Windows TUN adapter not coming up

jonwaggoner

I'm having issues getting Windows machines to connect to my server with a repeated message over and over when it fails, which happens 9 times out of 10:
TEST ROUTES: 0/0 succeeded len=2 ret=0 a=0 u/d=down
Route: Waiting for TUN/TAP interface to come up...

I don't see that message at all when the connect works. Sometimes, after a couple of minutes the connection will appear to go through (the OpenVPN status window goes away and connection show green) but I can't connect to the VPN network at all, even to ping the server. It appears to affect all versions of Windows that I'm trying - Vista, 7 x86 and x64, 8.1 x64 and Windows 10 x86 and x64, and yes OpenVPN is being run as an administrator. I've added route-delay to the config and have tried restarting the DHCP service after a failure. Neither appear to work. Connections from within the same network work just fine every time with the client getting a 10.8 address.

The server is OpenVPN 2.2.1-8+deb7u3 (from the repository) in Raspbian on a Raspberry pi 2. The server sits behind a router with port 1194 forwarded through. I'm using TUN and then passing network information in order to allow clients to connect to other resources on the network - mainly a file server but also remote desktop, etc. I've thought about compiling the latest from source and trying that, but haven't yet. Good next troubleshooting step, or is there a funny config problem in the configs/logs below?

server's configuration file

dev tun
proto udp
port 1194
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key
dh /etc/openvpn/easy-rsa/keys/dh1024.pem
user nobody
group nogroup
server 10.8.0.0 255.255.255.0
persist-key
persist-tun
status /var/log/openvpn-status.log
verb 4
push "redirect-gateway def1"
push "route 10.1.10.0 255.255.255.0"
push "dhcp-option WINS 10.8.0.0"
push "dhcp-option DNS 10.1.10.1"
push "dhcp-option DNS 8.8.8.8"
log-append /var/log/openvpn
comp-lzo

client configuration:

client
dev tun
proto udp
remote REMOTE_ADDRESS_HERE 1194
route-delay
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client1.crt
key client1.key
remote-cert-tls server
comp-lzo
log-append ./clientlog.txt
verb 4

Server verb 4 log during a good then a failed connection attempt

Wed Nov  4 09:11:06 2015 us=876417 MULTI: multi_create_instance called
Wed Nov  4 09:11:06 2015 us=876861 174.21.195.90:63607 Re-using SSL/TLS context
Wed Nov  4 09:11:06 2015 us=877002 174.21.195.90:63607 LZO compression initialized
Wed Nov  4 09:11:06 2015 us=877488 174.21.195.90:63607 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Wed Nov  4 09:11:06 2015 us=877637 174.21.195.90:63607 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Wed Nov  4 09:11:06 2015 us=877886 174.21.195.90:63607 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Wed Nov  4 09:11:06 2015 us=877992 174.21.195.90:63607 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Wed Nov  4 09:11:06 2015 us=878156 174.21.195.90:63607 Local Options hash (VER=V4): '530fdded'
Wed Nov  4 09:11:06 2015 us=878305 174.21.195.90:63607 Expected Remote Options hash (VER=V4): '41690919'
Wed Nov  4 09:11:06 2015 us=878523 174.21.195.90:63607 TLS: Initial packet from [AF_INET]174.21.195.90:63607, sid=bf166b5c 46433505
Wed Nov  4 09:11:07 2015 us=658849 174.21.195.90:63607 VERIFY OK: depth=1, /C=US/ST=WA/L=Bellingham/O=Coastal_Geologic_Services/OU=Main/CN=piServer/name=CGS/emailAddress=jonathan@coastalgeo.com
Wed Nov  4 09:11:07 2015 us=660640 174.21.195.90:63607 VERIFY OK: depth=0, /C=US/ST=WA/L=Bellingham/O=Coastal_Geologic_Services/OU=Main/CN=piServer/name=CGS/emailAddress=VPNclient@coastalgeo.com
Wed Nov  4 09:11:07 2015 us=765608 174.21.195.90:63607 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Nov  4 09:11:07 2015 us=765858 174.21.195.90:63607 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Nov  4 09:11:07 2015 us=766279 174.21.195.90:63607 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Nov  4 09:11:07 2015 us=766405 174.21.195.90:63607 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Nov  4 09:11:07 2015 us=821377 174.21.195.90:63607 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Wed Nov  4 09:11:07 2015 us=821623 174.21.195.90:63607 [piServer] Peer Connection Initiated with [AF_INET]174.21.195.90:63607
Wed Nov  4 09:11:07 2015 us=821863 piServer/174.21.195.90:63607 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=1891:e37e:80ee:f076:341b:f676:14bb:e178
Wed Nov  4 09:11:07 2015 us=822224 piServer/174.21.195.90:63607 MULTI: Learn: 10.8.0.6 -> piServer/174.21.195.90:63607
Wed Nov  4 09:11:07 2015 us=822355 piServer/174.21.195.90:63607 MULTI: primary virtual IP for piServer/174.21.195.90:63607: 10.8.0.6
Wed Nov  4 09:11:09 2015 us=933785 piServer/174.21.195.90:63607 PUSH: Received control message: 'PUSH_REQUEST'
Wed Nov  4 09:11:09 2015 us=934098 piServer/174.21.195.90:63607 send_push_reply(): safe_cap=960
Wed Nov  4 09:11:09 2015 us=934409 piServer/174.21.195.90:63607 SENT CONTROL [piServer]: 'PUSH_REPLY,redirect-gateway def1,route 10.1.10.0 255.255.255.0,dhcp-option WINS 10.8.0.0,dhcp-option DNS 10.1.10.1,dhcp-option DNS 8.8.8.8,route 10.8.0.1,topology net30,ifconfig 10.8.0.6 10.8.0.5' (status=1)
##############################
### Disconnected then reconnected and got a failure
##############################
Wed Nov  4 09:15:31 2015 us=376066 MULTI: multi_create_instance called
Wed Nov  4 09:15:31 2015 us=376659 174.21.195.90:49451 Re-using SSL/TLS context
Wed Nov  4 09:15:31 2015 us=376802 174.21.195.90:49451 LZO compression initialized
Wed Nov  4 09:15:31 2015 us=377284 174.21.195.90:49451 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Wed Nov  4 09:15:31 2015 us=377435 174.21.195.90:49451 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Wed Nov  4 09:15:31 2015 us=377680 174.21.195.90:49451 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Wed Nov  4 09:15:31 2015 us=377786 174.21.195.90:49451 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Wed Nov  4 09:15:31 2015 us=377951 174.21.195.90:49451 Local Options hash (VER=V4): '530fdded'
Wed Nov  4 09:15:31 2015 us=378101 174.21.195.90:49451 Expected Remote Options hash (VER=V4): '41690919'
Wed Nov  4 09:15:31 2015 us=378320 174.21.195.90:49451 TLS: Initial packet from [AF_INET]174.21.195.90:49451, sid=52bf0f9e 44c0812d
Wed Nov  4 09:15:32 2015 us=81765 174.21.195.90:49451 VERIFY OK: depth=1, /C=US/ST=WA/L=Bellingham/O=Coastal_Geologic_Services/OU=Main/CN=piServer/name=CGS/emailAddress=jonathan@coastalgeo.com
Wed Nov  4 09:15:32 2015 us=83445 174.21.195.90:49451 VERIFY OK: depth=0, /C=US/ST=WA/L=Bellingham/O=Coastal_Geologic_Services/OU=Main/CN=piServer/name=CGS/emailAddress=VPNclient@coastalgeo.com
Wed Nov  4 09:15:32 2015 us=185549 174.21.195.90:49451 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Nov  4 09:15:32 2015 us=185797 174.21.195.90:49451 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Nov  4 09:15:32 2015 us=186222 174.21.195.90:49451 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Nov  4 09:15:32 2015 us=186351 174.21.195.90:49451 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Nov  4 09:15:32 2015 us=237417 174.21.195.90:49451 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Wed Nov  4 09:15:32 2015 us=237653 174.21.195.90:49451 [piServer] Peer Connection Initiated with [AF_INET]174.21.195.90:49451
Wed Nov  4 09:15:32 2015 us=238718 MULTI: new connection by client 'piServer' will cause previous active sessions by this client to be dropped.  Remember to use the --duplicate-cn option if you want multiple clients using the same certificate or username to concurrently connect.
Wed Nov  4 09:15:32 2015 us=238906 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=d8fa:e378::488e:e37e:a877:e878
Wed Nov  4 09:15:32 2015 us=239274 MULTI: Learn: 10.8.0.6 -> piServer/174.21.195.90:49451
Wed Nov  4 09:15:32 2015 us=239407 MULTI: primary virtual IP for piServer/174.21.195.90:49451: 10.8.0.6
Wed Nov  4 09:15:34 2015 us=354007 piServer/174.21.195.90:49451 PUSH: Received control message: 'PUSH_REQUEST'
Wed Nov  4 09:15:34 2015 us=354233 piServer/174.21.195.90:49451 send_push_reply(): safe_cap=960
Wed Nov  4 09:15:34 2015 us=354540 piServer/174.21.195.90:49451 SENT CONTROL [piServer]: 'PUSH_REPLY,redirect-gateway def1,route 10.1.10.0 255.255.255.0,dhcp-option WINS 10.8.0.0,dhcp-option DNS 10.1.10.1,dhcp-option DNS 8.8.8.8,route 10.8.0.1,topology net30,ifconfig 10.8.0.6 10.8.0.5' (status=1)

Client verb 4 log when a connection fails (don't have one with a connection right now)

Wed Nov 04 08:20:39 2015 us=663704 Current Parameter Settings:
Wed Nov 04 08:20:39 2015 us=663704   config = 'client.ovpn'
Wed Nov 04 08:20:39 2015 us=663704   mode = 0
Wed Nov 04 08:20:39 2015 us=663704   show_ciphers = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   show_digests = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   show_engines = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   genkey = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   key_pass_file = '[UNDEF]'
Wed Nov 04 08:20:39 2015 us=663704   show_tls_ciphers = DISABLED
Wed Nov 04 08:20:39 2015 us=663704 Connection profiles [default]:
Wed Nov 04 08:20:39 2015 us=663704   proto = udp
Wed Nov 04 08:20:39 2015 us=663704   local = '[UNDEF]'
Wed Nov 04 08:20:39 2015 us=663704   local_port = 0
Wed Nov 04 08:20:39 2015 us=663704   remote = 'REMOTE_ADDRESS_HERE'
Wed Nov 04 08:20:39 2015 us=663704   remote_port = 1194
Wed Nov 04 08:20:39 2015 us=663704   remote_float = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   bind_defined = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   bind_local = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   connect_retry_seconds = 5
Wed Nov 04 08:20:39 2015 us=663704   connect_timeout = 10
Wed Nov 04 08:20:39 2015 us=663704   connect_retry_max = 0
Wed Nov 04 08:20:39 2015 us=663704   socks_proxy_server = '[UNDEF]'
Wed Nov 04 08:20:39 2015 us=663704   socks_proxy_port = 0
Wed Nov 04 08:20:39 2015 us=663704   socks_proxy_retry = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   tun_mtu = 1500
Wed Nov 04 08:20:39 2015 us=663704   tun_mtu_defined = ENABLED
Wed Nov 04 08:20:39 2015 us=663704   link_mtu = 1500
Wed Nov 04 08:20:39 2015 us=663704   link_mtu_defined = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   tun_mtu_extra = 0
Wed Nov 04 08:20:39 2015 us=663704   tun_mtu_extra_defined = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   mtu_discover_type = -1
Wed Nov 04 08:20:39 2015 us=663704   fragment = 0
Wed Nov 04 08:20:39 2015 us=663704   mssfix = 1450
Wed Nov 04 08:20:39 2015 us=663704   explicit_exit_notification = 0
Wed Nov 04 08:20:39 2015 us=663704 Connection profiles END
Wed Nov 04 08:20:39 2015 us=663704   remote_random = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   ipchange = '[UNDEF]'
Wed Nov 04 08:20:39 2015 us=663704   dev = 'tun'
Wed Nov 04 08:20:39 2015 us=663704   dev_type = '[UNDEF]'
Wed Nov 04 08:20:39 2015 us=663704   dev_node = '[UNDEF]'
Wed Nov 04 08:20:39 2015 us=663704   lladdr = '[UNDEF]'
Wed Nov 04 08:20:39 2015 us=663704   topology = 1
Wed Nov 04 08:20:39 2015 us=663704   tun_ipv6 = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   ifconfig_local = '[UNDEF]'
Wed Nov 04 08:20:39 2015 us=663704   ifconfig_remote_netmask = '[UNDEF]'
Wed Nov 04 08:20:39 2015 us=663704   ifconfig_noexec = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   ifconfig_nowarn = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   ifconfig_ipv6_local = '[UNDEF]'
Wed Nov 04 08:20:39 2015 us=663704   ifconfig_ipv6_netbits = 0
Wed Nov 04 08:20:39 2015 us=663704   ifconfig_ipv6_remote = '[UNDEF]'
Wed Nov 04 08:20:39 2015 us=663704   shaper = 0
Wed Nov 04 08:20:39 2015 us=663704   mtu_test = 0
Wed Nov 04 08:20:39 2015 us=663704   mlock = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   keepalive_ping = 0
Wed Nov 04 08:20:39 2015 us=663704   keepalive_timeout = 0
Wed Nov 04 08:20:39 2015 us=663704   inactivity_timeout = 0
Wed Nov 04 08:20:39 2015 us=663704   ping_send_timeout = 0
Wed Nov 04 08:20:39 2015 us=663704   ping_rec_timeout = 0
Wed Nov 04 08:20:39 2015 us=663704   ping_rec_timeout_action = 0
Wed Nov 04 08:20:39 2015 us=663704   ping_timer_remote = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   remap_sigusr1 = 0
Wed Nov 04 08:20:39 2015 us=663704   persist_tun = ENABLED
Wed Nov 04 08:20:39 2015 us=663704   persist_local_ip = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   persist_remote_ip = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   persist_key = ENABLED
Wed Nov 04 08:20:39 2015 us=663704   passtos = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   resolve_retry_seconds = 1000000000
Wed Nov 04 08:20:39 2015 us=663704   username = '[UNDEF]'
Wed Nov 04 08:20:39 2015 us=663704   groupname = '[UNDEF]'
Wed Nov 04 08:20:39 2015 us=663704   chroot_dir = '[UNDEF]'
Wed Nov 04 08:20:39 2015 us=663704   cd_dir = '[UNDEF]'
Wed Nov 04 08:20:39 2015 us=663704   writepid = '[UNDEF]'
Wed Nov 04 08:20:39 2015 us=663704   up_script = '[UNDEF]'
Wed Nov 04 08:20:39 2015 us=663704   down_script = '[UNDEF]'
Wed Nov 04 08:20:39 2015 us=663704   down_pre = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   up_restart = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   up_delay = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   daemon = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   inetd = 0
Wed Nov 04 08:20:39 2015 us=663704   log = ENABLED
Wed Nov 04 08:20:39 2015 us=663704   suppress_timestamps = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   nice = 0
Wed Nov 04 08:20:39 2015 us=663704   verbosity = 4
Wed Nov 04 08:20:39 2015 us=663704   mute = 0
Wed Nov 04 08:20:39 2015 us=663704   status_file = '[UNDEF]'
Wed Nov 04 08:20:39 2015 us=663704   status_file_version = 1
Wed Nov 04 08:20:39 2015 us=663704   status_file_update_freq = 60
Wed Nov 04 08:20:39 2015 us=663704   occ = ENABLED
Wed Nov 04 08:20:39 2015 us=663704   rcvbuf = 0
Wed Nov 04 08:20:39 2015 us=663704   sndbuf = 0
Wed Nov 04 08:20:39 2015 us=663704   sockflags = 0
Wed Nov 04 08:20:39 2015 us=663704   fast_io = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   lzo = 7
Wed Nov 04 08:20:39 2015 us=663704   route_script = '[UNDEF]'
Wed Nov 04 08:20:39 2015 us=663704   route_default_gateway = '[UNDEF]'
Wed Nov 04 08:20:39 2015 us=663704   route_default_metric = 0
Wed Nov 04 08:20:39 2015 us=663704   route_noexec = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   route_delay = 5
Wed Nov 04 08:20:39 2015 us=663704   route_delay_window = 120
Wed Nov 04 08:20:39 2015 us=663704   route_delay_defined = ENABLED
Wed Nov 04 08:20:39 2015 us=663704   route_nopull = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   route_gateway_via_dhcp = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   max_routes = 100
Wed Nov 04 08:20:39 2015 us=663704   allow_pull_fqdn = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   management_addr = '127.0.0.1'
Wed Nov 04 08:20:39 2015 us=663704   management_port = 25340
Wed Nov 04 08:20:39 2015 us=663704   management_user_pass = 'stdin'
Wed Nov 04 08:20:39 2015 us=663704   management_log_history_cache = 250
Wed Nov 04 08:20:39 2015 us=663704   management_echo_buffer_size = 100
Wed Nov 04 08:20:39 2015 us=663704   management_write_peer_info_file = '[UNDEF]'
Wed Nov 04 08:20:39 2015 us=663704   management_client_user = '[UNDEF]'
Wed Nov 04 08:20:39 2015 us=663704   management_client_group = '[UNDEF]'
Wed Nov 04 08:20:39 2015 us=663704   management_flags = 6
Wed Nov 04 08:20:39 2015 us=663704   shared_secret_file = '[UNDEF]'
Wed Nov 04 08:20:39 2015 us=663704   key_direction = 0
Wed Nov 04 08:20:39 2015 us=663704   ciphername_defined = ENABLED
Wed Nov 04 08:20:39 2015 us=663704   ciphername = 'BF-CBC'
Wed Nov 04 08:20:39 2015 us=663704   authname_defined = ENABLED
Wed Nov 04 08:20:39 2015 us=663704   authname = 'SHA1'
Wed Nov 04 08:20:39 2015 us=663704   prng_hash = 'SHA1'
Wed Nov 04 08:20:39 2015 us=663704   prng_nonce_secret_len = 16
Wed Nov 04 08:20:39 2015 us=663704   keysize = 0
Wed Nov 04 08:20:39 2015 us=663704   engine = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   replay = ENABLED
Wed Nov 04 08:20:39 2015 us=663704   mute_replay_warnings = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   replay_window = 64
Wed Nov 04 08:20:39 2015 us=663704   replay_time = 15
Wed Nov 04 08:20:39 2015 us=663704   packet_id_file = '[UNDEF]'
Wed Nov 04 08:20:39 2015 us=663704   use_iv = ENABLED
Wed Nov 04 08:20:39 2015 us=663704   test_crypto = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   tls_server = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   tls_client = ENABLED
Wed Nov 04 08:20:39 2015 us=663704   key_method = 2
Wed Nov 04 08:20:39 2015 us=663704   ca_file = 'ca.crt'
Wed Nov 04 08:20:39 2015 us=663704   ca_path = '[UNDEF]'
Wed Nov 04 08:20:39 2015 us=663704   dh_file = '[UNDEF]'
Wed Nov 04 08:20:39 2015 us=663704   cert_file = 'client1.crt'
Wed Nov 04 08:20:39 2015 us=663704   priv_key_file = 'client1.key'
Wed Nov 04 08:20:39 2015 us=663704   pkcs12_file = '[UNDEF]'
Wed Nov 04 08:20:39 2015 us=663704   cryptoapi_cert = '[UNDEF]'
Wed Nov 04 08:20:39 2015 us=663704   cipher_list = '[UNDEF]'
Wed Nov 04 08:20:39 2015 us=663704   tls_verify = '[UNDEF]'
Wed Nov 04 08:20:39 2015 us=663704   tls_export_cert = '[UNDEF]'
Wed Nov 04 08:20:39 2015 us=663704   verify_x509_type = 0
Wed Nov 04 08:20:39 2015 us=663704   verify_x509_name = '[UNDEF]'
Wed Nov 04 08:20:39 2015 us=663704   crl_file = '[UNDEF]'
Wed Nov 04 08:20:39 2015 us=663704   ns_cert_type = 0
Wed Nov 04 08:20:39 2015 us=663704   remote_cert_ku[i] = 160
Wed Nov 04 08:20:39 2015 us=663704   remote_cert_ku[i] = 136
Wed Nov 04 08:20:39 2015 us=663704   remote_cert_ku[i] = 0
Wed Nov 04 08:20:39 2015 us=663704   remote_cert_ku[i] = 0
Wed Nov 04 08:20:39 2015 us=663704   remote_cert_ku[i] = 0
Wed Nov 04 08:20:39 2015 us=663704   remote_cert_ku[i] = 0
Wed Nov 04 08:20:39 2015 us=663704   remote_cert_ku[i] = 0
Wed Nov 04 08:20:39 2015 us=663704   remote_cert_ku[i] = 0
Wed Nov 04 08:20:39 2015 us=663704   remote_cert_ku[i] = 0
Wed Nov 04 08:20:39 2015 us=663704   remote_cert_ku[i] = 0
Wed Nov 04 08:20:39 2015 us=663704   remote_cert_ku[i] = 0
Wed Nov 04 08:20:39 2015 us=663704   remote_cert_ku[i] = 0
Wed Nov 04 08:20:39 2015 us=663704   remote_cert_ku[i] = 0
Wed Nov 04 08:20:39 2015 us=663704   remote_cert_ku[i] = 0
Wed Nov 04 08:20:39 2015 us=663704   remote_cert_ku[i] = 0
Wed Nov 04 08:20:39 2015 us=663704   remote_cert_ku[i] = 0
Wed Nov 04 08:20:39 2015 us=663704   remote_cert_eku = 'TLS Web Server Authentication'
Wed Nov 04 08:20:39 2015 us=663704   ssl_flags = 0
Wed Nov 04 08:20:39 2015 us=663704   tls_timeout = 2
Wed Nov 04 08:20:39 2015 us=663704   renegotiate_bytes = 0
Wed Nov 04 08:20:39 2015 us=663704   renegotiate_packets = 0
Wed Nov 04 08:20:39 2015 us=663704   renegotiate_seconds = 3600
Wed Nov 04 08:20:39 2015 us=663704   handshake_window = 60
Wed Nov 04 08:20:39 2015 us=663704   transition_window = 3600
Wed Nov 04 08:20:39 2015 us=663704   single_session = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   push_peer_info = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   tls_exit = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   tls_auth_file = '[UNDEF]'
Wed Nov 04 08:20:39 2015 us=663704   pkcs11_protected_authentication = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   pkcs11_protected_authentication = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   pkcs11_protected_authentication = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   pkcs11_protected_authentication = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   pkcs11_protected_authentication = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   pkcs11_protected_authentication = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   pkcs11_protected_authentication = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   pkcs11_protected_authentication = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   pkcs11_protected_authentication = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   pkcs11_protected_authentication = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   pkcs11_protected_authentication = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   pkcs11_protected_authentication = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   pkcs11_protected_authentication = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   pkcs11_protected_authentication = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   pkcs11_protected_authentication = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   pkcs11_protected_authentication = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   pkcs11_private_mode = 00000000
Wed Nov 04 08:20:39 2015 us=663704   pkcs11_private_mode = 00000000
Wed Nov 04 08:20:39 2015 us=663704   pkcs11_private_mode = 00000000
Wed Nov 04 08:20:39 2015 us=663704   pkcs11_private_mode = 00000000
Wed Nov 04 08:20:39 2015 us=663704   pkcs11_private_mode = 00000000
Wed Nov 04 08:20:39 2015 us=663704   pkcs11_private_mode = 00000000
Wed Nov 04 08:20:39 2015 us=663704   pkcs11_private_mode = 00000000
Wed Nov 04 08:20:39 2015 us=663704   pkcs11_private_mode = 00000000
Wed Nov 04 08:20:39 2015 us=663704   pkcs11_private_mode = 00000000
Wed Nov 04 08:20:39 2015 us=663704   pkcs11_private_mode = 00000000
Wed Nov 04 08:20:39 2015 us=663704   pkcs11_private_mode = 00000000
Wed Nov 04 08:20:39 2015 us=663704   pkcs11_private_mode = 00000000
Wed Nov 04 08:20:39 2015 us=663704   pkcs11_private_mode = 00000000
Wed Nov 04 08:20:39 2015 us=663704   pkcs11_private_mode = 00000000
Wed Nov 04 08:20:39 2015 us=663704   pkcs11_private_mode = 00000000
Wed Nov 04 08:20:39 2015 us=663704   pkcs11_private_mode = 00000000
Wed Nov 04 08:20:39 2015 us=663704   pkcs11_cert_private = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   pkcs11_cert_private = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   pkcs11_cert_private = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   pkcs11_cert_private = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   pkcs11_cert_private = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   pkcs11_cert_private = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   pkcs11_cert_private = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   pkcs11_cert_private = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   pkcs11_cert_private = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   pkcs11_cert_private = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   pkcs11_cert_private = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   pkcs11_cert_private = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   pkcs11_cert_private = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   pkcs11_cert_private = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   pkcs11_cert_private = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   pkcs11_cert_private = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   pkcs11_pin_cache_period = -1
Wed Nov 04 08:20:39 2015 us=663704   pkcs11_id = '[UNDEF]'
Wed Nov 04 08:20:39 2015 us=663704   pkcs11_id_management = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   server_network = 0.0.0.0
Wed Nov 04 08:20:39 2015 us=663704   server_netmask = 0.0.0.0
Wed Nov 04 08:20:39 2015 us=663704   server_network_ipv6 = ::
Wed Nov 04 08:20:39 2015 us=663704   server_netbits_ipv6 = 0
Wed Nov 04 08:20:39 2015 us=663704   server_bridge_ip = 0.0.0.0
Wed Nov 04 08:20:39 2015 us=663704   server_bridge_netmask = 0.0.0.0
Wed Nov 04 08:20:39 2015 us=663704   server_bridge_pool_start = 0.0.0.0
Wed Nov 04 08:20:39 2015 us=663704   server_bridge_pool_end = 0.0.0.0
Wed Nov 04 08:20:39 2015 us=663704   ifconfig_pool_defined = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   ifconfig_pool_start = 0.0.0.0
Wed Nov 04 08:20:39 2015 us=663704   ifconfig_pool_end = 0.0.0.0
Wed Nov 04 08:20:39 2015 us=663704   ifconfig_pool_netmask = 0.0.0.0
Wed Nov 04 08:20:39 2015 us=663704   ifconfig_pool_persist_filename = '[UNDEF]'
Wed Nov 04 08:20:39 2015 us=663704   ifconfig_pool_persist_refresh_freq = 600
Wed Nov 04 08:20:39 2015 us=663704   ifconfig_ipv6_pool_defined = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   ifconfig_ipv6_pool_base = ::
Wed Nov 04 08:20:39 2015 us=663704   ifconfig_ipv6_pool_netbits = 0
Wed Nov 04 08:20:39 2015 us=663704   n_bcast_buf = 256
Wed Nov 04 08:20:39 2015 us=663704   tcp_queue_limit = 64
Wed Nov 04 08:20:39 2015 us=663704   real_hash_size = 256
Wed Nov 04 08:20:39 2015 us=663704   virtual_hash_size = 256
Wed Nov 04 08:20:39 2015 us=663704   client_connect_script = '[UNDEF]'
Wed Nov 04 08:20:39 2015 us=663704   learn_address_script = '[UNDEF]'
Wed Nov 04 08:20:39 2015 us=663704   client_disconnect_script = '[UNDEF]'
Wed Nov 04 08:20:39 2015 us=663704   client_config_dir = '[UNDEF]'
Wed Nov 04 08:20:39 2015 us=663704   ccd_exclusive = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   tmp_dir = 'C:\Users\Jonathan\AppData\Local\Temp\'
Wed Nov 04 08:20:39 2015 us=663704   push_ifconfig_defined = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   push_ifconfig_local = 0.0.0.0
Wed Nov 04 08:20:39 2015 us=663704   push_ifconfig_remote_netmask = 0.0.0.0
Wed Nov 04 08:20:39 2015 us=663704   push_ifconfig_ipv6_defined = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   push_ifconfig_ipv6_local = ::/0
Wed Nov 04 08:20:39 2015 us=663704   push_ifconfig_ipv6_remote = ::
Wed Nov 04 08:20:39 2015 us=663704   enable_c2c = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   duplicate_cn = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   cf_max = 0
Wed Nov 04 08:20:39 2015 us=663704   cf_per = 0
Wed Nov 04 08:20:39 2015 us=663704   max_clients = 1024
Wed Nov 04 08:20:39 2015 us=663704   max_routes_per_client = 256
Wed Nov 04 08:20:39 2015 us=663704   auth_user_pass_verify_script = '[UNDEF]'
Wed Nov 04 08:20:39 2015 us=663704   auth_user_pass_verify_script_via_file = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   client = ENABLED
Wed Nov 04 08:20:39 2015 us=663704   pull = ENABLED
Wed Nov 04 08:20:39 2015 us=663704   auth_user_pass_file = '[UNDEF]'
Wed Nov 04 08:20:39 2015 us=663704   show_net_up = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   route_method = 2
Wed Nov 04 08:20:39 2015 us=663704   ip_win32_defined = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   ip_win32_type = 3
Wed Nov 04 08:20:39 2015 us=663704   dhcp_masq_offset = 0
Wed Nov 04 08:20:39 2015 us=663704   dhcp_lease_time = 31536000
Wed Nov 04 08:20:39 2015 us=663704   tap_sleep = 0
Wed Nov 04 08:20:39 2015 us=663704   dhcp_options = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   dhcp_renew = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   dhcp_pre_release = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   dhcp_release = DISABLED
Wed Nov 04 08:20:39 2015 us=663704   domain = '[UNDEF]'
Wed Nov 04 08:20:39 2015 us=663704   netbios_scope = '[UNDEF]'
Wed Nov 04 08:20:39 2015 us=663704   netbios_node_type = 0
Wed Nov 04 08:20:39 2015 us=663704   disable_nbt = DISABLED
Wed Nov 04 08:20:39 2015 us=663704 OpenVPN 2.3.7 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Jun  8 2015
Wed Nov 04 08:20:39 2015 us=663704 library versions: OpenSSL 1.0.1m 19 Mar 2015, LZO 2.08
Enter Management Password:
Wed Nov 04 08:20:39 2015 us=663704 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Wed Nov 04 08:20:39 2015 us=663704 Need hold release from management interface, waiting...
Wed Nov 04 08:20:40 2015 us=148268 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Wed Nov 04 08:20:40 2015 us=257644 MANAGEMENT: CMD 'state on'
Wed Nov 04 08:20:40 2015 us=257644 MANAGEMENT: CMD 'log all on'
Wed Nov 04 08:20:40 2015 us=773081 MANAGEMENT: CMD 'hold off'
Wed Nov 04 08:20:40 2015 us=773081 MANAGEMENT: CMD 'hold release'
Wed Nov 04 08:20:40 2015 us=991829 LZO compression initialized
Wed Nov 04 08:20:40 2015 us=991829 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:3 ]
Wed Nov 04 08:20:40 2015 us=991829 Socket Buffers: R=[65536->65536] S=[65536->65536]
Wed Nov 04 08:20:40 2015 us=991829 MANAGEMENT: >STATE:1446654040,RESOLVE,,,
Wed Nov 04 08:20:41 2015 us=7468 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:143 ET:0 EL:3 AF:3/1 ]
Wed Nov 04 08:20:41 2015 us=7468 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Wed Nov 04 08:20:41 2015 us=7468 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Wed Nov 04 08:20:41 2015 us=7468 Local Options hash (VER=V4): '41690919'
Wed Nov 04 08:20:41 2015 us=7468 Expected Remote Options hash (VER=V4): '530fdded'
Wed Nov 04 08:20:41 2015 us=7468 UDPv4 link local: [undef]
Wed Nov 04 08:20:41 2015 us=7468 UDPv4 link remote: [AF_INET]104.36.242.38:1194
Wed Nov 04 08:20:41 2015 us=7468 MANAGEMENT: >STATE:1446654041,WAIT,,,
Wed Nov 04 08:20:41 2015 us=54347 MANAGEMENT: >STATE:1446654041,AUTH,,,
Wed Nov 04 08:20:41 2015 us=54347 TLS: Initial packet from [AF_INET]104.36.242.38:1194, sid=88278c41 0847486f
Wed Nov 04 08:20:41 2015 us=413899 VERIFY OK: depth=1, C=US, ST=WA, L=Bellingham, O=Coastal Geologic Services, OU=Main, CN=piServer, name=CGS, emailAddress=jonathan@coastalgeo.com
Wed Nov 04 08:20:41 2015 us=413899 Validating certificate key usage
Wed Nov 04 08:20:41 2015 us=413899 ++ Certificate has key usage  00a0, expects 00a0
Wed Nov 04 08:20:41 2015 us=413899 VERIFY KU OK
Wed Nov 04 08:20:41 2015 us=413899 Validating certificate extended key usage
Wed Nov 04 08:20:41 2015 us=413899 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Wed Nov 04 08:20:41 2015 us=413899 VERIFY EKU OK
Wed Nov 04 08:20:41 2015 us=413899 VERIFY OK: depth=0, C=US, ST=WA, L=Bellingham, O=Coastal Geologic Services, OU=Main, CN=piServer, name=CGS, emailAddress=jonathan@coastalgeo.com
Wed Nov 04 08:20:41 2015 us=929372 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Nov 04 08:20:41 2015 us=929372 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Nov 04 08:20:41 2015 us=929372 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Nov 04 08:20:41 2015 us=929372 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Nov 04 08:20:41 2015 us=929372 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Wed Nov 04 08:20:41 2015 us=929372 [piServer] Peer Connection Initiated with [AF_INET]104.36.242.38:1194
Wed Nov 04 08:20:42 2015 us=976265 MANAGEMENT: >STATE:1446654042,GET_CONFIG,,,
Wed Nov 04 08:20:44 2015 us=23276 SENT CONTROL [piServer]: 'PUSH_REQUEST' (status=1)
Wed Nov 04 08:20:44 2015 us=70160 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,route 10.1.10.0 255.255.255.0,dhcp-option WINS 10.8.0.0,dhcp-option DNS 10.1.10.1,dhcp-option DNS 8.8.8.8,route 10.8.0.1,topology net30,ifconfig 10.8.0.6 10.8.0.5'
Wed Nov 04 08:20:44 2015 us=70160 OPTIONS IMPORT: --ifconfig/up options modified
Wed Nov 04 08:20:44 2015 us=70160 OPTIONS IMPORT: route options modified
Wed Nov 04 08:20:44 2015 us=70160 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Wed Nov 04 08:20:44 2015 us=101234 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Nov 04 08:20:44 2015 us=101234 MANAGEMENT: >STATE:1446654044,ASSIGN_IP,,10.8.0.6,
Wed Nov 04 08:20:44 2015 us=101234 open_tun, tt->ipv6=0
Wed Nov 04 08:20:44 2015 us=101234 TAP-WIN32 device [Ethernet] opened: \\.\Global\{A8DDE4B0-77C1-4ECE-ACA6-16B770DC421F}.tap
Wed Nov 04 08:20:44 2015 us=101234 TAP-Windows Driver Version 9.9 
Wed Nov 04 08:20:44 2015 us=101234 TAP-Windows MTU=1500
Wed Nov 04 08:20:44 2015 us=116838 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.6/255.255.255.252 on interface {A8DDE4B0-77C1-4ECE-ACA6-16B770DC421F} [DHCP-serv: 10.8.0.5, lease-time: 31536000]
Wed Nov 04 08:20:44 2015 us=116838 DHCP option string: 06080a01 0a010808 08082c04 0a080000
Wed Nov 04 08:20:44 2015 us=116838 Successful ARP Flush on interface [12] {A8DDE4B0-77C1-4ECE-ACA6-16B770DC421F}
Wed Nov 04 08:20:49 2015 us=179642 TEST ROUTES: 0/0 succeeded len=2 ret=0 a=0 u/d=down
Wed Nov 04 08:20:49 2015 us=179642 Route: Waiting for TUN/TAP interface to come up...
Wed Nov 04 08:20:54 2015 us=227084 TEST ROUTES: 0/0 succeeded len=2 ret=0 a=0 u/d=down
Wed Nov 04 08:20:54 2015 us=227084 Route: Waiting for TUN/TAP interface to come up...
Wed Nov 04 08:20:55 2015 us=320839 TEST ROUTES: 0/0 succeeded len=2 ret=0 a=0 u/d=down
Wed Nov 04 08:20:55 2015 us=320839 Route: Waiting for TUN/TAP interface to come up...
Wed Nov 04 08:20:56 2015 us=414438 TEST ROUTES: 0/0 succeeded len=2 ret=0 a=0 u/d=down
Wed Nov 04 08:20:56 2015 us=414438 Route: Waiting for TUN/TAP interface to come up...
Wed Nov 04 08:20:57 2015 us=508269 TEST ROUTES: 0/0 succeeded len=2 ret=0 a=0 u/d=down
Wed Nov 04 08:20:57 2015 us=508269 Route: Waiting for TUN/TAP interface to come up...
Wed Nov 04 08:20:58 2015 us=602090 TEST ROUTES: 0/0 succeeded len=2 ret=0 a=0 u/d=down
Wed Nov 04 08:20:58 2015 us=602090 Route: Waiting for TUN/TAP interface to come up...
Wed Nov 04 08:20:59 2015 us=695847 TEST ROUTES: 0/0 succeeded len=2 ret=0 a=0 u/d=down
Wed Nov 04 08:20:59 2015 us=695847 Route: Waiting for TUN/TAP interface to come up...
Wed Nov 04 08:21:00 2015 us=789598 TEST ROUTES: 0/0 succeeded len=2 ret=0 a=0 u/d=down
Wed Nov 04 08:21:00 2015 us=789598 Route: Waiting for TUN/TAP interface to come up...
Wed Nov 04 08:21:01 2015 us=133274 TCP/UDP: Closing socket
Wed Nov 04 08:21:01 2015 us=133274 Closing TUN/TAP interface
Wed Nov 04 08:21:01 2015 us=133274 SIGTERM[hard,] received, process exiting
Wed Nov 04 08:21:01 2015 us=133274 MANAGEMENT: >STATE:1446654061,EXITING,SIGTERM,,

I cancelled this attempt after just a few "Route: Waiting" messages, as in my experience it has always failed when this occurs.

Thanks for taking the time to take a look!

Traffic

jonwaggoner wroteand have tried restarting the DHCP service after a failure

Make sure the Windows DHCP client service is running at all times ..

jonwaggoner

The main client I'm testing with is definitely on DHCP at all times, as that's how the LAN it's on is set up right now.

The reason I've tried restarting the DHCP service is that I've read elsewhere that a restart can get the connection working again. Doesn't work consistently for me though.

jonwaggoner

Traffic wroteMake sure the Windows DHCP client service is running at all times ..

What about my symptom suggests it isn't running? The DHCP client is up and running the whole time the connection is attempted. I only try to restart it, as some troubleshooting steps for Windows TUN/TAP problems have suggested restarting the DHCP service when my symptoms are presented.

Traffic

jonwaggoner wroteClient verb 4 log when a connection fails (don't have one with a connection right now)

Post one when you do :geek:

selvanair

I'm having issues getting Windows machines to connect to my server with a repeated message over and over when it fails, which happens 9 times out of 10:
TEST ROUTES: 0/0 succeeded len=2 ret=0 a=0 u/d=down
Route: Waiting for TUN/TAP interface to come up...

Errors are only on the client, right? What version of openvpn does the client run? Version of tap driver? Is ICS enabled on any of the LAN/WIFI adapters on the client?

Thanks,

Selva