Routing mode works fine, but this office got a new cable modem put in that (I kid you not) can't setup a static route in the stupid neutered Comcast Business cusadmin/highspeed interface. Everytime you try, it says "Something went wrong, please try again later." Comcast tech support says "We're not trained in that." and "You must be doing it wrong."
Moving on.
I've gone through the OpenVPN checklist on the error:
A perimeter firewall is. . .
Nope.
A software firewall running on the OpenVPN server machine itself is filtering incoming connections on port 1194.
Nope.
A NAT gateway on the server's network does not have a port forward rule for TCP/UDP 1194 to the internal address of the OpenVPN server machine.
Nope.
The OpenVPN client config does not have the correct server address in its config file. The remote directive in the client config file must point to either the server itself or the public IP address of the server network's gateway.
Nope.
Another possible cause is that the windows firewall is blocking access for the openvpn.exe binary. You may need to whitelist (add it to the "Exceptions" list) it for OpenVPN to work.
No Windows involved.
My client config
remote vpn.foo.bar 1194
client
dev tap
proto udp
resolv-retry infinite
nobind
persist-key
persist-tun
#cert/key files
comp-lzo
verb 3
auth-user-pass
Server config file
port 1194
proto udp
dev tap0
dev-node tap-bridge
#cert/key file paths
server-bridge 10.1.10.9 255.255.255.0 10.1.10.110 10.1.10.150
ifconfig-pool-persist /var/run/openvpn-ipp.cache
push "route 10.1.10.0 255.255.255.0"
push "dhcp-option DNS 10.1.10.9"
push "dhcp-option DOMAIN foo.bar"
keepalive 10 220
comp-lzo
persist-key
persist-tap
status /var/log/openvpn-status.log
verb 3
plugin /usr/lib64/openvpn/plugins/openvpn-plugin-auth-pam.so "login login USERNAME password PASSWORD"
duplicate-cn
client-to-client
client-config-dir /etc/openvpn/static
Output of ifconfig
br0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 10.1.10.9 netmask 255.255.255.0 broadcast 10.1.10.255
inet6 2601:7:700:ce00:8484:a0ff:fe7f:f075 prefixlen 64 scopeid 0x0<global>
inet6 fe80::8484:a0ff:fe7f:f075 prefixlen 64 scopeid 0x20<link>
ether 86:84:a0:7f:f0:75 txqueuelen 0 (Ethernet)
RX packets 144 bytes 25711 (25.1 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 117 bytes 20205 (19.7 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10<host>
loop txqueuelen 0 (Local Loopback)
RX packets 66 bytes 5830 (5.6 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 66 bytes 5830 (5.6 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
p5p1: flags=4419<UP,BROADCAST,RUNNING,PROMISC,MULTICAST> mtu 1500
inet 10.1.10.9 netmask 255.255.255.0 broadcast 10.1.10.255
inet6 fe80::d63d:7eff:fe3f:d858 prefixlen 64 scopeid 0x20<link>
ether d4:3d:7e:3f:d8:58 txqueuelen 1000 (Ethernet)
RX packets 193 bytes 41727 (40.7 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 159 bytes 24978 (24.3 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
tap0: flags=4355<UP,BROADCAST,PROMISC,MULTICAST> mtu 1500
inet6 fe80::8484:a0ff:fe7f:f075 prefixlen 64 scopeid 0x20<link>
ether 86:84:a0:7f:f0:75 txqueuelen 100 (Ethernet)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 8 overruns 0 carrier 0 collisions 0
