I have the following setup: An openvpn server in subnet topology mode. An openvpn client which has a subnet behind it. I want all the clients on the subnet of the client to be able to connect to the server. According to the guides [url=https://community.openvpn.net/openvpn/wiki/Concepts-Addressing]here[/url], [url=http://backreference.org/2009/11/15/openvpn-and-iroute/]here[/url] and [url=https://openvpn.net/index.php/open-source/documentation/howto.html]here[/url] I have set up the network like this: The vpn subnet is 10.9.0.0/24 The server is 10.9.0.1 The client is 10.9.0.201 The client is on the subnet 192.168.210.0/24 The client's ip on the subnet is 192.168.210.201 First I have generated keys for the server and the client. Then I have configured the server like: [code] local 999.999.999.999 (omitted) proto udp dev tun topology subnet server 10.9.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt client-config-dir ccd and a lot of security related stuff [/code] And the client to work with it. I have set up a CCD for the client to have the specific ip on the vpn: [code]ifconfig-push 10.9.0.201 255.255.255.0[/code] Tried out and it worked fine. Both server and client were able to ping each other. Everything was fine. The ip of the client was set up properly by the ccd. Then I have added the iroute to the client ccd: [code]iroute 192.168.210.0 255.255.255.0[/code] Restart both vpn client and server and stuff were still working. Then added [code]route 192.168.210.0 255.255.255.0[/code] to the server and the connection stopped working. The server logged the incoming connections populated the status log by the clients etc. But no ping went through between the server and client. The log was empty of errors. The following was added to the servers route table: 192.168.210.0 255.255.255.0 10.9.0.2 10.9.0.1 20 Why would the server add 10.9.0.2 as a gateway? The client has an other address. Where did it get that address from? Anyway changing the client's IP to 10.9.0.2 does not change anything. Removing the iroute from the config makes the server and client able to communicate again, but the other clients still cannot react the server (having the error bad source address from client showing up in the server log of course). What am I missing here?

[quote="SoonDead"]The log was empty of errors[/quote]Set [b]verb 4[/b] in your config files and post your logs.

Configuring client subnet messes up routing

SoonDead

I have the following setup:

An openvpn server in subnet topology mode.

An openvpn client which has a subnet behind it.

I want all the clients on the subnet of the client to be able to connect to the server.

According to the guides here, here and here I have set up the network like this:

The vpn subnet is 10.9.0.0/24
The server is 10.9.0.1
The client is 10.9.0.201

The client is on the subnet 192.168.210.0/24
The client's ip on the subnet is 192.168.210.201

First I have generated keys for the server and the client.

Then I have configured the server like:

local 999.999.999.999 (omitted)
proto udp
dev tun
topology subnet
server 10.9.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
client-config-dir ccd
and a lot of security related stuff

And the client to work with it.

I have set up a CCD for the client to have the specific ip on the vpn:

ifconfig-push 10.9.0.201 255.255.255.0

Tried out and it worked fine. Both server and client were able to ping each other. Everything was fine. The ip of the client was set up properly by the ccd.

Then I have added the iroute to the client ccd:

iroute 192.168.210.0 255.255.255.0

Restart both vpn client and server and stuff were still working.

Then added

route 192.168.210.0 255.255.255.0

to the server and the connection stopped working.

The server logged the incoming connections populated the status log by the clients etc. But no ping went through between the server and client. The log was empty of errors.

The following was added to the servers route table:

192.168.210.0 255.255.255.0 10.9.0.2 10.9.0.1 20

Why would the server add 10.9.0.2 as a gateway? The client has an other address. Where did it get that address from? Anyway changing the client's IP to 10.9.0.2 does not change anything.

Removing the iroute from the config makes the server and client able to communicate again, but the other clients still cannot react the server (having the error bad source address from client showing up in the server log of course).

What am I missing here?

Traffic

SoonDead wroteThe log was empty of errors

Set verb 4 in your config files and post your logs.

SoonDead

We have found that the direct cause of the problem is that a service on the server tries to react an unreachable (off) machine on the client subnet. The vpn connection is pretty much dead during the timeout period of that one request.

I have set up 2 consoles simultaneously with ping to demonstrate the problem:

ping 192.168.210.216 -t # machine is off so ping should not succeed
ping 10.9.0.201 # this is the client directly, and should succeed

The result pattern is interesting:

(The server is sadly installed as non-english which is a mistake not to be made by anyone ever, but the output of ping is mostly understandable, the long sentence means timeout)

It seems that the ping on the bottom waits out most of the timeout of the ping above. Succeeds in pinging 2-3 times and gets stuck every time the ping above does not succeed.

Why would this happen? Ping is not a huge command why can the server accidentally DOS the VPN connection with it?

Here are the logs (edited, because I'm not supposed to share authentication secrets and usernames according to my colleagues):

Wed Feb 24 10:37:21 2016 us=594000 Current Parameter Settings:
Wed Feb 24 10:37:21 2016 us=595000   config = 'server.ovpn'
Wed Feb 24 10:37:21 2016 us=595000   mode = 1
Wed Feb 24 10:37:21 2016 us=595000   show_ciphers = DISABLED
Wed Feb 24 10:37:21 2016 us=595000   show_digests = DISABLED
Wed Feb 24 10:37:21 2016 us=595000   show_engines = DISABLED
Wed Feb 24 10:37:21 2016 us=595000   genkey = DISABLED
Wed Feb 24 10:37:21 2016 us=595000   key_pass_file = '[UNDEF]'
Wed Feb 24 10:37:21 2016 us=595000   show_tls_ciphers = DISABLED
Wed Feb 24 10:37:21 2016 us=595000 Connection profiles [default]:
Wed Feb 24 10:37:21 2016 us=595000   proto = udp
Wed Feb 24 10:37:21 2016 us=595000   local = [REDACTED]
Wed Feb 24 10:37:21 2016 us=595000   local_port = 85
Wed Feb 24 10:37:21 2016 us=595000   remote = '[UNDEF]'
Wed Feb 24 10:37:21 2016 us=595000   remote_port = 85
Wed Feb 24 10:37:21 2016 us=595000   remote_float = DISABLED
Wed Feb 24 10:37:21 2016 us=595000   bind_defined = DISABLED
Wed Feb 24 10:37:21 2016 us=595000   bind_local = ENABLED
Wed Feb 24 10:37:21 2016 us=595000   connect_retry_seconds = 5
Wed Feb 24 10:37:21 2016 us=595000   connect_timeout = 10
Wed Feb 24 10:37:21 2016 us=595000   connect_retry_max = 0
Wed Feb 24 10:37:21 2016 us=595000   socks_proxy_server = '[UNDEF]'
Wed Feb 24 10:37:21 2016 us=595000   socks_proxy_port = 0
Wed Feb 24 10:37:21 2016 us=595000   socks_proxy_retry = DISABLED
Wed Feb 24 10:37:21 2016 us=595000   tun_mtu = 1500
Wed Feb 24 10:37:21 2016 us=595000   tun_mtu_defined = ENABLED
Wed Feb 24 10:37:21 2016 us=595000   link_mtu = 1500
Wed Feb 24 10:37:21 2016 us=595000   link_mtu_defined = DISABLED
Wed Feb 24 10:37:21 2016 us=595000   tun_mtu_extra = 0
Wed Feb 24 10:37:21 2016 us=595000   tun_mtu_extra_defined = DISABLED
Wed Feb 24 10:37:21 2016 us=595000   mtu_discover_type = -1
Wed Feb 24 10:37:21 2016 us=595000   fragment = 0
Wed Feb 24 10:37:21 2016 us=595000   mssfix = 1450
Wed Feb 24 10:37:21 2016 us=595000   explicit_exit_notification = 0
Wed Feb 24 10:37:21 2016 us=595000 Connection profiles END
Wed Feb 24 10:37:21 2016 us=595000   remote_random = DISABLED
Wed Feb 24 10:37:21 2016 us=595000   ipchange = '[UNDEF]'
Wed Feb 24 10:37:21 2016 us=595000   dev = 'tun'
Wed Feb 24 10:37:21 2016 us=595000   dev_type = '[UNDEF]'
Wed Feb 24 10:37:21 2016 us=595000   dev_node = '[UNDEF]'
Wed Feb 24 10:37:21 2016 us=595000   lladdr = '[UNDEF]'
Wed Feb 24 10:37:21 2016 us=595000   topology = 3
Wed Feb 24 10:37:21 2016 us=595000   tun_ipv6 = DISABLED
Wed Feb 24 10:37:21 2016 us=595000   ifconfig_local = '10.9.0.1'
Wed Feb 24 10:37:21 2016 us=595000   ifconfig_remote_netmask = '255.255.255.0'
Wed Feb 24 10:37:21 2016 us=595000   ifconfig_noexec = DISABLED
Wed Feb 24 10:37:21 2016 us=595000   ifconfig_nowarn = DISABLED
Wed Feb 24 10:37:21 2016 us=595000   ifconfig_ipv6_local = '[UNDEF]'
Wed Feb 24 10:37:21 2016 us=595000   ifconfig_ipv6_netbits = 0
Wed Feb 24 10:37:21 2016 us=595000   ifconfig_ipv6_remote = '[UNDEF]'
Wed Feb 24 10:37:21 2016 us=595000   shaper = 0
Wed Feb 24 10:37:21 2016 us=595000   mtu_test = 0
Wed Feb 24 10:37:21 2016 us=595000   mlock = DISABLED
Wed Feb 24 10:37:21 2016 us=595000   keepalive_ping = 10
Wed Feb 24 10:37:21 2016 us=595000   keepalive_timeout = 60
Wed Feb 24 10:37:21 2016 us=595000   inactivity_timeout = 0
Wed Feb 24 10:37:21 2016 us=595000   ping_send_timeout = 10
Wed Feb 24 10:37:21 2016 us=595000   ping_rec_timeout = 120
Wed Feb 24 10:37:21 2016 us=595000   ping_rec_timeout_action = 2
Wed Feb 24 10:37:21 2016 us=595000   ping_timer_remote = DISABLED
Wed Feb 24 10:37:21 2016 us=595000   remap_sigusr1 = 0
Wed Feb 24 10:37:21 2016 us=595000   persist_tun = ENABLED
Wed Feb 24 10:37:21 2016 us=595000   persist_local_ip = DISABLED
Wed Feb 24 10:37:21 2016 us=595000   persist_remote_ip = DISABLED
Wed Feb 24 10:37:21 2016 us=595000   persist_key = ENABLED
Wed Feb 24 10:37:21 2016 us=595000   passtos = DISABLED
Wed Feb 24 10:37:21 2016 us=595000   resolve_retry_seconds = 1000000000
Wed Feb 24 10:37:21 2016 us=595000   username = '[UNDEF]'
Wed Feb 24 10:37:21 2016 us=595000   groupname = '[UNDEF]'
Wed Feb 24 10:37:21 2016 us=595000   chroot_dir = '[UNDEF]'
Wed Feb 24 10:37:21 2016 us=595000   cd_dir = '[UNDEF]'
Wed Feb 24 10:37:21 2016 us=595000   writepid = '[UNDEF]'
Wed Feb 24 10:37:21 2016 us=595000   up_script = '[UNDEF]'
Wed Feb 24 10:37:21 2016 us=595000   down_script = '[UNDEF]'
Wed Feb 24 10:37:21 2016 us=595000   down_pre = DISABLED
Wed Feb 24 10:37:21 2016 us=595000   up_restart = DISABLED
Wed Feb 24 10:37:21 2016 us=595000   up_delay = DISABLED
Wed Feb 24 10:37:21 2016 us=595000   daemon = DISABLED
Wed Feb 24 10:37:21 2016 us=595000   inetd = 0
Wed Feb 24 10:37:21 2016 us=595000   log = ENABLED
Wed Feb 24 10:37:21 2016 us=595000   suppress_timestamps = DISABLED
Wed Feb 24 10:37:21 2016 us=595000   nice = 0
Wed Feb 24 10:37:21 2016 us=595000   verbosity = 4
Wed Feb 24 10:37:21 2016 us=595000   mute = 0
Wed Feb 24 10:37:21 2016 us=596000   gremlin = 0
Wed Feb 24 10:37:21 2016 us=596000   status_file = 'openvpn-status.log'
Wed Feb 24 10:37:21 2016 us=596000   status_file_version = 1
Wed Feb 24 10:37:21 2016 us=596000   status_file_update_freq = 60
Wed Feb 24 10:37:21 2016 us=596000   occ = ENABLED
Wed Feb 24 10:37:21 2016 us=596000   rcvbuf = 0
Wed Feb 24 10:37:21 2016 us=596000   sndbuf = 0
Wed Feb 24 10:37:21 2016 us=596000   sockflags = 0
Wed Feb 24 10:37:21 2016 us=596000   fast_io = DISABLED
Wed Feb 24 10:37:21 2016 us=596000   lzo = 7
Wed Feb 24 10:37:21 2016 us=596000   route_script = '[UNDEF]'
Wed Feb 24 10:37:21 2016 us=596000   route_default_gateway = '10.9.0.2'
Wed Feb 24 10:37:21 2016 us=596000   route_default_metric = 0
Wed Feb 24 10:37:21 2016 us=596000   route_noexec = DISABLED
Wed Feb 24 10:37:21 2016 us=596000   route_delay = 0
Wed Feb 24 10:37:21 2016 us=596000   route_delay_window = 30
Wed Feb 24 10:37:21 2016 us=596000   route_delay_defined = DISABLED
Wed Feb 24 10:37:21 2016 us=596000   route_nopull = DISABLED
Wed Feb 24 10:37:21 2016 us=596000   route_gateway_via_dhcp = DISABLED
Wed Feb 24 10:37:21 2016 us=596000   max_routes = 100
Wed Feb 24 10:37:21 2016 us=596000   allow_pull_fqdn = DISABLED
Wed Feb 24 10:37:21 2016 us=596000   route 192.168.210.0/255.255.255.0/10.9.0.201/30
Wed Feb 24 10:37:21 2016 us=596000   route 192.168.210.0/255.255.255.0/10.9.0.205/40
Wed Feb 24 10:37:21 2016 us=596000   management_addr = '[UNDEF]'
Wed Feb 24 10:37:21 2016 us=596000   management_port = 0
Wed Feb 24 10:37:21 2016 us=596000   management_user_pass = '[UNDEF]'
Wed Feb 24 10:37:21 2016 us=596000   management_log_history_cache = 250
Wed Feb 24 10:37:21 2016 us=596000   management_echo_buffer_size = 100
Wed Feb 24 10:37:21 2016 us=596000   management_write_peer_info_file = '[UNDEF]'
Wed Feb 24 10:37:21 2016 us=596000   management_client_user = '[UNDEF]'
Wed Feb 24 10:37:21 2016 us=596000   management_client_group = '[UNDEF]'
Wed Feb 24 10:37:21 2016 us=596000   management_flags = 0
Wed Feb 24 10:37:21 2016 us=596000   shared_secret_file = [REDACTED]
Wed Feb 24 10:37:21 2016 us=596000   key_direction = [REDACTED]
Wed Feb 24 10:37:21 2016 us=596000   ciphername_defined = [REDACTED]
Wed Feb 24 10:37:21 2016 us=596000   ciphername = [REDACTED]
Wed Feb 24 10:37:21 2016 us=596000   authname_defined = [REDACTED]
Wed Feb 24 10:37:21 2016 us=596000   authname = [REDACTED]
Wed Feb 24 10:37:21 2016 us=596000   prng_hash = [REDACTED]
Wed Feb 24 10:37:21 2016 us=596000   prng_nonce_secret_len = [REDACTED]
Wed Feb 24 10:37:21 2016 us=596000   keysize = 0
Wed Feb 24 10:37:21 2016 us=596000   engine = DISABLED
Wed Feb 24 10:37:21 2016 us=596000   replay = ENABLED
Wed Feb 24 10:37:21 2016 us=596000   mute_replay_warnings = DISABLED
Wed Feb 24 10:37:21 2016 us=596000   replay_window = 64
Wed Feb 24 10:37:21 2016 us=596000   replay_time = 15
Wed Feb 24 10:37:21 2016 us=596000   packet_id_file = '[UNDEF]'
Wed Feb 24 10:37:21 2016 us=596000   use_iv = [REDACTED]
Wed Feb 24 10:37:21 2016 us=596000   test_crypto = [REDACTED]
Wed Feb 24 10:37:21 2016 us=596000   tls_server = [REDACTED]
Wed Feb 24 10:37:21 2016 us=596000   tls_client = [REDACTED]
Wed Feb 24 10:37:21 2016 us=596000   key_method = [REDACTED]
Wed Feb 24 10:37:21 2016 us=596000   ca_file = [REDACTED]
Wed Feb 24 10:37:21 2016 us=596000   ca_path = [REDACTED]
Wed Feb 24 10:37:21 2016 us=596000   dh_file = [REDACTED]
Wed Feb 24 10:37:21 2016 us=596000   cert_file = [REDACTED]
Wed Feb 24 10:37:21 2016 us=596000   extra_certs_file = [REDACTED]
Wed Feb 24 10:37:21 2016 us=596000   priv_key_file = [REDACTED]
Wed Feb 24 10:37:21 2016 us=596000   pkcs12_file = [REDACTED]
Wed Feb 24 10:37:21 2016 us=596000   cryptoapi_cert = [REDACTED]
Wed Feb 24 10:37:21 2016 us=596000   cipher_list = [REDACTED]
Wed Feb 24 10:37:21 2016 us=596000   tls_verify = [REDACTED]
Wed Feb 24 10:37:21 2016 us=596000   tls_export_cert = [REDACTED]
Wed Feb 24 10:37:21 2016 us=596000   verify_x509_type = [REDACTED]
Wed Feb 24 10:37:21 2016 us=596000   verify_x509_name = [REDACTED]
Wed Feb 24 10:37:21 2016 us=596000   crl_file = [REDACTED]
Wed Feb 24 10:37:21 2016 us=596000   ns_cert_type = [REDACTED]
Wed Feb 24 10:37:21 2016 us=596000   remote_cert_ku[i] = [REDACTED]
Wed Feb 24 10:37:21 2016 us=596000   remote_cert_ku[i] = [REDACTED]
Wed Feb 24 10:37:21 2016 us=596000   remote_cert_ku[i] = [REDACTED]
Wed Feb 24 10:37:21 2016 us=596000   remote_cert_ku[i] = [REDACTED]
Wed Feb 24 10:37:21 2016 us=596000   remote_cert_ku[i] = [REDACTED]
Wed Feb 24 10:37:21 2016 us=596000   remote_cert_ku[i] = [REDACTED]
Wed Feb 24 10:37:21 2016 us=596000   remote_cert_ku[i] = [REDACTED]
Wed Feb 24 10:37:21 2016 us=596000   remote_cert_ku[i] = [REDACTED]
Wed Feb 24 10:37:21 2016 us=596000   remote_cert_ku[i] = [REDACTED]
Wed Feb 24 10:37:21 2016 us=596000   remote_cert_ku[i] = [REDACTED]
Wed Feb 24 10:37:21 2016 us=596000   remote_cert_ku[i] = [REDACTED]
Wed Feb 24 10:37:21 2016 us=596000   remote_cert_ku[i] = [REDACTED]
Wed Feb 24 10:37:21 2016 us=596000   remote_cert_ku[i] = [REDACTED]
Wed Feb 24 10:37:21 2016 us=596000   remote_cert_ku[i] = [REDACTED]
Wed Feb 24 10:37:21 2016 us=596000   remote_cert_ku[i] = [REDACTED]
Wed Feb 24 10:37:21 2016 us=596000   remote_cert_ku[i] = [REDACTED]
Wed Feb 24 10:37:21 2016 us=596000   remote_cert_eku = [REDACTED]
Wed Feb 24 10:37:21 2016 us=596000   ssl_flags = 0
Wed Feb 24 10:37:21 2016 us=596000   tls_timeout = 2
Wed Feb 24 10:37:21 2016 us=596000   renegotiate_bytes = 0
Wed Feb 24 10:37:21 2016 us=596000   renegotiate_packets = 0
Wed Feb 24 10:37:21 2016 us=596000   renegotiate_seconds = 3600
Wed Feb 24 10:37:21 2016 us=596000   handshake_window = [REDACTED]
Wed Feb 24 10:37:21 2016 us=596000   transition_window = [REDACTED]
Wed Feb 24 10:37:21 2016 us=596000   single_session = DISABLED
Wed Feb 24 10:37:21 2016 us=596000   push_peer_info = DISABLED
Wed Feb 24 10:37:21 2016 us=596000   tls_exit = [REDACTED]
Wed Feb 24 10:37:21 2016 us=596000   tls_auth_file = [REDACTED]
Wed Feb 24 10:37:21 2016 us=596000   pkcs11_protected_authentication = [REDACTED]
Wed Feb 24 10:37:21 2016 us=596000   pkcs11_protected_authentication = [REDACTED]
Wed Feb 24 10:37:21 2016 us=596000   pkcs11_protected_authentication = [REDACTED]
Wed Feb 24 10:37:21 2016 us=596000   pkcs11_protected_authentication = [REDACTED]
Wed Feb 24 10:37:21 2016 us=596000   pkcs11_protected_authentication = [REDACTED]
Wed Feb 24 10:37:21 2016 us=596000   pkcs11_protected_authentication = [REDACTED]
Wed Feb 24 10:37:21 2016 us=596000   pkcs11_protected_authentication = [REDACTED]
Wed Feb 24 10:37:21 2016 us=596000   pkcs11_protected_authentication = [REDACTED]
Wed Feb 24 10:37:21 2016 us=596000   pkcs11_protected_authentication = [REDACTED]
Wed Feb 24 10:37:21 2016 us=596000   pkcs11_protected_authentication = [REDACTED]
Wed Feb 24 10:37:21 2016 us=596000   pkcs11_protected_authentication = [REDACTED]
Wed Feb 24 10:37:21 2016 us=596000   pkcs11_protected_authentication = [REDACTED]
Wed Feb 24 10:37:21 2016 us=596000   pkcs11_protected_authentication = [REDACTED]
Wed Feb 24 10:37:21 2016 us=596000   pkcs11_protected_authentication = [REDACTED]
Wed Feb 24 10:37:21 2016 us=597000   pkcs11_protected_authentication = [REDACTED]
Wed Feb 24 10:37:21 2016 us=597000   pkcs11_protected_authentication = [REDACTED]
Wed Feb 24 10:37:21 2016 us=597000   pkcs11_private_mode = [REDACTED]
Wed Feb 24 10:37:21 2016 us=597000   pkcs11_private_mode = [REDACTED]
Wed Feb 24 10:37:21 2016 us=597000   pkcs11_private_mode = [REDACTED]
Wed Feb 24 10:37:21 2016 us=597000   pkcs11_private_mode = [REDACTED]
Wed Feb 24 10:37:21 2016 us=597000   pkcs11_private_mode = [REDACTED]
Wed Feb 24 10:37:21 2016 us=597000   pkcs11_private_mode = [REDACTED]
Wed Feb 24 10:37:21 2016 us=597000   pkcs11_private_mode = [REDACTED]
Wed Feb 24 10:37:21 2016 us=597000   pkcs11_private_mode = [REDACTED]
Wed Feb 24 10:37:21 2016 us=597000   pkcs11_private_mode = [REDACTED]
Wed Feb 24 10:37:21 2016 us=597000   pkcs11_private_mode = [REDACTED]
Wed Feb 24 10:37:21 2016 us=597000   pkcs11_private_mode = [REDACTED]
Wed Feb 24 10:37:21 2016 us=597000   pkcs11_private_mode = [REDACTED]
Wed Feb 24 10:37:21 2016 us=597000   pkcs11_private_mode = [REDACTED]
Wed Feb 24 10:37:21 2016 us=597000   pkcs11_private_mode = [REDACTED]
Wed Feb 24 10:37:21 2016 us=597000   pkcs11_private_mode = [REDACTED]
Wed Feb 24 10:37:21 2016 us=597000   pkcs11_private_mode = [REDACTED]
Wed Feb 24 10:37:21 2016 us=597000   pkcs11_cert_private = [REDACTED]
Wed Feb 24 10:37:21 2016 us=597000   pkcs11_cert_private = [REDACTED]
Wed Feb 24 10:37:21 2016 us=597000   pkcs11_cert_private = [REDACTED]
Wed Feb 24 10:37:21 2016 us=597000   pkcs11_cert_private = [REDACTED]
Wed Feb 24 10:37:21 2016 us=597000   pkcs11_cert_private = [REDACTED]
Wed Feb 24 10:37:21 2016 us=597000   pkcs11_cert_private = [REDACTED]
Wed Feb 24 10:37:21 2016 us=597000   pkcs11_cert_private = [REDACTED]
Wed Feb 24 10:37:21 2016 us=597000   pkcs11_cert_private = [REDACTED]
Wed Feb 24 10:37:21 2016 us=597000   pkcs11_cert_private = [REDACTED]
Wed Feb 24 10:37:21 2016 us=597000   pkcs11_cert_private = [REDACTED]
Wed Feb 24 10:37:21 2016 us=597000   pkcs11_cert_private = [REDACTED]
Wed Feb 24 10:37:21 2016 us=597000   pkcs11_cert_private = [REDACTED]
Wed Feb 24 10:37:21 2016 us=597000   pkcs11_cert_private = [REDACTED]
Wed Feb 24 10:37:21 2016 us=597000   pkcs11_cert_private = [REDACTED]
Wed Feb 24 10:37:21 2016 us=597000   pkcs11_cert_private = [REDACTED]
Wed Feb 24 10:37:21 2016 us=597000   pkcs11_cert_private = [REDACTED]
Wed Feb 24 10:37:21 2016 us=597000   pkcs11_pin_cache_period = [REDACTED]
Wed Feb 24 10:37:21 2016 us=597000   pkcs11_id = [REDACTED]
Wed Feb 24 10:37:21 2016 us=597000   pkcs11_id_management = [REDACTED]
Wed Feb 24 10:37:21 2016 us=597000   server_network = 10.9.0.0
Wed Feb 24 10:37:21 2016 us=597000   server_netmask = 255.255.255.0
Wed Feb 24 10:37:21 2016 us=598000   server_network_ipv6 = ::
Wed Feb 24 10:37:21 2016 us=598000   server_netbits_ipv6 = 0
Wed Feb 24 10:37:21 2016 us=598000   server_bridge_ip = 0.0.0.0
Wed Feb 24 10:37:21 2016 us=598000   server_bridge_netmask = 0.0.0.0
Wed Feb 24 10:37:21 2016 us=598000   server_bridge_pool_start = 0.0.0.0
Wed Feb 24 10:37:21 2016 us=598000   server_bridge_pool_end = 0.0.0.0
Wed Feb 24 10:37:21 2016 us=598000   push_entry = 'dhcp-option DNS 192.168.210.230'
Wed Feb 24 10:37:21 2016 us=598000   push_entry = 'route-gateway 10.9.0.1'
Wed Feb 24 10:37:21 2016 us=598000   push_entry = 'topology subnet'
Wed Feb 24 10:37:21 2016 us=598000   push_entry = 'ping 10'
Wed Feb 24 10:37:21 2016 us=598000   push_entry = 'ping-restart 60'
Wed Feb 24 10:37:21 2016 us=598000   ifconfig_pool_defined = ENABLED
Wed Feb 24 10:37:21 2016 us=598000   ifconfig_pool_start = 10.9.0.2
Wed Feb 24 10:37:21 2016 us=598000   ifconfig_pool_end = 10.9.0.253
Wed Feb 24 10:37:21 2016 us=598000   ifconfig_pool_netmask = 255.255.255.0
Wed Feb 24 10:37:21 2016 us=598000   ifconfig_pool_persist_filename = 'ipp.txt'
Wed Feb 24 10:37:21 2016 us=598000   ifconfig_pool_persist_refresh_freq = 600
Wed Feb 24 10:37:21 2016 us=598000   ifconfig_ipv6_pool_defined = DISABLED
Wed Feb 24 10:37:21 2016 us=598000   ifconfig_ipv6_pool_base = ::
Wed Feb 24 10:37:21 2016 us=598000   ifconfig_ipv6_pool_netbits = 0
Wed Feb 24 10:37:21 2016 us=598000   n_bcast_buf = 256
Wed Feb 24 10:37:21 2016 us=598000   tcp_queue_limit = 64
Wed Feb 24 10:37:21 2016 us=598000   real_hash_size = 256
Wed Feb 24 10:37:21 2016 us=598000   virtual_hash_size = 256
Wed Feb 24 10:37:21 2016 us=598000   client_connect_script = '[UNDEF]'
Wed Feb 24 10:37:21 2016 us=598000   learn_address_script = '[UNDEF]'
Wed Feb 24 10:37:21 2016 us=598000   client_disconnect_script = '[UNDEF]'
Wed Feb 24 10:37:21 2016 us=598000   client_config_dir = 'ccd'
Wed Feb 24 10:37:21 2016 us=598000   ccd_exclusive = DISABLED
Wed Feb 24 10:37:21 2016 us=598000   tmp_dir = 'C:\Windows\TEMP\'
Wed Feb 24 10:37:21 2016 us=598000   push_ifconfig_defined = DISABLED
Wed Feb 24 10:37:21 2016 us=598000   push_ifconfig_local = 0.0.0.0
Wed Feb 24 10:37:21 2016 us=598000   push_ifconfig_remote_netmask = 0.0.0.0
Wed Feb 24 10:37:21 2016 us=598000   push_ifconfig_ipv6_defined = DISABLED
Wed Feb 24 10:37:21 2016 us=598000   push_ifconfig_ipv6_local = ::/0
Wed Feb 24 10:37:21 2016 us=598000   push_ifconfig_ipv6_remote = ::
Wed Feb 24 10:37:21 2016 us=598000   enable_c2c = ENABLED
Wed Feb 24 10:37:21 2016 us=598000   duplicate_cn = DISABLED
Wed Feb 24 10:37:21 2016 us=598000   cf_max = 0
Wed Feb 24 10:37:21 2016 us=598000   cf_per = 0
Wed Feb 24 10:37:21 2016 us=598000   max_clients = 1024
Wed Feb 24 10:37:21 2016 us=599000   max_routes_per_client = 256
Wed Feb 24 10:37:21 2016 us=599000   auth_user_pass_verify_script = '[UNDEF]'
Wed Feb 24 10:37:21 2016 us=599000   auth_user_pass_verify_script_via_file = DISABLED
Wed Feb 24 10:37:21 2016 us=599000   client = DISABLED
Wed Feb 24 10:37:21 2016 us=599000   pull = DISABLED
Wed Feb 24 10:37:21 2016 us=599000   auth_user_pass_file = '[UNDEF]'
Wed Feb 24 10:37:21 2016 us=599000   show_net_up = DISABLED
Wed Feb 24 10:37:21 2016 us=599000   route_method = 0
Wed Feb 24 10:37:21 2016 us=599000   block_outside_dns = DISABLED
Wed Feb 24 10:37:21 2016 us=599000   ip_win32_defined = DISABLED
Wed Feb 24 10:37:21 2016 us=599000   ip_win32_type = 3
Wed Feb 24 10:37:21 2016 us=599000   dhcp_masq_offset = 0
Wed Feb 24 10:37:21 2016 us=599000   dhcp_lease_time = 31536000
Wed Feb 24 10:37:21 2016 us=599000   tap_sleep = 10
Wed Feb 24 10:37:21 2016 us=599000   dhcp_options = DISABLED
Wed Feb 24 10:37:21 2016 us=599000   dhcp_renew = DISABLED
Wed Feb 24 10:37:21 2016 us=599000   dhcp_pre_release = DISABLED
Wed Feb 24 10:37:21 2016 us=599000   dhcp_release = DISABLED
Wed Feb 24 10:37:21 2016 us=599000   domain = '[UNDEF]'
Wed Feb 24 10:37:21 2016 us=599000   netbios_scope = '[UNDEF]'
Wed Feb 24 10:37:21 2016 us=599000   netbios_node_type = 0
Wed Feb 24 10:37:21 2016 us=599000   disable_nbt = DISABLED
Wed Feb 24 10:37:21 2016 us=599000 OpenVPN 2.3.10 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Feb  1 2016
Wed Feb 24 10:37:21 2016 us=599000 Windows version 6.0 (Windows Vista)
Wed Feb 24 10:37:21 2016 us=599000 library versions: OpenSSL 1.0.1r  28 Jan 2016, LZO 2.09
Wed Feb 24 10:37:21 2016 us=928000 Diffie-Hellman initialized with 1024 bit key
Wed Feb 24 10:37:21 2016 us=943000 TLS-Auth MTU parms [ L:1558 D:1212 EF:38 EB:0 ET:0 EL:3 ]
Wed Feb 24 10:37:21 2016 us=944000 Socket Buffers: R=[8192->8192] S=[8192->8192]
Wed Feb 24 10:37:21 2016 us=947000 ROUTE_GATEWAY [REDACTED]/255.255.255.0 I=10 HWADDR=00:1e:4f:3a:e4:b8
Wed Feb 24 10:37:21 2016 us=950000 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Feb 24 10:37:21 2016 us=950000 open_tun, tt->ipv6=0
Wed Feb 24 10:37:21 2016 us=951000 TAP-WIN32 device [Helyi kapcsolat 2] opened: \\.\Global\{FD14083A-0DA8-437E-A874-1E05722F3BD1}.tap
Wed Feb 24 10:37:21 2016 us=951000 TAP-Windows Driver Version 9.21 
Wed Feb 24 10:37:21 2016 us=951000 TAP-Windows MTU=1500
Wed Feb 24 10:37:21 2016 us=953000 Set TAP-Windows TUN subnet mode network/local/netmask = 10.9.0.0/10.9.0.1/255.255.255.0 [SUCCEEDED]
Wed Feb 24 10:37:21 2016 us=953000 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.9.0.1/255.255.255.0 on interface {FD14083A-0DA8-437E-A874-1E05722F3BD1} [DHCP-serv: 10.9.0.254, lease-time: 31536000]
Wed Feb 24 10:37:21 2016 us=954000 Sleeping for 10 seconds...
Wed Feb 24 10:37:31 2016 us=954000 Successful ARP Flush on interface [20] {FD14083A-0DA8-437E-A874-1E05722F3BD1}
Wed Feb 24 10:37:31 2016 us=957000 C:\Windows\system32\route.exe ADD 192.168.210.0 MASK 255.255.255.0 10.9.0.201 METRIC 30
Wed Feb 24 10:37:31 2016 us=960000 Route addition via IPAPI succeeded [adaptive]
Wed Feb 24 10:37:31 2016 us=960000 C:\Windows\system32\route.exe ADD 192.168.210.0 MASK 255.255.255.0 10.9.0.205 METRIC 40
Wed Feb 24 10:37:31 2016 us=963000 Route addition via IPAPI succeeded [adaptive]
Wed Feb 24 10:37:31 2016 us=963000 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:143 ET:0 EL:3 AF:3/1 ]
Wed Feb 24 10:37:31 2016 us=963000 UDPv4 link local (bound): [AF_INET][REDACTED]:85
Wed Feb 24 10:37:31 2016 us=963000 UDPv4 link remote: [undef]
Wed Feb 24 10:37:31 2016 us=963000 MULTI: multi_init called, r=256 v=256
Wed Feb 24 10:37:31 2016 us=964000 IFCONFIG POOL: base=10.9.0.2 size=252, ipv6=0
Wed Feb 24 10:37:31 2016 us=964000 ifconfig_pool_read(), in='iroda1,10.9.0.2', TODO: IPv6
Wed Feb 24 10:37:31 2016 us=964000 succeeded -> ifconfig_pool_set()
Wed Feb 24 10:37:31 2016 us=964000 ifconfig_pool_read(), in='[REDACTED],10.9.0.3', TODO: IPv6
Wed Feb 24 10:37:31 2016 us=964000 succeeded -> ifconfig_pool_set()
Wed Feb 24 10:37:31 2016 us=964000 ifconfig_pool_read(), in='[REDACTED],10.9.0.4', TODO: IPv6
Wed Feb 24 10:37:31 2016 us=964000 succeeded -> ifconfig_pool_set()
Wed Feb 24 10:37:31 2016 us=964000 ifconfig_pool_read(), in='[REDACTED],10.9.0.5', TODO: IPv6
Wed Feb 24 10:37:31 2016 us=964000 succeeded -> ifconfig_pool_set()
Wed Feb 24 10:37:31 2016 us=964000 ifconfig_pool_read(), in='iroda2,10.9.0.6', TODO: IPv6
Wed Feb 24 10:37:31 2016 us=964000 succeeded -> ifconfig_pool_set()
Wed Feb 24 10:37:31 2016 us=964000 IFCONFIG POOL LIST
Wed Feb 24 10:37:31 2016 us=964000 iroda1,10.9.0.2
Wed Feb 24 10:37:31 2016 us=964000 [REDACTED],10.9.0.3
Wed Feb 24 10:37:31 2016 us=964000 [REDACTED],10.9.0.4
Wed Feb 24 10:37:31 2016 us=964000 [REDACTED],10.9.0.5
Wed Feb 24 10:37:31 2016 us=964000 iroda2,10.9.0.6
Wed Feb 24 10:37:31 2016 us=964000 Initialization Sequence Completed
Wed Feb 24 10:37:31 2016 us=964000 MULTI: multi_create_instance called
[REDACTED]
Wed Feb 24 10:37:31 2016 us=994000 [REDACTED]:65214 [iroda1] Peer Connection Initiated with [AF_INET][REDACTED]:65214
Wed Feb 24 10:37:31 2016 us=994000 iroda1/[REDACTED]:65214 OPTIONS IMPORT: reading client specific options from: ccd\iroda1
Wed Feb 24 10:37:32 2016 iroda1/[REDACTED]:65214 MULTI: Learn: 10.9.0.201 -> iroda1/[REDACTED]:65214
Wed Feb 24 10:37:32 2016 iroda1/[REDACTED]:65214 MULTI: primary virtual IP for iroda1/[REDACTED]:65214: 10.9.0.201
Wed Feb 24 10:37:32 2016 iroda1/[REDACTED]:65214 MULTI: internal route 192.168.210.0/24 -> iroda1/[REDACTED]:65214
Wed Feb 24 10:37:32 2016 iroda1/[REDACTED]:65214 MULTI: Learn: 192.168.210.0/24 -> iroda1/[REDACTED]:65214
Wed Feb 24 10:37:34 2016 us=501000 iroda1/[REDACTED]:65214 PUSH: Received control message: 'PUSH_REQUEST'
Wed Feb 24 10:37:34 2016 us=501000 iroda1/[REDACTED]:65214 send_push_reply(): safe_cap=940
Wed Feb 24 10:37:34 2016 us=501000 iroda1/[REDACTED]:65214 SENT CONTROL [iroda1]: 'PUSH_REPLY,dhcp-option DNS 192.168.210.230,route-gateway 10.9.0.1,topology subnet,ping 10,ping-restart 60,ifconfig 10.9.0.201 255.255.255.0' (status=1)
Wed Feb 24 10:37:36 2016 us=918000 MULTI: Learn: 192.168.210.232 -> iroda1/[REDACTED]:65214
Wed Feb 24 10:37:36 2016 us=981000 MULTI: Learn: 192.168.210.230 -> iroda1/[REDACTED]:65214
Wed Feb 24 10:37:36 2016 us=982000 MULTI: Learn: 192.168.210.216 -> iroda1/[REDACTED]:65214

Traffic

SoonDead wroteThe following was added to the servers route table:

192.168.210.0 255.255.255.0 10.9.0.2 10.9.0.1 20

Why would the server add 10.9.0.2 as a gateway?

That is how openvpn handles the route to the remote network.. 10.9.0.2 is an internal node to the server .. and the --iroute (internal route) is what tells openvpn which client the subnet 192.168.210.0/24 is behind.

I cannot see anything wrong .. maybe someone else here will spot something.

Otherwise, work through this carefully:
HOWTO: Expanding the scope of the VPN to include additional machines