I'm running centos 6 with openvpn-2.3.7-1.el6.x86_64 and I can't get a connection from a windows client running openvpn-gui. I'm convinced the problem is my firewall however I can't work out what the correct firewall config should be and I haven't been able to find a working example of /etc/sysconfig/iptables. I was following this blog here [url]https://tryapi.wordpress.com/2014/02/26/howto-openvpn-server-using-easy-rsa3-to-create-keys-and-certs/comment-page-1/#comment-414[/url] but the /usr/local/bin/firewall.sh script there doesn't work for me, in fact it hoses my iptables and then I have to dance around to get a console connection again. At the moment I have this in /etc/sysconfig/iptables: [code]-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT -A FORWARD -s 10.8.0.0/24 -j ACCEPT -A FORWARD -j REJECT[/code]but I can't get a connection. The openvpn.log on the server doesn't show any activity at all, this is why I think the firewall is blocking things. Thanks for any help.

post the output of [code]iptables -nL[/code] and [code]iptables -t nat -nL[/code]

centos 6 iptables config for openvpn

neuronetv

I'm running centos 6 with openvpn-2.3.7-1.el6.x86_64 and I can't get a connection from a windows client running openvpn-gui. I'm convinced the problem is my firewall however I can't work out what the correct firewall config should be and I haven't been able to find a working example of /etc/sysconfig/iptables.
I was following this blog here
https://tryapi.wordpress.com/2014/02/26/howto-openvpn-server-using-easy-rsa3-to-create-keys-and-certs/comment-page-1/#comment-414
but the /usr/local/bin/firewall.sh script there doesn't work for me, in fact it hoses my iptables and then I have to dance around to get a console connection again. At the moment I have this in /etc/sysconfig/iptables:

-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 10.8.0.0/24 -j ACCEPT
-A FORWARD -j REJECT

but I can't get a connection. The openvpn.log on the server doesn't show any activity at all, this is why I think the firewall is blocking things. Thanks for any help.

TiTex

post the output of

iptables -nL

and

iptables -t nat -nL

neuronetv

thanks for your response:

# iptables -nL
Chain INPUT (policy DROP)
target     prot opt source               destination         
fail2ban-FTP  tcp  --  0.0.0.0/0            0.0.0.0/0           multiport dports 21 
fail2ban-sendmail-reject  tcp  --  0.0.0.0/0            0.0.0.0/0           multiport dports 587,465,25 
fail2ban-dovecot  tcp  --  0.0.0.0/0            0.0.0.0/0           multiport dports 110,995,143,993,587,465,4190 
fail2ban-apache-auth  tcp  --  0.0.0.0/0            0.0.0.0/0           multiport dports 80 
fail2ban-sendmail-auth  tcp  --  0.0.0.0/0            0.0.0.0/0           multiport dports 587,465,25 
fail2ban-SIP  all  --  0.0.0.0/0            0.0.0.0/0           
fail2ban-SIP  all  --  0.0.0.0/0            0.0.0.0/0           
fail2ban-SSH  tcp  --  0.0.0.0/0            0.0.0.0/0           multiport dports 22 
fail2ban-recidive  all  --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:22 
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:25 
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:110 
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:514 
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:69 
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:80 
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:34557 
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpts:5060:5061 
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpts:10000:20000 
ACCEPT     tcp  --  172.16.0.0/16        172.16.1.61         tcp dpt:3389 
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           state NEW udp dpt:137 
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           state NEW udp dpt:138 
ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           state NEW udp dpt:139 
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:445 
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED 

Chain FORWARD (policy DROP)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain fail2ban-BadBots (0 references)
target     prot opt source               destination         
RETURN     all  --  0.0.0.0/0            0.0.0.0/0           

Chain fail2ban-FTP (1 references)
target     prot opt source               destination         
RETURN     all  --  0.0.0.0/0            0.0.0.0/0           

Chain fail2ban-SIP (2 references)
target     prot opt source               destination         
RETURN     all  --  0.0.0.0/0            0.0.0.0/0           
RETURN     all  --  0.0.0.0/0            0.0.0.0/0           

Chain fail2ban-SSH (1 references)
target     prot opt source               destination         
RETURN     all  --  0.0.0.0/0            0.0.0.0/0           

Chain fail2ban-apache-auth (1 references)
target     prot opt source               destination         
RETURN     all  --  0.0.0.0/0            0.0.0.0/0           

Chain fail2ban-dovecot (1 references)
target     prot opt source               destination         
RETURN     all  --  0.0.0.0/0            0.0.0.0/0           

Chain fail2ban-recidive (1 references)
target     prot opt source               destination         
RETURN     all  --  0.0.0.0/0            0.0.0.0/0           

Chain fail2ban-sendmail-auth (1 references)
target     prot opt source               destination         
RETURN     all  --  0.0.0.0/0            0.0.0.0/0           

Chain fail2ban-sendmail-reject (1 references)
target     prot opt source               destination         
RETURN     all  --  0.0.0.0/0            0.0.0.0/0

and

# iptables -t nat -nL
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

TiTex

if your second to last rule in the INPUT chain is for the loopback interface

ACCEPT all -- 0.0.0.0/0 0.0.0.0/0

then your iptables rules don't allow traffic to udp/tcp port 1194 , which is the default port of openvpn
or you are running the server with another port ?

you can see more details with

iptables -nvL INPUT

neuronetv

yes, following the instructions at:
https://tryapi.wordpress.com/2014/02/26/howto-openvpn-server-using-easy-rsa3-to-create-keys-and-certs/
I'm running openvpn on port 34557, which is open in iptables.

TiTex

then you should also post
server/client configs and logs

check the top of this page how to do that.

neuronetv

thanks for your further help.

server.conf

port 34557
proto tcp
dev tun
ca ca.crt
cert server.crt
key server.key
tls-auth ta.key 0
dh dh2048.pem
server 10.8.0.0 255.255.255.0
cipher AES-256-CBC
comp-lzo
persist-key
persist-tun
user nobody
group nogroup
status openvpn-status.log
log openvpn.log
verb 3
push "redirect-gateway def1"
push "dhcp-option DNS "156.154.70.22"
push "dhcp-option DNS "156.154.71.22
keepalive 5 30

client.ovpn

client
dev tun
proto udp
remote <host-ip-address> 34557
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
cipher AES-256-CBC
comp-lzo
verb 3
key-direction 1
<ca>
</ca>
<cert>
</cert>
<key>
</key>
<tls-auth>
</tls-auth>
key-direction 1
<ca>
-----BEGIN CERTIFICATE-----
<snip>
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
<snip>
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
<snip>
-----END PRIVATE KEY-----
</key>
<tls-auth>
-----BEGIN OpenVPN Static key V1-----
<snip>
-----END OpenVPN Static key V1-----
</tls-auth>

server-openvpn.log

Tue Mar  1 12:48:00 2016 OpenVPN 2.3.7 x86_64-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Jun  9 2015
Tue Mar  1 12:48:00 2016 library versions: OpenSSL 1.0.1e-fips 11 Feb 2013, LZO 2.03
Tue Mar  1 12:48:00 2016 Diffie-Hellman initialized with 2048 bit key
Tue Mar  1 12:48:00 2016 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
Tue Mar  1 12:48:00 2016 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Mar  1 12:48:00 2016 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Mar  1 12:48:00 2016 Socket Buffers: R=[87380->131072] S=[16384->131072]
Tue Mar  1 12:48:00 2016 ROUTE_GATEWAY <gateway-ip./<mask> IFACE=eth0 HWADDR=70:5a:b6:f7:2e:0f
Tue Mar  1 12:48:00 2016 TUN/TAP device tun0 opened
Tue Mar  1 12:48:00 2016 TUN/TAP TX queue length set to 100
Tue Mar  1 12:48:00 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Tue Mar  1 12:48:00 2016 /sbin/ip link set dev tun0 up mtu 1500
Tue Mar  1 12:48:01 2016 /sbin/ip addr add dev tun0 local 10.8.0.1 peer 10.8.0.2
Tue Mar  1 12:48:01 2016 /sbin/ip route add 10.8.0.0/24 via 10.8.0.2
Tue Mar  1 12:48:01 2016 failed to find GID for group nogroup
Tue Mar  1 12:48:01 2016 Exiting due to fatal error
Tue Mar  1 12:48:01 2016 /sbin/ip route del 10.8.0.0/24
Tue Mar  1 12:48:01 2016 Closing TUN/TAP interface
Tue Mar  1 12:48:01 2016 /sbin/ip addr del dev tun0 local 10.8.0.1 peer 10.8.0.2

client connection log;

Tue Mar 01 12:52:44 2016 us=970505 Current Parameter Settings:
Tue Mar 01 12:52:44 2016 us=970505   config = 'freepbx.ovpn'
Tue Mar 01 12:52:44 2016 us=970505   mode = 0
Tue Mar 01 12:52:44 2016 us=970505   show_ciphers = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   show_digests = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   show_engines = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   genkey = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   key_pass_file = '[UNDEF]'
Tue Mar 01 12:52:44 2016 us=970505   show_tls_ciphers = DISABLED
Tue Mar 01 12:52:44 2016 us=970505 Connection profiles [default]:
Tue Mar 01 12:52:44 2016 us=970505   proto = tcp-client
Tue Mar 01 12:52:44 2016 us=970505   local = '[UNDEF]'
Tue Mar 01 12:52:44 2016 us=970505   local_port = 0
Tue Mar 01 12:52:44 2016 us=970505   remote = '<openvpn-svr-ip>'
Tue Mar 01 12:52:44 2016 us=970505   remote_port = 34557
Tue Mar 01 12:52:44 2016 us=970505   remote_float = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   bind_defined = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   bind_local = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   connect_retry_seconds = 5
Tue Mar 01 12:52:44 2016 us=970505   connect_timeout = 10
Tue Mar 01 12:52:44 2016 us=970505   connect_retry_max = 0
Tue Mar 01 12:52:44 2016 us=970505   socks_proxy_server = '[UNDEF]'
Tue Mar 01 12:52:44 2016 us=970505   socks_proxy_port = 0
Tue Mar 01 12:52:44 2016 us=970505   socks_proxy_retry = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   tun_mtu = 1500
Tue Mar 01 12:52:44 2016 us=970505   tun_mtu_defined = ENABLED
Tue Mar 01 12:52:44 2016 us=970505   link_mtu = 1500
Tue Mar 01 12:52:44 2016 us=970505   link_mtu_defined = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   tun_mtu_extra = 0
Tue Mar 01 12:52:44 2016 us=970505   tun_mtu_extra_defined = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   mtu_discover_type = -1
Tue Mar 01 12:52:44 2016 us=970505   fragment = 0
Tue Mar 01 12:52:44 2016 us=970505   mssfix = 1450
Tue Mar 01 12:52:44 2016 us=970505   explicit_exit_notification = 0
Tue Mar 01 12:52:44 2016 us=970505 Connection profiles END
Tue Mar 01 12:52:44 2016 us=970505   remote_random = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   ipchange = '[UNDEF]'
Tue Mar 01 12:52:44 2016 us=970505   dev = 'tun'
Tue Mar 01 12:52:44 2016 us=970505   dev_type = '[UNDEF]'
Tue Mar 01 12:52:44 2016 us=970505   dev_node = '[UNDEF]'
Tue Mar 01 12:52:44 2016 us=970505   lladdr = '[UNDEF]'
Tue Mar 01 12:52:44 2016 us=970505   topology = 1
Tue Mar 01 12:52:44 2016 us=970505   tun_ipv6 = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   ifconfig_local = '[UNDEF]'
Tue Mar 01 12:52:44 2016 us=970505   ifconfig_remote_netmask = '[UNDEF]'
Tue Mar 01 12:52:44 2016 us=970505   ifconfig_noexec = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   ifconfig_nowarn = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   ifconfig_ipv6_local = '[UNDEF]'
Tue Mar 01 12:52:44 2016 us=970505   ifconfig_ipv6_netbits = 0
Tue Mar 01 12:52:44 2016 us=970505   ifconfig_ipv6_remote = '[UNDEF]'
Tue Mar 01 12:52:44 2016 us=970505   shaper = 0
Tue Mar 01 12:52:44 2016 us=970505   mtu_test = 0
Tue Mar 01 12:52:44 2016 us=970505   mlock = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   keepalive_ping = 0
Tue Mar 01 12:52:44 2016 us=970505   keepalive_timeout = 0
Tue Mar 01 12:52:44 2016 us=970505   inactivity_timeout = 0
Tue Mar 01 12:52:44 2016 us=970505   ping_send_timeout = 0
Tue Mar 01 12:52:44 2016 us=970505   ping_rec_timeout = 0
Tue Mar 01 12:52:44 2016 us=970505   ping_rec_timeout_action = 0
Tue Mar 01 12:52:44 2016 us=970505   ping_timer_remote = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   remap_sigusr1 = 0
Tue Mar 01 12:52:44 2016 us=970505   persist_tun = ENABLED
Tue Mar 01 12:52:44 2016 us=970505   persist_local_ip = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   persist_remote_ip = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   persist_key = ENABLED
Tue Mar 01 12:52:44 2016 us=970505   passtos = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   resolve_retry_seconds = 1000000000
Tue Mar 01 12:52:44 2016 us=970505   username = '[UNDEF]'
Tue Mar 01 12:52:44 2016 us=970505   groupname = '[UNDEF]'
Tue Mar 01 12:52:44 2016 us=970505   chroot_dir = '[UNDEF]'
Tue Mar 01 12:52:44 2016 us=970505   cd_dir = '[UNDEF]'
Tue Mar 01 12:52:44 2016 us=970505   writepid = '[UNDEF]'
Tue Mar 01 12:52:44 2016 us=970505   up_script = '[UNDEF]'
Tue Mar 01 12:52:44 2016 us=970505   down_script = '[UNDEF]'
Tue Mar 01 12:52:44 2016 us=970505   down_pre = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   up_restart = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   up_delay = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   daemon = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   inetd = 0
Tue Mar 01 12:52:44 2016 us=970505   log = ENABLED
Tue Mar 01 12:52:44 2016 us=970505   suppress_timestamps = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   nice = 0
Tue Mar 01 12:52:44 2016 us=970505   verbosity = 7
Tue Mar 01 12:52:44 2016 us=970505   mute = 0
Tue Mar 01 12:52:44 2016 us=970505   gremlin = 0
Tue Mar 01 12:52:44 2016 us=970505   status_file = '[UNDEF]'
Tue Mar 01 12:52:44 2016 us=970505   status_file_version = 1
Tue Mar 01 12:52:44 2016 us=970505   status_file_update_freq = 60
Tue Mar 01 12:52:44 2016 us=970505   occ = ENABLED
Tue Mar 01 12:52:44 2016 us=970505   rcvbuf = 0
Tue Mar 01 12:52:44 2016 us=970505   sndbuf = 0
Tue Mar 01 12:52:44 2016 us=970505   sockflags = 0
Tue Mar 01 12:52:44 2016 us=970505   fast_io = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   lzo = 7
Tue Mar 01 12:52:44 2016 us=970505   route_script = '[UNDEF]'
Tue Mar 01 12:52:44 2016 us=970505   route_default_gateway = '[UNDEF]'
Tue Mar 01 12:52:44 2016 us=970505   route_default_metric = 0
Tue Mar 01 12:52:44 2016 us=970505   route_noexec = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   route_delay = 5
Tue Mar 01 12:52:44 2016 us=970505   route_delay_window = 30
Tue Mar 01 12:52:44 2016 us=970505   route_delay_defined = ENABLED
Tue Mar 01 12:52:44 2016 us=970505   route_nopull = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   route_gateway_via_dhcp = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   max_routes = 100
Tue Mar 01 12:52:44 2016 us=970505   allow_pull_fqdn = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   management_addr = '127.0.0.1'
Tue Mar 01 12:52:44 2016 us=970505   management_port = 25343
Tue Mar 01 12:52:44 2016 us=970505   management_user_pass = 'stdin'
Tue Mar 01 12:52:44 2016 us=970505   management_log_history_cache = 250
Tue Mar 01 12:52:44 2016 us=970505   management_echo_buffer_size = 100
Tue Mar 01 12:52:44 2016 us=970505   management_write_peer_info_file = '[UNDEF]'
Tue Mar 01 12:52:44 2016 us=970505   management_client_user = '[UNDEF]'
Tue Mar 01 12:52:44 2016 us=970505   management_client_group = '[UNDEF]'
Tue Mar 01 12:52:44 2016 us=970505   management_flags = 6
Tue Mar 01 12:52:44 2016 us=970505   shared_secret_file = '[UNDEF]'
Tue Mar 01 12:52:44 2016 us=970505   key_direction = 2
Tue Mar 01 12:52:44 2016 us=970505   ciphername_defined = ENABLED
Tue Mar 01 12:52:44 2016 us=970505   ciphername = 'AES-256-CBC'
Tue Mar 01 12:52:44 2016 us=970505   authname_defined = ENABLED
Tue Mar 01 12:52:44 2016 us=970505   authname = 'SHA1'
Tue Mar 01 12:52:44 2016 us=970505   prng_hash = 'SHA1'
Tue Mar 01 12:52:44 2016 us=970505   prng_nonce_secret_len = 16
Tue Mar 01 12:52:44 2016 us=970505   keysize = 0
Tue Mar 01 12:52:44 2016 us=970505   engine = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   replay = ENABLED
Tue Mar 01 12:52:44 2016 us=970505   mute_replay_warnings = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   replay_window = 64
Tue Mar 01 12:52:44 2016 us=970505   replay_time = 15
Tue Mar 01 12:52:44 2016 us=970505   packet_id_file = '[UNDEF]'
Tue Mar 01 12:52:44 2016 us=970505   use_iv = ENABLED
Tue Mar 01 12:52:44 2016 us=970505   test_crypto = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   tls_server = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   tls_client = ENABLED
Tue Mar 01 12:52:44 2016 us=970505   key_method = 2
Tue Mar 01 12:52:44 2016 us=970505   ca_file = '[[INLINE]]'
Tue Mar 01 12:52:44 2016 us=970505   ca_path = '[UNDEF]'
Tue Mar 01 12:52:44 2016 us=970505   dh_file = '[UNDEF]'
Tue Mar 01 12:52:44 2016 us=970505   cert_file = '[[INLINE]]'
Tue Mar 01 12:52:44 2016 us=970505   extra_certs_file = '[UNDEF]'
Tue Mar 01 12:52:44 2016 us=970505   priv_key_file = '[[INLINE]]'
Tue Mar 01 12:52:44 2016 us=970505   pkcs12_file = '[UNDEF]'
Tue Mar 01 12:52:44 2016 us=970505   cryptoapi_cert = '[UNDEF]'
Tue Mar 01 12:52:44 2016 us=970505   cipher_list = '[UNDEF]'
Tue Mar 01 12:52:44 2016 us=970505   tls_verify = '[UNDEF]'
Tue Mar 01 12:52:44 2016 us=970505   tls_export_cert = '[UNDEF]'
Tue Mar 01 12:52:44 2016 us=970505   verify_x509_type = 0
Tue Mar 01 12:52:44 2016 us=970505   verify_x509_name = '[UNDEF]'
Tue Mar 01 12:52:44 2016 us=970505   crl_file = '[UNDEF]'
Tue Mar 01 12:52:44 2016 us=970505   ns_cert_type = 0
Tue Mar 01 12:52:44 2016 us=970505   remote_cert_ku[i] = 160
Tue Mar 01 12:52:44 2016 us=970505   remote_cert_ku[i] = 136
Tue Mar 01 12:52:44 2016 us=970505   remote_cert_ku[i] = 0
Tue Mar 01 12:52:44 2016 us=970505   remote_cert_ku[i] = 0
Tue Mar 01 12:52:44 2016 us=970505   remote_cert_ku[i] = 0
Tue Mar 01 12:52:44 2016 us=970505   remote_cert_ku[i] = 0
Tue Mar 01 12:52:44 2016 us=970505   remote_cert_ku[i] = 0
Tue Mar 01 12:52:44 2016 us=970505   remote_cert_ku[i] = 0
Tue Mar 01 12:52:44 2016 us=970505   remote_cert_ku[i] = 0
Tue Mar 01 12:52:44 2016 us=970505   remote_cert_ku[i] = 0
Tue Mar 01 12:52:44 2016 us=970505   remote_cert_ku[i] = 0
Tue Mar 01 12:52:44 2016 us=970505   remote_cert_ku[i] = 0
Tue Mar 01 12:52:44 2016 us=970505   remote_cert_ku[i] = 0
Tue Mar 01 12:52:44 2016 us=970505   remote_cert_ku[i] = 0
Tue Mar 01 12:52:44 2016 us=970505   remote_cert_ku[i] = 0
Tue Mar 01 12:52:44 2016 us=970505   remote_cert_ku[i] = 0
Tue Mar 01 12:52:44 2016 us=970505   remote_cert_eku = 'TLS Web Server Authentication'
Tue Mar 01 12:52:44 2016 us=970505   ssl_flags = 0
Tue Mar 01 12:52:44 2016 us=970505   tls_timeout = 2
Tue Mar 01 12:52:44 2016 us=970505   renegotiate_bytes = 0
Tue Mar 01 12:52:44 2016 us=970505   renegotiate_packets = 0
Tue Mar 01 12:52:44 2016 us=970505   renegotiate_seconds = 3600
Tue Mar 01 12:52:44 2016 us=970505   handshake_window = 60
Tue Mar 01 12:52:44 2016 us=970505   transition_window = 3600
Tue Mar 01 12:52:44 2016 us=970505   single_session = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   push_peer_info = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   tls_exit = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   tls_auth_file = '[[INLINE]]'
Tue Mar 01 12:52:44 2016 us=970505   pkcs11_protected_authentication = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   pkcs11_protected_authentication = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   pkcs11_protected_authentication = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   pkcs11_protected_authentication = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   pkcs11_protected_authentication = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   pkcs11_protected_authentication = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   pkcs11_protected_authentication = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   pkcs11_protected_authentication = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   pkcs11_protected_authentication = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   pkcs11_protected_authentication = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   pkcs11_protected_authentication = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   pkcs11_protected_authentication = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   pkcs11_protected_authentication = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   pkcs11_protected_authentication = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   pkcs11_protected_authentication = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   pkcs11_protected_authentication = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   pkcs11_private_mode = 00000000
Tue Mar 01 12:52:44 2016 us=970505   pkcs11_private_mode = 00000000
Tue Mar 01 12:52:44 2016 us=970505   pkcs11_private_mode = 00000000
Tue Mar 01 12:52:44 2016 us=970505   pkcs11_private_mode = 00000000
Tue Mar 01 12:52:44 2016 us=970505   pkcs11_private_mode = 00000000
Tue Mar 01 12:52:44 2016 us=970505   pkcs11_private_mode = 00000000
Tue Mar 01 12:52:44 2016 us=970505   pkcs11_private_mode = 00000000
Tue Mar 01 12:52:44 2016 us=970505   pkcs11_private_mode = 00000000
Tue Mar 01 12:52:44 2016 us=970505   pkcs11_private_mode = 00000000
Tue Mar 01 12:52:44 2016 us=970505   pkcs11_private_mode = 00000000
Tue Mar 01 12:52:44 2016 us=970505   pkcs11_private_mode = 00000000
Tue Mar 01 12:52:44 2016 us=970505   pkcs11_private_mode = 00000000
Tue Mar 01 12:52:44 2016 us=970505   pkcs11_private_mode = 00000000
Tue Mar 01 12:52:44 2016 us=970505   pkcs11_private_mode = 00000000
Tue Mar 01 12:52:44 2016 us=970505   pkcs11_private_mode = 00000000
Tue Mar 01 12:52:44 2016 us=970505   pkcs11_private_mode = 00000000
Tue Mar 01 12:52:44 2016 us=970505   pkcs11_cert_private = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   pkcs11_cert_private = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   pkcs11_cert_private = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   pkcs11_cert_private = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   pkcs11_cert_private = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   pkcs11_cert_private = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   pkcs11_cert_private = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   pkcs11_cert_private = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   pkcs11_cert_private = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   pkcs11_cert_private = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   pkcs11_cert_private = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   pkcs11_cert_private = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   pkcs11_cert_private = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   pkcs11_cert_private = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   pkcs11_cert_private = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   pkcs11_cert_private = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   pkcs11_pin_cache_period = -1
Tue Mar 01 12:52:44 2016 us=970505   pkcs11_id = '[UNDEF]'
Tue Mar 01 12:52:44 2016 us=970505   pkcs11_id_management = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   server_network = 0.0.0.0
Tue Mar 01 12:52:44 2016 us=970505   server_netmask = 0.0.0.0
Tue Mar 01 12:52:44 2016 us=970505   server_network_ipv6 = ìó"
Tue Mar 01 12:52:44 2016 us=970505   server_netbits_ipv6 = 0
Tue Mar 01 12:52:44 2016 us=970505   server_bridge_ip = 0.0.0.0
Tue Mar 01 12:52:44 2016 us=970505   server_bridge_netmask = 0.0.0.0
Tue Mar 01 12:52:44 2016 us=970505   server_bridge_pool_start = 0.0.0.0
Tue Mar 01 12:52:44 2016 us=970505   server_bridge_pool_end = 0.0.0.0
Tue Mar 01 12:52:44 2016 us=970505   ifconfig_pool_defined = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   ifconfig_pool_start = 0.0.0.0
Tue Mar 01 12:52:44 2016 us=970505   ifconfig_pool_end = 0.0.0.0
Tue Mar 01 12:52:44 2016 us=970505   ifconfig_pool_netmask = 0.0.0.0
Tue Mar 01 12:52:44 2016 us=970505   ifconfig_pool_persist_filename = '[UNDEF]'
Tue Mar 01 12:52:44 2016 us=970505   ifconfig_pool_persist_refresh_freq = 600
Tue Mar 01 12:52:44 2016 us=970505   ifconfig_ipv6_pool_defined = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   ifconfig_ipv6_pool_base = ìó"
Tue Mar 01 12:52:44 2016 us=970505   ifconfig_ipv6_pool_netbits = 0
Tue Mar 01 12:52:44 2016 us=970505   n_bcast_buf = 256
Tue Mar 01 12:52:44 2016 us=970505   tcp_queue_limit = 64
Tue Mar 01 12:52:44 2016 us=970505   real_hash_size = 256
Tue Mar 01 12:52:44 2016 us=970505   virtual_hash_size = 256
Tue Mar 01 12:52:44 2016 us=970505   client_connect_script = '[UNDEF]'
Tue Mar 01 12:52:44 2016 us=970505   learn_address_script = '[UNDEF]'
Tue Mar 01 12:52:44 2016 us=970505   client_disconnect_script = '[UNDEF]'
Tue Mar 01 12:52:44 2016 us=970505   client_config_dir = '[UNDEF]'
Tue Mar 01 12:52:44 2016 us=970505   ccd_exclusive = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   tmp_dir = 'C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\'
Tue Mar 01 12:52:44 2016 us=970505   push_ifconfig_defined = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   push_ifconfig_local = 0.0.0.0
Tue Mar 01 12:52:44 2016 us=970505   push_ifconfig_remote_netmask = 0.0.0.0
Tue Mar 01 12:52:44 2016 us=970505   push_ifconfig_ipv6_defined = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   push_ifconfig_ipv6_local = ìó"/0
Tue Mar 01 12:52:44 2016 us=970505   push_ifconfig_ipv6_remote = ìó"
Tue Mar 01 12:52:44 2016 us=970505   enable_c2c = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   duplicate_cn = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   cf_max = 0
Tue Mar 01 12:52:44 2016 us=970505   cf_per = 0
Tue Mar 01 12:52:44 2016 us=970505   max_clients = 1024
Tue Mar 01 12:52:44 2016 us=970505   max_routes_per_client = 256
Tue Mar 01 12:52:44 2016 us=970505   auth_user_pass_verify_script = '[UNDEF]'
Tue Mar 01 12:52:44 2016 us=970505   auth_user_pass_verify_script_via_file = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   client = ENABLED
Tue Mar 01 12:52:44 2016 us=970505   pull = ENABLED
Tue Mar 01 12:52:44 2016 us=970505   auth_user_pass_file = '[UNDEF]'
Tue Mar 01 12:52:44 2016 us=970505   show_net_up = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   route_method = 0
Tue Mar 01 12:52:44 2016 us=970505   block_outside_dns = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   ip_win32_defined = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   ip_win32_type = 3
Tue Mar 01 12:52:44 2016 us=970505   dhcp_masq_offset = 0
Tue Mar 01 12:52:44 2016 us=970505   dhcp_lease_time = 31536000
Tue Mar 01 12:52:44 2016 us=970505   tap_sleep = 0
Tue Mar 01 12:52:44 2016 us=970505   dhcp_options = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   dhcp_renew = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   dhcp_pre_release = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   dhcp_release = DISABLED
Tue Mar 01 12:52:44 2016 us=970505   domain = '[UNDEF]'
Tue Mar 01 12:52:44 2016 us=970505   netbios_scope = '[UNDEF]'
Tue Mar 01 12:52:44 2016 us=970505   netbios_node_type = 0
Tue Mar 01 12:52:44 2016 us=970505   disable_nbt = DISABLED
Tue Mar 01 12:52:44 2016 us=970505 OpenVPN 2.3.10 i686-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Feb  1 2016
Tue Mar 01 12:52:44 2016 us=970505 Windows version 5.1 (Windows XP)
Tue Mar 01 12:52:44 2016 us=970505 library versions: OpenSSL 1.0.1r  28 Jan 2016, LZO 2.09
Enter Management Password:
Tue Mar 01 12:52:44 2016 us=970505 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25343
Tue Mar 01 12:52:44 2016 us=970505 Need hold release from management interface, waiting...
Tue Mar 01 12:52:45 2016 us=579911 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25343
Tue Mar 01 12:52:45 2016 us=689291 MANAGEMENT: CMD 'state on'
Tue Mar 01 12:52:45 2016 us=689291 MANAGEMENT: CMD 'log all on'
Tue Mar 01 12:52:45 2016 us=767420 MANAGEMENT: CMD 'hold off'
Tue Mar 01 12:52:45 2016 us=767420 MANAGEMENT: CMD 'hold release'
Tue Mar 01 12:52:45 2016 us=892427 PRNG init md=SHA1 size=36
Tue Mar 01 12:52:45 2016 us=892427 Control Channel Authentication: tls-auth using INLINE static key file
Tue Mar 01 12:52:45 2016 us=892427 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Mar 01 12:52:45 2016 us=892427 Outgoing Control Channel Authentication: HMAC KEY: 325f93a5 cc542491 6feb3bc4 9728e8ff 183a730a
Tue Mar 01 12:52:45 2016 us=892427 Outgoing Control Channel Authentication: HMAC size=20 block_size=20
Tue Mar 01 12:52:45 2016 us=892427 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Mar 01 12:52:45 2016 us=892427 Incoming Control Channel Authentication: HMAC KEY: 67168c59 dda9497e ce496083 84a4dd56 8e675c59
Tue Mar 01 12:52:45 2016 us=892427 Incoming Control Channel Authentication: HMAC size=20 block_size=20
Tue Mar 01 12:52:45 2016 us=892427 crypto_adjust_frame_parameters: Adjusting frame parameters for crypto by zu bytes
Tue Mar 01 12:52:45 2016 us=892427 crypto_adjust_frame_parameters: Adjusting frame parameters for crypto by zu bytes
Tue Mar 01 12:52:45 2016 us=892427 LZO compression initialized
Tue Mar 01 12:52:45 2016 us=892427 PID packet_id_init tcp_mode=1 seq_backtrack=64 time_backtrack=15
Tue Mar 01 12:52:45 2016 us=892427 PID packet_id_init tcp_mode=1 seq_backtrack=64 time_backtrack=15
Tue Mar 01 12:52:45 2016 us=892427 PID packet_id_init tcp_mode=1 seq_backtrack=64 time_backtrack=15
Tue Mar 01 12:52:45 2016 us=892427 PID packet_id_init tcp_mode=1 seq_backtrack=64 time_backtrack=15
Tue Mar 01 12:52:45 2016 us=892427 Control Channel MTU parms [ L:1560 D:1182 EF:68 EB:0 ET:0 EL:3 ]
Tue Mar 01 12:52:45 2016 us=892427 MTU DYNAMIC mtu=1450, flags=2, 1560 -> 1450
Tue Mar 01 12:52:45 2016 us=892427 Socket Buffers: R=[8192->8192] S=[8192->8192]
Tue Mar 01 12:52:45 2016 us=892427 RESOLVE_REMOTE flags=0x0101 phase=1 rrs=0 sig=-1 status=0
Tue Mar 01 12:52:45 2016 us=892427 Data Channel MTU parms [ L:1560 D:1450 EF:60 EB:143 ET:0 EL:3 AF:3/1 ]
Tue Mar 01 12:52:45 2016 us=892427 Local Options String: 'V4,dev-type tun,link-mtu 1560,tun-mtu 1500,proto TCPv4_CLIENT,comp-lzo,keydir 1,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client'
Tue Mar 01 12:52:45 2016 us=892427 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1560,tun-mtu 1500,proto TCPv4_SERVER,comp-lzo,keydir 0,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-server'
Tue Mar 01 12:52:45 2016 us=892427 Local Options hash (VER=V4): '2f2c6498'
Tue Mar 01 12:52:45 2016 us=892427 Expected Remote Options hash (VER=V4): '9915e4a2'
Tue Mar 01 12:52:45 2016 us=892427 Attempting to establish TCP connection with [AF_INET]<openvpn-svr-ip>:34557 [nonblock]
Tue Mar 01 12:52:45 2016 us=892427 MANAGEMENT: >STATE:1456836765,TCP_CONNECT,,,
Tue Mar 01 12:52:55 2016 us=892939 TCP: connect to [AF_INET]<openvpn-svr-ip>:34557 failed, will try again in 5 seconds: The system tried to join a drive to a directory on a joined drive.  
Tue Mar 01 12:53:00 2016 us=893195 MANAGEMENT: >STATE:1456836780,TCP_CONNECT,,,
Tue Mar 01 12:53:03 2016 us=893348 PID packet_id_free
Tue Mar 01 12:53:03 2016 us=893348 PID packet_id_free
Tue Mar 01 12:53:03 2016 us=893348 PID packet_id_free
Tue Mar 01 12:53:03 2016 us=893348 PID packet_id_free
Tue Mar 01 12:53:03 2016 us=893348 PID packet_id_free
Tue Mar 01 12:53:03 2016 us=893348 PID packet_id_free
Tue Mar 01 12:53:03 2016 us=893348 PID packet_id_free
Tue Mar 01 12:53:03 2016 us=893348 PID packet_id_free
Tue Mar 01 12:53:03 2016 us=893348 TCP/UDP: Closing socket
Tue Mar 01 12:53:03 2016 us=893348 PID packet_id_free
Tue Mar 01 12:53:03 2016 us=893348 SIGTERM[hard,init_instance] received, process exiting
Tue Mar 01 12:53:03 2016 us=893348 MANAGEMENT: >STATE:1456836783,EXITING,init_instance,,
Tue Mar 01 12:53:03 2016 us=893348 PKCS#11: Terminating openssl
Tue Mar 01 12:53:03 2016 us=893348 PKCS#11: Removing providers
Tue Mar 01 12:53:03 2016 us=893348 PKCS#11: Releasing sessions
Tue Mar 01 12:53:03 2016 us=893348 PKCS#11: Terminating slotevent
Tue Mar 01 12:53:03 2016 us=893348 PKCS#11: Marking as uninitialized
Tue Mar 01 12:53:03 2016 us=893348 Closing Win32 semaphore 'openvpn_netcmd'

TiTex

as you can see in the server.log ,

Tue Mar 1 12:48:01 2016 failed to find GID for group nogroup
Tue Mar 1 12:48:01 2016 Exiting due to fatal error

your sever stops immediately after startup , due to there's no such group *'nogroup' on your system
on red hat based system you should change that in the configs to

user nobody
group nobody

*nogroup - is specific for debian based distros among others

neuronetv

thankyou titex that did it, I now have a connection from the client which is great.