
Tue Mar 10 09:58:14 2015 win-client/212.130.108.54:32676 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled)
Tue Mar 10 09:58:14 2015 win-client/212.130.108.54:32676 MULTI: Learn: 10.8.0.6 -> win-client/212.130.108.54:32676
Tue Mar 10 09:58:14 2015 win-client/212.130.108.54:32676 MULTI: primary virtual IP for win-client/212.130.108.54:32676: 10.8.0.6
Tue Mar 10 09:58:16 2015 win-client/212.130.108.54:32676 PUSH: Received control message: 'PUSH_REQUEST'
Tue Mar 10 09:58:16 2015 win-client/212.130.108.54:32676 send_push_reply(): safe_cap=940
Tue Mar 10 09:58:16 2015 win-client/212.130.108.54:32676 SENT CONTROL [win-client]: 'PUSH_REPLY,redirect-gateway def1,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)
Tue Mar 10 10:04:09 2015 win-client/212.130.108.54:32676 [win-client] Inactivity timeout (--ping-restart), restarting
Tue Mar 10 10:04:09 2015 win-client/212.130.108.54:32676 SIGUSR1[soft,ping-restart] received, client-instance restarting

And the windows client .ovpn file

client
dev tun
proto udp
remote <myurl.net> 1194 #<> does not contain the real url
resolv-retry infinite
nobind
persist-key
persist-tun
ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\config\\win-client.crt"
key "C:\\Program Files\\OpenVPN\\config\\win-client.key"
remote-cert-tls server
tls-auth ta.key 1
verb 3

server config

config openvpn 'myvpn'
	option enabled '1'
	option dev 'tun'
	option proto 'udp'
	option server '10.8.0.0 255.255.255.0'
	option port '1194'
	option keepalive '10 120'
	option ca '/etc/openvpn/ca.crt'
	option key '/etc/openvpn/router-server.key'
	option cert '/etc/openvpn/router-server.crt'
	option dh '/etc/openvpn/dh1024.pem'
	option log '/tmp/openvpn.log'
	option verb '3'
	option persist_key '1'
	option persist_tun '1'
	option mute '20'
	option tls_auth '/etc/openvpn/ta.key 0'
	option push 'redirect-gateway def1'

Traffic

My first conclusion is you are having trouble with the new NDIS6 TAP driver ..

OpenVPN Community Edition version 2.3.x (Current):

TAP NDIS6 driver versions:
- Installer (32-bit), Windows Vista and later = openvpn-install-2.3.6-I60x-i686.exe
  Installer (64-bit), Windows Vista and later = openvpn-install-2.3.6-I60x-x86_64.exe
TAP NDIS5 driver versions:
- Installer (32-bit), Windows XP and later = openvpn-install-2.3.6-I00x-i686.exe
  Installer (64-bit), Windows XP and later = openvpn-install-2.3.6-I00x-x86_64.exe
If you are having trouble with any NDIS6 version please try the NDIS5 version.
- http://openvpn.net/index.php/download/community-downloads.html

Let us know if this has any impact on the issue you are seeing, thanks.

Jakob

Tried installing openvpn-install-2.3.6-I00x-x86_64.exe but no change. Can still only access local resources. Using Windows 7 btw, if it makes any different.

Tue Mar 10 19:49:29 2015 OpenVPN 2.3.6 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Mar  4 2015
Tue Mar 10 19:49:29 2015 library versions: OpenSSL 1.0.1l 15 Jan 2015, LZO 2.08
Tue Mar 10 19:49:29 2015 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Tue Mar 10 19:49:29 2015 Need hold release from management interface, waiting...
Tue Mar 10 19:49:29 2015 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Tue Mar 10 19:49:29 2015 MANAGEMENT: CMD 'state on'
Tue Mar 10 19:49:29 2015 MANAGEMENT: CMD 'log all on'
Tue Mar 10 19:49:29 2015 MANAGEMENT: CMD 'hold off'
Tue Mar 10 19:49:29 2015 MANAGEMENT: CMD 'hold release'
Tue Mar 10 19:49:29 2015 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
Tue Mar 10 19:49:29 2015 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Mar 10 19:49:29 2015 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Mar 10 19:49:29 2015 Socket Buffers: R=[8192->8192] S=[8192->8192]
Tue Mar 10 19:49:29 2015 MANAGEMENT: >STATE:1426013369,RESOLVE,,,
Tue Mar 10 19:49:30 2015 UDPv4 link local: [undef]
Tue Mar 10 19:49:30 2015 UDPv4 link remote: [AF_INET]87.104.56.186:1194
Tue Mar 10 19:49:30 2015 MANAGEMENT: >STATE:1426013370,WAIT,,,
Tue Mar 10 19:49:30 2015 MANAGEMENT: >STATE:1426013370,AUTH,,,
Tue Mar 10 19:49:30 2015 TLS: Initial packet from [AF_INET]87.104.56.186:1194, sid=b12b29eb 45c41b47
Tue Mar 10 19:49:30 2015 VERIFY OK: depth=1, C=DK, ST=Jutland, L=Aarhus, O=ArmadilloNetworks, OU=ArmadilloNetworks, CN=ArmadilloNetworks CA, name=EasyRSA, emailAddress=jakobjl@gmail.com
Tue Mar 10 19:49:30 2015 Validating certificate key usage
Tue Mar 10 19:49:30 2015 ++ Certificate has key usage  00a0, expects 00a0
Tue Mar 10 19:49:30 2015 VERIFY KU OK
Tue Mar 10 19:49:30 2015 Validating certificate extended key usage
Tue Mar 10 19:49:30 2015 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Tue Mar 10 19:49:30 2015 VERIFY EKU OK
Tue Mar 10 19:49:30 2015 VERIFY OK: depth=0, C=DK, ST=Jutland, L=Aarhus, O=ArmadilloNetworks, OU=ArmadilloNetworks, CN=router-server, name=EasyRSA, emailAddress=jakobjl@gmail.com
Tue Mar 10 19:49:30 2015 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Mar 10 19:49:30 2015 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Mar 10 19:49:30 2015 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Mar 10 19:49:30 2015 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Mar 10 19:49:30 2015 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Tue Mar 10 19:49:30 2015 [router-server] Peer Connection Initiated with [AF_INET]87.104.56.186:1194
Tue Mar 10 19:49:31 2015 MANAGEMENT: >STATE:1426013371,GET_CONFIG,,,
Tue Mar 10 19:49:32 2015 SENT CONTROL [router-server]: 'PUSH_REQUEST' (status=1)
Tue Mar 10 19:49:32 2015 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Tue Mar 10 19:49:32 2015 OPTIONS IMPORT: timers and/or timeouts modified
Tue Mar 10 19:49:32 2015 OPTIONS IMPORT: --ifconfig/up options modified
Tue Mar 10 19:49:32 2015 OPTIONS IMPORT: route options modified
Tue Mar 10 19:49:32 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Tue Mar 10 19:49:32 2015 MANAGEMENT: >STATE:1426013372,ASSIGN_IP,,10.8.0.6,
Tue Mar 10 19:49:32 2015 open_tun, tt->ipv6=0
Tue Mar 10 19:49:32 2015 TAP-WIN32 device [LAN-forbindelse 4] opened: \\.\Global\{16F213CA-148C-487E-96F2-C43B06632917}.tap
Tue Mar 10 19:49:32 2015 TAP-Windows Driver Version 9.9 
Tue Mar 10 19:49:32 2015 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.6/255.255.255.252 on interface {16F213CA-148C-487E-96F2-C43B06632917} [DHCP-serv: 10.8.0.5, lease-time: 31536000]
Tue Mar 10 19:49:32 2015 Successful ARP Flush on interface [55] {16F213CA-148C-487E-96F2-C43B06632917}
Tue Mar 10 19:49:37 2015 TEST ROUTES: 2/2 succeeded len=1 ret=1 a=0 u/d=up
Tue Mar 10 19:49:37 2015 C:\Windows\system32\route.exe ADD 87.104.56.186 MASK 255.255.255.255 192.168.1.1
Tue Mar 10 19:49:37 2015 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=25 and dwForwardType=4
Tue Mar 10 19:49:37 2015 Route addition via IPAPI succeeded [adaptive]
Tue Mar 10 19:49:37 2015 C:\Windows\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.8.0.5
Tue Mar 10 19:49:37 2015 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Tue Mar 10 19:49:37 2015 Route addition via IPAPI succeeded [adaptive]
Tue Mar 10 19:49:37 2015 C:\Windows\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.8.0.5
Tue Mar 10 19:49:37 2015 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Tue Mar 10 19:49:37 2015 Route addition via IPAPI succeeded [adaptive]
Tue Mar 10 19:49:37 2015 MANAGEMENT: >STATE:1426013377,ADD_ROUTES,,,
Tue Mar 10 19:49:37 2015 C:\Windows\system32\route.exe ADD 10.8.0.1 MASK 255.255.255.255 10.8.0.5
Tue Mar 10 19:49:37 2015 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Tue Mar 10 19:49:37 2015 Route addition via IPAPI succeeded [adaptive]
Tue Mar 10 19:49:37 2015 Initialization Sequence Completed
Tue Mar 10 19:49:37 2015 MANAGEMENT: >STATE:1426013377,CONNECTED,SUCCESS,10.8.0.6,87.104.56.186

Tue Mar 10 19:49:30 2015 87.104.56.186:59066 TLS: Initial packet from [AF_INET]87.104.56.186:59066, sid=24f5d13b 59ee3187
Tue Mar 10 19:49:30 2015 87.104.56.186:59066 VERIFY OK: depth=1, C=DK, ST=Jutland, L=Aarhus, O=ArmadilloNetworks, OU=ArmadilloNetworks, CN=ArmadilloNetworks CA, name=EasyRSA, emailAddress=jakobjl@gmail.com
Tue Mar 10 19:49:30 2015 87.104.56.186:59066 VERIFY OK: depth=0, C=DK, ST=Jutland, L=Aarhus, O=ArmadilloNetworks, OU=ArmadilloNetworks, CN=win-client, name=EasyRSA, emailAddress=jakobjl@gmail.com
Tue Mar 10 19:49:30 2015 87.104.56.186:59066 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Mar 10 19:49:30 2015 87.104.56.186:59066 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Mar 10 19:49:30 2015 87.104.56.186:59066 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Mar 10 19:49:30 2015 87.104.56.186:59066 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Mar 10 19:49:30 2015 87.104.56.186:59066 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Tue Mar 10 19:49:30 2015 87.104.56.186:59066 [win-client] Peer Connection Initiated with [AF_INET]87.104.56.186:59066
Tue Mar 10 19:49:30 2015 MULTI: new connection by client 'win-client' will cause previous active sessions by this client to be dropped.  Remember to use the --duplicate-cn option if you want multiple clients using the same certificate or username to concurrently connect.
Tue Mar 10 19:49:30 2015 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled)
Tue Mar 10 19:49:30 2015 MULTI: Learn: 10.8.0.6 -> win-client/87.104.56.186:59066
Tue Mar 10 19:49:30 2015 MULTI: primary virtual IP for win-client/87.104.56.186:59066: 10.8.0.6
Tue Mar 10 19:49:32 2015 win-client/87.104.56.186:59066 PUSH: Received control message: 'PUSH_REQUEST'
Tue Mar 10 19:49:32 2015 win-client/87.104.56.186:59066 send_push_reply(): safe_cap=940
Tue Mar 10 19:49:32 2015 win-client/87.104.56.186:59066 SENT CONTROL [win-client]: 'PUSH_REPLY,redirect-gateway def1,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)

Jakob

Tried installing openvpn-install-2.3.6-I00x-x86_64.exe but no change. Can still only access the resources on my openvpn servers network and no internet when connected to the openvpn server.

Tue Mar 10 19:49:29 2015 OpenVPN 2.3.6 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Mar  4 2015
Tue Mar 10 19:49:29 2015 library versions: OpenSSL 1.0.1l 15 Jan 2015, LZO 2.08
Tue Mar 10 19:49:29 2015 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Tue Mar 10 19:49:29 2015 Need hold release from management interface, waiting...
Tue Mar 10 19:49:29 2015 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Tue Mar 10 19:49:29 2015 MANAGEMENT: CMD 'state on'
Tue Mar 10 19:49:29 2015 MANAGEMENT: CMD 'log all on'
Tue Mar 10 19:49:29 2015 MANAGEMENT: CMD 'hold off'
Tue Mar 10 19:49:29 2015 MANAGEMENT: CMD 'hold release'
Tue Mar 10 19:49:29 2015 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
Tue Mar 10 19:49:29 2015 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Mar 10 19:49:29 2015 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Mar 10 19:49:29 2015 Socket Buffers: R=[8192->8192] S=[8192->8192]
Tue Mar 10 19:49:29 2015 MANAGEMENT: >STATE:1426013369,RESOLVE,,,
Tue Mar 10 19:49:30 2015 UDPv4 link local: [undef]
Tue Mar 10 19:49:30 2015 UDPv4 link remote: [AF_INET]87.104.56.186:1194
Tue Mar 10 19:49:30 2015 MANAGEMENT: >STATE:1426013370,WAIT,,,
Tue Mar 10 19:49:30 2015 MANAGEMENT: >STATE:1426013370,AUTH,,,
Tue Mar 10 19:49:30 2015 TLS: Initial packet from [AF_INET]87.104.56.186:1194, sid=b12b29eb 45c41b47
Tue Mar 10 19:49:30 2015 VERIFY OK: depth=1, C=DK, ST=Jutland, L=Aarhus, O=ArmadilloNetworks, OU=ArmadilloNetworks, CN=ArmadilloNetworks CA, name=EasyRSA, emailAddress=jakobjl@gmail.com
Tue Mar 10 19:49:30 2015 Validating certificate key usage
Tue Mar 10 19:49:30 2015 ++ Certificate has key usage  00a0, expects 00a0
Tue Mar 10 19:49:30 2015 VERIFY KU OK
Tue Mar 10 19:49:30 2015 Validating certificate extended key usage
Tue Mar 10 19:49:30 2015 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Tue Mar 10 19:49:30 2015 VERIFY EKU OK
Tue Mar 10 19:49:30 2015 VERIFY OK: depth=0, C=DK, ST=Jutland, L=Aarhus, O=ArmadilloNetworks, OU=ArmadilloNetworks, CN=router-server, name=EasyRSA, emailAddress=jakobjl@gmail.com
Tue Mar 10 19:49:30 2015 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Mar 10 19:49:30 2015 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Mar 10 19:49:30 2015 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Mar 10 19:49:30 2015 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Mar 10 19:49:30 2015 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Tue Mar 10 19:49:30 2015 [router-server] Peer Connection Initiated with [AF_INET]87.104.56.186:1194
Tue Mar 10 19:49:31 2015 MANAGEMENT: >STATE:1426013371,GET_CONFIG,,,
Tue Mar 10 19:49:32 2015 SENT CONTROL [router-server]: 'PUSH_REQUEST' (status=1)
Tue Mar 10 19:49:32 2015 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Tue Mar 10 19:49:32 2015 OPTIONS IMPORT: timers and/or timeouts modified
Tue Mar 10 19:49:32 2015 OPTIONS IMPORT: --ifconfig/up options modified
Tue Mar 10 19:49:32 2015 OPTIONS IMPORT: route options modified
Tue Mar 10 19:49:32 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Tue Mar 10 19:49:32 2015 MANAGEMENT: >STATE:1426013372,ASSIGN_IP,,10.8.0.6,
Tue Mar 10 19:49:32 2015 open_tun, tt->ipv6=0
Tue Mar 10 19:49:32 2015 TAP-WIN32 device [LAN-forbindelse 4] opened: \\.\Global\{16F213CA-148C-487E-96F2-C43B06632917}.tap
Tue Mar 10 19:49:32 2015 TAP-Windows Driver Version 9.9 
Tue Mar 10 19:49:32 2015 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.6/255.255.255.252 on interface {16F213CA-148C-487E-96F2-C43B06632917} [DHCP-serv: 10.8.0.5, lease-time: 31536000]
Tue Mar 10 19:49:32 2015 Successful ARP Flush on interface [55] {16F213CA-148C-487E-96F2-C43B06632917}
Tue Mar 10 19:49:37 2015 TEST ROUTES: 2/2 succeeded len=1 ret=1 a=0 u/d=up
Tue Mar 10 19:49:37 2015 C:\Windows\system32\route.exe ADD 87.104.56.186 MASK 255.255.255.255 192.168.1.1
Tue Mar 10 19:49:37 2015 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=25 and dwForwardType=4
Tue Mar 10 19:49:37 2015 Route addition via IPAPI succeeded [adaptive]
Tue Mar 10 19:49:37 2015 C:\Windows\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.8.0.5
Tue Mar 10 19:49:37 2015 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Tue Mar 10 19:49:37 2015 Route addition via IPAPI succeeded [adaptive]
Tue Mar 10 19:49:37 2015 C:\Windows\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.8.0.5
Tue Mar 10 19:49:37 2015 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Tue Mar 10 19:49:37 2015 Route addition via IPAPI succeeded [adaptive]
Tue Mar 10 19:49:37 2015 MANAGEMENT: >STATE:1426013377,ADD_ROUTES,,,
Tue Mar 10 19:49:37 2015 C:\Windows\system32\route.exe ADD 10.8.0.1 MASK 255.255.255.255 10.8.0.5
Tue Mar 10 19:49:37 2015 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Tue Mar 10 19:49:37 2015 Route addition via IPAPI succeeded [adaptive]
Tue Mar 10 19:49:37 2015 Initialization Sequence Completed
Tue Mar 10 19:49:37 2015 MANAGEMENT: >STATE:1426013377,CONNECTED,SUCCESS,10.8.0.6,87.104.56.186

Tue Mar 10 19:49:30 2015 87.104.56.186:59066 TLS: Initial packet from [AF_INET]87.104.56.186:59066, sid=24f5d13b 59ee3187
Tue Mar 10 19:49:30 2015 87.104.56.186:59066 VERIFY OK: depth=1, C=DK, ST=Jutland, L=Aarhus, O=ArmadilloNetworks, OU=ArmadilloNetworks, CN=ArmadilloNetworks CA, name=EasyRSA, emailAddress=jakobjl@gmail.com
Tue Mar 10 19:49:30 2015 87.104.56.186:59066 VERIFY OK: depth=0, C=DK, ST=Jutland, L=Aarhus, O=ArmadilloNetworks, OU=ArmadilloNetworks, CN=win-client, name=EasyRSA, emailAddress=jakobjl@gmail.com
Tue Mar 10 19:49:30 2015 87.104.56.186:59066 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Mar 10 19:49:30 2015 87.104.56.186:59066 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Mar 10 19:49:30 2015 87.104.56.186:59066 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Mar 10 19:49:30 2015 87.104.56.186:59066 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Mar 10 19:49:30 2015 87.104.56.186:59066 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Tue Mar 10 19:49:30 2015 87.104.56.186:59066 [win-client] Peer Connection Initiated with [AF_INET]87.104.56.186:59066
Tue Mar 10 19:49:30 2015 MULTI: new connection by client 'win-client' will cause previous active sessions by this client to be dropped.  Remember to use the --duplicate-cn option if you want multiple clients using the same certificate or username to concurrently connect.
Tue Mar 10 19:49:30 2015 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled)
Tue Mar 10 19:49:30 2015 MULTI: Learn: 10.8.0.6 -> win-client/87.104.56.186:59066
Tue Mar 10 19:49:30 2015 MULTI: primary virtual IP for win-client/87.104.56.186:59066: 10.8.0.6
Tue Mar 10 19:49:32 2015 win-client/87.104.56.186:59066 PUSH: Received control message: 'PUSH_REQUEST'
Tue Mar 10 19:49:32 2015 win-client/87.104.56.186:59066 send_push_reply(): safe_cap=940
Tue Mar 10 19:49:32 2015 win-client/87.104.56.186:59066 SENT CONTROL [win-client]: 'PUSH_REPLY,redirect-gateway def1,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5' (status=1)

maikcat

can you post the output of traceroute 8.8.8.8 on your win 7 client?

Michael.

Jakob

maikcat wrotecan you post the output of traceroute 8.8.8.8 on your win 7 client?

Michael.

Thanks, this question lead me on the right track.

I could traceroute 8.8.8.8 just fine, but trying traceroute www.google.com gave a 'cannot resolve' error. So it must be DNS-related. Poking about I found out that my Windows machine was set to use 8.8.8.8 and 8.8.4.4 as DNS servers. If I change this to automatic instead, it works and I can traceroute google.com and use my browser.

Can any of you explain why setting the DNS to 8.8.8.8 makes it fail? As I said I could do a successful traceroute 8.8.8.8 so I should be able to reach it for DNS services as well? I also tried ipconfig /flushdns but that made no change. Only setting DNS to automatic did.

maikcat

can you query these dns from your server side?

Michael.

Jakob

Connected to my home network via openvpn server and with DNS set to 8.8.8.8 I can traceroute to 8.8.8.8 but not to an url (traceroute google.com). The last gives a 'cannot resolve' error.

Connected to my home network via openvpn server and with DNS set to automatic I can traceroute to both IP and URL.

When actually at home and on my home network I can traceroute both IP and URL.