Why won't tunnel pass traffic?

sailtoad

I am absolutely stumped trying to pass traffic through a tunnel between a windows OpenVPN Server and a DD-WRT router Client. The tunnel seems to be created and PCs on each side can ping the virtual adapter, but not on the other side of the tunnel. The setup is very simple for testing purposes (see below) The OpenVPN server and the WAN port of the DD-WRT OpenVPN client router sit on the 192.168.8.0 subnet. A laptop is plugged into the LAN ports of the DD-WRT router and receives a DHCP lease in the 192.168.11.0 subnet.

SERVER>---------192.168.8.0------------<ROUTER>----------------------<PC
192.168.8.239 192.168.8.51/192.168.11.0 192.168.11.134
10.8.0.1>-----------TUNNEL-------------<10.8.0.2

All firewalls have been disabled in client and server. A gateway was added to the Windows TAP adapter so it appears as a "Work" network rather than unidentified. See Routing table below) IP forwarding has been enabled on Server.

What am I missing? Why doesn't the tunnel pass any data?

Configuration files, connection logs, routing tables, and tracert results are listed below. If you cut and paste into Notepad you can unwrap the routing tables and it will be easier to read. (Provided tabs are not stripped off.)

Tracert from a PC in the Servers subnet. Note that static routes for 10.8.0.0 and 192.168.11.0 have been added the default router (192.168.8.250) and point to the OpenVPN Server. Results are similar from the client side.

Tracing route to OPENVPN [10.8.0.1]
over a maximum of 30 hops:

1 <1 ms <1 ms <1 ms 192.168.8.250
2 * * * Request timed out.
3 1 ms 1 ms 1 ms OPENVPN [10.8.0.1]

Trace complete.

Tracing route to 10.8.0.2 over a maximum of 30 hops

1 1 ms <1 ms <1 ms 192.168.8.250
2 1 ms 1 ms 1 ms OpenVPN [192.168.8.239]
3 * * * Request timed out.
4 * * * Request timed out.
5 * * * Request timed out.

Tracing route to 192.168.11.134 over a maximum of 30 hops

1 <1 ms <1 ms <1 ms 192.168.8.250
2 1 ms 1 ms 1 ms OpenVPN [192.168.8.239]
3 * * * Request timed out.
4 * * * Request timed out.
5 * * * Request timed out.

WINDOWS 7 - SERVER CONFIGURATION FILE
###################################
local 192.168.8.239
port 1194
proto udp
dev tun
dev-node MyTap
ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\config\\server.crt"
key "C:\\Program Files\\OpenVPN\\config\\server.key"
dh "C:\\Program Files\\OpenVPN\\config\\dh1024.pem"
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
client-config-dir ccd
push "route 192.168.11.0 255.255.255.0"
push "route 192.168.10.0 255.255.255.0"
push "route 192.168.9.0 255.255.255.0"
push "route 192.168.8.0 255.255.255.0"
route 192.168.9.0 255.255.255.0
route 192.168.10.0 255.255.255.0
route 192.168.11.0 255.255.255.0
push "dhcp-option DNS 192.168.8.240"
push "dhcp-option WINS 192.168.8.240"
client-to-client
keepalive 10 120
cipher BF-CBC
comp-lzo
max-clients 20
persist-key
persist-tun
status openvpn-status.log
log openvpn.log
verb 6
mute 20

DD-WRT ROUTER - CLIENT CONFIGURATION FILE
#####################################
ca /tmp/openvpncl/ca.crt
cert /tmp/openvpncl/client.crt
key /tmp/openvpncl/client.key
management 127.0.0.1 16
management-log-cache 100
verb 3
mute 3
syslog
writepid /var/run/openvpncl.pid
client
resolv-retry infinite
nobind
persist-key
persist-tun
script-security 2
dev tun1
proto udp
cipher bf-cbc
auth sha1
remote 192.168.8.239 1194
comp-lzo adaptive
tun-mtu 1500
mtu-disc yes
fast-io
tun-ipv6

SERVER CONNECTION LOG
##########################################
Wed Nov 11 12:06:57 2015 us=315429 Current Parameter Settings:
Wed Nov 11 12:06:57 2015 us=315429 config = 'C:\Program Files\OpenVPN\config\server.ovpn'
Wed Nov 11 12:06:57 2015 us=315429 mode = 1
Wed Nov 11 12:06:57 2015 us=315429 show_ciphers = DISABLED
Wed Nov 11 12:06:57 2015 us=315429 show_digests = DISABLED
Wed Nov 11 12:06:57 2015 us=315429 show_engines = DISABLED
Wed Nov 11 12:06:57 2015 us=315429 genkey = DISABLED
Wed Nov 11 12:06:57 2015 us=315429 key_pass_file = '[UNDEF]'
Wed Nov 11 12:06:57 2015 us=315429 show_tls_ciphers = DISABLED
Wed Nov 11 12:06:57 2015 us=315429 Connection profiles [default]:
Wed Nov 11 12:06:57 2015 us=315429 proto = udp
Wed Nov 11 12:06:57 2015 us=315429 local = '192.168.8.239'
Wed Nov 11 12:06:57 2015 us=315429 local_port = 1194
Wed Nov 11 12:06:57 2015 us=315429 remote = '[UNDEF]'
Wed Nov 11 12:06:57 2015 us=315429 remote_port = 1194
Wed Nov 11 12:06:57 2015 us=315429 remote_float = DISABLED
Wed Nov 11 12:06:57 2015 us=315429 bind_defined = DISABLED
Wed Nov 11 12:06:57 2015 us=315429 bind_local = ENABLED
Wed Nov 11 12:06:57 2015 us=315429 connect_retry_seconds = 5
Wed Nov 11 12:06:57 2015 us=315429 connect_timeout = 10
Wed Nov 11 12:06:57 2015 us=315429 NOTE: --mute triggered...
Wed Nov 11 12:06:57 2015 us=315429 278 variation(s) on previous 20 message(s) suppressed by --mute
Wed Nov 11 12:06:57 2015 us=315429 OpenVPN 2.3.8 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Aug 4 2015
Wed Nov 11 12:06:57 2015 us=315429 library versions: OpenSSL 1.0.1p 9 Jul 2015, LZO 2.08
Wed Nov 11 12:06:57 2015 us=549804 Diffie-Hellman initialized with 1024 bit key
Wed Nov 11 12:06:57 2015 us=549804 TLS-Auth MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:3 ]
Wed Nov 11 12:06:57 2015 us=549804 Socket Buffers: R=[8192->8192] S=[8192->8192]
Wed Nov 11 12:06:57 2015 us=565429 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Nov 11 12:06:57 2015 us=565429 open_tun, tt->ipv6=0
Wed Nov 11 12:06:57 2015 us=565429 TAP-WIN32 device [MyTap] opened: \\.\Global\{66B18222-F85E-4076-8210-0840CD058FA8}.tap
Wed Nov 11 12:06:57 2015 us=565429 TAP-Windows Driver Version 9.21
Wed Nov 11 12:06:57 2015 us=565429 TAP-Windows MTU=1500
Wed Nov 11 12:06:57 2015 us=565429 Set TAP-Windows TUN subnet mode network/local/netmask = 10.8.0.0/10.8.0.1/255.255.255.0 [SUCCEEDED]
Wed Nov 11 12:06:57 2015 us=565429 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.1/255.255.255.0 on interface {66B18222-F85E-4076-8210-0840CD058FA8} [DHCP-serv: 10.8.0.254, lease-time: 31536000]
Wed Nov 11 12:06:57 2015 us=565429 Sleeping for 10 seconds...
Wed Nov 11 12:07:07 2015 us=568359 Successful ARP Flush on interface [19] {66B18222-F85E-4076-8210-0840CD058FA8}
Wed Nov 11 12:07:07 2015 us=568359 C:\Windows\system32\route.exe ADD 192.168.9.0 MASK 255.255.255.0 10.8.0.2
Wed Nov 11 12:07:07 2015 us=568359 ROUTE: route addition failed using CreateIpForwardEntry: The object already exists. [status=5010 if_index=19]
Wed Nov 11 12:07:07 2015 us=568359 Route addition via IPAPI failed [adaptive]
Wed Nov 11 12:07:07 2015 us=568359 Route addition fallback to route.exe
Wed Nov 11 12:07:07 2015 us=568359 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Wed Nov 11 12:07:07 2015 us=615234 C:\Windows\system32\route.exe ADD 192.168.10.0 MASK 255.255.255.0 10.8.0.2
Wed Nov 11 12:07:07 2015 us=630859 ROUTE: route addition failed using CreateIpForwardEntry: The object already exists. [status=5010 if_index=19]
Wed Nov 11 12:07:07 2015 us=630859 Route addition via IPAPI failed [adaptive]
Wed Nov 11 12:07:07 2015 us=630859 Route addition fallback to route.exe
Wed Nov 11 12:07:07 2015 us=630859 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Wed Nov 11 12:07:07 2015 us=646484 C:\Windows\system32\route.exe ADD 192.168.11.0 MASK 255.255.255.0 10.8.0.2
Wed Nov 11 12:07:07 2015 us=646484 ROUTE: route addition failed using CreateIpForwardEntry: The object already exists. [status=5010 if_index=19]
Wed Nov 11 12:07:07 2015 us=646484 Route addition via IPAPI failed [adaptive]
Wed Nov 11 12:07:07 2015 us=646484 Route addition fallback to route.exe
Wed Nov 11 12:07:07 2015 us=646484 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Wed Nov 11 12:07:07 2015 us=677734 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:143 ET:0 EL:3 AF:3/1 ]
Wed Nov 11 12:07:07 2015 us=677734 UDPv4 link local (bound): [AF_INET]192.168.8.239:1194
Wed Nov 11 12:07:07 2015 us=677734 UDPv4 link remote: [undef]
Wed Nov 11 12:07:07 2015 us=677734 MULTI: multi_init called, r=256 v=256
Wed Nov 11 12:07:07 2015 us=677734 IFCONFIG POOL: base=10.8.0.2 size=252, ipv6=0
Wed Nov 11 12:07:07 2015 us=677734 ifconfig_pool_read(), in='WNDR3700v2,10.8.0.2', TODO: IPv6
Wed Nov 11 12:07:07 2015 us=677734 succeeded -> ifconfig_pool_set()
Wed Nov 11 12:07:07 2015 us=677734 IFCONFIG POOL LIST
Wed Nov 11 12:07:07 2015 us=677734 WNDR3700v2,10.8.0.2
Wed Nov 11 12:07:07 2015 us=677734 Initialization Sequence Completed
Wed Nov 11 12:08:09 2015 us=460937 MULTI: multi_create_instance called
Wed Nov 11 12:08:09 2015 us=460937 192.168.8.51:47956 Re-using SSL/TLS context
Wed Nov 11 12:08:09 2015 us=460937 192.168.8.51:47956 LZO compression initialized
Wed Nov 11 12:08:09 2015 us=460937 192.168.8.51:47956 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:3 ]
Wed Nov 11 12:08:09 2015 us=460937 192.168.8.51:47956 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:143 ET:0 EL:3 AF:3/1 ]
Wed Nov 11 12:08:09 2015 us=460937 192.168.8.51:47956 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Wed Nov 11 12:08:09 2015 us=460937 192.168.8.51:47956 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Wed Nov 11 12:08:09 2015 us=460937 192.168.8.51:47956 Local Options hash (VER=V4): '530fdded'
Wed Nov 11 12:08:09 2015 us=460937 192.168.8.51:47956 Expected Remote Options hash (VER=V4): '41690919'
Wed Nov 11 12:08:09 2015 us=460937 192.168.8.51:47956 UDPv4 READ [14] from [AF_INET]192.168.8.51:47956: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 [ ] pid=0 DATA len=0
Wed Nov 11 12:08:09 2015 us=460937 192.168.8.51:47956 TLS: Initial packet from [AF_INET]192.168.8.51:47956, sid=56ee779d 8df04483
Wed Nov 11 12:08:09 2015 us=460937 192.168.8.51:47956 UDPv4 WRITE [26] to [AF_INET]192.168.8.51:47956: P_CONTROL_HARD_RESET_SERVER_V2 kid=0 [ 0 ] pid=0 DATA len=0
Wed Nov 11 12:08:09 2015 us=460937 192.168.8.51:47956 UDPv4 READ [22] from [AF_INET]192.168.8.51:47956: P_ACK_V1 kid=0 [ 0 ]
Wed Nov 11 12:08:09 2015 us=460937 192.168.8.51:47956 UDPv4 READ [114] from [AF_INET]192.168.8.51:47956: P_CONTROL_V1 kid=0 [ ] pid=1 DATA len=100
Wed Nov 11 12:08:09 2015 us=460937 192.168.8.51:47956 UDPv4 WRITE [22] to [AF_INET]192.168.8.51:47956: P_ACK_V1 kid=0 [ 1 ]
Wed Nov 11 12:08:09 2015 us=460937 192.168.8.51:47956 UDPv4 READ [91] from [AF_INET]192.168.8.51:47956: P_CONTROL_V1 kid=0 [ ] pid=2 DATA len=77
Wed Nov 11 12:08:09 2015 us=460937 192.168.8.51:47956 UDPv4 WRITE [126] to [AF_INET]192.168.8.51:47956: P_CONTROL_V1 kid=0 [ 2 ] pid=1 DATA len=100
Wed Nov 11 12:08:09 2015 us=460937 192.168.8.51:47956 UDPv4 WRITE [114] to [AF_INET]192.168.8.51:47956: P_CONTROL_V1 kid=0 [ ] pid=2 DATA len=100
Wed Nov 11 12:08:09 2015 us=476562 192.168.8.51:47956 UDPv4 WRITE [114] to [AF_INET]192.168.8.51:47956: P_CONTROL_V1 kid=0 [ ] pid=3 DATA len=100
Wed Nov 11 12:08:09 2015 us=476562 192.168.8.51:47956 UDPv4 WRITE [114] to [AF_INET]192.168.8.51:47956: P_CONTROL_V1 kid=0 [ ] pid=4 DATA len=100
Wed Nov 11 12:08:09 2015 us=476562 192.168.8.51:47956 UDPv4 READ [22] from [AF_INET]192.168.8.51:47956: P_ACK_V1 kid=0 [ 1 ]
Wed Nov 11 12:08:09 2015 us=476562 192.168.8.51:47956 UDPv4 WRITE [114] to [AF_INET]192.168.8.51:47956: P_CONTROL_V1 kid=0 [ ] pid=5 DATA len=100
Wed Nov 11 12:08:09 2015 us=476562 192.168.8.51:47956 UDPv4 READ [22] from [AF_INET]192.168.8.51:47956: P_ACK_V1 kid=0 [ 2 ]
Wed Nov 11 12:08:09 2015 us=476562 192.168.8.51:47956 UDPv4 WRITE [114] to [AF_INET]192.168.8.51:47956: P_CONTROL_V1 kid=0 [ ] pid=6 DATA len=100
Wed Nov 11 12:08:09 2015 us=476562 192.168.8.51:47956 UDPv4 READ [22] from [AF_INET]192.168.8.51:47956: P_ACK_V1 kid=0 [ 3 ]
Wed Nov 11 12:08:09 2015 us=476562 192.168.8.51:47956 UDPv4 WRITE [114] to [AF_INET]192.168.8.51:47956: P_CONTROL_V1 kid=0 [ ] pid=7 DATA len=100
Wed Nov 11 12:08:09 2015 us=476562 192.168.8.51:47956 UDPv4 READ [22] from [AF_INET]192.168.8.51:47956: P_ACK_V1 kid=0 [ 4 ]
Wed Nov 11 12:08:09 2015 us=476562 192.168.8.51:47956 UDPv4 WRITE [114] to [AF_INET]192.168.8.51:47956: P_CONTROL_V1 kid=0 [ ] pid=8 DATA len=100
Wed Nov 11 12:08:09 2015 us=476562 192.168.8.51:47956 UDPv4 READ [22] from [AF_INET]192.168.8.51:47956: P_ACK_V1 kid=0 [ 5 ]
Wed Nov 11 12:08:09 2015 us=476562 192.168.8.51:47956 UDPv4 WRITE [114] to [AF_INET]192.168.8.51:47956: P_CONTROL_V1 kid=0 [ ] pid=9 DATA len=100
Wed Nov 11 12:08:09 2015 us=476562 192.168.8.51:47956 UDPv4 READ [22] from [AF_INET]192.168.8.51:47956: P_ACK_V1 kid=0 [ 6 ]
Wed Nov 11 12:08:09 2015 us=476562 192.168.8.51:47956 NOTE: --mute triggered...
Wed Nov 11 12:08:09 2015 us=648437 192.168.8.51:47956 81 variation(s) on previous 20 message(s) suppressed by --mute
Wed Nov 11 12:08:09 2015 us=648437 192.168.8.51:47956 VERIFY OK: depth=1, C=US, ST=OK, L=Edmond, O=XX-Home, OU=changeme, CN=MX-CA, name=changeme, emailAddress=xxx@xxxxxx.com
Wed Nov 11 12:08:09 2015 us=648437 192.168.8.51:47956 VERIFY OK: depth=0, C=US, ST=OK, L=Edmond, O=XX-Home, OU=changeme, CN=WNDR3700v2, name=changeme, emailAddress=xxxxxxx@xxxxxxxxx.com
Wed Nov 11 12:08:09 2015 us=648437 192.168.8.51:47956 UDPv4 WRITE [22] to [AF_INET]192.168.8.51:47956: P_ACK_V1 kid=0 [ 23 ]
Wed Nov 11 12:08:09 2015 us=648437 192.168.8.51:47956 UDPv4 READ [114] from [AF_INET]192.168.8.51:47956: P_CONTROL_V1 kid=0 [ ] pid=24 DATA len=100
Wed Nov 11 12:08:09 2015 us=664062 192.168.8.51:47956 UDPv4 WRITE [22] to [AF_INET]192.168.8.51:47956: P_ACK_V1 kid=0 [ 24 ]
Wed Nov 11 12:08:09 2015 us=664062 192.168.8.51:47956 UDPv4 READ [114] from [AF_INET]192.168.8.51:47956: P_CONTROL_V1 kid=0 [ ] pid=25 DATA len=100
Wed Nov 11 12:08:09 2015 us=664062 192.168.8.51:47956 UDPv4 WRITE [22] to [AF_INET]192.168.8.51:47956: P_ACK_V1 kid=0 [ 25 ]
Wed Nov 11 12:08:09 2015 us=664062 192.168.8.51:47956 UDPv4 READ [100] from [AF_INET]192.168.8.51:47956: P_CONTROL_V1 kid=0 [ ] pid=26 DATA len=86
Wed Nov 11 12:08:09 2015 us=664062 192.168.8.51:47956 UDPv4 WRITE [77] to [AF_INET]192.168.8.51:47956: P_CONTROL_V1 kid=0 [ 26 ] pid=29 DATA len=51
Wed Nov 11 12:08:09 2015 us=664062 192.168.8.51:47956 UDPv4 READ [126] from [AF_INET]192.168.8.51:47956: P_CONTROL_V1 kid=0 [ 29 ] pid=27 DATA len=100
Wed Nov 11 12:08:09 2015 us=664062 192.168.8.51:47956 UDPv4 WRITE [22] to [AF_INET]192.168.8.51:47956: P_ACK_V1 kid=0 [ 27 ]
Wed Nov 11 12:08:09 2015 us=664062 192.168.8.51:47956 UDPv4 READ [114] from [AF_INET]192.168.8.51:47956: P_CONTROL_V1 kid=0 [ ] pid=28 DATA len=100
Wed Nov 11 12:08:09 2015 us=664062 192.168.8.51:47956 UDPv4 WRITE [22] to [AF_INET]192.168.8.51:47956: P_ACK_V1 kid=0 [ 28 ]
Wed Nov 11 12:08:09 2015 us=664062 192.168.8.51:47956 UDPv4 READ [114] from [AF_INET]192.168.8.51:47956: P_CONTROL_V1 kid=0 [ ] pid=29 DATA len=100
Wed Nov 11 12:08:09 2015 us=664062 192.168.8.51:47956 UDPv4 WRITE [22] to [AF_INET]192.168.8.51:47956: P_ACK_V1 kid=0 [ 29 ]
Wed Nov 11 12:08:09 2015 us=664062 192.168.8.51:47956 UDPv4 READ [31] from [AF_INET]192.168.8.51:47956: P_CONTROL_V1 kid=0 [ ] pid=30 DATA len=17
Wed Nov 11 12:08:09 2015 us=664062 192.168.8.51:47956 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Nov 11 12:08:09 2015 us=664062 192.168.8.51:47956 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Nov 11 12:08:09 2015 us=664062 192.168.8.51:47956 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Nov 11 12:08:09 2015 us=664062 192.168.8.51:47956 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Nov 11 12:08:09 2015 us=664062 192.168.8.51:47956 UDPv4 WRITE [126] to [AF_INET]192.168.8.51:47956: P_CONTROL_V1 kid=0 [ 30 ] pid=30 DATA len=100
Wed Nov 11 12:08:09 2015 us=664062 192.168.8.51:47956 UDPv4 WRITE [114] to [AF_INET]192.168.8.51:47956: P_CONTROL_V1 kid=0 [ ] pid=31 DATA len=100
Wed Nov 11 12:08:09 2015 us=664062 192.168.8.51:47956 UDPv4 WRITE [44] to [AF_INET]192.168.8.51:47956: P_CONTROL_V1 kid=0 [ ] pid=32 DATA len=30
Wed Nov 11 12:08:09 2015 us=664062 192.168.8.51:47956 UDPv4 READ [22] from [AF_INET]192.168.8.51:47956: P_ACK_V1 kid=0 [ 30 ]
Wed Nov 11 12:08:09 2015 us=664062 192.168.8.51:47956 UDPv4 READ [22] from [AF_INET]192.168.8.51:47956: P_ACK_V1 kid=0 [ 31 ]
Wed Nov 11 12:08:09 2015 us=664062 192.168.8.51:47956 UDPv4 READ [22] from [AF_INET]192.168.8.51:47956: P_ACK_V1 kid=0 [ 32 ]
Wed Nov 11 12:08:09 2015 us=664062 192.168.8.51:47956 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 1024 bit RSA
Wed Nov 11 12:08:09 2015 us=664062 192.168.8.51:47956 [WNDR3700v2] Peer Connection Initiated with [AF_INET]192.168.8.51:47956
Wed Nov 11 12:08:09 2015 us=664062 WNDR3700v2/192.168.8.51:47956 OPTIONS IMPORT: reading client specific options from: ccd\WNDR3700v2
Wed Nov 11 12:08:09 2015 us=664062 WNDR3700v2/192.168.8.51:47956 MULTI_sva: pool returned IPv4=10.8.0.2, IPv6=(Not enabled)
Wed Nov 11 12:08:09 2015 us=664062 WNDR3700v2/192.168.8.51:47956 MULTI: Learn: 10.8.0.2 -> WNDR3700v2/192.168.8.51:47956
Wed Nov 11 12:08:09 2015 us=664062 WNDR3700v2/192.168.8.51:47956 MULTI: primary virtual IP for WNDR3700v2/192.168.8.51:47956: 10.8.0.2
Wed Nov 11 12:08:09 2015 us=664062 WNDR3700v2/192.168.8.51:47956 MULTI: internal route 192.168.11.0/24 -> WNDR3700v2/192.168.8.51:47956
Wed Nov 11 12:08:09 2015 us=664062 WNDR3700v2/192.168.8.51:47956 MULTI: Learn: 192.168.11.0/24 -> WNDR3700v2/192.168.8.51:47956
Wed Nov 11 12:08:09 2015 us=664062 WNDR3700v2/192.168.8.51:47956 REMOVE PUSH ROUTE: 'route 192.168.11.0 255.255.255.0'
Wed Nov 11 12:08:12 2015 us=85937 WNDR3700v2/192.168.8.51:47956 UDPv4 READ [56] from [AF_INET]192.168.8.51:47956: P_CONTROL_V1 kid=0 [ ] pid=31 DATA len=42
Wed Nov 11 12:08:12 2015 us=85937 WNDR3700v2/192.168.8.51:47956 PUSH: Received control message: 'PUSH_REQUEST'
Wed Nov 11 12:08:12 2015 us=85937 WNDR3700v2/192.168.8.51:47956 send_push_reply(): safe_cap=940
Wed Nov 11 12:08:12 2015 us=85937 WNDR3700v2/192.168.8.51:47956 SENT CONTROL [WNDR3700v2]: 'PUSH_REPLY,route 192.168.10.0 255.255.255.0,route 192.168.9.0 255.255.255.0,route 192.168.8.0 255.255.255.0,dhcp-option DNS 192.168.8.240,dhcp-option WINS 192.168.8.240,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.8.0.2 255.255.255.0' (status=1)
Wed Nov 11 12:08:12 2015 us=85937 WNDR3700v2/192.168.8.51:47956 UDPv4 WRITE [22] to [AF_INET]192.168.8.51:47956: P_ACK_V1 kid=0 [ 31 ]
Wed Nov 11 12:08:12 2015 us=85937 WNDR3700v2/192.168.8.51:47956 UDPv4 WRITE [114] to [AF_INET]192.168.8.51:47956: P_CONTROL_V1 kid=0 [ ] pid=33 DATA len=100
Wed Nov 11 12:08:12 2015 us=85937 WNDR3700v2/192.168.8.51:47956 UDPv4 WRITE [114] to [AF_INET]192.168.8.51:47956: P_CONTROL_V1 kid=0 [ ] pid=34 DATA len=100
Wed Nov 11 12:08:12 2015 us=85937 WNDR3700v2/192.168.8.51:47956 UDPv4 WRITE [108] to [AF_INET]192.168.8.51:47956: P_CONTROL_V1 kid=0 [ ] pid=35 DATA len=94
Wed Nov 11 12:08:12 2015 us=85937 WNDR3700v2/192.168.8.51:47956 UDPv4 READ [22] from [AF_INET]192.168.8.51:47956: P_ACK_V1 kid=0 [ 33 ]
Wed Nov 11 12:08:12 2015 us=85937 WNDR3700v2/192.168.8.51:47956 UDPv4 READ [22] from [AF_INET]192.168.8.51:47956: P_ACK_V1 kid=0 [ 34 ]
Wed Nov 11 12:08:17 2015 us=23437 WNDR3700v2/192.168.8.51:47956 UDPv4 WRITE [108] to [AF_INET]192.168.8.51:47956: P_CONTROL_V1 kid=0 [ ] pid=35 DATA len=94
Wed Nov 11 12:08:21 2015 us=773437 WNDR3700v2/192.168.8.51:47956 UDPv4 WRITE [108] to [AF_INET]192.168.8.51:47956: P_CONTROL_V1 kid=0 [ ] pid=35 DATA len=94
Wed Nov 11 12:08:29 2015 us=757812 WNDR3700v2/192.168.8.51:47956 UDPv4 WRITE [108] to [AF_INET]192.168.8.51:47956: P_CONTROL_V1 kid=0 [ ] pid=35 DATA len=94
Wed Nov 11 12:08:40 2015 us=70312 WNDR3700v2/192.168.8.51:47956 UDPv4 WRITE [53] to [AF_INET]192.168.8.51:47956: P_DATA_V1 kid=0 DATA len=52
Wed Nov 11 12:08:45 2015 us=539062 WNDR3700v2/192.168.8.51:47956 UDPv4 WRITE [108] to [AF_INET]192.168.8.51:47956: P_CONTROL_V1 kid=0 [ ] pid=35 DATA len=94
Wed Nov 11 12:08:55 2015 us=882812 WNDR3700v2/192.168.8.51:47956 UDPv4 WRITE [53] to [AF_INET]192.168.8.51:47956: P_DATA_V1 kid=0 DATA len=52
Wed Nov 11 12:09:05 2015 us=257812 WNDR3700v2/192.168.8.51:47956 UDPv4 WRITE [53] to [AF_INET]192.168.8.51:47956: P_DATA_V1 kid=0 DATA len=52
Wed Nov 11 12:09:15 2015 us=382812 WNDR3700v2/192.168.8.51:47956 UDPv4 WRITE [53] to [AF_INET]192.168.8.51:47956: P_DATA_V1 kid=0 DATA len=52
Wed Nov 11 12:09:17 2015 us=632812 WNDR3700v2/192.168.8.51:47956 UDPv4 WRITE [108] to [AF_INET]192.168.8.51:47956: P_CONTROL_V1 kid=0 [ ] pid=35 DATA len=94
Wed Nov 11 12:09:27 2015 us=992187 WNDR3700v2/192.168.8.51:47956 UDPv4 WRITE [53] to [AF_INET]192.168.8.51:47956: P_DATA_V1 kid=0 DATA len=52
Wed Nov 11 12:09:37 2015 us=867187 WNDR3700v2/192.168.8.51:47956 UDPv4 WRITE [53] to [AF_INET]192.168.8.51:47956: P_DATA_V1 kid=0 DATA len=52
Wed Nov 11 12:09:47 2015 us=210937 WNDR3700v2/192.168.8.51:47956 UDPv4 WRITE [53] to [AF_INET]192.168.8.51:47956: P_DATA_V1 kid=0 DATA len=52
Wed Nov 11 12:09:57 2015 us=601562 WNDR3700v2/192.168.8.51:47956 UDPv4 WRITE [53] to [AF_INET]192.168.8.51:47956: P_DATA_V1 kid=0 DATA len=52
Wed Nov 11 12:10:07 2015 us=585937 WNDR3700v2/192.168.8.51:47956 UDPv4 WRITE [53] to [AF_INET]192.168.8.51:47956: P_DATA_V1 kid=0 DATA len=52

CLIENT CONNECTION LOG
#########################################
Clientlog:
19691231 18:00:08 I OpenVPN 2.3.8 mips-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Oct 30 2015
19691231 18:00:08 I library versions: OpenSSL 1.0.2d 9 Jul 2015 LZO 2.09
19691231 18:00:08 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:16
19691231 18:00:08 W WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
19691231 18:00:08 W NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
19691231 18:00:08 W WARNING: file '/tmp/openvpncl/client.key' is group or others accessible
19691231 18:00:08 Socket Buffers: R=[172032->131072] S=[172032->131072]
19691231 18:00:08 I UDPv4 link local: [undef]
19691231 18:00:08 I UDPv4 link remote: [AF_INET]192.168.8.239:1194
20151111 12:08:06 I [UNDEF] Inactivity timeout (--ping-restart) restarting
20151111 12:08:06 I SIGUSR1[soft ping-restart] received process restarting
20151111 12:08:06 Restart pause 2 second(s)
20151111 12:08:08 W WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
20151111 12:08:08 W NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
20151111 12:08:08 Socket Buffers: R=[172032->131072] S=[172032->131072]
20151111 12:08:08 I UDPv4 link local: [undef]
20151111 12:08:08 I UDPv4 link remote: [AF_INET]192.168.8.239:1194
20151111 12:08:08 TLS: Initial packet from [AF_INET]192.168.8.239:1194 sid=e9f57aee 613cf055
20151111 12:08:08 VERIFY OK: depth=1 C=US ST=OK L=Edmond O=XX-Home OU=changeme CN=MX-CA name=changeme emailAddress=xxxxxxx@xxxxxxxxx.com
20151111 12:08:08 VERIFY OK: depth=0 C=US ST=OK L=Edmond O=XX-Home OU=changeme CN=server name=changeme emailAddress=xxxxxxx@xxxxxxxxxx.com
20151111 12:08:08 NOTE: --mute triggered...
20151111 12:08:08 5 variation(s) on previous 3 message(s) suppressed by --mute
20151111 12:08:08 I [server] Peer Connection Initiated with [AF_INET]192.168.8.239:1194
20151111 12:08:10 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
20151111 12:08:10 PUSH: Received control message: 'PUSH_REPLY route 192.168.10.0 255.255.255.0 route 192.168.9.0 255.255.255.0 route 192.168.8.0 255.255.255.0 dhcp-option DNS 192.168.8.240 dhcp-option WINS 192.168.8.240 route-gateway 10.8.0.1 topology subnet ping 10 ping-restart 120 ifconfig 10.8.0.2 255.255.255.0'
20151111 12:08:10 OPTIONS IMPORT: timers and/or timeouts modified
20151111 12:08:10 NOTE: --mute triggered...
20151111 12:08:10 4 variation(s) on previous 3 message(s) suppressed by --mute
20151111 12:08:10 I TUN/TAP device tun1 opened
20151111 12:08:10 TUN/TAP TX queue length set to 100
20151111 12:08:10 I do_ifconfig tt->ipv6=1 tt->did_ifconfig_ipv6_setup=0
20151111 12:08:10 I /sbin/ifconfig tun1 10.8.0.2 netmask 255.255.255.0 mtu 1500 broadcast 10.8.0.255
20151111 12:08:10 /sbin/route add -net 192.168.10.0 netmask 255.255.255.0 gw 10.8.0.1
20151111 12:08:10 /sbin/route add -net 192.168.9.0 netmask 255.255.255.0 gw 10.8.0.1
20151111 12:08:10 /sbin/route add -net 192.168.8.0 netmask 255.255.255.0 gw 10.8.0.1
20151111 12:08:11 I Initialization Sequence Completed
20151111 12:08:11 N write UDPv4: Message too large (code=97)
20151111 12:08:11 N write UDPv4: Message too large (code=97)
20151111 12:08:11 N write UDPv4: Message too large (code=97)
20151111 12:08:12 NOTE: --mute triggered...
20151111 12:08:33 11 variation(s) on previous 3 message(s) suppressed by --mute
20151111 12:08:33 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:16
20151111 12:08:33 D MANAGEMENT: CMD 'state'
20151111 12:08:33 MANAGEMENT: Client disconnected
20151111 12:08:33 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:16
20151111 12:08:33 D MANAGEMENT: CMD 'state'
20151111 12:08:33 MANAGEMENT: Client disconnected
20151111 12:08:33 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:16
20151111 12:08:33 D MANAGEMENT: CMD 'state'
20151111 12:08:33 MANAGEMENT: Client disconnected
20151111 12:08:33 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:16
20151111 12:08:33 D MANAGEMENT: CMD 'status 2'
20151111 12:08:33 MANAGEMENT: Client disconnected
20151111 12:08:33 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:16
20151111 12:08:33 D MANAGEMENT: CMD 'log 500'
19691231 18:00:00

SERVER ROUTING TABLE
#################################
DESTINATION MASK GATEWAY INTERFACE IP METRIC TYPE PROTOCOL AGE NAME MAC DATE PERSISTENT
0.0.0.0 0.0.0.0 192.168.8.250 192.168.8.239 10 Indirect Static Route 11,591 NVIDIA nForce Networking Controller 00-16-E6-1D-23-B6 11/11/2015 9:09:50 AM No
192.168.9.0 255.255.255.0 10.8.0.2 10.8.0.1 20 Indirect Static Route 10,250 TAP-Windows Adapter V9 00-FF-66-B1-82-22 11/11/2015 9:32:11 AM No
192.168.10.0 255.255.255.0 10.8.0.2 10.8.0.1 20 Indirect Static Route 10,250 TAP-Windows Adapter V9 00-FF-66-B1-82-22 11/11/2015 9:32:11 AM No
192.168.11.0 255.255.255.0 10.8.0.2 10.8.0.1 20 Indirect Static Route 10,250 TAP-Windows Adapter V9 00-FF-66-B1-82-22 11/11/2015 9:32:11 AM No
192.168.8.0 255.255.255.0 192.168.8.239 192.168.8.239 266 Direct Static Route 11,591 NVIDIA nForce Networking Controller 00-16-E6-1D-23-B6 11/11/2015 9:09:50 AM No
192.168.8.239 255.255.255.255 192.168.8.239 192.168.8.239 266 Direct Static Route 11,591 NVIDIA nForce Networking Controller 00-16-E6-1D-23-B6 11/11/2015 9:09:50 AM No
192.168.8.255 255.255.255.255 192.168.8.239 192.168.8.239 266 Direct Static Route 11,591 NVIDIA nForce Networking Controller 00-16-E6-1D-23-B6 11/11/2015 9:09:50 AM No
224.0.0.0 240.0.0.0 192.168.8.239 192.168.8.239 266 Direct Static Route 11,602 NVIDIA nForce Networking Controller 00-16-E6-1D-23-B6 11/11/2015 9:09:39 AM No
255.255.255.255 255.255.255.255 192.168.8.239 192.168.8.239 266 Direct Static Route 11,602 NVIDIA nForce Networking Controller 00-16-E6-1D-23-B6 11/11/2015 9:09:39 AM No
0.0.0.0 0.0.0.0 10.8.0.2 10.8.0.1 276 Indirect Static Route 5,725 TAP-Windows Adapter V9 00-FF-66-B1-82-22 11/11/2015 10:47:36 AM Yes
10.8.0.0 255.255.255.0 10.8.0.1 10.8.0.1 276 Direct Static Route 964 TAP-Windows Adapter V9 00-FF-66-B1-82-22 11/11/2015 12:06:57 PM No
10.8.0.1 255.255.255.255 10.8.0.1 10.8.0.1 276 Direct Static Route 964 TAP-Windows Adapter V9 00-FF-66-B1-82-22 11/11/2015 12:06:57 PM No
10.8.0.255 255.255.255.255 10.8.0.1 10.8.0.1 276 Direct Static Route 964 TAP-Windows Adapter V9 00-FF-66-B1-82-22 11/11/2015 12:06:57 PM No
224.0.0.0 240.0.0.0 10.8.0.1 10.8.0.1 276 Direct Static Route 10,294 TAP-Windows Adapter V9 00-FF-66-B1-82-22 11/11/2015 9:31:27 AM No
255.255.255.255 255.255.255.255 10.8.0.1 10.8.0.1 276 Direct Static Route 10,294 TAP-Windows Adapter V9 00-FF-66-B1-82-22 11/11/2015 9:31:27 AM No
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 306 Direct Static Route 11,609 Software Loopback Interface 1 00-00-00-00-00-00 11/11/2015 9:09:32 AM No
127.0.0.1 255.255.255.255 127.0.0.1 127.0.0.1 306 Direct Static Route 11,609 Software Loopback Interface 1 00-00-00-00-00-00 11/11/2015 9:09:32 AM No
127.255.255.255 255.255.255.255 127.0.0.1 127.0.0.1 306 Direct Static Route 11,609 Software Loopback Interface 1 00-00-00-00-00-00 11/11/2015 9:09:32 AM No
224.0.0.0 240.0.0.0 127.0.0.1 127.0.0.1 306 Direct Static Route 11,609 Software Loopback Interface 1 00-00-00-00-00-00 11/11/2015 9:09:32 AM No
255.255.255.255 255.255.255.255 127.0.0.1 127.0.0.1 306 Direct Static Route 11,609 Software Loopback Interface 1 00-00-00-00-00-00 11/11/2015 9:09:32 AM No

CLIENT ROUTING TABLE
################################
DESTINATION MASK GATEWAY FLAGS METRIC INTERFACE
default 0.0.0.0 192.168.8.250 UG 0 WAN
10.8.0.0 255.255.255.0 * U 0 tun1
169.254.0.0 255.255.0.0 * U 0 LAN & WLAN
192.168.8.0 255.255.255.0 10.8.0.1 UG 0 tun1
192.168.8.0 255.255.255.0 * U 0 WAN
192.168.9.0 255.255.255.0 10.8.0.1 UG 0 tun1
192.168.10.0 255.255.255.0 10.8.0.1 UG 0 tun1
192.168.11.0 255.255.255.0 * U 0 LAN & WLAN

Thanks in advance for the help.

Traffic

sailtoad wroteWINDOWS 7 - SERVER CONFIGURATION FILE
###################################
client-config-dir ccd

Please post CCD file for client.

sailtoad wroteWed Nov 11 12:08:09 2015 us=664062 192.168.8.51:47956 [WNDR3700v2] Peer Connection Initiated with [AF_INET]192.168.8.51:47956
Wed Nov 11 12:08:09 2015 us=664062 WNDR3700v2/192.168.8.51:47956 OPTIONS IMPORT: reading client specific options from: ccd\WNDR3700v2
Wed Nov 11 12:08:09 2015 us=664062 WNDR3700v2/192.168.8.51:47956 MULTI_sva: pool returned IPv4=10.8.0.2, IPv6=(Not enabled)
Wed Nov 11 12:08:09 2015 us=664062 WNDR3700v2/192.168.8.51:47956 MULTI: Learn: 10.8.0.2 -> WNDR3700v2/192.168.8.51:47956
Wed Nov 11 12:08:09 2015 us=664062 WNDR3700v2/192.168.8.51:47956 MULTI: primary virtual IP for WNDR3700v2/192.168.8.51:47956: 10.8.0.2
Wed Nov 11 12:08:09 2015 us=664062 WNDR3700v2/192.168.8.51:47956 MULTI: internal route 192.168.11.0/24 -> WNDR3700v2/192.168.8.51:47956
Wed Nov 11 12:08:09 2015 us=664062 WNDR3700v2/192.168.8.51:47956 MULTI: Learn: 192.168.11.0/24 -> WNDR3700v2/192.168.8.51:47956
Wed Nov 11 12:08:09 2015 us=664062 WNDR3700v2/192.168.8.51:47956 REMOVE PUSH ROUTE: 'route 192.168.11.0 255.255.255.0'

I never saw "REMOVE PUSH " before ...

You have some quite complicated routing, I suggest you review this:
HOWTO: Expanding the scope of the VPN to include additional machines

sailtoad

Contents of \CCD\WNDR3700v2

iroute 192.168.11.0 255.255.255.0

I knew I forgot something.

FYI, I changed the client router so it actually goes out to the internet and comes back into the 192.168.8.0 network that the server is in. No change. It connects and makes a tunnel but doesn't pass any traffic. So out of frustration or desperation, I did an upgrade repair of Windows 7 on the server. After configuring the same as before, I can now ping from the 192.168.11.0 client to internal IP's in the 192.168.8.0 "server" subnet. I still can't ping beyond the client's end of the tunnel (10.8.0.2) from the server or other computers on the same network.

The REMOVE PUSH ROUTE in the log is something internal to OpenVPN. My guess is that it is an expression of the iroute statement in the ccd file?

At this point I'm wondering if it wouldn't be easier to scrap Windows and install Linux on the server. Just a thought.

sailtoad

Further Information - It appears that I actually cannot open the tunnel allowing traffic from the client side until I ping the client side of the tunnel 10.8.0.2 about 20 times from the server or another computer in the same network. Once the remote side of the tunnel responds, everything opens up from the client side and I can access shares, open web pages etc. It is though it wakes up and starts working. Go figure. See Below. Unfortunately, traffic to the client is still a no-go.

First attempt to ping client side of tunnel
Pinging 10.8.0.2 with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Reply from 10.8.0.2: bytes=32 time=10ms TTL=64
Reply from 10.8.0.2: bytes=32 time=14ms TTL=64

2nd Attempt after restarting tunnel. Tunnel passes no traffic until ~20 pings?
Pinging 10.8.0.2 with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Reply from 10.8.0.2: bytes=32 time=10ms TTL=64
Reply from 10.8.0.2: bytes=32 time=10ms TTL=64

I did read the article on expanding subnets. Thanks. I believe that is already set up. Just for clarification the other subnets are existing Sonicwall VPNs. Routes to them are already set up in the default router. But they aren't important for the issue at hand I can just remove the "PUSH" commands for them if it makes it easier.

Thanks

Traffic

sailtoad wroteI still can't ping beyond the client's end of the tunnel (10.8.0.2) from the server

Did you enable IP_Forwarding on the client ?

sailtoad

Sorry, I had to leave town for a few days. In answer to your question, yes IP forwarding is enabled "I think". The client is a ww-drt wireless gateway in it's stock client configuration with options being pushed to it from the server. The setup is supposed to be in place with the only options needed covered in the GUI.

As a final note, I finally reformatted the hard drive and created a dual boot system running Ubuntu LTS 14.04 and Window 7 Ultimate. I had no issues with either operating system hooking up and passing traffic intermittently. The client disconnects and reconnects at intervals ranging from 2 minutes to about 30 seconds. Since both Windows and Linux systems have the same behavior, it must be the WW-DRT gateway or a hardware issue on the server. And since no other applications on the server seem to be having network issues. I'm leaning towards an issue with the gateway/router. Looks like it's time to start a post on the WW-DRT site. Sorry this thread isn't likely to help anyone else. I appreciate your comments. Thanks.

Traffic

sailtoad wroteyes IP forwarding is enabled "I think".

Check it .. I had the same problem not so long ago .. I thought wrong ..

Other points ..
Your --remote is 192.168.8.239 .. this is unusual .. I presume you are trying to encrypt a wireless connection.
You have a lot of routing which you do not need to debug your problem, I would disable all the other routes
which are not involved between your DD-WRT client and PC server.
Also, disable --mute and set --verb 4

Also, why do you set MTU in the client ?

sailtoad wroteDD-WRT ROUTER - CLIENT CONFIGURATION FILE
#####################################
tun-mtu 1500
mtu-disc yes

I would comment these out.

sailtoad wroteThe tunnel seems to be created and PCs on each side can ping the virtual adapter, but not on the other side of the tunnel

As you cannot ping across the VPN server to client or vice versa, remove everything from your configs and let openVPN assign the defaults. Check the example configs.