Hello everyone, I hope you can help me..also linking to some more guides and examples. This is my configuration * Win 7 pc (192.168.1.19) with Virtualboxed Win2012 R2 Essentials; on W2012 I'm trying to setup an OpenVPN server * I setup the VM network as "bridged adapter", so it's getting an IP (192.168.1.8) in the same subnet of Win7 host * I have a "Technicolor AG plus VDNT-S VDSL2" modem/router (fttc; I live in Italy); not reachable from the internet with a static IP address, but I configured DynDNS and it seems to work (it says "Active" on dyndns.it page) What I would like to do, is to set up a VPN server on the VM, and connect from my parent's home. I have followed this guide: https://community.openvpn.net/openvpn/wiki/Easy_Windows_Guide and generated the server/client certificates which this evening I will copy on a Win7 client at my parents'. I have left everything as defaults such as "server" and "dev tun" (so I suppose I'll go with routing instead of eth bridging) Some questions: * firewall: do I have to open communications to UDP 1194 on the W2012 software firewall? * port forwarding: I went on my router (192.168.1.1) and set up the following: [img]http://666kb.com/i/d38swhhiomjhpbinh.jpg[/img] In my mind, if it worked, it would send all packets sent to udp port 1194 to my VM (I know the guide says [size=85][/size] so I might change the VM IP to like 192.168.1.234) Now, my doubts come after reading more at https://openvpn.net/index.php/open-source/documentation/howto.html, where it says, in section "Editing the server configuration file", that "[size=85]The sample server configuration file is an ideal starting point for an OpenVPN server configuration. It will create a VPN using a virtual TUN network interface (for routing), will listen for client connections on UDP port 1194 (OpenVPN's official port number), and [u]distribute virtual addresses to connecting clients from the 10.8.0.0/24 subnet[/u].[/size]" What was in my mind was going at my parents', intalling OpenVPN on the client notebook (which might very well be on a local 192.168.1.X/24), copying the client stuff (ca.crt, client1.crt, client1.key, client1.ovpn) in the /config/ folder, start up the software on both server & client, and off you go. Questions: * what do I have to do with that 10.8.0.0/24 ? Is it automated or do I have to make some other configurations? * anything I have forgotten / I wrongly assumed here? Thanks!

[quote="xlepws"]what do I have to do with that 10.8.0.0/24 ? Is it automated or do I have to make some other configurations?[/quote]If your configs are setup correctly the clients will automatically be assigned an IP address from that range on their VPN adapter. [quote="xlepws"]anything I have forgotten / I wrongly assumed here?[/quote]If you can avoid it :arrow: [u]Never[/u] use 192.168.0.0/24 or 192.168.1.0/24 (or other common subnets) for your OpenVPN Server LAN :!: Also, using OpenVPN Access Server on a VM should be no problem, I use it on an Ubuntu VirtualBox.

Thank you. [size=85]I might have posted in the wrong section (maybe https://forums.openvpn.net/configuration-f6.html was more appropriate)?[/size] Anyway..since I was having difficulties using the VM, I decided to make it simpler and set up a VPN Server on my Win7 machine directly, using the "bridge" option. As I said in my last post I copied the client1 files on the client machine..tried a connection and..something went wrong Here is the SERVER log: [code]Mon Nov 02 22:33:48 2015 OpenVPN 2.3.8 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Aug 4 2015 Mon Nov 02 22:33:48 2015 library versions: OpenSSL 1.0.1p 9 Jul 2015, LZO 2.08 Enter Management Password: Mon Nov 02 22:33:48 2015 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340 Mon Nov 02 22:33:48 2015 Need hold release from management interface, waiting... Mon Nov 02 22:33:48 2015 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340 Mon Nov 02 22:33:48 2015 MANAGEMENT: CMD 'state on' Mon Nov 02 22:33:48 2015 MANAGEMENT: CMD 'log all on' Mon Nov 02 22:33:48 2015 MANAGEMENT: CMD 'hold off' Mon Nov 02 22:33:48 2015 MANAGEMENT: CMD 'hold release' Mon Nov 02 22:33:48 2015 NOTE: when bridging your LAN adapter with the TAP adapter, note that the new bridge adapter will often take on its own IP address that is different from what the LAN adapter was previously set to Mon Nov 02 22:33:48 2015 NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet. Mon Nov 02 22:33:48 2015 Diffie-Hellman initialized with 1024 bit key Mon Nov 02 22:33:48 2015 Control Channel Authentication: using 'key.txt' as a OpenVPN static key file Mon Nov 02 22:33:48 2015 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication Mon Nov 02 22:33:48 2015 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication Mon Nov 02 22:33:48 2015 Socket Buffers: R=[8192->8192] S=[64512->64512] Mon Nov 02 22:33:48 2015 open_tun, tt->ipv6=0 Mon Nov 02 22:33:48 2015 TAP-WIN32 device [OpenVPN] opened: \\.\Global\{39515606-475C-4784-9991-92DFECA048F3}.tap Mon Nov 02 22:33:48 2015 TAP-Windows Driver Version 9.21 Mon Nov 02 22:33:48 2015 Sleeping for 10 seconds... Mon Nov 02 22:33:58 2015 NOTE: FlushIpNetTable failed on interface [30] {39515606-475C-4784-9991-92DFECA048F3} (status=1168) : Element not found. Mon Nov 02 22:33:58 2015 UDPv4 link local (bound): [undef] Mon Nov 02 22:33:58 2015 UDPv4 link remote: [undef] Mon Nov 02 22:33:58 2015 MULTI: multi_init called, r=256 v=256 Mon Nov 02 22:33:58 2015 IFCONFIG POOL: base=192.168.1.50 size=51, ipv6=0 Mon Nov 02 22:33:58 2015 ifconfig_pool_read(), in='client1,192.168.1.50', TODO: IPv6 Mon Nov 02 22:33:58 2015 succeeded -> ifconfig_pool_set() Mon Nov 02 22:33:58 2015 IFCONFIG POOL LIST Mon Nov 02 22:33:58 2015 client1,192.168.1.50 Mon Nov 02 22:33:58 2015 Initialization Sequence Completed Mon Nov 02 22:33:58 2015 MANAGEMENT: >STATE:1446500038,CONNECTED,SUCCESS,, Mon Nov 02 22:34:08 2015 93.34.147.196:14509 TLS: Initial packet from [AF_INET]93.34.147.196:14509, sid=d2ea729e 0be3688a Mon Nov 02 22:34:08 2015 93.34.147.196:14509 VERIFY OK: depth=1, C=IT, ST=IT, L=Milan, O=my_org, OU=my_ou, CN=OpenVPN-CA, name=my_name, emailAddress=mail@host.domain Mon Nov 02 22:34:08 2015 93.34.147.196:14509 VERIFY OK: depth=0, C=IT, ST=IT, L=Milan, O=my_org, OU=my_ou, CN=client1, name=my_name, emailAddress=mail@host.domain Mon Nov 02 22:34:08 2015 93.34.147.196:14509 WARNING: 'dev-type' is used inconsistently, local='dev-type tap', remote='dev-type tun' Mon Nov 02 22:34:08 2015 93.34.147.196:14509 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1574', remote='link-mtu 1542' Mon Nov 02 22:34:08 2015 93.34.147.196:14509 WARNING: 'tun-mtu' is used inconsistently, local='tun-mtu 1532', remote='tun-mtu 1500' Mon Nov 02 22:34:08 2015 93.34.147.196:14509 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key Mon Nov 02 22:34:08 2015 93.34.147.196:14509 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication Mon Nov 02 22:34:08 2015 93.34.147.196:14509 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key Mon Nov 02 22:34:08 2015 93.34.147.196:14509 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication Mon Nov 02 22:34:08 2015 93.34.147.196:14509 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 1024 bit RSA Mon Nov 02 22:34:08 2015 93.34.147.196:14509 [client1] Peer Connection Initiated with [AF_INET]93.34.147.196:14509 Mon Nov 02 22:34:08 2015 client1/93.34.147.196:14509 MULTI_sva: pool returned IPv4=192.168.1.50, IPv6=(Not enabled) Mon Nov 02 22:34:10 2015 client1/93.34.147.196:14509 PUSH: Received control message: 'PUSH_REQUEST' Mon Nov 02 22:34:10 2015 client1/93.34.147.196:14509 send_push_reply(): safe_cap=940 Mon Nov 02 22:34:10 2015 client1/93.34.147.196:14509 SENT CONTROL [client1]: 'PUSH_REPLY,route-gateway 192.168.1.45,ping 10,ping-restart 120,ifconfig 192.168.1.50 255.255.255.0' (status=1) Mon Nov 02 22:38:11 2015 client1/93.34.147.196:14509 [client1] Inactivity timeout (--ping-restart), restarting Mon Nov 02 22:38:11 2015 client1/93.34.147.196:14509 SIGUSR1[soft,ping-restart] received, client-instance restarting Tue Nov 03 00:40:15 2015 MANAGEMENT: Client disconnected Tue Nov 03 08:49:36 2015 TUN/TAP I/O operation aborted, exiting Tue Nov 03 08:49:36 2015 Exiting due to fatal error Tue Nov 03 08:49:36 2015 Closing TUN/TAP interface[/code] CLIENT LOG [code]Mon Nov 02 22:34:07 2015 OpenVPN 2.3.8 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Aug 4 2015 Mon Nov 02 22:34:07 2015 library versions: OpenSSL 1.0.1p 9 Jul 2015, LZO 2.08 Enter Management Password: Mon Nov 02 22:34:07 2015 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340 Mon Nov 02 22:34:07 2015 Need hold release from management interface, waiting... Mon Nov 02 22:34:08 2015 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340 Mon Nov 02 22:34:08 2015 MANAGEMENT: CMD 'state on' Mon Nov 02 22:34:08 2015 MANAGEMENT: CMD 'log all on' Mon Nov 02 22:34:08 2015 MANAGEMENT: CMD 'hold off' Mon Nov 02 22:34:08 2015 MANAGEMENT: CMD 'hold release' Mon Nov 02 22:34:08 2015 Control Channel Authentication: using 'key.txt' as a OpenVPN static key file Mon Nov 02 22:34:08 2015 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication Mon Nov 02 22:34:08 2015 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication Mon Nov 02 22:34:08 2015 Socket Buffers: R=[8192->8192] S=[8192->8192] Mon Nov 02 22:34:08 2015 MANAGEMENT: >STATE:1446500048,RESOLVE,,, Mon Nov 02 22:34:08 2015 UDPv4 link local: [undef] Mon Nov 02 22:34:08 2015 UDPv4 link remote: [AF_INET]87.5.128.45:1194 Mon Nov 02 22:34:08 2015 MANAGEMENT: >STATE:1446500048,WAIT,,, Mon Nov 02 22:34:08 2015 MANAGEMENT: >STATE:1446500048,AUTH,,, Mon Nov 02 22:34:08 2015 TLS: Initial packet from [AF_INET]87.5.128.45:1194, sid=552ab731 acefa450 Mon Nov 02 22:34:08 2015 VERIFY OK: depth=1, C=IT, ST=IT, L=Milan, O=my_org, OU=my_ou, CN=OpenVPN-CA, name=my_name, emailAddress=mail@host.domain Mon Nov 02 22:34:08 2015 Validating certificate key usage Mon Nov 02 22:34:08 2015 ++ Certificate has key usage 00a0, expects 00a0 Mon Nov 02 22:34:08 2015 VERIFY KU OK Mon Nov 02 22:34:08 2015 Validating certificate extended key usage Mon Nov 02 22:34:08 2015 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication Mon Nov 02 22:34:08 2015 VERIFY EKU OK Mon Nov 02 22:34:08 2015 VERIFY OK: depth=0, C=IT, ST=IT, L=Milan, O=my_org, OU=my_ou, CN=server, name=my_name, emailAddress=mail@host.domain Mon Nov 02 22:34:08 2015 WARNING: 'dev-type' is used inconsistently, local='dev-type tun', remote='dev-type tap' Mon Nov 02 22:34:08 2015 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1542', remote='link-mtu 1574' Mon Nov 02 22:34:08 2015 WARNING: 'tun-mtu' is used inconsistently, local='tun-mtu 1500', remote='tun-mtu 1532' Mon Nov 02 22:34:08 2015 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key Mon Nov 02 22:34:08 2015 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication Mon Nov 02 22:34:08 2015 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key Mon Nov 02 22:34:08 2015 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication Mon Nov 02 22:34:08 2015 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 1024 bit RSA Mon Nov 02 22:34:08 2015 [server] Peer Connection Initiated with [AF_INET]87.5.128.45:1194 Mon Nov 02 22:34:10 2015 MANAGEMENT: >STATE:1446500050,GET_CONFIG,,, Mon Nov 02 22:34:11 2015 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1) Mon Nov 02 22:34:11 2015 PUSH: Received control message: 'PUSH_REPLY,route-gateway 192.168.1.45,ping 10,ping-restart 120,ifconfig 192.168.1.50 255.255.255.0' Mon Nov 02 22:34:11 2015 OPTIONS IMPORT: timers and/or timeouts modified Mon Nov 02 22:34:11 2015 OPTIONS IMPORT: --ifconfig/up options modified Mon Nov 02 22:34:11 2015 OPTIONS IMPORT: route-related options modified Mon Nov 02 22:34:11 2015 WARNING: Since you are using --dev tun with a point-to-point topology, the second argument to --ifconfig must be an IP address. You are using something (255.255.255.0) that looks more like a netmask. (silence this warning with --ifconfig-nowarn) Mon Nov 02 22:34:11 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0 Mon Nov 02 22:34:11 2015 MANAGEMENT: >STATE:1446500051,ASSIGN_IP,,192.168.1.50, Mon Nov 02 22:34:11 2015 MANAGEMENT: Client disconnected Mon Nov 02 22:34:11 2015 There is a problem in your selection of --ifconfig endpoints [local=192.168.1.50, remote=255.255.255.0]. The local and remote VPN endpoints must exist within the same 255.255.255.252 subnet. This is a limitation of --dev tun when used with the TAP-WIN32 driver. Try 'openvpn --show-valid-subnets' option for more info. Mon Nov 02 22:34:11 2015 Exiting due to fatal error[/code] I think the error is described by the last 3 rows of the client log..but I'm not well into IP addressing :-/ What I know is that I have local IPs like 192.168.0.X and the remote machine has 192.168.1.X so they're different. In my server.ovpn file I have this part [code]# Configure server mode for ethernet bridging. # You must first use your OS's bridging capability # to bridge the TAP interface with the ethernet # NIC interface. Then you must manually set the # IP/netmask on the bridge interface, here we # assume 10.8.0.4/255.255.255.0. Finally we # must set aside an IP range in this subnet # (start=10.8.0.50 end=10.8.0.100) to allocate # to connecting clients. Leave this line commented # out unless you are ethernet bridging. server-bridge 192.168.1.45 255.255.255.0 192.168.1.50 192.168.1.100[/code] ..and I guess I'm using this directive in the wrong way. Also maybe because in case we are on different lans (168.0 vs .1) "dev tun"? But I wanted to use the "bridge" option because it seemed easier to config.. Can you please help me here? Again, I'm on 192.168.0.X/24, remote is 192.168.1.X/24, all ok router-side and dyndns side (seems so).. Thank you!

[quote="xlepws"]since I was having difficulties using the VM, I decided to make it simpler and set up a VPN Server on my Win7 machine directly, using the "bridge" option.[/quote]Your setup is unsupportable because you have changed so much and not documented it with [b]config files and logs[/b].

From the look of your logs you need to change your VPN subnet .. do [u]not[/u] use 192.168.x.x for your VPN.

first time with OpenVPN..need help understanding IP flow

xlepws

Hello everyone,
I hope you can help me..also linking to some more guides and examples.

This is my configuration
* Win 7 pc (192.168.1.19) with Virtualboxed Win2012 R2 Essentials; on W2012 I'm trying to setup an OpenVPN server
* I setup the VM network as "bridged adapter", so it's getting an IP (192.168.1.8) in the same subnet of Win7 host
* I have a "Technicolor AG plus VDNT-S VDSL2" modem/router (fttc; I live in Italy); not reachable from the internet with a static IP address, but I configured DynDNS and it seems to work (it says "Active" on dyndns.it page)

What I would like to do, is to set up a VPN server on the VM, and connect from my parent's home.
I have followed this guide: https://community.openvpn.net/openvpn/wiki/Easy_Windows_Guide and generated the server/client certificates which this evening I will copy on a Win7 client at my parents'.
I have left everything as defaults such as "server" and "dev tun" (so I suppose I'll go with routing instead of eth bridging)

Some questions:
* firewall: do I have to open communications to UDP 1194 on the W2012 software firewall?
* port forwarding: I went on my router (192.168.1.1) and set up the following:

In my mind, if it worked, it would send all packets sent to udp port 1194 to my VM
(I know the guide says <<Make sure to choose a static IP address that is not in the range your router might assign as a dynamic IP>> so I might change the VM IP to like 192.168.1.234)

Now, my doubts come after reading more at https://openvpn.net/index.php/open-source/documentation/howto.html, where it says, in section "Editing the server configuration file", that "The sample server configuration file is an ideal starting point for an OpenVPN server configuration. It will create a VPN using a virtual TUN network interface (for routing), will listen for client connections on UDP port 1194 (OpenVPN's official port number), and distribute virtual addresses to connecting clients from the 10.8.0.0/24 subnet."

What was in my mind was going at my parents', intalling OpenVPN on the client notebook (which might very well be on a local 192.168.1.X/24), copying the client stuff (ca.crt, client1.crt, client1.key, client1.ovpn) in the /config/ folder, start up the software on both server & client, and off you go.

Questions:
* what do I have to do with that 10.8.0.0/24 ? Is it automated or do I have to make some other configurations?
* anything I have forgotten / I wrongly assumed here?

Thanks!

Traffic

xlepws wrotewhat do I have to do with that 10.8.0.0/24 ? Is it automated or do I have to make some other configurations?

If your configs are setup correctly the clients will automatically be assigned an IP address from that range on their VPN adapter.

xlepws wroteanything I have forgotten / I wrongly assumed here?

If you can avoid it :arrow: Never use 192.168.0.0/24 or 192.168.1.0/24 (or other common subnets) for your OpenVPN Server LAN :!:

Also, using OpenVPN Access Server on a VM should be no problem, I use it on an Ubuntu VirtualBox.

xlepws

Thank you. I might have posted in the wrong section (maybe https://forums.openvpn.net/configuration-f6.html was more appropriate)?

Anyway..since I was having difficulties using the VM, I decided to make it simpler and set up a VPN Server on my Win7 machine directly, using the "bridge" option.
As I said in my last post I copied the client1 files on the client machine..tried a connection and..something went wrong

Here is the SERVER log:

Mon Nov 02 22:33:48 2015 OpenVPN 2.3.8 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Aug  4 2015
Mon Nov 02 22:33:48 2015 library versions: OpenSSL 1.0.1p 9 Jul 2015, LZO 2.08
Enter Management Password:
Mon Nov 02 22:33:48 2015 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Mon Nov 02 22:33:48 2015 Need hold release from management interface, waiting...
Mon Nov 02 22:33:48 2015 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Mon Nov 02 22:33:48 2015 MANAGEMENT: CMD 'state on'
Mon Nov 02 22:33:48 2015 MANAGEMENT: CMD 'log all on'
Mon Nov 02 22:33:48 2015 MANAGEMENT: CMD 'hold off'
Mon Nov 02 22:33:48 2015 MANAGEMENT: CMD 'hold release'
Mon Nov 02 22:33:48 2015 NOTE: when bridging your LAN adapter with the TAP adapter, note that the new bridge adapter will often take on its own IP address that is different from what the LAN adapter was previously set to
Mon Nov 02 22:33:48 2015 NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x.  Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
Mon Nov 02 22:33:48 2015 Diffie-Hellman initialized with 1024 bit key
Mon Nov 02 22:33:48 2015 Control Channel Authentication: using 'key.txt' as a OpenVPN static key file
Mon Nov 02 22:33:48 2015 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Nov 02 22:33:48 2015 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Nov 02 22:33:48 2015 Socket Buffers: R=[8192->8192] S=[64512->64512]
Mon Nov 02 22:33:48 2015 open_tun, tt->ipv6=0
Mon Nov 02 22:33:48 2015 TAP-WIN32 device [OpenVPN] opened: \\.\Global\{39515606-475C-4784-9991-92DFECA048F3}.tap
Mon Nov 02 22:33:48 2015 TAP-Windows Driver Version 9.21 
Mon Nov 02 22:33:48 2015 Sleeping for 10 seconds...
Mon Nov 02 22:33:58 2015 NOTE: FlushIpNetTable failed on interface [30] {39515606-475C-4784-9991-92DFECA048F3} (status=1168) : Element not found.  
Mon Nov 02 22:33:58 2015 UDPv4 link local (bound): [undef]
Mon Nov 02 22:33:58 2015 UDPv4 link remote: [undef]
Mon Nov 02 22:33:58 2015 MULTI: multi_init called, r=256 v=256
Mon Nov 02 22:33:58 2015 IFCONFIG POOL: base=192.168.1.50 size=51, ipv6=0
Mon Nov 02 22:33:58 2015 ifconfig_pool_read(), in='client1,192.168.1.50', TODO: IPv6
Mon Nov 02 22:33:58 2015 succeeded -> ifconfig_pool_set()
Mon Nov 02 22:33:58 2015 IFCONFIG POOL LIST
Mon Nov 02 22:33:58 2015 client1,192.168.1.50
Mon Nov 02 22:33:58 2015 Initialization Sequence Completed
Mon Nov 02 22:33:58 2015 MANAGEMENT: >STATE:1446500038,CONNECTED,SUCCESS,,
Mon Nov 02 22:34:08 2015 93.34.147.196:14509 TLS: Initial packet from [AF_INET]93.34.147.196:14509, sid=d2ea729e 0be3688a
Mon Nov 02 22:34:08 2015 93.34.147.196:14509 VERIFY OK: depth=1, C=IT, ST=IT, L=Milan, O=my_org, OU=my_ou, CN=OpenVPN-CA, name=my_name, emailAddress=mail@host.domain
Mon Nov 02 22:34:08 2015 93.34.147.196:14509 VERIFY OK: depth=0, C=IT, ST=IT, L=Milan, O=my_org, OU=my_ou, CN=client1, name=my_name, emailAddress=mail@host.domain
Mon Nov 02 22:34:08 2015 93.34.147.196:14509 WARNING: 'dev-type' is used inconsistently, local='dev-type tap', remote='dev-type tun'
Mon Nov 02 22:34:08 2015 93.34.147.196:14509 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1574', remote='link-mtu 1542'
Mon Nov 02 22:34:08 2015 93.34.147.196:14509 WARNING: 'tun-mtu' is used inconsistently, local='tun-mtu 1532', remote='tun-mtu 1500'
Mon Nov 02 22:34:08 2015 93.34.147.196:14509 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Nov 02 22:34:08 2015 93.34.147.196:14509 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Nov 02 22:34:08 2015 93.34.147.196:14509 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Nov 02 22:34:08 2015 93.34.147.196:14509 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Nov 02 22:34:08 2015 93.34.147.196:14509 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 1024 bit RSA
Mon Nov 02 22:34:08 2015 93.34.147.196:14509 [client1] Peer Connection Initiated with [AF_INET]93.34.147.196:14509
Mon Nov 02 22:34:08 2015 client1/93.34.147.196:14509 MULTI_sva: pool returned IPv4=192.168.1.50, IPv6=(Not enabled)
Mon Nov 02 22:34:10 2015 client1/93.34.147.196:14509 PUSH: Received control message: 'PUSH_REQUEST'
Mon Nov 02 22:34:10 2015 client1/93.34.147.196:14509 send_push_reply(): safe_cap=940
Mon Nov 02 22:34:10 2015 client1/93.34.147.196:14509 SENT CONTROL [client1]: 'PUSH_REPLY,route-gateway 192.168.1.45,ping 10,ping-restart 120,ifconfig 192.168.1.50 255.255.255.0' (status=1)
Mon Nov 02 22:38:11 2015 client1/93.34.147.196:14509 [client1] Inactivity timeout (--ping-restart), restarting
Mon Nov 02 22:38:11 2015 client1/93.34.147.196:14509 SIGUSR1[soft,ping-restart] received, client-instance restarting
Tue Nov 03 00:40:15 2015 MANAGEMENT: Client disconnected
Tue Nov 03 08:49:36 2015 TUN/TAP I/O operation aborted, exiting
Tue Nov 03 08:49:36 2015 Exiting due to fatal error
Tue Nov 03 08:49:36 2015 Closing TUN/TAP interface

CLIENT LOG

Mon Nov 02 22:34:07 2015 OpenVPN 2.3.8 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Aug  4 2015
Mon Nov 02 22:34:07 2015 library versions: OpenSSL 1.0.1p 9 Jul 2015, LZO 2.08
Enter Management Password:
Mon Nov 02 22:34:07 2015 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Mon Nov 02 22:34:07 2015 Need hold release from management interface, waiting...
Mon Nov 02 22:34:08 2015 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Mon Nov 02 22:34:08 2015 MANAGEMENT: CMD 'state on'
Mon Nov 02 22:34:08 2015 MANAGEMENT: CMD 'log all on'
Mon Nov 02 22:34:08 2015 MANAGEMENT: CMD 'hold off'
Mon Nov 02 22:34:08 2015 MANAGEMENT: CMD 'hold release'
Mon Nov 02 22:34:08 2015 Control Channel Authentication: using 'key.txt' as a OpenVPN static key file
Mon Nov 02 22:34:08 2015 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Nov 02 22:34:08 2015 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Nov 02 22:34:08 2015 Socket Buffers: R=[8192->8192] S=[8192->8192]
Mon Nov 02 22:34:08 2015 MANAGEMENT: >STATE:1446500048,RESOLVE,,,
Mon Nov 02 22:34:08 2015 UDPv4 link local: [undef]
Mon Nov 02 22:34:08 2015 UDPv4 link remote: [AF_INET]87.5.128.45:1194
Mon Nov 02 22:34:08 2015 MANAGEMENT: >STATE:1446500048,WAIT,,,
Mon Nov 02 22:34:08 2015 MANAGEMENT: >STATE:1446500048,AUTH,,,
Mon Nov 02 22:34:08 2015 TLS: Initial packet from [AF_INET]87.5.128.45:1194, sid=552ab731 acefa450
Mon Nov 02 22:34:08 2015 VERIFY OK: depth=1, C=IT, ST=IT, L=Milan, O=my_org, OU=my_ou, CN=OpenVPN-CA, name=my_name, emailAddress=mail@host.domain
Mon Nov 02 22:34:08 2015 Validating certificate key usage
Mon Nov 02 22:34:08 2015 ++ Certificate has key usage  00a0, expects 00a0
Mon Nov 02 22:34:08 2015 VERIFY KU OK
Mon Nov 02 22:34:08 2015 Validating certificate extended key usage
Mon Nov 02 22:34:08 2015 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Mon Nov 02 22:34:08 2015 VERIFY EKU OK
Mon Nov 02 22:34:08 2015 VERIFY OK: depth=0, C=IT, ST=IT, L=Milan, O=my_org, OU=my_ou, CN=server, name=my_name, emailAddress=mail@host.domain
Mon Nov 02 22:34:08 2015 WARNING: 'dev-type' is used inconsistently, local='dev-type tun', remote='dev-type tap'
Mon Nov 02 22:34:08 2015 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1542', remote='link-mtu 1574'
Mon Nov 02 22:34:08 2015 WARNING: 'tun-mtu' is used inconsistently, local='tun-mtu 1500', remote='tun-mtu 1532'
Mon Nov 02 22:34:08 2015 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Nov 02 22:34:08 2015 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Nov 02 22:34:08 2015 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mon Nov 02 22:34:08 2015 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Nov 02 22:34:08 2015 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 1024 bit RSA
Mon Nov 02 22:34:08 2015 [server] Peer Connection Initiated with [AF_INET]87.5.128.45:1194
Mon Nov 02 22:34:10 2015 MANAGEMENT: >STATE:1446500050,GET_CONFIG,,,
Mon Nov 02 22:34:11 2015 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Mon Nov 02 22:34:11 2015 PUSH: Received control message: 'PUSH_REPLY,route-gateway 192.168.1.45,ping 10,ping-restart 120,ifconfig 192.168.1.50 255.255.255.0'
Mon Nov 02 22:34:11 2015 OPTIONS IMPORT: timers and/or timeouts modified
Mon Nov 02 22:34:11 2015 OPTIONS IMPORT: --ifconfig/up options modified
Mon Nov 02 22:34:11 2015 OPTIONS IMPORT: route-related options modified
Mon Nov 02 22:34:11 2015 WARNING: Since you are using --dev tun with a point-to-point topology, the second argument to --ifconfig must be an IP address.  You are using something (255.255.255.0) that looks more like a netmask. (silence this warning with --ifconfig-nowarn)
Mon Nov 02 22:34:11 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Mon Nov 02 22:34:11 2015 MANAGEMENT: >STATE:1446500051,ASSIGN_IP,,192.168.1.50,
Mon Nov 02 22:34:11 2015 MANAGEMENT: Client disconnected
Mon Nov 02 22:34:11 2015 There is a problem in your selection of --ifconfig endpoints [local=192.168.1.50, remote=255.255.255.0].  The local and remote VPN endpoints must exist within the same 255.255.255.252 subnet.  This is a limitation of --dev tun when used with the TAP-WIN32 driver.  Try 'openvpn --show-valid-subnets' option for more info.
Mon Nov 02 22:34:11 2015 Exiting due to fatal error

I think the error is described by the last 3 rows of the client log..but I'm not well into IP addressing :-/
What I know is that I have local IPs like 192.168.0.X and the remote machine has 192.168.1.X so they're different.

In my server.ovpn file I have this part

# Configure server mode for ethernet bridging.
# You must first use your OS's bridging capability
# to bridge the TAP interface with the ethernet
# NIC interface.  Then you must manually set the
# IP/netmask on the bridge interface, here we
# assume 10.8.0.4/255.255.255.0.  Finally we
# must set aside an IP range in this subnet
# (start=10.8.0.50 end=10.8.0.100) to allocate
# to connecting clients.  Leave this line commented
# out unless you are ethernet bridging.
server-bridge 192.168.1.45 255.255.255.0 192.168.1.50 192.168.1.100

..and I guess I'm using this directive in the wrong way.
Also maybe because in case we are on different lans (168.0 vs .1) "dev tun"?
But I wanted to use the "bridge" option because it seemed easier to config..

Can you please help me here?

Again, I'm on 192.168.0.X/24, remote is 192.168.1.X/24, all ok router-side and dyndns side (seems so)..

Thank you!

xlepws

(sorry, I'm 192.168.1.X and remote client 192.168.0.X .. I can't see my previous post yet because it has to be moderated..)

Traffic

xlepws wrotesince I was having difficulties using the VM, I decided to make it simpler and set up a VPN Server on my Win7 machine directly, using the "bridge" option.

Your setup is unsupportable because you have changed so much and not documented it with config files and logs.

Traffic

From the look of your logs you need to change your VPN subnet .. do not use 192.168.x.x for your VPN.