Hello. I have OpenVPN 2.3.1 server on embedded platform and Windows clients (mostly win 7). Server pushes configuration to the clients. Well known issue is, when windows don't recognize network and packets are blocked by fireewall (if missing default route). I found working configuration for case when is client connected directly by local network and different configuration when is client working through port forwarding at office router. But i dont find configuration, where works both cases. [code] ifconfig 192.168.10.100 255.255.255.0 push "route-gateway 192.168.10.100" push route "192.168.15.0 255.255.255.0" #left network push "redirect-gateway local" #with local flag it works only localy, without flag it works only through office router. [/code] In documentation is mentioned flag autolocal, but it doesn't work. Pull in client config is of course contained. I googled for some workarounds and there was advice add to client config: [code] route-method exe route-delay 2 [/code] But it didn't help. Thanks for any clue.

push "redirect-gateway autolocal" don't work

erik_etech

Hello.
I have OpenVPN 2.3.1 server on embedded platform and Windows clients (mostly win 7). Server pushes configuration to the clients. Well known issue is, when windows don't recognize network and packets are blocked by fireewall (if missing default route).

I found working configuration for case when is client connected directly by local network and different configuration when is client working through port forwarding at office router. But i dont find configuration, where works both cases.

ifconfig 192.168.10.100 255.255.255.0
push "route-gateway 192.168.10.100"
push route "192.168.15.0 255.255.255.0" #left network
push "redirect-gateway local" #with local flag it works only localy, without flag it works only through office router.

In documentation is mentioned flag autolocal, but it doesn't work.

Pull in client config is of course contained.
I googled for some workarounds and there was advice add to client config:

route-method exe
route-delay 2

But it didn't help.

Thanks for any clue.

Traffic

Please post full configs and logs at verb 4 ..

erik_etech

Here I post logs when was configurated push "redirect-gateway autolocal" and in comments is written differences with push "redirect-gateway local". Flag autolocal, it seems to me do nothing - it is same as place just push "redirect-gateway".

Note: as opposed to the first post, is left network 192.168.3.0.

Client config

verb 4
dev tap
proto udp
remote-cert-tls server
tls-client
nobind
pull
route-method exe
route-delay 2
persist-key

<ca>
...
</ca>
<cert>
...
</cert>
<key>
...
</key> 

mute 10 
remote address port  #here we alternate local IP of OpenVPN server, or public domain name of office router with port forwarding to OpenVPN server.

Server config

mode server
tls-server
dev tap
port 1194
proto udp

ifconfig 192.168.10.100 255.255.255.0

push "route-gateway 192.168.10.100"
push route "192.168.3.0 255.255.255.0" #left network
push "redirect-gateway autolocal"  # !!!!!!!!! this line is going on !!!!!!!!!

ifconfig-pool 192.168.10.101 192.168.10.105 255.255.255.0

duplicate-cn
client-to-client

ca /etc/openvpn/ca.crt
cert /etc/openvpn/etech.crt
key /etc/openvpn/etech.pem
dh /etc/openvpn/dh2048.pem

persist-tun
persist-key

keepalive 30 120
user root
group root

script-security 3
up /etc/openvpn/ip-up
down /etc/openvpn/ip-down

status /var/log/openvpn/status.log
log-append /var/log/openvpn/vpn.log

verb 4
mute 20

Routed through office router (port forwarding).
Log:

Mon Apr 20 09:29:26 2015 us=734375 Current Parameter Settings:
Mon Apr 20 09:29:26 2015 us=734375   config = 'ENA.ovpn'
Mon Apr 20 09:29:26 2015 us=734375   mode = 0
Mon Apr 20 09:29:26 2015 us=734375   show_ciphers = DISABLED
Mon Apr 20 09:29:26 2015 us=734375   show_digests = DISABLED
Mon Apr 20 09:29:26 2015 us=734375   show_engines = DISABLED
Mon Apr 20 09:29:26 2015 us=734375   genkey = DISABLED
Mon Apr 20 09:29:26 2015 us=734375   key_pass_file = '[UNDEF]'
Mon Apr 20 09:29:26 2015 us=734375   show_tls_ciphers = DISABLED
Mon Apr 20 09:29:26 2015 us=734375 Connection profiles [default]:
Mon Apr 20 09:29:26 2015 us=734375 NOTE: --mute triggered...
Mon Apr 20 09:29:26 2015 us=734375 275 variation(s) on previous 10 message(s) suppressed by --mute
Mon Apr 20 09:29:26 2015 us=734375 OpenVPN 2.3.6 i686-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Mar  4 2015
Mon Apr 20 09:29:26 2015 us=734375 library versions: OpenSSL 1.0.1l 15 Jan 2015, LZO 2.08
Enter Management Password:
Mon Apr 20 09:29:26 2015 us=734375 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Mon Apr 20 09:29:26 2015 us=734375 Need hold release from management interface, waiting...
Mon Apr 20 09:29:27 2015 us=234375 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Mon Apr 20 09:29:27 2015 us=343750 MANAGEMENT: CMD 'state on'
Mon Apr 20 09:29:27 2015 us=343750 MANAGEMENT: CMD 'log all on'
Mon Apr 20 09:29:27 2015 us=343750 MANAGEMENT: CMD 'hold off'
Mon Apr 20 09:29:27 2015 us=343750 MANAGEMENT: CMD 'hold release'
Mon Apr 20 09:29:30 2015 us=890625 MANAGEMENT: CMD 'password [...]'
Mon Apr 20 09:29:30 2015 us=890625 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Mon Apr 20 09:29:30 2015 us=890625 Control Channel MTU parms [ L:1573 D:138 EF:38 EB:0 ET:0 EL:0 ]
Mon Apr 20 09:29:30 2015 us=890625 Socket Buffers: R=[8192->8192] S=[8192->8192]
Mon Apr 20 09:29:30 2015 us=890625 MANAGEMENT: >STATE:1429547370,RESOLVE,,,
Mon Apr 20 09:29:30 2015 us=906250 Data Channel MTU parms [ L:1573 D:1450 EF:41 EB:4 ET:32 EL:0 ]
Mon Apr 20 09:29:30 2015 us=906250 Local Options String: 'V4,dev-type tap,link-mtu 1573,tun-mtu 1532,proto UDPv4,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Mon Apr 20 09:29:30 2015 us=906250 Expected Remote Options String: 'V4,dev-type tap,link-mtu 1573,tun-mtu 1532,proto UDPv4,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Mon Apr 20 09:29:30 2015 us=906250 Local Options hash (VER=V4): '2c50bd2c'
Mon Apr 20 09:29:30 2015 us=906250 Expected Remote Options hash (VER=V4): '0ddbb6e3'
Mon Apr 20 09:29:30 2015 us=906250 UDPv4 link local: [undef]
Mon Apr 20 09:29:30 2015 us=906250 UDPv4 link remote: [AF_INET]{public_ip_address}:4594
Mon Apr 20 09:29:30 2015 us=906250 MANAGEMENT: >STATE:1429547370,WAIT,,,
Mon Apr 20 09:29:30 2015 us=921875 MANAGEMENT: >STATE:1429547370,AUTH,,,
Mon Apr 20 09:29:30 2015 us=921875 TLS: Initial packet from [AF_INET]{public_ip_address}:4594, sid=ea26386c b4b9c0b3
Mon Apr 20 09:29:41 2015 us=156250 VERIFY OK: depth=1, C=CZ, ST=Czech Republic, L=Turnov, O=Embedded Technologies, OU=R&D, CN=Embedded Technologies CA, emailAddress=info@etech.cz
Mon Apr 20 09:29:41 2015 us=156250 Validating certificate key usage
Mon Apr 20 09:29:41 2015 us=156250 ++ Certificate has key usage  00a0, expects 00a0
Mon Apr 20 09:29:41 2015 us=156250 VERIFY KU OK
Mon Apr 20 09:29:41 2015 us=156250 Validating certificate extended key usage
Mon Apr 20 09:29:41 2015 us=156250 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Mon Apr 20 09:29:41 2015 us=156250 VERIFY EKU OK
Mon Apr 20 09:29:41 2015 us=156250 VERIFY OK: depth=0, C=CZ, L=Turnov, O=Embedded Technologies, OU=R&D, CN=192.168.1.47, emailAddress=support@etech.cz
Mon Apr 20 09:29:55 2015 us=328125 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Apr 20 09:29:55 2015 us=328125 NOTE: --mute triggered...
Mon Apr 20 09:29:55 2015 us=328125 4 variation(s) on previous 10 message(s) suppressed by --mute
Mon Apr 20 09:29:55 2015 us=328125 [192.168.1.47] Peer Connection Initiated with [AF_INET]{public_ip_address}:4594
Mon Apr 20 09:29:56 2015 us=390625 MANAGEMENT: >STATE:1429547396,GET_CONFIG,,,
Mon Apr 20 09:29:57 2015 us=453125 SENT CONTROL [192.168.1.47]: 'PUSH_REQUEST' (status=1)
Mon Apr 20 09:29:57 2015 us=453125 PUSH: Received control message: 'PUSH_REPLY,route-gateway 192.168.10.100,route 192.168.3.0 255.255.255.0,redirect-gateway autolocal,ping 30,ping-restart 120,ifconfig 192.168.10.102 255.255.255.0'
Mon Apr 20 09:29:57 2015 us=453125 OPTIONS IMPORT: timers and/or timeouts modified
Mon Apr 20 09:29:57 2015 us=453125 OPTIONS IMPORT: --ifconfig/up options modified
Mon Apr 20 09:29:57 2015 us=453125 OPTIONS IMPORT: route options modified
Mon Apr 20 09:29:57 2015 us=453125 OPTIONS IMPORT: route-related options modified
Mon Apr 20 09:29:57 2015 us=468750 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Mon Apr 20 09:29:57 2015 us=468750 MANAGEMENT: >STATE:1429547397,ASSIGN_IP,,192.168.10.102,
Mon Apr 20 09:29:57 2015 us=468750 open_tun, tt->ipv6=0
Mon Apr 20 09:29:57 2015 us=468750 TAP-WIN32 device [Local Area Connection 2] opened: \\.\Global\{7000F5C7-74D7-46EE-9882-2718488F503A}.tap
Mon Apr 20 09:29:57 2015 us=468750 TAP-Windows Driver Version 9.21 
Mon Apr 20 09:29:57 2015 us=468750 TAP-Windows MTU=1500
Mon Apr 20 09:29:57 2015 us=468750 Notified TAP-Windows driver to set a DHCP IP/netmask of 192.168.10.102/255.255.255.0 on interface {7000F5C7-74D7-46EE-9882-2718488F503A} [DHCP-serv: 192.168.10.0, lease-time: 31536000]
Mon Apr 20 09:29:57 2015 us=468750 Successful ARP Flush on interface [14] {7000F5C7-74D7-46EE-9882-2718488F503A}
Mon Apr 20 09:29:59 2015 us=109375 TEST ROUTES: 2/2 succeeded len=1 ret=1 a=0 u/d=up
Mon Apr 20 09:29:59 2015 us=109375 C:\Windows\system32\route.exe ADD {public_ip_address} MASK 255.255.255.255 192.168.1.50
Mon Apr 20 09:29:59 2015 us=109375 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Mon Apr 20 09:29:59 2015 us=125000 C:\Windows\system32\route.exe DELETE 0.0.0.0 MASK 0.0.0.0 192.168.1.50
Mon Apr 20 09:29:59 2015 us=125000 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Mon Apr 20 09:29:59 2015 us=156250 C:\Windows\system32\route.exe ADD 0.0.0.0 MASK 0.0.0.0 192.168.10.100
Mon Apr 20 09:29:59 2015 us=156250 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Mon Apr 20 09:29:59 2015 us=218750 MANAGEMENT: >STATE:1429547399,ADD_ROUTES,,,
Mon Apr 20 09:29:59 2015 us=218750 C:\Windows\system32\route.exe ADD 192.168.3.0 MASK 255.255.255.0 192.168.10.100
Mon Apr 20 09:29:59 2015 us=218750 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Mon Apr 20 09:29:59 2015 us=296875 Initialization Sequence Completed
Mon Apr 20 09:29:59 2015 us=296875 MANAGEMENT: >STATE:1429547399,CONNECTED,SUCCESS,192.168.10.102,{public_ip_address}
Mon Apr 20 09:31:46 2015 us=640625 TCP/UDP: Closing socket
Mon Apr 20 09:31:46 2015 us=640625 C:\Windows\system32\route.exe DELETE 192.168.3.0 MASK 255.255.255.0 192.168.10.100
Mon Apr 20 09:31:46 2015 us=640625 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Mon Apr 20 09:31:46 2015 us=671875 C:\Windows\system32\route.exe DELETE {public_ip_address} MASK 255.255.255.255 192.168.1.50
Mon Apr 20 09:31:46 2015 us=671875 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Mon Apr 20 09:31:46 2015 us=703125 C:\Windows\system32\route.exe DELETE 0.0.0.0 MASK 0.0.0.0 192.168.10.100
Mon Apr 20 09:31:46 2015 us=703125 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Mon Apr 20 09:31:46 2015 us=734375 C:\Windows\system32\route.exe ADD 0.0.0.0 MASK 0.0.0.0 192.168.1.50
Mon Apr 20 09:31:46 2015 us=734375 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Mon Apr 20 09:31:46 2015 us=828125 Closing TUN/TAP interface
Mon Apr 20 09:31:46 2015 us=828125 SIGTERM[hard,] received, process exiting
Mon Apr 20 09:31:46 2015 us=828125 MANAGEMENT: >STATE:1429547506,EXITING,SIGTERM,,

Route table:

Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0   192.168.10.100   192.168.10.102     21
    {public_ip_address}  255.255.255.255     192.168.1.50    192.168.1.215     11    #this line is necessary for detect network by windows, when we connect by port forwarding, but with push "redirect-gateway local" is missing
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
      192.168.1.0    255.255.255.0         On-link     192.168.1.215    266
    192.168.1.215  255.255.255.255         On-link     192.168.1.215    266
    192.168.1.255  255.255.255.255         On-link     192.168.1.215    266
      192.168.3.0    255.255.255.0   192.168.10.100   192.168.10.102     21
     192.168.10.0    255.255.255.0         On-link    192.168.10.102    276
   192.168.10.102  255.255.255.255         On-link    192.168.10.102    276
   192.168.10.255  255.255.255.255         On-link    192.168.10.102    276
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link     192.168.1.215    266
        224.0.0.0        240.0.0.0         On-link    192.168.10.102    276
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link     192.168.1.215    266
  255.255.255.255  255.255.255.255         On-link    192.168.10.102    276
===========================================================================
Persistent Routes:
  None

Connected directly to local IP
Log:

Mon Apr 20 09:33:16 2015 us=390625 Current Parameter Settings:
Mon Apr 20 09:33:16 2015 us=390625   config = 'ENA_lOC.ovpn'
Mon Apr 20 09:33:16 2015 us=390625   mode = 0
Mon Apr 20 09:33:16 2015 us=390625   show_ciphers = DISABLED
Mon Apr 20 09:33:16 2015 us=390625   show_digests = DISABLED
Mon Apr 20 09:33:16 2015 us=390625   show_engines = DISABLED
Mon Apr 20 09:33:16 2015 us=390625   genkey = DISABLED
Mon Apr 20 09:33:16 2015 us=390625   key_pass_file = '[UNDEF]'
Mon Apr 20 09:33:16 2015 us=390625   show_tls_ciphers = DISABLED
Mon Apr 20 09:33:16 2015 us=390625 Connection profiles [default]:
Mon Apr 20 09:33:16 2015 us=390625 NOTE: --mute triggered...
Mon Apr 20 09:33:16 2015 us=390625 275 variation(s) on previous 10 message(s) suppressed by --mute
Mon Apr 20 09:33:16 2015 us=390625 OpenVPN 2.3.6 i686-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Mar  4 2015
Mon Apr 20 09:33:16 2015 us=390625 library versions: OpenSSL 1.0.1l 15 Jan 2015, LZO 2.08
Enter Management Password:
Mon Apr 20 09:33:16 2015 us=390625 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25341
Mon Apr 20 09:33:16 2015 us=390625 Need hold release from management interface, waiting...
Mon Apr 20 09:33:16 2015 us=875000 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25341
Mon Apr 20 09:33:16 2015 us=984375 MANAGEMENT: CMD 'state on'
Mon Apr 20 09:33:16 2015 us=984375 MANAGEMENT: CMD 'log all on'
Mon Apr 20 09:33:16 2015 us=984375 MANAGEMENT: CMD 'hold off'
Mon Apr 20 09:33:16 2015 us=984375 MANAGEMENT: CMD 'hold release'
Mon Apr 20 09:33:20 2015 us=140625 MANAGEMENT: CMD 'password [...]'
Mon Apr 20 09:33:20 2015 us=140625 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Mon Apr 20 09:33:20 2015 us=140625 Control Channel MTU parms [ L:1573 D:138 EF:38 EB:0 ET:0 EL:0 ]
Mon Apr 20 09:33:20 2015 us=140625 Socket Buffers: R=[8192->8192] S=[8192->8192]
Mon Apr 20 09:33:20 2015 us=140625 Data Channel MTU parms [ L:1573 D:1450 EF:41 EB:4 ET:32 EL:0 ]
Mon Apr 20 09:33:20 2015 us=140625 Local Options String: 'V4,dev-type tap,link-mtu 1573,tun-mtu 1532,proto UDPv4,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Mon Apr 20 09:33:20 2015 us=140625 Expected Remote Options String: 'V4,dev-type tap,link-mtu 1573,tun-mtu 1532,proto UDPv4,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Mon Apr 20 09:33:20 2015 us=140625 Local Options hash (VER=V4): '2c50bd2c'
Mon Apr 20 09:33:20 2015 us=140625 Expected Remote Options hash (VER=V4): '0ddbb6e3'
Mon Apr 20 09:33:20 2015 us=140625 UDPv4 link local: [undef]
Mon Apr 20 09:33:20 2015 us=140625 UDPv4 link remote: [AF_INET]192.168.1.47:1194
Mon Apr 20 09:33:20 2015 us=140625 MANAGEMENT: >STATE:1429547600,WAIT,,,
Mon Apr 20 09:33:20 2015 us=187500 MANAGEMENT: >STATE:1429547600,AUTH,,,
Mon Apr 20 09:33:20 2015 us=187500 TLS: Initial packet from [AF_INET]192.168.1.47:1194, sid=89edf9fa 116e2083
Mon Apr 20 09:33:30 2015 us=125000 VERIFY OK: depth=1, C=CZ, ST=Czech Republic, L=Turnov, O=Embedded Technologies, OU=R&D, CN=Embedded Technologies CA, emailAddress=info@etech.cz
Mon Apr 20 09:33:30 2015 us=125000 Validating certificate key usage
Mon Apr 20 09:33:30 2015 us=125000 ++ Certificate has key usage  00a0, expects 00a0
Mon Apr 20 09:33:30 2015 us=125000 VERIFY KU OK
Mon Apr 20 09:33:30 2015 us=125000 Validating certificate extended key usage
Mon Apr 20 09:33:30 2015 us=125000 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Mon Apr 20 09:33:30 2015 us=125000 VERIFY EKU OK
Mon Apr 20 09:33:30 2015 us=125000 VERIFY OK: depth=0, C=CZ, L=Turnov, O=Embedded Technologies, OU=R&D, CN=192.168.1.47, emailAddress=support@etech.cz
Mon Apr 20 09:33:41 2015 us=234375 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Apr 20 09:33:41 2015 us=234375 NOTE: --mute triggered...
Mon Apr 20 09:33:41 2015 us=234375 4 variation(s) on previous 10 message(s) suppressed by --mute
Mon Apr 20 09:33:41 2015 us=234375 [192.168.1.47] Peer Connection Initiated with [AF_INET]192.168.1.47:1194
Mon Apr 20 09:33:42 2015 us=500000 MANAGEMENT: >STATE:1429547622,GET_CONFIG,,,
Mon Apr 20 09:33:43 2015 us=765625 SENT CONTROL [192.168.1.47]: 'PUSH_REQUEST' (status=1)
Mon Apr 20 09:33:43 2015 us=765625 PUSH: Received control message: 'PUSH_REPLY,route-gateway 192.168.10.100,route 192.168.3.0 255.255.255.0,redirect-gateway autolocal,ping 30,ping-restart 120,ifconfig 192.168.10.101 255.255.255.0'
Mon Apr 20 09:33:43 2015 us=765625 OPTIONS IMPORT: timers and/or timeouts modified
Mon Apr 20 09:33:43 2015 us=765625 OPTIONS IMPORT: --ifconfig/up options modified
Mon Apr 20 09:33:43 2015 us=765625 OPTIONS IMPORT: route options modified
Mon Apr 20 09:33:43 2015 us=765625 OPTIONS IMPORT: route-related options modified
Mon Apr 20 09:33:43 2015 us=781250 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Mon Apr 20 09:33:43 2015 us=781250 MANAGEMENT: >STATE:1429547623,ASSIGN_IP,,192.168.10.101,
Mon Apr 20 09:33:43 2015 us=781250 open_tun, tt->ipv6=0
Mon Apr 20 09:33:43 2015 us=781250 TAP-WIN32 device [Local Area Connection 2] opened: \\.\Global\{7000F5C7-74D7-46EE-9882-2718488F503A}.tap
Mon Apr 20 09:33:43 2015 us=781250 TAP-Windows Driver Version 9.21 
Mon Apr 20 09:33:43 2015 us=781250 TAP-Windows MTU=1500
Mon Apr 20 09:33:43 2015 us=781250 Notified TAP-Windows driver to set a DHCP IP/netmask of 192.168.10.101/255.255.255.0 on interface {7000F5C7-74D7-46EE-9882-2718488F503A} [DHCP-serv: 192.168.10.0, lease-time: 31536000]
Mon Apr 20 09:33:43 2015 us=781250 Successful ARP Flush on interface [14] {7000F5C7-74D7-46EE-9882-2718488F503A}
Mon Apr 20 09:33:45 2015 us=312500 TEST ROUTES: 2/2 succeeded len=1 ret=1 a=0 u/d=up
Mon Apr 20 09:33:45 2015 us=312500 C:\Windows\system32\route.exe ADD 192.168.1.47 MASK 255.255.255.255 192.168.1.50 IF 11
Mon Apr 20 09:33:45 2015 us=312500 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Mon Apr 20 09:33:45 2015 us=328125 C:\Windows\system32\route.exe DELETE 0.0.0.0 MASK 0.0.0.0 192.168.1.50
Mon Apr 20 09:33:45 2015 us=328125 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Mon Apr 20 09:33:45 2015 us=359375 C:\Windows\system32\route.exe ADD 0.0.0.0 MASK 0.0.0.0 192.168.10.100
Mon Apr 20 09:33:45 2015 us=359375 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Mon Apr 20 09:33:45 2015 us=437500 MANAGEMENT: >STATE:1429547625,ADD_ROUTES,,,
Mon Apr 20 09:33:45 2015 us=437500 C:\Windows\system32\route.exe ADD 192.168.3.0 MASK 255.255.255.0 192.168.10.100
Mon Apr 20 09:33:45 2015 us=437500 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Mon Apr 20 09:33:45 2015 us=500000 Initialization Sequence Completed
Mon Apr 20 09:33:45 2015 us=500000 MANAGEMENT: >STATE:1429547625,CONNECTED,SUCCESS,192.168.10.101,192.168.1.47
Mon Apr 20 09:35:31 2015 us=546875 TCP/UDP: Closing socket
Mon Apr 20 09:35:31 2015 us=546875 C:\Windows\system32\route.exe DELETE 192.168.3.0 MASK 255.255.255.0 192.168.10.100
Mon Apr 20 09:35:31 2015 us=546875 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Mon Apr 20 09:35:31 2015 us=578125 C:\Windows\system32\route.exe DELETE 192.168.1.47 MASK 255.255.255.255 192.168.1.50
Mon Apr 20 09:35:31 2015 us=578125 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Mon Apr 20 09:35:31 2015 us=609375 C:\Windows\system32\route.exe DELETE 0.0.0.0 MASK 0.0.0.0 192.168.10.100
Mon Apr 20 09:35:31 2015 us=609375 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Mon Apr 20 09:35:31 2015 us=640625 C:\Windows\system32\route.exe ADD 0.0.0.0 MASK 0.0.0.0 192.168.1.50
Mon Apr 20 09:35:31 2015 us=640625 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Mon Apr 20 09:35:31 2015 us=734375 Closing TUN/TAP interface
Mon Apr 20 09:35:31 2015 us=734375 SIGTERM[hard,] received, process exiting
Mon Apr 20 09:35:31 2015 us=734375 MANAGEMENT: >STATE:1429547731,EXITING,SIGTERM,,

Route table :

Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0   192.168.10.100   192.168.10.101     21
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
      192.168.1.0    255.255.255.0         On-link     192.168.1.215    266
     192.168.1.47  255.255.255.255     192.168.1.50    192.168.1.215     11    # It should not be here. With "redirect-gateway local" it is ok.
    192.168.1.215  255.255.255.255         On-link     192.168.1.215    266
    192.168.1.255  255.255.255.255         On-link     192.168.1.215    266
      192.168.3.0    255.255.255.0   192.168.10.100   192.168.10.101     21
     192.168.10.0    255.255.255.0         On-link    192.168.10.101    276
   192.168.10.101  255.255.255.255         On-link    192.168.10.101    276
   192.168.10.255  255.255.255.255         On-link    192.168.10.101    276
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link     192.168.1.215    266
        224.0.0.0        240.0.0.0         On-link    192.168.10.101    276
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link     192.168.1.215    266
  255.255.255.255  255.255.255.255         On-link    192.168.10.101    276
===========================================================================
Persistent Routes:
  None

So we have two configurations (autolocal vs. local) and two cases (with port forwarding and local connection) - 4 combinations. With "redirect-gateway autolocal" is going traffic through port forwarded connection and inn't going through local connection (route 192.168.1.47 - local IP of OpenVPN server - should not be there ). With "redirect-gateway local" it is oposite. Local connection is ok, but in port forwarded connection is one route missing {public_ip_address}.

Thanks.

erik_etech

verb 4
dev tap
proto udp
remote-cert-tls server
tls-client
nobind
pull
route-method exe
route-delay 2
persist-key

<ca>
...
</ca>
<cert>
...
</cert>
<key>
...
</key> 

mute 10 
remote address port  #here we alternate local IP of OpenVPN server, or public domain name of office router with port forwarding to OpenVPN server.

Server config

mode server
tls-server
dev tap
port 1194
proto udp

ifconfig 192.168.10.100 255.255.255.0

push "route-gateway 192.168.10.100"
push route "192.168.3.0 255.255.255.0" #left network
push "redirect-gateway autolocal"  # !!!!!!!!! this line is going on !!!!!!!!!

ifconfig-pool 192.168.10.101 192.168.10.105 255.255.255.0

duplicate-cn
client-to-client

ca /etc/openvpn/ca.crt
cert /etc/openvpn/etech.crt
key /etc/openvpn/etech.pem
dh /etc/openvpn/dh2048.pem

persist-tun
persist-key

keepalive 30 120
user root
group root

script-security 3
up /etc/openvpn/ip-up
down /etc/openvpn/ip-down

status /var/log/openvpn/status.log
log-append /var/log/openvpn/vpn.log

verb 4
mute 20

Routed through office router (port forwarding).
Log:

Mon Apr 20 09:29:26 2015 us=734375 Current Parameter Settings:
Mon Apr 20 09:29:26 2015 us=734375   config = 'ENA.ovpn'
Mon Apr 20 09:29:26 2015 us=734375   mode = 0
Mon Apr 20 09:29:26 2015 us=734375   show_ciphers = DISABLED
Mon Apr 20 09:29:26 2015 us=734375   show_digests = DISABLED
Mon Apr 20 09:29:26 2015 us=734375   show_engines = DISABLED
Mon Apr 20 09:29:26 2015 us=734375   genkey = DISABLED
Mon Apr 20 09:29:26 2015 us=734375   key_pass_file = '[UNDEF]'
Mon Apr 20 09:29:26 2015 us=734375   show_tls_ciphers = DISABLED
Mon Apr 20 09:29:26 2015 us=734375 Connection profiles [default]:
Mon Apr 20 09:29:26 2015 us=734375 NOTE: --mute triggered...
Mon Apr 20 09:29:26 2015 us=734375 275 variation(s) on previous 10 message(s) suppressed by --mute
Mon Apr 20 09:29:26 2015 us=734375 OpenVPN 2.3.6 i686-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Mar  4 2015
Mon Apr 20 09:29:26 2015 us=734375 library versions: OpenSSL 1.0.1l 15 Jan 2015, LZO 2.08
Enter Management Password:
Mon Apr 20 09:29:26 2015 us=734375 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Mon Apr 20 09:29:26 2015 us=734375 Need hold release from management interface, waiting...
Mon Apr 20 09:29:27 2015 us=234375 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Mon Apr 20 09:29:27 2015 us=343750 MANAGEMENT: CMD 'state on'
Mon Apr 20 09:29:27 2015 us=343750 MANAGEMENT: CMD 'log all on'
Mon Apr 20 09:29:27 2015 us=343750 MANAGEMENT: CMD 'hold off'
Mon Apr 20 09:29:27 2015 us=343750 MANAGEMENT: CMD 'hold release'
Mon Apr 20 09:29:30 2015 us=890625 MANAGEMENT: CMD 'password [...]'
Mon Apr 20 09:29:30 2015 us=890625 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Mon Apr 20 09:29:30 2015 us=890625 Control Channel MTU parms [ L:1573 D:138 EF:38 EB:0 ET:0 EL:0 ]
Mon Apr 20 09:29:30 2015 us=890625 Socket Buffers: R=[8192->8192] S=[8192->8192]
Mon Apr 20 09:29:30 2015 us=890625 MANAGEMENT: >STATE:1429547370,RESOLVE,,,
Mon Apr 20 09:29:30 2015 us=906250 Data Channel MTU parms [ L:1573 D:1450 EF:41 EB:4 ET:32 EL:0 ]
Mon Apr 20 09:29:30 2015 us=906250 Local Options String: 'V4,dev-type tap,link-mtu 1573,tun-mtu 1532,proto UDPv4,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Mon Apr 20 09:29:30 2015 us=906250 Expected Remote Options String: 'V4,dev-type tap,link-mtu 1573,tun-mtu 1532,proto UDPv4,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Mon Apr 20 09:29:30 2015 us=906250 Local Options hash (VER=V4): '2c50bd2c'
Mon Apr 20 09:29:30 2015 us=906250 Expected Remote Options hash (VER=V4): '0ddbb6e3'
Mon Apr 20 09:29:30 2015 us=906250 UDPv4 link local: [undef]
Mon Apr 20 09:29:30 2015 us=906250 UDPv4 link remote: [AF_INET]{public_ip_address}:4594
Mon Apr 20 09:29:30 2015 us=906250 MANAGEMENT: >STATE:1429547370,WAIT,,,
Mon Apr 20 09:29:30 2015 us=921875 MANAGEMENT: >STATE:1429547370,AUTH,,,
Mon Apr 20 09:29:30 2015 us=921875 TLS: Initial packet from [AF_INET]{public_ip_address}:4594, sid=ea26386c b4b9c0b3
Mon Apr 20 09:29:41 2015 us=156250 VERIFY OK: depth=1, C=CZ, ST=Czech Republic, L=Turnov, O=Embedded Technologies, OU=R&D, CN=Embedded Technologies CA, emailAddress=info@etech.cz
Mon Apr 20 09:29:41 2015 us=156250 Validating certificate key usage
Mon Apr 20 09:29:41 2015 us=156250 ++ Certificate has key usage  00a0, expects 00a0
Mon Apr 20 09:29:41 2015 us=156250 VERIFY KU OK
Mon Apr 20 09:29:41 2015 us=156250 Validating certificate extended key usage
Mon Apr 20 09:29:41 2015 us=156250 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Mon Apr 20 09:29:41 2015 us=156250 VERIFY EKU OK
Mon Apr 20 09:29:41 2015 us=156250 VERIFY OK: depth=0, C=CZ, L=Turnov, O=Embedded Technologies, OU=R&D, CN=192.168.1.47, emailAddress=support@etech.cz
Mon Apr 20 09:29:55 2015 us=328125 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Apr 20 09:29:55 2015 us=328125 NOTE: --mute triggered...
Mon Apr 20 09:29:55 2015 us=328125 4 variation(s) on previous 10 message(s) suppressed by --mute
Mon Apr 20 09:29:55 2015 us=328125 [192.168.1.47] Peer Connection Initiated with [AF_INET]{public_ip_address}:4594
Mon Apr 20 09:29:56 2015 us=390625 MANAGEMENT: >STATE:1429547396,GET_CONFIG,,,
Mon Apr 20 09:29:57 2015 us=453125 SENT CONTROL [192.168.1.47]: 'PUSH_REQUEST' (status=1)
Mon Apr 20 09:29:57 2015 us=453125 PUSH: Received control message: 'PUSH_REPLY,route-gateway 192.168.10.100,route 192.168.3.0 255.255.255.0,redirect-gateway autolocal,ping 30,ping-restart 120,ifconfig 192.168.10.102 255.255.255.0'
Mon Apr 20 09:29:57 2015 us=453125 OPTIONS IMPORT: timers and/or timeouts modified
Mon Apr 20 09:29:57 2015 us=453125 OPTIONS IMPORT: --ifconfig/up options modified
Mon Apr 20 09:29:57 2015 us=453125 OPTIONS IMPORT: route options modified
Mon Apr 20 09:29:57 2015 us=453125 OPTIONS IMPORT: route-related options modified
Mon Apr 20 09:29:57 2015 us=468750 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Mon Apr 20 09:29:57 2015 us=468750 MANAGEMENT: >STATE:1429547397,ASSIGN_IP,,192.168.10.102,
Mon Apr 20 09:29:57 2015 us=468750 open_tun, tt->ipv6=0
Mon Apr 20 09:29:57 2015 us=468750 TAP-WIN32 device [Local Area Connection 2] opened: \\.\Global\{7000F5C7-74D7-46EE-9882-2718488F503A}.tap
Mon Apr 20 09:29:57 2015 us=468750 TAP-Windows Driver Version 9.21 
Mon Apr 20 09:29:57 2015 us=468750 TAP-Windows MTU=1500
Mon Apr 20 09:29:57 2015 us=468750 Notified TAP-Windows driver to set a DHCP IP/netmask of 192.168.10.102/255.255.255.0 on interface {7000F5C7-74D7-46EE-9882-2718488F503A} [DHCP-serv: 192.168.10.0, lease-time: 31536000]
Mon Apr 20 09:29:57 2015 us=468750 Successful ARP Flush on interface [14] {7000F5C7-74D7-46EE-9882-2718488F503A}
Mon Apr 20 09:29:59 2015 us=109375 TEST ROUTES: 2/2 succeeded len=1 ret=1 a=0 u/d=up
Mon Apr 20 09:29:59 2015 us=109375 C:\Windows\system32\route.exe ADD {public_ip_address} MASK 255.255.255.255 192.168.1.50
Mon Apr 20 09:29:59 2015 us=109375 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Mon Apr 20 09:29:59 2015 us=125000 C:\Windows\system32\route.exe DELETE 0.0.0.0 MASK 0.0.0.0 192.168.1.50
Mon Apr 20 09:29:59 2015 us=125000 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Mon Apr 20 09:29:59 2015 us=156250 C:\Windows\system32\route.exe ADD 0.0.0.0 MASK 0.0.0.0 192.168.10.100
Mon Apr 20 09:29:59 2015 us=156250 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Mon Apr 20 09:29:59 2015 us=218750 MANAGEMENT: >STATE:1429547399,ADD_ROUTES,,,
Mon Apr 20 09:29:59 2015 us=218750 C:\Windows\system32\route.exe ADD 192.168.3.0 MASK 255.255.255.0 192.168.10.100
Mon Apr 20 09:29:59 2015 us=218750 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Mon Apr 20 09:29:59 2015 us=296875 Initialization Sequence Completed
Mon Apr 20 09:29:59 2015 us=296875 MANAGEMENT: >STATE:1429547399,CONNECTED,SUCCESS,192.168.10.102,{public_ip_address}
Mon Apr 20 09:31:46 2015 us=640625 TCP/UDP: Closing socket
Mon Apr 20 09:31:46 2015 us=640625 C:\Windows\system32\route.exe DELETE 192.168.3.0 MASK 255.255.255.0 192.168.10.100
Mon Apr 20 09:31:46 2015 us=640625 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Mon Apr 20 09:31:46 2015 us=671875 C:\Windows\system32\route.exe DELETE {public_ip_address} MASK 255.255.255.255 192.168.1.50
Mon Apr 20 09:31:46 2015 us=671875 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Mon Apr 20 09:31:46 2015 us=703125 C:\Windows\system32\route.exe DELETE 0.0.0.0 MASK 0.0.0.0 192.168.10.100
Mon Apr 20 09:31:46 2015 us=703125 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Mon Apr 20 09:31:46 2015 us=734375 C:\Windows\system32\route.exe ADD 0.0.0.0 MASK 0.0.0.0 192.168.1.50
Mon Apr 20 09:31:46 2015 us=734375 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Mon Apr 20 09:31:46 2015 us=828125 Closing TUN/TAP interface
Mon Apr 20 09:31:46 2015 us=828125 SIGTERM[hard,] received, process exiting
Mon Apr 20 09:31:46 2015 us=828125 MANAGEMENT: >STATE:1429547506,EXITING,SIGTERM,,

Route table:

Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0   192.168.10.100   192.168.10.102     21
    {public_ip_address}  255.255.255.255     192.168.1.50    192.168.1.215     11    #this line is necessary, but with push "redirect-gateway local" is missing
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
      192.168.1.0    255.255.255.0         On-link     192.168.1.215    266
    192.168.1.215  255.255.255.255         On-link     192.168.1.215    266
    192.168.1.255  255.255.255.255         On-link     192.168.1.215    266
      192.168.3.0    255.255.255.0   192.168.10.100   192.168.10.102     21
     192.168.10.0    255.255.255.0         On-link    192.168.10.102    276
   192.168.10.102  255.255.255.255         On-link    192.168.10.102    276
   192.168.10.255  255.255.255.255         On-link    192.168.10.102    276
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link     192.168.1.215    266
        224.0.0.0        240.0.0.0         On-link    192.168.10.102    276
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link     192.168.1.215    266
  255.255.255.255  255.255.255.255         On-link    192.168.10.102    276
===========================================================================
Persistent Routes:
  None

Connected directly to local IP
Log:

Mon Apr 20 09:33:16 2015 us=390625 Current Parameter Settings:
Mon Apr 20 09:33:16 2015 us=390625   config = 'ENA_lOC.ovpn'
Mon Apr 20 09:33:16 2015 us=390625   mode = 0
Mon Apr 20 09:33:16 2015 us=390625   show_ciphers = DISABLED
Mon Apr 20 09:33:16 2015 us=390625   show_digests = DISABLED
Mon Apr 20 09:33:16 2015 us=390625   show_engines = DISABLED
Mon Apr 20 09:33:16 2015 us=390625   genkey = DISABLED
Mon Apr 20 09:33:16 2015 us=390625   key_pass_file = '[UNDEF]'
Mon Apr 20 09:33:16 2015 us=390625   show_tls_ciphers = DISABLED
Mon Apr 20 09:33:16 2015 us=390625 Connection profiles [default]:
Mon Apr 20 09:33:16 2015 us=390625 NOTE: --mute triggered...
Mon Apr 20 09:33:16 2015 us=390625 275 variation(s) on previous 10 message(s) suppressed by --mute
Mon Apr 20 09:33:16 2015 us=390625 OpenVPN 2.3.6 i686-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Mar  4 2015
Mon Apr 20 09:33:16 2015 us=390625 library versions: OpenSSL 1.0.1l 15 Jan 2015, LZO 2.08
Enter Management Password:
Mon Apr 20 09:33:16 2015 us=390625 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25341
Mon Apr 20 09:33:16 2015 us=390625 Need hold release from management interface, waiting...
Mon Apr 20 09:33:16 2015 us=875000 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25341
Mon Apr 20 09:33:16 2015 us=984375 MANAGEMENT: CMD 'state on'
Mon Apr 20 09:33:16 2015 us=984375 MANAGEMENT: CMD 'log all on'
Mon Apr 20 09:33:16 2015 us=984375 MANAGEMENT: CMD 'hold off'
Mon Apr 20 09:33:16 2015 us=984375 MANAGEMENT: CMD 'hold release'
Mon Apr 20 09:33:20 2015 us=140625 MANAGEMENT: CMD 'password [...]'
Mon Apr 20 09:33:20 2015 us=140625 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Mon Apr 20 09:33:20 2015 us=140625 Control Channel MTU parms [ L:1573 D:138 EF:38 EB:0 ET:0 EL:0 ]
Mon Apr 20 09:33:20 2015 us=140625 Socket Buffers: R=[8192->8192] S=[8192->8192]
Mon Apr 20 09:33:20 2015 us=140625 Data Channel MTU parms [ L:1573 D:1450 EF:41 EB:4 ET:32 EL:0 ]
Mon Apr 20 09:33:20 2015 us=140625 Local Options String: 'V4,dev-type tap,link-mtu 1573,tun-mtu 1532,proto UDPv4,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Mon Apr 20 09:33:20 2015 us=140625 Expected Remote Options String: 'V4,dev-type tap,link-mtu 1573,tun-mtu 1532,proto UDPv4,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Mon Apr 20 09:33:20 2015 us=140625 Local Options hash (VER=V4): '2c50bd2c'
Mon Apr 20 09:33:20 2015 us=140625 Expected Remote Options hash (VER=V4): '0ddbb6e3'
Mon Apr 20 09:33:20 2015 us=140625 UDPv4 link local: [undef]
Mon Apr 20 09:33:20 2015 us=140625 UDPv4 link remote: [AF_INET]192.168.1.47:1194
Mon Apr 20 09:33:20 2015 us=140625 MANAGEMENT: >STATE:1429547600,WAIT,,,
Mon Apr 20 09:33:20 2015 us=187500 MANAGEMENT: >STATE:1429547600,AUTH,,,
Mon Apr 20 09:33:20 2015 us=187500 TLS: Initial packet from [AF_INET]192.168.1.47:1194, sid=89edf9fa 116e2083
Mon Apr 20 09:33:30 2015 us=125000 VERIFY OK: depth=1, C=CZ, ST=Czech Republic, L=Turnov, O=Embedded Technologies, OU=R&D, CN=Embedded Technologies CA, emailAddress=info@etech.cz
Mon Apr 20 09:33:30 2015 us=125000 Validating certificate key usage
Mon Apr 20 09:33:30 2015 us=125000 ++ Certificate has key usage  00a0, expects 00a0
Mon Apr 20 09:33:30 2015 us=125000 VERIFY KU OK
Mon Apr 20 09:33:30 2015 us=125000 Validating certificate extended key usage
Mon Apr 20 09:33:30 2015 us=125000 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Mon Apr 20 09:33:30 2015 us=125000 VERIFY EKU OK
Mon Apr 20 09:33:30 2015 us=125000 VERIFY OK: depth=0, C=CZ, L=Turnov, O=Embedded Technologies, OU=R&D, CN=192.168.1.47, emailAddress=support@etech.cz
Mon Apr 20 09:33:41 2015 us=234375 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Apr 20 09:33:41 2015 us=234375 NOTE: --mute triggered...
Mon Apr 20 09:33:41 2015 us=234375 4 variation(s) on previous 10 message(s) suppressed by --mute
Mon Apr 20 09:33:41 2015 us=234375 [192.168.1.47] Peer Connection Initiated with [AF_INET]192.168.1.47:1194
Mon Apr 20 09:33:42 2015 us=500000 MANAGEMENT: >STATE:1429547622,GET_CONFIG,,,
Mon Apr 20 09:33:43 2015 us=765625 SENT CONTROL [192.168.1.47]: 'PUSH_REQUEST' (status=1)
Mon Apr 20 09:33:43 2015 us=765625 PUSH: Received control message: 'PUSH_REPLY,route-gateway 192.168.10.100,route 192.168.3.0 255.255.255.0,redirect-gateway autolocal,ping 30,ping-restart 120,ifconfig 192.168.10.101 255.255.255.0'
Mon Apr 20 09:33:43 2015 us=765625 OPTIONS IMPORT: timers and/or timeouts modified
Mon Apr 20 09:33:43 2015 us=765625 OPTIONS IMPORT: --ifconfig/up options modified
Mon Apr 20 09:33:43 2015 us=765625 OPTIONS IMPORT: route options modified
Mon Apr 20 09:33:43 2015 us=765625 OPTIONS IMPORT: route-related options modified
Mon Apr 20 09:33:43 2015 us=781250 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Mon Apr 20 09:33:43 2015 us=781250 MANAGEMENT: >STATE:1429547623,ASSIGN_IP,,192.168.10.101,
Mon Apr 20 09:33:43 2015 us=781250 open_tun, tt->ipv6=0
Mon Apr 20 09:33:43 2015 us=781250 TAP-WIN32 device [Local Area Connection 2] opened: \\.\Global\{7000F5C7-74D7-46EE-9882-2718488F503A}.tap
Mon Apr 20 09:33:43 2015 us=781250 TAP-Windows Driver Version 9.21 
Mon Apr 20 09:33:43 2015 us=781250 TAP-Windows MTU=1500
Mon Apr 20 09:33:43 2015 us=781250 Notified TAP-Windows driver to set a DHCP IP/netmask of 192.168.10.101/255.255.255.0 on interface {7000F5C7-74D7-46EE-9882-2718488F503A} [DHCP-serv: 192.168.10.0, lease-time: 31536000]
Mon Apr 20 09:33:43 2015 us=781250 Successful ARP Flush on interface [14] {7000F5C7-74D7-46EE-9882-2718488F503A}
Mon Apr 20 09:33:45 2015 us=312500 TEST ROUTES: 2/2 succeeded len=1 ret=1 a=0 u/d=up
Mon Apr 20 09:33:45 2015 us=312500 C:\Windows\system32\route.exe ADD 192.168.1.47 MASK 255.255.255.255 192.168.1.50 IF 11
Mon Apr 20 09:33:45 2015 us=312500 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Mon Apr 20 09:33:45 2015 us=328125 C:\Windows\system32\route.exe DELETE 0.0.0.0 MASK 0.0.0.0 192.168.1.50
Mon Apr 20 09:33:45 2015 us=328125 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Mon Apr 20 09:33:45 2015 us=359375 C:\Windows\system32\route.exe ADD 0.0.0.0 MASK 0.0.0.0 192.168.10.100
Mon Apr 20 09:33:45 2015 us=359375 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Mon Apr 20 09:33:45 2015 us=437500 MANAGEMENT: >STATE:1429547625,ADD_ROUTES,,,
Mon Apr 20 09:33:45 2015 us=437500 C:\Windows\system32\route.exe ADD 192.168.3.0 MASK 255.255.255.0 192.168.10.100
Mon Apr 20 09:33:45 2015 us=437500 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Mon Apr 20 09:33:45 2015 us=500000 Initialization Sequence Completed
Mon Apr 20 09:33:45 2015 us=500000 MANAGEMENT: >STATE:1429547625,CONNECTED,SUCCESS,192.168.10.101,192.168.1.47
Mon Apr 20 09:35:31 2015 us=546875 TCP/UDP: Closing socket
Mon Apr 20 09:35:31 2015 us=546875 C:\Windows\system32\route.exe DELETE 192.168.3.0 MASK 255.255.255.0 192.168.10.100
Mon Apr 20 09:35:31 2015 us=546875 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Mon Apr 20 09:35:31 2015 us=578125 C:\Windows\system32\route.exe DELETE 192.168.1.47 MASK 255.255.255.255 192.168.1.50
Mon Apr 20 09:35:31 2015 us=578125 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Mon Apr 20 09:35:31 2015 us=609375 C:\Windows\system32\route.exe DELETE 0.0.0.0 MASK 0.0.0.0 192.168.10.100
Mon Apr 20 09:35:31 2015 us=609375 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Mon Apr 20 09:35:31 2015 us=640625 C:\Windows\system32\route.exe ADD 0.0.0.0 MASK 0.0.0.0 192.168.1.50
Mon Apr 20 09:35:31 2015 us=640625 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Mon Apr 20 09:35:31 2015 us=734375 Closing TUN/TAP interface
Mon Apr 20 09:35:31 2015 us=734375 SIGTERM[hard,] received, process exiting
Mon Apr 20 09:35:31 2015 us=734375 MANAGEMENT: >STATE:1429547731,EXITING,SIGTERM,,

Route table:

Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0   192.168.10.100   192.168.10.101     21
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
      192.168.1.0    255.255.255.0         On-link     192.168.1.215    266
     192.168.1.47  255.255.255.255     192.168.1.50    192.168.1.215     11    # It should not be here. With "redirect-gateway local" it is ok.
    192.168.1.215  255.255.255.255         On-link     192.168.1.215    266
    192.168.1.255  255.255.255.255         On-link     192.168.1.215    266
      192.168.3.0    255.255.255.0   192.168.10.100   192.168.10.101     21
     192.168.10.0    255.255.255.0         On-link    192.168.10.101    276
   192.168.10.101  255.255.255.255         On-link    192.168.10.101    276
   192.168.10.255  255.255.255.255         On-link    192.168.10.101    276
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link     192.168.1.215    266
        224.0.0.0        240.0.0.0         On-link    192.168.10.101    276
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link     192.168.1.215    266
  255.255.255.255  255.255.255.255         On-link    192.168.10.101    276
===========================================================================
Persistent Routes:
  None

So we have two configurations (local, autolocal) and two cases with remote address (local subnet and forvarded from office router), what is 4 combinations. With "redirect-gateway autolocal" traffic goes through port forwarded connection and don't going through local connection (route 192.168.1.47 - local IP of OpenVPN server should not be there). With "redirect-gateway local" it is oposite. Local connection is ok, but in port forwarded connection is one route missing {public_ip_address of office router}.

Thanks

dferbas

Hi, we already posted configs, but neither they were publish, neither we received a response.

Today we came back to this problem, we compiled the OpenVPN client on Ubuntu and we recognized, it works here.
So it seems it does not work on Windows platform, even the autolocal routine is implemented for WIN32.

Traffic

Sorry for the delay in Moderation ..

dferbas wrotewe compiled the OpenVPN client on Ubuntu and we recognized, it works here.
So it seems it does not work on Windows platform, even the autolocal routine is implemented for WIN32

Thanks for your feedback.

From a read-through of your thread .. possibly you have isolated a use-case which does not conform with how OpenVPN has implemented this flag .. also Windows Firewall is a complex beast. If you would like to raise a detailed bug report (new login id may be required) we would be interested to understand the full details.

Regards.

selvanair

Hi,

The handling of autolocal on Windows was broken until very recently (remote always defaulted to be non-local due to a bug).

You have to either use the git-master or wait for the release of 2.3.9.

Selva

selvanair

erik_etech wrote In documentation is mentioned flag autolocal, but it doesn't work.

On windows the autolocal handling was broken until recently (late Sept 2015). A fix is in git-master and will be in the next release (2.3.9).

Selva