Hi community, I need some help with my configuration: my goal is to access my network from the outside, and connect to all clients in the network (primarily web-interfaces to devices, and samba-access to windows machines). My router runs dd-wrt (v3.0-r28000M kongac), and is reachable from the outside via dyn-dns, internally via the IP 192.168.111.1. With my current config, OpenVPN-GUI on windows does connect, but I can't reach any of the machines in the network. My main problem is that I am on a different continent as the router, and dd-wrt stops responding when messing up the config... So it's a major PITA to troubleshoot my problem, as I need a person to go and physically reset the router every time :roll: Router-Config: [code] push "route 192.168.111.0 255.255.255.0" server 10.8.0.0 255.255.255.0 dev tun0 proto tcp keepalive 10 120 dh /tmp/openvpn/dh.pem ca /tmp/openvpn/ca.crt cert /tmp/openvpn/cert.pem key /tmp/openvpn/key.pem management localhost 5001 ifconfig-pool-persist ipp.txt keepalive 10 60 cipher AES-256-CBC comp-lzo max-clients 20 persist-key persist-tun [/code] Client-Config: [code] client dev tun proto tcp remote redacted.com 1194 resolv-retry infinite nobind persist-key persist-tun ca ca.crt cert admin.crt key admin.key ns-cert-type server cipher AES-256-CBC comp-lzo verb 4 [/code] I got it running on our old router, but that broke, and I'm thousands of kilometers away now... Thanks in advance!

[quote="Jekyll"]and is reachable from the outside via dyn-dns, internally via the [b]IP 192.168.111.1[/b][/quote]Can your client ping [b]that IP[/b] ?

[quote="TinCanTech"]Can you ping 10.8.0.1 ? Did you enable IP_FORWARD in the router ?[/quote] No, like I said, I cannot ping 192.168.111.1 nor 10.8.0.1 :( IP_FORWARD is on: [code] cat /proc/sys/net/ipv4/ip_forward 1 [/code] I guess I forgot some stupid option somewhere, as it [b]did[/b] work without problems on the last router of ours (also dd-wrt). But I'm absolutely lost which option that is...

Help with routing-config on dd-wrt: does connect, but can't access network

Jekyll

Hi community,
I need some help with my configuration:

my goal is to access my network from the outside, and connect to all clients in the network (primarily web-interfaces to devices, and samba-access to windows machines). My router runs dd-wrt (v3.0-r28000M kongac), and is reachable from the outside via dyn-dns, internally via the IP 192.168.111.1.

With my current config, OpenVPN-GUI on windows does connect, but I can't reach any of the machines in the network. My main problem is that I am on a different continent as the router, and dd-wrt stops responding when messing up the config... So it's a major PITA to troubleshoot my problem, as I need a person to go and physically reset the router every time :roll:

Router-Config:

    push "route 192.168.111.0 255.255.255.0"
    server 10.8.0.0 255.255.255.0
    dev tun0
    proto tcp
    keepalive 10 120
    dh /tmp/openvpn/dh.pem
    ca /tmp/openvpn/ca.crt
    cert /tmp/openvpn/cert.pem
    key /tmp/openvpn/key.pem
    management localhost 5001
    ifconfig-pool-persist ipp.txt
    keepalive 10 60
    cipher AES-256-CBC
    comp-lzo
    max-clients 20
    persist-key
    persist-tun

Client-Config:

    client
    dev tun
    proto tcp
    remote redacted.com 1194
    resolv-retry infinite
    nobind
    persist-key
    persist-tun
    ca ca.crt
    cert admin.crt
    key admin.key
    ns-cert-type server
    cipher AES-256-CBC
    comp-lzo
    verb 4

I got it running on our old router, but that broke, and I'm thousands of kilometers away now...
Thanks in advance!

Jekyll

Additional info: I do not want to route my clients traffic through the VPN. Only access the remote network's clients...

TinCanTech

Jekyll wroteand is reachable from the outside via dyn-dns, internally via the IP 192.168.111.1

Can your client ping that IP ?

Jekyll

No, I can't ping 192.168.111.1 and neither 10.8.0.1

ipconfig gives:

   Link-local IPv6-Adresse   . . . . : fe80::2518:f15b:674a:3e44%19
   IPv4-Address  . . . . . . . . . . : 10.8.0.6
   Subnet Mask   . . . . . . . . . . : 255.255.255.252
   Default Gateway . . . . . . . . . :

and here is the client's log-output:

Wed Jun 22 19:27:00 2016 us=435935 Current Parameter Settings:
Wed Jun 22 19:27:00 2016 us=437936   config = 'foobar.ovpn'
Wed Jun 22 19:27:00 2016 us=437936   mode = 0
Wed Jun 22 19:27:00 2016 us=437936   show_ciphers = DISABLED
Wed Jun 22 19:27:00 2016 us=437936   show_digests = DISABLED
Wed Jun 22 19:27:00 2016 us=437936   show_engines = DISABLED
Wed Jun 22 19:27:00 2016 us=438936   genkey = DISABLED
Wed Jun 22 19:27:00 2016 us=438936   key_pass_file = '[UNDEF]'
Wed Jun 22 19:27:00 2016 us=438936   show_tls_ciphers = DISABLED
Wed Jun 22 19:27:00 2016 us=438936 Connection profiles [default]:
Wed Jun 22 19:27:00 2016 us=438936   proto = tcp-client
Wed Jun 22 19:27:00 2016 us=438936   local = '[UNDEF]'
Wed Jun 22 19:27:00 2016 us=438936   local_port = 0
Wed Jun 22 19:27:00 2016 us=438936   remote = 'redacted.com'
Wed Jun 22 19:27:00 2016 us=438936   remote_port = 1194
Wed Jun 22 19:27:00 2016 us=438936   remote_float = DISABLED
Wed Jun 22 19:27:00 2016 us=438936   bind_defined = DISABLED
Wed Jun 22 19:27:00 2016 us=438936   bind_local = DISABLED
Wed Jun 22 19:27:00 2016 us=438936   connect_retry_seconds = 5
Wed Jun 22 19:27:00 2016 us=438936   connect_timeout = 10
Wed Jun 22 19:27:00 2016 us=438936   connect_retry_max = 0
Wed Jun 22 19:27:00 2016 us=438936   socks_proxy_server = '[UNDEF]'
Wed Jun 22 19:27:00 2016 us=438936   socks_proxy_port = 0
Wed Jun 22 19:27:00 2016 us=438936   socks_proxy_retry = DISABLED
Wed Jun 22 19:27:00 2016 us=439936   tun_mtu = 1500
Wed Jun 22 19:27:00 2016 us=439936   tun_mtu_defined = ENABLED
Wed Jun 22 19:27:00 2016 us=439936   link_mtu = 1500
Wed Jun 22 19:27:00 2016 us=439936   link_mtu_defined = DISABLED
Wed Jun 22 19:27:00 2016 us=439936   tun_mtu_extra = 0
Wed Jun 22 19:27:00 2016 us=439936   tun_mtu_extra_defined = DISABLED
Wed Jun 22 19:27:00 2016 us=439936   mtu_discover_type = -1
Wed Jun 22 19:27:00 2016 us=439936   fragment = 0
Wed Jun 22 19:27:00 2016 us=439936   mssfix = 1450
Wed Jun 22 19:27:00 2016 us=439936   explicit_exit_notification = 0
Wed Jun 22 19:27:00 2016 us=439936 Connection profiles END
Wed Jun 22 19:27:00 2016 us=439936   remote_random = DISABLED
Wed Jun 22 19:27:00 2016 us=439936   ipchange = '[UNDEF]'
Wed Jun 22 19:27:00 2016 us=439936   dev = 'tun'
Wed Jun 22 19:27:00 2016 us=439936   dev_type = '[UNDEF]'
Wed Jun 22 19:27:00 2016 us=439936   dev_node = '[UNDEF]'
Wed Jun 22 19:27:00 2016 us=439936   lladdr = '[UNDEF]'
Wed Jun 22 19:27:00 2016 us=439936   topology = 1
Wed Jun 22 19:27:00 2016 us=439936   tun_ipv6 = DISABLED
Wed Jun 22 19:27:00 2016 us=439936   ifconfig_local = '[UNDEF]'
Wed Jun 22 19:27:00 2016 us=439936   ifconfig_remote_netmask = '[UNDEF]'
Wed Jun 22 19:27:00 2016 us=439936   ifconfig_noexec = DISABLED
Wed Jun 22 19:27:00 2016 us=439936   ifconfig_nowarn = DISABLED
Wed Jun 22 19:27:00 2016 us=439936   ifconfig_ipv6_local = '[UNDEF]'
Wed Jun 22 19:27:00 2016 us=440936   ifconfig_ipv6_netbits = 0
Wed Jun 22 19:27:00 2016 us=440936   ifconfig_ipv6_remote = '[UNDEF]'
Wed Jun 22 19:27:00 2016 us=440936   shaper = 0
Wed Jun 22 19:27:00 2016 us=440936   mtu_test = 0
Wed Jun 22 19:27:00 2016 us=440936   mlock = DISABLED
Wed Jun 22 19:27:00 2016 us=440936   keepalive_ping = 0
Wed Jun 22 19:27:00 2016 us=440936   keepalive_timeout = 0
Wed Jun 22 19:27:00 2016 us=440936   inactivity_timeout = 0
Wed Jun 22 19:27:00 2016 us=440936   ping_send_timeout = 0
Wed Jun 22 19:27:00 2016 us=440936   ping_rec_timeout = 0
Wed Jun 22 19:27:00 2016 us=440936   ping_rec_timeout_action = 0
Wed Jun 22 19:27:00 2016 us=440936   ping_timer_remote = DISABLED
Wed Jun 22 19:27:00 2016 us=440936   remap_sigusr1 = 0
Wed Jun 22 19:27:00 2016 us=440936   persist_tun = ENABLED
Wed Jun 22 19:27:00 2016 us=440936   persist_local_ip = DISABLED
Wed Jun 22 19:27:00 2016 us=440936   persist_remote_ip = DISABLED
Wed Jun 22 19:27:00 2016 us=440936   persist_key = ENABLED
Wed Jun 22 19:27:00 2016 us=440936   passtos = DISABLED
Wed Jun 22 19:27:00 2016 us=440936   resolve_retry_seconds = 1000000000
Wed Jun 22 19:27:00 2016 us=440936   username = '[UNDEF]'
Wed Jun 22 19:27:00 2016 us=440936   groupname = '[UNDEF]'
Wed Jun 22 19:27:00 2016 us=441936   chroot_dir = '[UNDEF]'
Wed Jun 22 19:27:00 2016 us=441936   cd_dir = '[UNDEF]'
Wed Jun 22 19:27:00 2016 us=441936   writepid = '[UNDEF]'
Wed Jun 22 19:27:00 2016 us=441936   up_script = '[UNDEF]'
Wed Jun 22 19:27:00 2016 us=441936   down_script = '[UNDEF]'
Wed Jun 22 19:27:00 2016 us=441936   down_pre = DISABLED
Wed Jun 22 19:27:00 2016 us=441936   up_restart = DISABLED
Wed Jun 22 19:27:00 2016 us=441936   up_delay = DISABLED
Wed Jun 22 19:27:00 2016 us=441936   daemon = DISABLED
Wed Jun 22 19:27:00 2016 us=441936   inetd = 0
Wed Jun 22 19:27:00 2016 us=441936   log = ENABLED
Wed Jun 22 19:27:00 2016 us=441936   suppress_timestamps = DISABLED
Wed Jun 22 19:27:00 2016 us=441936   nice = 0
Wed Jun 22 19:27:00 2016 us=441936   verbosity = 4
Wed Jun 22 19:27:00 2016 us=441936   mute = 0
Wed Jun 22 19:27:00 2016 us=441936   gremlin = 0
Wed Jun 22 19:27:00 2016 us=441936   status_file = '[UNDEF]'
Wed Jun 22 19:27:00 2016 us=441936   status_file_version = 1
Wed Jun 22 19:27:00 2016 us=441936   status_file_update_freq = 60
Wed Jun 22 19:27:00 2016 us=441936   occ = ENABLED
Wed Jun 22 19:27:00 2016 us=441936   rcvbuf = 0
Wed Jun 22 19:27:00 2016 us=441936   sndbuf = 0
Wed Jun 22 19:27:00 2016 us=441936   sockflags = 0
Wed Jun 22 19:27:00 2016 us=441936   fast_io = DISABLED
Wed Jun 22 19:27:00 2016 us=441936   lzo = 7
Wed Jun 22 19:27:00 2016 us=441936   route_script = '[UNDEF]'
Wed Jun 22 19:27:00 2016 us=441936   route_default_gateway = '[UNDEF]'
Wed Jun 22 19:27:00 2016 us=441936   route_default_metric = 0
Wed Jun 22 19:27:00 2016 us=441936   route_noexec = DISABLED
Wed Jun 22 19:27:00 2016 us=441936   route_delay = 5
Wed Jun 22 19:27:00 2016 us=441936   route_delay_window = 30
Wed Jun 22 19:27:00 2016 us=441936   route_delay_defined = ENABLED
Wed Jun 22 19:27:00 2016 us=441936   route_nopull = DISABLED
Wed Jun 22 19:27:00 2016 us=441936   route_gateway_via_dhcp = DISABLED
Wed Jun 22 19:27:00 2016 us=442936   max_routes = 100
Wed Jun 22 19:27:00 2016 us=442936   allow_pull_fqdn = DISABLED
Wed Jun 22 19:27:00 2016 us=442936   management_addr = '127.0.0.1'
Wed Jun 22 19:27:00 2016 us=442936   management_port = 25340
Wed Jun 22 19:27:00 2016 us=442936   management_user_pass = 'stdin'
Wed Jun 22 19:27:00 2016 us=442936   management_log_history_cache = 250
Wed Jun 22 19:27:00 2016 us=442936   management_echo_buffer_size = 100
Wed Jun 22 19:27:00 2016 us=442936   management_write_peer_info_file = '[UNDEF]'
Wed Jun 22 19:27:00 2016 us=442936   management_client_user = '[UNDEF]'
Wed Jun 22 19:27:00 2016 us=442936   management_client_group = '[UNDEF]'
Wed Jun 22 19:27:00 2016 us=442936   management_flags = 6
Wed Jun 22 19:27:00 2016 us=442936   shared_secret_file = '[UNDEF]'
Wed Jun 22 19:27:00 2016 us=442936   key_direction = 0
Wed Jun 22 19:27:00 2016 us=442936   ciphername_defined = ENABLED
Wed Jun 22 19:27:00 2016 us=442936   ciphername = 'AES-256-CBC'
Wed Jun 22 19:27:00 2016 us=442936   authname_defined = ENABLED
Wed Jun 22 19:27:00 2016 us=442936   authname = 'SHA1'
Wed Jun 22 19:27:00 2016 us=442936   prng_hash = 'SHA1'
Wed Jun 22 19:27:00 2016 us=442936   prng_nonce_secret_len = 16
Wed Jun 22 19:27:00 2016 us=442936   keysize = 0
Wed Jun 22 19:27:00 2016 us=442936   engine = DISABLED
Wed Jun 22 19:27:00 2016 us=442936   replay = ENABLED
Wed Jun 22 19:27:00 2016 us=442936   mute_replay_warnings = DISABLED
Wed Jun 22 19:27:00 2016 us=442936   replay_window = 64
Wed Jun 22 19:27:00 2016 us=442936   replay_time = 15
Wed Jun 22 19:27:00 2016 us=442936   packet_id_file = '[UNDEF]'
Wed Jun 22 19:27:00 2016 us=442936   use_iv = ENABLED
Wed Jun 22 19:27:00 2016 us=442936   test_crypto = DISABLED
Wed Jun 22 19:27:00 2016 us=442936   tls_server = DISABLED
Wed Jun 22 19:27:00 2016 us=443936   tls_client = ENABLED
Wed Jun 22 19:27:00 2016 us=443936   key_method = 2
Wed Jun 22 19:27:00 2016 us=443936   ca_file = 'ca.crt'
Wed Jun 22 19:27:00 2016 us=443936   ca_path = '[UNDEF]'
Wed Jun 22 19:27:00 2016 us=443936   dh_file = '[UNDEF]'
Wed Jun 22 19:27:00 2016 us=443936   cert_file = 'admin.crt'
Wed Jun 22 19:27:00 2016 us=443936   extra_certs_file = '[UNDEF]'
Wed Jun 22 19:27:00 2016 us=443936   priv_key_file = 'admin.key'
Wed Jun 22 19:27:00 2016 us=443936   pkcs12_file = '[UNDEF]'
Wed Jun 22 19:27:00 2016 us=443936   cryptoapi_cert = '[UNDEF]'
Wed Jun 22 19:27:00 2016 us=443936   cipher_list = '[UNDEF]'
Wed Jun 22 19:27:00 2016 us=443936   tls_verify = '[UNDEF]'
Wed Jun 22 19:27:00 2016 us=443936   tls_export_cert = '[UNDEF]'
Wed Jun 22 19:27:00 2016 us=443936   verify_x509_type = 0
Wed Jun 22 19:27:00 2016 us=443936   verify_x509_name = '[UNDEF]'
Wed Jun 22 19:27:00 2016 us=443936   crl_file = '[UNDEF]'
Wed Jun 22 19:27:00 2016 us=443936   ns_cert_type = 1
Wed Jun 22 19:27:00 2016 us=443936   remote_cert_ku[i] = 0
Wed Jun 22 19:27:00 2016 us=444936   remote_cert_ku[i] = 0
Wed Jun 22 19:27:00 2016 us=444936   remote_cert_ku[i] = 0
Wed Jun 22 19:27:00 2016 us=444936   remote_cert_ku[i] = 0
Wed Jun 22 19:27:00 2016 us=444936   remote_cert_ku[i] = 0
Wed Jun 22 19:27:00 2016 us=444936   remote_cert_ku[i] = 0
Wed Jun 22 19:27:00 2016 us=444936   remote_cert_ku[i] = 0
Wed Jun 22 19:27:00 2016 us=444936   remote_cert_ku[i] = 0
Wed Jun 22 19:27:00 2016 us=444936   remote_cert_ku[i] = 0
Wed Jun 22 19:27:00 2016 us=444936   remote_cert_ku[i] = 0
Wed Jun 22 19:27:00 2016 us=444936   remote_cert_ku[i] = 0
Wed Jun 22 19:27:00 2016 us=444936   remote_cert_ku[i] = 0
Wed Jun 22 19:27:00 2016 us=444936   remote_cert_ku[i] = 0
Wed Jun 22 19:27:00 2016 us=444936   remote_cert_ku[i] = 0
Wed Jun 22 19:27:00 2016 us=444936   remote_cert_ku[i] = 0
Wed Jun 22 19:27:00 2016 us=444936   remote_cert_ku[i] = 0
Wed Jun 22 19:27:00 2016 us=444936   remote_cert_eku = '[UNDEF]'
Wed Jun 22 19:27:00 2016 us=444936   ssl_flags = 0
Wed Jun 22 19:27:00 2016 us=444936   tls_timeout = 2
Wed Jun 22 19:27:00 2016 us=444936   renegotiate_bytes = 0
Wed Jun 22 19:27:00 2016 us=444936   renegotiate_packets = 0
Wed Jun 22 19:27:00 2016 us=444936   renegotiate_seconds = 3600
Wed Jun 22 19:27:00 2016 us=444936   handshake_window = 60
Wed Jun 22 19:27:00 2016 us=444936   transition_window = 3600
Wed Jun 22 19:27:00 2016 us=444936   single_session = DISABLED
Wed Jun 22 19:27:00 2016 us=444936   push_peer_info = DISABLED
Wed Jun 22 19:27:00 2016 us=444936   tls_exit = DISABLED
Wed Jun 22 19:27:00 2016 us=445936   tls_auth_file = '[UNDEF]'
Wed Jun 22 19:27:00 2016 us=445936   pkcs11_protected_authentication = DISABLED
Wed Jun 22 19:27:00 2016 us=445936   pkcs11_protected_authentication = DISABLED
Wed Jun 22 19:27:00 2016 us=445936   pkcs11_protected_authentication = DISABLED
Wed Jun 22 19:27:00 2016 us=445936   pkcs11_protected_authentication = DISABLED
Wed Jun 22 19:27:00 2016 us=445936   pkcs11_protected_authentication = DISABLED
Wed Jun 22 19:27:00 2016 us=445936   pkcs11_protected_authentication = DISABLED
Wed Jun 22 19:27:00 2016 us=445936   pkcs11_protected_authentication = DISABLED
Wed Jun 22 19:27:00 2016 us=445936   pkcs11_protected_authentication = DISABLED
Wed Jun 22 19:27:00 2016 us=445936   pkcs11_protected_authentication = DISABLED
Wed Jun 22 19:27:00 2016 us=445936   pkcs11_protected_authentication = DISABLED
Wed Jun 22 19:27:00 2016 us=445936   pkcs11_protected_authentication = DISABLED
Wed Jun 22 19:27:00 2016 us=445936   pkcs11_protected_authentication = DISABLED
Wed Jun 22 19:27:00 2016 us=445936   pkcs11_protected_authentication = DISABLED
Wed Jun 22 19:27:00 2016 us=446936   pkcs11_protected_authentication = DISABLED
Wed Jun 22 19:27:00 2016 us=446936   pkcs11_protected_authentication = DISABLED
Wed Jun 22 19:27:00 2016 us=446936   pkcs11_protected_authentication = DISABLED
Wed Jun 22 19:27:00 2016 us=446936   pkcs11_private_mode = 00000000
Wed Jun 22 19:27:00 2016 us=446936   pkcs11_private_mode = 00000000
Wed Jun 22 19:27:00 2016 us=446936   pkcs11_private_mode = 00000000
Wed Jun 22 19:27:00 2016 us=446936   pkcs11_private_mode = 00000000
Wed Jun 22 19:27:00 2016 us=446936   pkcs11_private_mode = 00000000
Wed Jun 22 19:27:00 2016 us=446936   pkcs11_private_mode = 00000000
Wed Jun 22 19:27:00 2016 us=446936   pkcs11_private_mode = 00000000
Wed Jun 22 19:27:00 2016 us=446936   pkcs11_private_mode = 00000000
Wed Jun 22 19:27:00 2016 us=446936   pkcs11_private_mode = 00000000
Wed Jun 22 19:27:00 2016 us=446936   pkcs11_private_mode = 00000000
Wed Jun 22 19:27:00 2016 us=446936   pkcs11_private_mode = 00000000
Wed Jun 22 19:27:00 2016 us=446936   pkcs11_private_mode = 00000000
Wed Jun 22 19:27:00 2016 us=446936   pkcs11_private_mode = 00000000
Wed Jun 22 19:27:00 2016 us=446936   pkcs11_private_mode = 00000000
Wed Jun 22 19:27:00 2016 us=446936   pkcs11_private_mode = 00000000
Wed Jun 22 19:27:00 2016 us=446936   pkcs11_private_mode = 00000000
Wed Jun 22 19:27:00 2016 us=446936   pkcs11_cert_private = DISABLED
Wed Jun 22 19:27:00 2016 us=447936   pkcs11_cert_private = DISABLED
Wed Jun 22 19:27:00 2016 us=447936   pkcs11_cert_private = DISABLED
Wed Jun 22 19:27:00 2016 us=447936   pkcs11_cert_private = DISABLED
Wed Jun 22 19:27:00 2016 us=447936   pkcs11_cert_private = DISABLED
Wed Jun 22 19:27:00 2016 us=447936   pkcs11_cert_private = DISABLED
Wed Jun 22 19:27:00 2016 us=447936   pkcs11_cert_private = DISABLED
Wed Jun 22 19:27:00 2016 us=447936   pkcs11_cert_private = DISABLED
Wed Jun 22 19:27:00 2016 us=447936   pkcs11_cert_private = DISABLED
Wed Jun 22 19:27:00 2016 us=447936   pkcs11_cert_private = DISABLED
Wed Jun 22 19:27:00 2016 us=447936   pkcs11_cert_private = DISABLED
Wed Jun 22 19:27:00 2016 us=447936   pkcs11_cert_private = DISABLED
Wed Jun 22 19:27:00 2016 us=447936   pkcs11_cert_private = DISABLED
Wed Jun 22 19:27:00 2016 us=447936   pkcs11_cert_private = DISABLED
Wed Jun 22 19:27:00 2016 us=447936   pkcs11_cert_private = DISABLED
Wed Jun 22 19:27:00 2016 us=447936   pkcs11_cert_private = DISABLED
Wed Jun 22 19:27:00 2016 us=447936   pkcs11_pin_cache_period = -1
Wed Jun 22 19:27:00 2016 us=447936   pkcs11_id = '[UNDEF]'
Wed Jun 22 19:27:00 2016 us=447936   pkcs11_id_management = DISABLED
Wed Jun 22 19:27:00 2016 us=448936   server_network = 0.0.0.0
Wed Jun 22 19:27:00 2016 us=448936   server_netmask = 0.0.0.0
Wed Jun 22 19:27:00 2016 us=450936   server_network_ipv6 = ::
Wed Jun 22 19:27:00 2016 us=450936   server_netbits_ipv6 = 0
Wed Jun 22 19:27:00 2016 us=450936   server_bridge_ip = 0.0.0.0
Wed Jun 22 19:27:00 2016 us=450936   server_bridge_netmask = 0.0.0.0
Wed Jun 22 19:27:00 2016 us=450936   server_bridge_pool_start = 0.0.0.0
Wed Jun 22 19:27:00 2016 us=450936   server_bridge_pool_end = 0.0.0.0
Wed Jun 22 19:27:00 2016 us=451936   ifconfig_pool_defined = DISABLED
Wed Jun 22 19:27:00 2016 us=451936   ifconfig_pool_start = 0.0.0.0
Wed Jun 22 19:27:00 2016 us=451936   ifconfig_pool_end = 0.0.0.0
Wed Jun 22 19:27:00 2016 us=451936   ifconfig_pool_netmask = 0.0.0.0
Wed Jun 22 19:27:00 2016 us=451936   ifconfig_pool_persist_filename = '[UNDEF]'
Wed Jun 22 19:27:00 2016 us=451936   ifconfig_pool_persist_refresh_freq = 600
Wed Jun 22 19:27:00 2016 us=452936   ifconfig_ipv6_pool_defined = DISABLED
Wed Jun 22 19:27:00 2016 us=452936   ifconfig_ipv6_pool_base = ::
Wed Jun 22 19:27:00 2016 us=452936   ifconfig_ipv6_pool_netbits = 0
Wed Jun 22 19:27:00 2016 us=452936   n_bcast_buf = 256
Wed Jun 22 19:27:00 2016 us=452936   tcp_queue_limit = 64
Wed Jun 22 19:27:00 2016 us=452936   real_hash_size = 256
Wed Jun 22 19:27:00 2016 us=452936   virtual_hash_size = 256
Wed Jun 22 19:27:00 2016 us=452936   client_connect_script = '[UNDEF]'
Wed Jun 22 19:27:00 2016 us=452936   learn_address_script = '[UNDEF]'
Wed Jun 22 19:27:00 2016 us=452936   client_disconnect_script = '[UNDEF]'
Wed Jun 22 19:27:00 2016 us=452936   client_config_dir = '[UNDEF]'
Wed Jun 22 19:27:00 2016 us=452936   ccd_exclusive = DISABLED
Wed Jun 22 19:27:00 2016 us=452936   tmp_dir = 'C:\Users\foobar\AppData\Local\Temp\'
Wed Jun 22 19:27:00 2016 us=452936   push_ifconfig_defined = DISABLED
Wed Jun 22 19:27:00 2016 us=452936   push_ifconfig_local = 0.0.0.0
Wed Jun 22 19:27:00 2016 us=452936   push_ifconfig_remote_netmask = 0.0.0.0
Wed Jun 22 19:27:00 2016 us=452936   push_ifconfig_ipv6_defined = DISABLED
Wed Jun 22 19:27:00 2016 us=452936   push_ifconfig_ipv6_local = ::/0
Wed Jun 22 19:27:00 2016 us=452936   push_ifconfig_ipv6_remote = ::
Wed Jun 22 19:27:00 2016 us=452936   enable_c2c = DISABLED
Wed Jun 22 19:27:00 2016 us=452936   duplicate_cn = DISABLED
Wed Jun 22 19:27:00 2016 us=452936   cf_max = 0
Wed Jun 22 19:27:00 2016 us=452936   cf_per = 0
Wed Jun 22 19:27:00 2016 us=452936   max_clients = 1024
Wed Jun 22 19:27:00 2016 us=452936   max_routes_per_client = 256
Wed Jun 22 19:27:00 2016 us=452936   auth_user_pass_verify_script = '[UNDEF]'
Wed Jun 22 19:27:00 2016 us=452936   auth_user_pass_verify_script_via_file = DISABLED
Wed Jun 22 19:27:00 2016 us=452936   client = ENABLED
Wed Jun 22 19:27:00 2016 us=452936   pull = ENABLED
Wed Jun 22 19:27:00 2016 us=452936   auth_user_pass_file = '[UNDEF]'
Wed Jun 22 19:27:00 2016 us=453936   show_net_up = DISABLED
Wed Jun 22 19:27:00 2016 us=453936   route_method = 0
Wed Jun 22 19:27:00 2016 us=453936   block_outside_dns = DISABLED
Wed Jun 22 19:27:00 2016 us=453936   ip_win32_defined = DISABLED
Wed Jun 22 19:27:00 2016 us=453936   ip_win32_type = 3
Wed Jun 22 19:27:00 2016 us=453936   dhcp_masq_offset = 0
Wed Jun 22 19:27:00 2016 us=453936   dhcp_lease_time = 31536000
Wed Jun 22 19:27:00 2016 us=453936   tap_sleep = 0
Wed Jun 22 19:27:00 2016 us=453936   dhcp_options = DISABLED
Wed Jun 22 19:27:00 2016 us=453936   dhcp_renew = DISABLED
Wed Jun 22 19:27:00 2016 us=453936   dhcp_pre_release = DISABLED
Wed Jun 22 19:27:00 2016 us=453936   dhcp_release = DISABLED
Wed Jun 22 19:27:00 2016 us=453936   domain = '[UNDEF]'
Wed Jun 22 19:27:00 2016 us=453936   netbios_scope = '[UNDEF]'
Wed Jun 22 19:27:00 2016 us=453936   netbios_node_type = 0
Wed Jun 22 19:27:00 2016 us=453936   disable_nbt = DISABLED
Wed Jun 22 19:27:00 2016 us=453936 OpenVPN 2.3.9 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Dec 16 2015
Wed Jun 22 19:27:00 2016 us=453936 library versions: OpenSSL 1.0.1q 3 Dec 2015, LZO 2.09
Enter Management Password:
Wed Jun 22 19:27:00 2016 us=455937 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Wed Jun 22 19:27:00 2016 us=455937 Need hold release from management interface, waiting...
Wed Jun 22 19:27:00 2016 us=849959 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Wed Jun 22 19:27:00 2016 us=950965 MANAGEMENT: CMD 'state on'
Wed Jun 22 19:27:00 2016 us=951965 MANAGEMENT: CMD 'log all on'
Wed Jun 22 19:27:01 2016 us=525998 MANAGEMENT: CMD 'hold off'
Wed Jun 22 19:27:01 2016 us=529998 MANAGEMENT: CMD 'hold release'
Wed Jun 22 19:27:02 2016 us=147033 LZO compression initialized
Wed Jun 22 19:27:02 2016 us=147033 Control Channel MTU parms [ L:1560 D:1210 EF:40 EB:0 ET:0 EL:3 ]
Wed Jun 22 19:27:02 2016 us=148033 Socket Buffers: R=[8192->8192] S=[8192->8192]
Wed Jun 22 19:27:02 2016 us=148033 MANAGEMENT: >STATE:1466638022,RESOLVE,,,
Wed Jun 22 19:27:02 2016 us=873075 Data Channel MTU parms [ L:1560 D:1450 EF:60 EB:143 ET:0 EL:3 AF:3/1 ]
Wed Jun 22 19:27:02 2016 us=873075 Local Options String: 'V4,dev-type tun,link-mtu 1560,tun-mtu 1500,proto TCPv4_CLIENT,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-client'
Wed Jun 22 19:27:02 2016 us=873075 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1560,tun-mtu 1500,proto TCPv4_SERVER,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,key-method 2,tls-server'
Wed Jun 22 19:27:02 2016 us=873075 Local Options hash (VER=V4): '958c5492'
Wed Jun 22 19:27:02 2016 us=873075 Expected Remote Options hash (VER=V4): '79ef4284'
Wed Jun 22 19:27:02 2016 us=873075 Attempting to establish TCP connection with [AF_INET]111.111.111.111:1194 [nonblock]
Wed Jun 22 19:27:02 2016 us=873075 MANAGEMENT: >STATE:1466638022,TCP_CONNECT,,,
Wed Jun 22 19:27:03 2016 us=874132 TCP connection established with [AF_INET]111.111.111.111:1194
Wed Jun 22 19:27:03 2016 us=874132 TCPv4_CLIENT link local: [undef]
Wed Jun 22 19:27:03 2016 us=875132 TCPv4_CLIENT link remote: [AF_INET]111.111.111.111:1194
Wed Jun 22 19:27:03 2016 us=875132 MANAGEMENT: >STATE:1466638023,WAIT,,,
Wed Jun 22 19:27:04 2016 us=132147 MANAGEMENT: >STATE:1466638024,AUTH,,,
Wed Jun 22 19:27:04 2016 us=132147 TLS: Initial packet from [AF_INET]111.111.111.111:1194, sid=7874e9fb f392ddfb
Wed Jun 22 19:27:09 2016 us=714466 VERIFY OK: depth=1, C=CL, ST=RM, L=off-site, O=my-company, OU=Admin, CN=Jekyll, name=Dr Jekyll, emailAddress=admin@my-company.com
Wed Jun 22 19:27:09 2016 us=715466 VERIFY OK: nsCertType=SERVER
Wed Jun 22 19:27:09 2016 us=715466 VERIFY OK: depth=0, C=DE, ST=BW, L=on-site, O=my-company, OU=Router R8000, CN=redacted.com, name=Netgear R8000, emailAddress=admin@my-company.com
Wed Jun 22 19:27:12 2016 us=808643 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Wed Jun 22 19:27:12 2016 us=808643 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Jun 22 19:27:12 2016 us=808643 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Wed Jun 22 19:27:12 2016 us=808643 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Jun 22 19:27:12 2016 us=808643 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Wed Jun 22 19:27:12 2016 us=809643 [redacted.com] Peer Connection Initiated with [AF_INET]111.111.111.111:1194
Wed Jun 22 19:27:14 2016 us=48714 MANAGEMENT: >STATE:1466638034,GET_CONFIG,,,
Wed Jun 22 19:27:15 2016 us=251783 SENT CONTROL [redacted.com]: 'PUSH_REQUEST' (status=1)
Wed Jun 22 19:27:15 2016 us=979825 PUSH: Received control message: 'PUSH_REPLY,route 192.168.111.0 255.255.255.0,route 10.8.0.1,topology net30,ping 10,ping-restart 60,ifconfig 10.8.0.6 10.8.0.5'
Wed Jun 22 19:27:15 2016 us=980825 OPTIONS IMPORT: timers and/or timeouts modified
Wed Jun 22 19:27:15 2016 us=980825 OPTIONS IMPORT: --ifconfig/up options modified
Wed Jun 22 19:27:15 2016 us=980825 OPTIONS IMPORT: route options modified
Wed Jun 22 19:27:15 2016 us=987825 ROUTE_GATEWAY 192.168.1.1/255.255.255.0 I=12 HWADDR=08:11:96:1f:59:34
Wed Jun 22 19:27:15 2016 us=994825 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Jun 22 19:27:15 2016 us=994825 MANAGEMENT: >STATE:1466638035,ASSIGN_IP,,10.8.0.6,
Wed Jun 22 19:27:15 2016 us=994825 open_tun, tt->ipv6=0
Wed Jun 22 19:27:15 2016 us=998826 TAP-WIN32 device [LAN-Verbindung 2] opened: \\.\Global\{C3FB6E35-34FB-4252-A00E-87904B1C1E36}.tap
Wed Jun 22 19:27:15 2016 us=998826 TAP-Windows Driver Version 9.21 
Wed Jun 22 19:27:15 2016 us=999826 TAP-Windows MTU=1500
Wed Jun 22 19:27:16 2016 us=4826 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.6/255.255.255.252 on interface {C3FB6E35-34FB-4252-A00E-87904B1C1E36} [DHCP-serv: 10.8.0.5, lease-time: 31536000]
Wed Jun 22 19:27:16 2016 us=4826 Successful ARP Flush on interface [19] {C3FB6E35-34FB-4252-A00E-87904B1C1E36}
Wed Jun 22 19:27:21 2016 us=302129 TEST ROUTES: 2/2 succeeded len=2 ret=1 a=0 u/d=up
Wed Jun 22 19:27:21 2016 us=302129 MANAGEMENT: >STATE:1466638041,ADD_ROUTES,,,
Wed Jun 22 19:27:21 2016 us=302129 C:\Windows\system32\route.exe ADD 192.168.111.0 MASK 255.255.255.0 10.8.0.5
Wed Jun 22 19:27:21 2016 us=335131 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Wed Jun 22 19:27:21 2016 us=335131 Route addition via IPAPI succeeded [adaptive]
Wed Jun 22 19:27:21 2016 us=336131 C:\Windows\system32\route.exe ADD 10.8.0.1 MASK 255.255.255.255 10.8.0.5
Wed Jun 22 19:27:21 2016 us=373133 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Wed Jun 22 19:27:21 2016 us=373133 Route addition via IPAPI succeeded [adaptive]
Wed Jun 22 19:27:21 2016 us=374133 Initialization Sequence Completed
Wed Jun 22 19:27:21 2016 us=374133 MANAGEMENT: >STATE:1466638041,CONNECTED,SUCCESS,10.8.0.6,111.111.111.111

(for privacy reasons I replaced the dyn-host with "redacted.com" and its IP with "111.111.111.111" )

ty, Jekyll

TinCanTech

Jekyll wroteNo, I can't ping 192.168.111.1 and neither 10.8.0.1

and here is the client's log-output:
Wed Jun 22 19:27:00 2016 us=453936 OpenVPN 2.3.9 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Dec 16 2015
Wed Jun 22 19:27:00 2016 us=453936 library versions: OpenSSL 1.0.1q 3 Dec 2015, LZO 2.09

Wed Jun 22 19:27:15 2016 us=979825 PUSH: Received control message: 'PUSH_REPLY,route 192.168.111.0 255.255.255.0,route 10.8.0.1,topology net30,ping 10,ping-restart 60,ifconfig 10.8.0.6 10.8.0.5'
Wed Jun 22 19:27:15 2016 us=980825 OPTIONS IMPORT: timers and/or timeouts modified
Wed Jun 22 19:27:15 2016 us=980825 OPTIONS IMPORT: --ifconfig/up options modified
Wed Jun 22 19:27:15 2016 us=980825 OPTIONS IMPORT: route options modified
Wed Jun 22 19:27:15 2016 us=987825 ROUTE_GATEWAY 192.168.1.1/255.255.255.0 I=12 HWADDR=08:11:96:1f:59:34
Wed Jun 22 19:27:15 2016 us=994825 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Jun 22 19:27:15 2016 us=994825 MANAGEMENT: >STATE:1466638035,ASSIGN_IP,,10.8.0.6,
Wed Jun 22 19:27:15 2016 us=994825 open_tun, tt->ipv6=0
Wed Jun 22 19:27:15 2016 us=998826 TAP-WIN32 device [LAN-Verbindung 2] opened: \\.\Global\{C3FB6E35-34FB-4252-A00E-87904B1C1E36}.tap
Wed Jun 22 19:27:15 2016 us=998826 TAP-Windows Driver Version 9.21
Wed Jun 22 19:27:15 2016 us=999826 TAP-Windows MTU=1500
Wed Jun 22 19:27:16 2016 us=4826 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.6/255.255.255.252 on interface {C3FB6E35-34FB-4252-A00E-87904B1C1E36} [DHCP-serv: 10.8.0.5, lease-time: 31536000]
Wed Jun 22 19:27:16 2016 us=4826 Successful ARP Flush on interface [19] {C3FB6E35-34FB-4252-A00E-87904B1C1E36}
Wed Jun 22 19:27:21 2016 us=302129 TEST ROUTES: 2/2 succeeded len=2 ret=1 a=0 u/d=up
Wed Jun 22 19:27:21 2016 us=302129 MANAGEMENT: >STATE:1466638041,ADD_ROUTES,,,
Wed Jun 22 19:27:21 2016 us=302129 C:\Windows\system32\route.exe ADD 192.168.111.0 MASK 255.255.255.0 10.8.0.5
Wed Jun 22 19:27:21 2016 us=335131 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Wed Jun 22 19:27:21 2016 us=335131 Route addition via IPAPI succeeded [adaptive]
Wed Jun 22 19:27:21 2016 us=336131 C:\Windows\system32\route.exe ADD 10.8.0.1 MASK 255.255.255.255 10.8.0.5
Wed Jun 22 19:27:21 2016 us=373133 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Wed Jun 22 19:27:21 2016 us=373133 Route addition via IPAPI succeeded [adaptive]
Wed Jun 22 19:27:21 2016 us=374133 Initialization Sequence Completed

Routing is correct ..

Can you ping 10.8.0.1 ?

Did you enable IP_FORWARD in the router ?

Jekyll

TinCanTech wroteCan you ping 10.8.0.1 ?

Did you enable IP_FORWARD in the router ?

No, like I said, I cannot ping 192.168.111.1 nor 10.8.0.1 🙁

IP_FORWARD is on:

cat /proc/sys/net/ipv4/ip_forward
1

I guess I forgot some stupid option somewhere, as it did work without problems on the last router of ours (also dd-wrt).
But I'm absolutely lost which option that is...

TinCanTech

Your logs appear to show that openvpn is working correctly.

If you cannot ping the VPN server on 10.8.0.1 then I expect it is your firewall (iptables on the server) blocking you.

Jekyll

TinCanTech wroteIf you cannot ping the VPN server on 10.8.0.1 then I expect it is your firewall (iptables on the server) blocking you.

Okay, could you maybe give me some working iptables-rules? Or hint me in the right direction?

Currently I am using this:

iptables -I INPUT 1 -p tcp –dport 1194 -j ACCEPT
iptables -I FORWARD 1 –source 192.168.111.0/24 -j ACCEPT
iptables -I FORWARD -i br0 -o tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -o br0 -j ACCEPT

(following this howto)

Thanks a lot!