[Solved] Full tunnel traffic restricted to LAN connections DD-WRT

s10

Hi all,

I've been breaking my head on realizing a full tunnel (redirect gateway).

The vpn server (Running on a DD-WRT router) is working perfectly, apart from the full tunnel.
I've followed the Openvpn how-to to "Routing all client traffic (including web-traffic) through the VPN"
Summarized:

Adding to the openvpn server config

push "redirect-gateway def1"

Adding the following iptables rule

iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

Once connected i can ping all my LAN clients, but remote clients (like 8.8.8.8 or google.com) are unreachable.
I think the response of the remote website is not deliverd accordingly, due to the fact it doesnt know where to deliver.
But i don't know how to change this.

Some config files:

Server config:

push "route 192.168.1.0 255.255.255.0"
server 10.8.0.0 255.255.255.0

####test opzet redirect gateway
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
####test opzet redirect gateway

dev tun0
proto tcp
#port 443
keepalive 10 120
dh /tmp/openvpn/dh.pem
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem

# Only use crl-verify if you are using the revoke list &#-106; otherwise leave it commented out
# crl-verify /tmp/openvpn/ca.crl

# management parameter allows DD-WRT's OpenVPN Status web page to access the servers management port
# port must be 5001 for scripts embedded in firmware to work
management localhost 5001
comp-lzo no
cipher AES-128-CBC

client config

client
dev tun
proto tcp
remote ##### 1194
resolv-retry infinite
nobind
persist-key
persist-tun

ca ca.crt
cert client1.crt
key client1.key
ns-cert-type server
cipher AES-128-CBC
comp-lzo no
verb 4

Iptables

# NAT the VPN client traffic to the internet
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

#werkende port forward command
iptables -t nat -A POSTROUTING -j MASQUERADE

#OpenVPN
iptables -I INPUT 1 -p udp -dport 1194 -j ACCEPT
iptables -I FORWARD 1 -source 192.168.1.0/24 -j ACCEPT
iptables -I FORWARD -i br0 -o tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -o br0 -j ACCEPT
iptables -t nat -s 10.8.0.0/24 -A POSTROUTING -j SNAT --to myserverIP
iptables -t nat -A PREROUTING -i tun+ -p udp --dport 53 -j DNAT --to-destination 8.8.8.8

route -n

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.9.0.194      128.0.0.0       UG    0      0        0 tun0
0.0.0.0         192.168.1.1     0.0.0.0         UG    0      0        0 eth0
8.8.8.8         192.168.1.1     255.255.255.255 UGH   0      0        0 eth0
10.9.0.1        10.9.0.194      255.255.255.255 UGH   0      0        0 tun0
10.9.0.194      0.0.0.0         255.255.255.255 UH    0      0        0 tun0
128.0.0.0       10.9.0.194      128.0.0.0       UG    0      0        0 tun0
xxx.xxx.xxx.xx  192.168.1.1     255.255.255.255 UGH   0      0        0 eth0
192.168.1.0     0.0.0.0         255.255.255.0   U     0      0        0 eth0
192.168.1.1     0.0.0.0         255.255.255.255 UH    0      0        0 eth0

TinCanTech

Looks like you have not posted your correct configs either:

s10 wroteserver 10.8.0.0 255.255.255.0

s10 wrote

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0      *  10.9.0.194      128.0.0.0       UG    0      0        0 tun0
0.0.0.0         192.168.1.1     0.0.0.0         UG    0      0        0 eth0
8.8.8.8         192.168.1.1     255.255.255.255 UGH   0      0        0 eth0
10.9.0.1     *  10.9.0.194      255.255.255.255 UGH   0      0        0 tun0
10.9.0.194      0.0.0.0         255.255.255.255 UH    0      0        0 tun0
128.0.0.0       10.9.0.194      128.0.0.0       UG    0      0        0 tun0

10.8 vs 10.9 ?

Also,

NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.

:arrow: Never use 192.168.0.0/24 or 192.168.1.0/24 (or other common subnets) for your OpenVPN Server LAN :!:

You are advised to change your server LAN to a more unique RFC1918 compliant subnet. f.e 192.168.143.0/24

Also, ensure IP forwarding is enabled on your server.

Probably worth listing this:
HOWTO: Routing all client traffic (including web-traffic) through the VPN

s10

Strange,
below the route print from my local laptop with vpn connected. I dont know what caused the difference.

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.1.1    192.168.1.151     25
          0.0.0.0        128.0.0.0         10.8.0.5         10.8.0.6     20
         10.8.0.1  255.255.255.255         10.8.0.5         10.8.0.6     20
         10.8.0.4  255.255.255.252         On-link          10.8.0.6    276
         10.8.0.6  255.255.255.255         On-link          10.8.0.6    276
         10.8.0.7  255.255.255.255         On-link          10.8.0.6    276
     xx.xx.xx.xxx  255.255.255.255      192.168.1.1    192.168.1.151     25
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
        128.0.0.0        128.0.0.0         10.8.0.5         10.8.0.6     20
      192.168.1.0    255.255.255.0         On-link     192.168.1.151    281
      192.168.1.0    255.255.255.0         10.8.0.5         10.8.0.6     20
    192.168.1.151  255.255.255.255         On-link     192.168.1.151    281
    192.168.1.255  255.255.255.255         On-link     192.168.1.151    281
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link     192.168.1.151    281
        224.0.0.0        240.0.0.0         On-link          10.8.0.6    276
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link     192.168.1.151    281
  255.255.255.255  255.255.255.255         On-link          10.8.0.6    276

I'll also change my subnet, hopefully this will solve the problem

s10

Ok i've changed my subnet, still no internet connection :-(

Below the "route print"

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
0.0.0.0          0.0.0.0    192.168.143.1  192.168.143.151     25
0.0.0.0        128.0.0.0         10.8.0.5         10.8.0.6     20
10.8.0.1  255.255.255.255         10.8.0.5         10.8.0.6     20
10.8.0.4  255.255.255.252         On-link          10.8.0.6    276
10.8.0.6  255.255.255.255         On-link          10.8.0.6    276
10.8.0.7  255.255.255.255         On-link          10.8.0.6    276
xx.xx.xx.xx  255.255.255.255    192.168.143.1  192.168.143.151     25
127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
128.0.0.0        128.0.0.0         10.8.0.5         10.8.0.6     20
192.168.1.0    255.255.255.0         10.8.0.5         10.8.0.6     20
192.168.143.0    255.255.255.0         On-link   192.168.143.151    281
192.168.143.151  255.255.255.255         On-link   192.168.143.151    281
192.168.143.255  255.255.255.255         On-link   192.168.143.151    281
224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
224.0.0.0        240.0.0.0         On-link   192.168.143.151    281
224.0.0.0        240.0.0.0         On-link          10.8.0.6    276
255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
255.255.255.255  255.255.255.255         On-link   192.168.143.151    281
255.255.255.255  255.255.255.255         On-link          10.8.0.6    276
===========================================================================

TinCanTech

s10 wroteIptables

Code: Select all
# NAT the VPN client traffic to the internet
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

Keep this rule

s10 wrote#werkende port forward command
iptables -t nat -A POSTROUTING -j MASQUERADE

#OpenVPN
iptables -I INPUT 1 -p udp -dport 1194 -j ACCEPT
iptables -I FORWARD 1 -source 192.168.1.0/24 -j ACCEPT
iptables -I FORWARD -i br0 -o tun0 -j ACCEPT
iptables -I FORWARD -i tun0 -o br0 -j ACCEPT
iptables -t nat -s 10.8.0.0/24 -A POSTROUTING -j SNAT --to myserverIP
iptables -t nat -A PREROUTING -i tun+ -p udp --dport 53 -j DNAT --to-destination 8.8.8.8

Delete these rules

s10

I've commented out all rules, sadly no change in behaviour,

# NAT the VPN client traffic to the internet
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE

#werkende port forward command
#iptables -t nat -A POSTROUTING -j MASQUERADE

#OpenVPN
#iptables -I INPUT 1 -p udp -dport 1194 -j ACCEPT
#iptables -I FORWARD 1 -source 192.168.143.0/24 -j ACCEPT
#iptables -I FORWARD -i br0 -o tun0 -j ACCEPT
#iptables -I FORWARD -i tun0 -o br0 -j ACCEPT
#iptables -t nat -s 10.8.0.0/24 -A POSTROUTING -j SNAT --to myserverIP
#iptables -t nat -A PREROUTING -i tun+ -p udp --dport 53 -j DNAT --to-destination 8.8.8.8

Next to that i've noticed a minor difference between server and client config.

Server had specified "dev tun0"
Client had specified "dev tun"

Changed both to

dev tun0

Thanks for your patience and understanding.

TinCanTech

s10 wroteI've commented out all rules, sadly no change

Did you reload the rules ?

s10

After commenting out the ip rules. and saving them. i gave the router a full reboot.

TinCanTech

Please post your client log file.

s10

Below the client openvpn log

Sat Jul 09 09:16:23 2016 us=89007 Current Parameter Settings:
Sat Jul 09 09:16:23 2016 us=104653   config = 'client.ovpn'
Sat Jul 09 09:16:23 2016 us=104653   mode = 0
Sat Jul 09 09:16:23 2016 us=104653   show_ciphers = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   show_digests = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   show_engines = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   genkey = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   key_pass_file = '[UNDEF]'
Sat Jul 09 09:16:23 2016 us=104653   show_tls_ciphers = DISABLED
Sat Jul 09 09:16:23 2016 us=104653 Connection profiles [default]:
Sat Jul 09 09:16:23 2016 us=104653   proto = tcp-client
Sat Jul 09 09:16:23 2016 us=104653   local = '[UNDEF]'
Sat Jul 09 09:16:23 2016 us=104653   local_port = 0
Sat Jul 09 09:16:23 2016 us=104653   remote = '[Public IP]'
Sat Jul 09 09:16:23 2016 us=104653   remote_port = 1194
Sat Jul 09 09:16:23 2016 us=104653   remote_float = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   bind_defined = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   bind_local = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   connect_retry_seconds = 5
Sat Jul 09 09:16:23 2016 us=104653   connect_timeout = 10
Sat Jul 09 09:16:23 2016 us=104653   connect_retry_max = 0
Sat Jul 09 09:16:23 2016 us=104653   socks_proxy_server = '[UNDEF]'
Sat Jul 09 09:16:23 2016 us=104653   socks_proxy_port = 0
Sat Jul 09 09:16:23 2016 us=104653   socks_proxy_retry = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   tun_mtu = 1500
Sat Jul 09 09:16:23 2016 us=104653   tun_mtu_defined = ENABLED
Sat Jul 09 09:16:23 2016 us=104653   link_mtu = 1500
Sat Jul 09 09:16:23 2016 us=104653   link_mtu_defined = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   tun_mtu_extra = 0
Sat Jul 09 09:16:23 2016 us=104653   tun_mtu_extra_defined = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   mtu_discover_type = -1
Sat Jul 09 09:16:23 2016 us=104653   fragment = 0
Sat Jul 09 09:16:23 2016 us=104653   mssfix = 1450
Sat Jul 09 09:16:23 2016 us=104653   explicit_exit_notification = 0
Sat Jul 09 09:16:23 2016 us=104653 Connection profiles END
Sat Jul 09 09:16:23 2016 us=104653   remote_random = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   ipchange = '[UNDEF]'
Sat Jul 09 09:16:23 2016 us=104653   dev = 'tun0'
Sat Jul 09 09:16:23 2016 us=104653   dev_type = '[UNDEF]'
Sat Jul 09 09:16:23 2016 us=104653   dev_node = '[UNDEF]'
Sat Jul 09 09:16:23 2016 us=104653   lladdr = '[UNDEF]'
Sat Jul 09 09:16:23 2016 us=104653   topology = 1
Sat Jul 09 09:16:23 2016 us=104653   tun_ipv6 = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   ifconfig_local = '[UNDEF]'
Sat Jul 09 09:16:23 2016 us=104653   ifconfig_remote_netmask = '[UNDEF]'
Sat Jul 09 09:16:23 2016 us=104653   ifconfig_noexec = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   ifconfig_nowarn = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   ifconfig_ipv6_local = '[UNDEF]'
Sat Jul 09 09:16:23 2016 us=104653   ifconfig_ipv6_netbits = 0
Sat Jul 09 09:16:23 2016 us=104653   ifconfig_ipv6_remote = '[UNDEF]'
Sat Jul 09 09:16:23 2016 us=104653   shaper = 0
Sat Jul 09 09:16:23 2016 us=104653   mtu_test = 0
Sat Jul 09 09:16:23 2016 us=104653   mlock = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   keepalive_ping = 0
Sat Jul 09 09:16:23 2016 us=104653   keepalive_timeout = 0
Sat Jul 09 09:16:23 2016 us=104653   inactivity_timeout = 0
Sat Jul 09 09:16:23 2016 us=104653   ping_send_timeout = 0
Sat Jul 09 09:16:23 2016 us=104653   ping_rec_timeout = 0
Sat Jul 09 09:16:23 2016 us=104653   ping_rec_timeout_action = 0
Sat Jul 09 09:16:23 2016 us=104653   ping_timer_remote = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   remap_sigusr1 = 0
Sat Jul 09 09:16:23 2016 us=104653   persist_tun = ENABLED
Sat Jul 09 09:16:23 2016 us=104653   persist_local_ip = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   persist_remote_ip = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   persist_key = ENABLED
Sat Jul 09 09:16:23 2016 us=104653   passtos = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   resolve_retry_seconds = 1000000000
Sat Jul 09 09:16:23 2016 us=104653   username = '[UNDEF]'
Sat Jul 09 09:16:23 2016 us=104653   groupname = '[UNDEF]'
Sat Jul 09 09:16:23 2016 us=104653   chroot_dir = '[UNDEF]'
Sat Jul 09 09:16:23 2016 us=104653   cd_dir = '[UNDEF]'
Sat Jul 09 09:16:23 2016 us=104653   writepid = '[UNDEF]'
Sat Jul 09 09:16:23 2016 us=104653   up_script = '[UNDEF]'
Sat Jul 09 09:16:23 2016 us=104653   down_script = '[UNDEF]'
Sat Jul 09 09:16:23 2016 us=104653   down_pre = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   up_restart = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   up_delay = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   daemon = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   inetd = 0
Sat Jul 09 09:16:23 2016 us=104653   log = ENABLED
Sat Jul 09 09:16:23 2016 us=104653   suppress_timestamps = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   nice = 0
Sat Jul 09 09:16:23 2016 us=104653   verbosity = 4
Sat Jul 09 09:16:23 2016 us=104653   mute = 0
Sat Jul 09 09:16:23 2016 us=104653   gremlin = 0
Sat Jul 09 09:16:23 2016 us=104653   status_file = '[UNDEF]'
Sat Jul 09 09:16:23 2016 us=104653   status_file_version = 1
Sat Jul 09 09:16:23 2016 us=104653   status_file_update_freq = 60
Sat Jul 09 09:16:23 2016 us=104653   occ = ENABLED
Sat Jul 09 09:16:23 2016 us=104653   rcvbuf = 0
Sat Jul 09 09:16:23 2016 us=104653   sndbuf = 0
Sat Jul 09 09:16:23 2016 us=104653   sockflags = 0
Sat Jul 09 09:16:23 2016 us=104653   fast_io = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   lzo = 1
Sat Jul 09 09:16:23 2016 us=104653   route_script = '[UNDEF]'
Sat Jul 09 09:16:23 2016 us=104653   route_default_gateway = '[UNDEF]'
Sat Jul 09 09:16:23 2016 us=104653   route_default_metric = 0
Sat Jul 09 09:16:23 2016 us=104653   route_noexec = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   route_delay = 5
Sat Jul 09 09:16:23 2016 us=104653   route_delay_window = 30
Sat Jul 09 09:16:23 2016 us=104653   route_delay_defined = ENABLED
Sat Jul 09 09:16:23 2016 us=104653   route_nopull = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   route_gateway_via_dhcp = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   max_routes = 100
Sat Jul 09 09:16:23 2016 us=104653   allow_pull_fqdn = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   management_addr = '127.0.0.1'
Sat Jul 09 09:16:23 2016 us=104653   management_port = 25340
Sat Jul 09 09:16:23 2016 us=104653   management_user_pass = 'stdin'
Sat Jul 09 09:16:23 2016 us=104653   management_log_history_cache = 250
Sat Jul 09 09:16:23 2016 us=104653   management_echo_buffer_size = 100
Sat Jul 09 09:16:23 2016 us=104653   management_write_peer_info_file = '[UNDEF]'
Sat Jul 09 09:16:23 2016 us=104653   management_client_user = '[UNDEF]'
Sat Jul 09 09:16:23 2016 us=104653   management_client_group = '[UNDEF]'
Sat Jul 09 09:16:23 2016 us=104653   management_flags = 6
Sat Jul 09 09:16:23 2016 us=104653   shared_secret_file = '[UNDEF]'
Sat Jul 09 09:16:23 2016 us=104653   key_direction = 0
Sat Jul 09 09:16:23 2016 us=104653   ciphername_defined = ENABLED
Sat Jul 09 09:16:23 2016 us=104653   ciphername = 'AES-128-CBC'
Sat Jul 09 09:16:23 2016 us=104653   authname_defined = ENABLED
Sat Jul 09 09:16:23 2016 us=104653   authname = 'SHA1'
Sat Jul 09 09:16:23 2016 us=104653   prng_hash = 'SHA1'
Sat Jul 09 09:16:23 2016 us=104653   prng_nonce_secret_len = 16
Sat Jul 09 09:16:23 2016 us=104653   keysize = 0
Sat Jul 09 09:16:23 2016 us=104653   engine = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   replay = ENABLED
Sat Jul 09 09:16:23 2016 us=104653   mute_replay_warnings = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   replay_window = 64
Sat Jul 09 09:16:23 2016 us=104653   replay_time = 15
Sat Jul 09 09:16:23 2016 us=104653   packet_id_file = '[UNDEF]'
Sat Jul 09 09:16:23 2016 us=104653   use_iv = ENABLED
Sat Jul 09 09:16:23 2016 us=104653   test_crypto = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   tls_server = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   tls_client = ENABLED
Sat Jul 09 09:16:23 2016 us=104653   key_method = 2
Sat Jul 09 09:16:23 2016 us=104653   ca_file = 'ca.crt'
Sat Jul 09 09:16:23 2016 us=104653   ca_path = '[UNDEF]'
Sat Jul 09 09:16:23 2016 us=104653   dh_file = '[UNDEF]'
Sat Jul 09 09:16:23 2016 us=104653   cert_file = 'client1.crt'
Sat Jul 09 09:16:23 2016 us=104653   extra_certs_file = '[UNDEF]'
Sat Jul 09 09:16:23 2016 us=104653   priv_key_file = 'client1.key'
Sat Jul 09 09:16:23 2016 us=104653   pkcs12_file = '[UNDEF]'
Sat Jul 09 09:16:23 2016 us=104653   cryptoapi_cert = '[UNDEF]'
Sat Jul 09 09:16:23 2016 us=104653   cipher_list = '[UNDEF]'
Sat Jul 09 09:16:23 2016 us=104653   tls_verify = '[UNDEF]'
Sat Jul 09 09:16:23 2016 us=104653   tls_export_cert = '[UNDEF]'
Sat Jul 09 09:16:23 2016 us=104653   verify_x509_type = 0
Sat Jul 09 09:16:23 2016 us=104653   verify_x509_name = '[UNDEF]'
Sat Jul 09 09:16:23 2016 us=104653   crl_file = '[UNDEF]'
Sat Jul 09 09:16:23 2016 us=104653   ns_cert_type = 1
Sat Jul 09 09:16:23 2016 us=104653   remote_cert_ku[i] = 0
Sat Jul 09 09:16:23 2016 us=104653   remote_cert_ku[i] = 0
Sat Jul 09 09:16:23 2016 us=104653   remote_cert_ku[i] = 0
Sat Jul 09 09:16:23 2016 us=104653   remote_cert_ku[i] = 0
Sat Jul 09 09:16:23 2016 us=104653   remote_cert_ku[i] = 0
Sat Jul 09 09:16:23 2016 us=104653   remote_cert_ku[i] = 0
Sat Jul 09 09:16:23 2016 us=104653   remote_cert_ku[i] = 0
Sat Jul 09 09:16:23 2016 us=104653   remote_cert_ku[i] = 0
Sat Jul 09 09:16:23 2016 us=104653   remote_cert_ku[i] = 0
Sat Jul 09 09:16:23 2016 us=104653   remote_cert_ku[i] = 0
Sat Jul 09 09:16:23 2016 us=104653   remote_cert_ku[i] = 0
Sat Jul 09 09:16:23 2016 us=104653   remote_cert_ku[i] = 0
Sat Jul 09 09:16:23 2016 us=104653   remote_cert_ku[i] = 0
Sat Jul 09 09:16:23 2016 us=104653   remote_cert_ku[i] = 0
Sat Jul 09 09:16:23 2016 us=104653   remote_cert_ku[i] = 0
Sat Jul 09 09:16:23 2016 us=104653   remote_cert_ku[i] = 0
Sat Jul 09 09:16:23 2016 us=104653   remote_cert_eku = '[UNDEF]'
Sat Jul 09 09:16:23 2016 us=104653   ssl_flags = 0
Sat Jul 09 09:16:23 2016 us=104653   tls_timeout = 2
Sat Jul 09 09:16:23 2016 us=104653   renegotiate_bytes = 0
Sat Jul 09 09:16:23 2016 us=104653   renegotiate_packets = 0
Sat Jul 09 09:16:23 2016 us=104653   renegotiate_seconds = 3600
Sat Jul 09 09:16:23 2016 us=104653   handshake_window = 60
Sat Jul 09 09:16:23 2016 us=104653   transition_window = 3600
Sat Jul 09 09:16:23 2016 us=104653   single_session = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   push_peer_info = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   tls_exit = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   tls_auth_file = '[UNDEF]'
Sat Jul 09 09:16:23 2016 us=104653   pkcs11_protected_authentication = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   pkcs11_protected_authentication = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   pkcs11_protected_authentication = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   pkcs11_protected_authentication = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   pkcs11_protected_authentication = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   pkcs11_protected_authentication = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   pkcs11_protected_authentication = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   pkcs11_protected_authentication = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   pkcs11_protected_authentication = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   pkcs11_protected_authentication = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   pkcs11_protected_authentication = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   pkcs11_protected_authentication = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   pkcs11_protected_authentication = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   pkcs11_protected_authentication = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   pkcs11_protected_authentication = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   pkcs11_protected_authentication = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   pkcs11_private_mode = 00000000
Sat Jul 09 09:16:23 2016 us=104653   pkcs11_private_mode = 00000000
Sat Jul 09 09:16:23 2016 us=104653   pkcs11_private_mode = 00000000
Sat Jul 09 09:16:23 2016 us=104653   pkcs11_private_mode = 00000000
Sat Jul 09 09:16:23 2016 us=104653   pkcs11_private_mode = 00000000
Sat Jul 09 09:16:23 2016 us=104653   pkcs11_private_mode = 00000000
Sat Jul 09 09:16:23 2016 us=104653   pkcs11_private_mode = 00000000
Sat Jul 09 09:16:23 2016 us=104653   pkcs11_private_mode = 00000000
Sat Jul 09 09:16:23 2016 us=104653   pkcs11_private_mode = 00000000
Sat Jul 09 09:16:23 2016 us=104653   pkcs11_private_mode = 00000000
Sat Jul 09 09:16:23 2016 us=104653   pkcs11_private_mode = 00000000
Sat Jul 09 09:16:23 2016 us=104653   pkcs11_private_mode = 00000000
Sat Jul 09 09:16:23 2016 us=104653   pkcs11_private_mode = 00000000
Sat Jul 09 09:16:23 2016 us=104653   pkcs11_private_mode = 00000000
Sat Jul 09 09:16:23 2016 us=104653   pkcs11_private_mode = 00000000
Sat Jul 09 09:16:23 2016 us=104653   pkcs11_private_mode = 00000000
Sat Jul 09 09:16:23 2016 us=104653   pkcs11_cert_private = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   pkcs11_cert_private = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   pkcs11_cert_private = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   pkcs11_cert_private = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   pkcs11_cert_private = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   pkcs11_cert_private = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   pkcs11_cert_private = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   pkcs11_cert_private = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   pkcs11_cert_private = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   pkcs11_cert_private = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   pkcs11_cert_private = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   pkcs11_cert_private = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   pkcs11_cert_private = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   pkcs11_cert_private = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   pkcs11_cert_private = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   pkcs11_cert_private = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   pkcs11_pin_cache_period = -1
Sat Jul 09 09:16:23 2016 us=104653   pkcs11_id = '[UNDEF]'
Sat Jul 09 09:16:23 2016 us=104653   pkcs11_id_management = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   server_network = 0.0.0.0
Sat Jul 09 09:16:23 2016 us=104653   server_netmask = 0.0.0.0
Sat Jul 09 09:16:23 2016 us=104653   server_network_ipv6 = ::
Sat Jul 09 09:16:23 2016 us=104653   server_netbits_ipv6 = 0
Sat Jul 09 09:16:23 2016 us=104653   server_bridge_ip = 0.0.0.0
Sat Jul 09 09:16:23 2016 us=104653   server_bridge_netmask = 0.0.0.0
Sat Jul 09 09:16:23 2016 us=104653   server_bridge_pool_start = 0.0.0.0
Sat Jul 09 09:16:23 2016 us=104653   server_bridge_pool_end = 0.0.0.0
Sat Jul 09 09:16:23 2016 us=104653   ifconfig_pool_defined = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   ifconfig_pool_start = 0.0.0.0
Sat Jul 09 09:16:23 2016 us=104653   ifconfig_pool_end = 0.0.0.0
Sat Jul 09 09:16:23 2016 us=104653   ifconfig_pool_netmask = 0.0.0.0
Sat Jul 09 09:16:23 2016 us=104653   ifconfig_pool_persist_filename = '[UNDEF]'
Sat Jul 09 09:16:23 2016 us=104653   ifconfig_pool_persist_refresh_freq = 600
Sat Jul 09 09:16:23 2016 us=104653   ifconfig_ipv6_pool_defined = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   ifconfig_ipv6_pool_base = ::
Sat Jul 09 09:16:23 2016 us=104653   ifconfig_ipv6_pool_netbits = 0
Sat Jul 09 09:16:23 2016 us=104653   n_bcast_buf = 256
Sat Jul 09 09:16:23 2016 us=104653   tcp_queue_limit = 64
Sat Jul 09 09:16:23 2016 us=104653   real_hash_size = 256
Sat Jul 09 09:16:23 2016 us=104653   virtual_hash_size = 256
Sat Jul 09 09:16:23 2016 us=104653   client_connect_script = '[UNDEF]'
Sat Jul 09 09:16:23 2016 us=104653   learn_address_script = '[UNDEF]'
Sat Jul 09 09:16:23 2016 us=104653   client_disconnect_script = '[UNDEF]'
Sat Jul 09 09:16:23 2016 us=104653   client_config_dir = '[UNDEF]'
Sat Jul 09 09:16:23 2016 us=104653   ccd_exclusive = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   tmp_dir = 'C:\Users\stijn\AppData\Local\Temp\'
Sat Jul 09 09:16:23 2016 us=104653   push_ifconfig_defined = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   push_ifconfig_local = 0.0.0.0
Sat Jul 09 09:16:23 2016 us=104653   push_ifconfig_remote_netmask = 0.0.0.0
Sat Jul 09 09:16:23 2016 us=104653   push_ifconfig_ipv6_defined = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   push_ifconfig_ipv6_local = ::/0
Sat Jul 09 09:16:23 2016 us=104653   push_ifconfig_ipv6_remote = ::
Sat Jul 09 09:16:23 2016 us=104653   enable_c2c = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   duplicate_cn = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   cf_max = 0
Sat Jul 09 09:16:23 2016 us=104653   cf_per = 0
Sat Jul 09 09:16:23 2016 us=104653   max_clients = 1024
Sat Jul 09 09:16:23 2016 us=104653   max_routes_per_client = 256
Sat Jul 09 09:16:23 2016 us=104653   auth_user_pass_verify_script = '[UNDEF]'
Sat Jul 09 09:16:23 2016 us=104653   auth_user_pass_verify_script_via_file = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   client = ENABLED
Sat Jul 09 09:16:23 2016 us=104653   pull = ENABLED
Sat Jul 09 09:16:23 2016 us=104653   auth_user_pass_file = '[UNDEF]'
Sat Jul 09 09:16:23 2016 us=104653   show_net_up = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   route_method = 0
Sat Jul 09 09:16:23 2016 us=104653   block_outside_dns = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   ip_win32_defined = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   ip_win32_type = 3
Sat Jul 09 09:16:23 2016 us=104653   dhcp_masq_offset = 0
Sat Jul 09 09:16:23 2016 us=104653   dhcp_lease_time = 31536000
Sat Jul 09 09:16:23 2016 us=104653   tap_sleep = 0
Sat Jul 09 09:16:23 2016 us=104653   dhcp_options = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   dhcp_renew = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   dhcp_pre_release = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   dhcp_release = DISABLED
Sat Jul 09 09:16:23 2016 us=104653   domain = '[UNDEF]'
Sat Jul 09 09:16:23 2016 us=104653   netbios_scope = '[UNDEF]'
Sat Jul 09 09:16:23 2016 us=104653   netbios_node_type = 0
Sat Jul 09 09:16:23 2016 us=104653   disable_nbt = DISABLED
Sat Jul 09 09:16:23 2016 us=104653 OpenVPN 2.3.10 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Mar 10 2016
Sat Jul 09 09:16:23 2016 us=104653 Windows version 6.2 (Windows 8 or greater)
Sat Jul 09 09:16:23 2016 us=104653 library versions: OpenSSL 1.0.1s  1 Mar 2016, LZO 2.09
Enter Management Password:
Sat Jul 09 09:16:23 2016 us=104653 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Sat Jul 09 09:16:23 2016 us=104653 Need hold release from management interface, waiting...
Sat Jul 09 09:16:23 2016 us=573471 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Sat Jul 09 09:16:23 2016 us=682766 MANAGEMENT: CMD 'state on'
Sat Jul 09 09:16:23 2016 us=682766 MANAGEMENT: CMD 'log all on'
Sat Jul 09 09:16:23 2016 us=792140 MANAGEMENT: CMD 'hold off'
Sat Jul 09 09:16:23 2016 us=792140 MANAGEMENT: CMD 'hold release'
Sat Jul 09 09:16:23 2016 us=917141 LZO compression initialized
Sat Jul 09 09:16:23 2016 us=917141 Control Channel MTU parms [ L:1560 D:1210 EF:40 EB:0 ET:0 EL:3 ]
Sat Jul 09 09:16:23 2016 us=917141 Socket Buffers: R=[65536->65536] S=[65536->65536]
Sat Jul 09 09:16:23 2016 us=917141 MANAGEMENT: >STATE:1468048583,RESOLVE,,,
Sat Jul 09 09:16:24 2016 us=73464 Data Channel MTU parms [ L:1560 D:1450 EF:60 EB:143 ET:0 EL:3 AF:3/1 ]
Sat Jul 09 09:16:24 2016 us=73464 Local Options String: 'V4,dev-type tun,link-mtu 1560,tun-mtu 1500,proto TCPv4_CLIENT,comp-lzo,cipher AES-128-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Sat Jul 09 09:16:24 2016 us=73464 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1560,tun-mtu 1500,proto TCPv4_SERVER,comp-lzo,cipher AES-128-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Sat Jul 09 09:16:24 2016 us=73464 Local Options hash (VER=V4): 'bc07730e'
Sat Jul 09 09:16:24 2016 us=73464 Expected Remote Options hash (VER=V4): 'b695cb4a'
Sat Jul 09 09:16:24 2016 us=73464 Attempting to establish TCP connection with [AF_INET][Public IP]:1194 [nonblock]
Sat Jul 09 09:16:24 2016 us=73464 MANAGEMENT: >STATE:1468048584,TCP_CONNECT,,,
Sat Jul 09 09:16:25 2016 us=73534 TCP connection established with [AF_INET][Public IP]:1194
Sat Jul 09 09:16:25 2016 us=73534 TCPv4_CLIENT link local: [undef]
Sat Jul 09 09:16:25 2016 us=73534 TCPv4_CLIENT link remote: [AF_INET][Public IP]:1194
Sat Jul 09 09:16:25 2016 us=73534 MANAGEMENT: >STATE:1468048585,WAIT,,,
Sat Jul 09 09:16:25 2016 us=73534 MANAGEMENT: >STATE:1468048585,AUTH,,,
Sat Jul 09 09:16:25 2016 us=73534 TLS: Initial packet from [AF_INET][Public IP]:1194, sid=a438eca1 324e3569
Sat Jul 09 09:16:25 2016 us=182852 VERIFY OK: depth=1, C=NL, ST=BR, L=Oosterhout, O=OpenVPN, OU=changeme, CN=s10vpn, name=changeme, emailAddress=stijn.thomaes@gmail.com
Sat Jul 09 09:16:25 2016 us=198416 VERIFY OK: nsCertType=SERVER
Sat Jul 09 09:16:25 2016 us=198416 VERIFY OK: depth=0, C=NL, ST=BR, L=Oosterhout, O=OpenVPN, OU=changeme, CN=server, name=changeme, emailAddress=stijn.thomaes@gmail.com
Sat Jul 09 09:16:25 2016 us=276615 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Sat Jul 09 09:16:25 2016 us=276615 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Jul 09 09:16:25 2016 us=276615 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Sat Jul 09 09:16:25 2016 us=276615 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Jul 09 09:16:25 2016 us=276615 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 1024 bit RSA
Sat Jul 09 09:16:25 2016 us=276615 [server] Peer Connection Initiated with [AF_INET][Public IP]:1194
Sat Jul 09 09:16:26 2016 us=432878 MANAGEMENT: >STATE:1468048586,GET_CONFIG,,,
Sat Jul 09 09:16:27 2016 us=589189 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sat Jul 09 09:16:27 2016 us=651560 PUSH: Received control message: 'PUSH_REPLY,route 192.168.143.0 255.255.255.0,redirect-gateway def1,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Sat Jul 09 09:16:27 2016 us=651560 OPTIONS IMPORT: timers and/or timeouts modified
Sat Jul 09 09:16:27 2016 us=651560 OPTIONS IMPORT: --ifconfig/up options modified
Sat Jul 09 09:16:27 2016 us=651560 OPTIONS IMPORT: route options modified
Sat Jul 09 09:16:27 2016 us=651560 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Sat Jul 09 09:16:27 2016 us=651560 ROUTE_GATEWAY 192.168.143.1/255.255.255.0 I=15 HWADDR=10:02:b5:66:f9:36
Sat Jul 09 09:16:27 2016 us=667193 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Sat Jul 09 09:16:27 2016 us=667193 MANAGEMENT: >STATE:1468048587,ASSIGN_IP,,10.8.0.6,
Sat Jul 09 09:16:27 2016 us=667193 open_tun, tt->ipv6=0
Sat Jul 09 09:16:27 2016 us=667193 TAP-WIN32 device [Ethernet 2] opened: \\.\Global\{73C73DDC-165E-4231-BD54-85344AB7F65A}.tap
Sat Jul 09 09:16:27 2016 us=667193 TAP-Windows Driver Version 9.21 
Sat Jul 09 09:16:27 2016 us=667193 TAP-Windows MTU=1500
Sat Jul 09 09:16:27 2016 us=667193 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.6/255.255.255.252 on interface {73C73DDC-165E-4231-BD54-85344AB7F65A} [DHCP-serv: 10.8.0.5, lease-time: 31536000]
Sat Jul 09 09:16:27 2016 us=667193 DHCP option string: 06080808 08080808 0404
Sat Jul 09 09:16:27 2016 us=682810 Successful ARP Flush on interface [13] {73C73DDC-165E-4231-BD54-85344AB7F65A}
Sat Jul 09 09:16:32 2016 us=32716 TEST ROUTES: 3/3 succeeded len=2 ret=1 a=0 u/d=up
Sat Jul 09 09:16:32 2016 us=32716 C:\WINDOWS\system32\route.exe ADD [Public IP] MASK 255.255.255.255 192.168.143.1
Sat Jul 09 09:16:32 2016 us=48216 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=25 and dwForwardType=4
Sat Jul 09 09:16:32 2016 us=48216 Route addition via IPAPI succeeded [adaptive]
Sat Jul 09 09:16:32 2016 us=48216 C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.8.0.5
Sat Jul 09 09:16:32 2016 us=48216 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Sat Jul 09 09:16:32 2016 us=48216 Route addition via IPAPI succeeded [adaptive]
Sat Jul 09 09:16:32 2016 us=63843 C:\WINDOWS\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.8.0.5
Sat Jul 09 09:16:32 2016 us=79467 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Sat Jul 09 09:16:32 2016 us=79467 Route addition via IPAPI succeeded [adaptive]
Sat Jul 09 09:16:32 2016 us=79467 MANAGEMENT: >STATE:1468048592,ADD_ROUTES,,,
Sat Jul 09 09:16:32 2016 us=79467 C:\WINDOWS\system32\route.exe ADD 192.168.143.0 MASK 255.255.255.0 10.8.0.5
Sat Jul 09 09:16:32 2016 us=79467 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Sat Jul 09 09:16:32 2016 us=79467 Route addition via IPAPI succeeded [adaptive]
Sat Jul 09 09:16:32 2016 us=79467 C:\WINDOWS\system32\route.exe ADD 10.8.0.1 MASK 255.255.255.255 10.8.0.5
Sat Jul 09 09:16:32 2016 us=95092 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Sat Jul 09 09:16:32 2016 us=95092 Route addition via IPAPI succeeded [adaptive]
Sat Jul 09 09:16:32 2016 us=95092 Initialization Sequence Completed
Sat Jul 09 09:16:32 2016 us=95092 MANAGEMENT: >STATE:1468048592,CONNECTED,SUCCESS,10.8.0.6,[Public IP]

TinCanTech

Your client has redirected it's gateway successfully .. so you have done something wrong at your server. most likely your iptables is not correct.

s10

Got it working!

Apparantly dd-wrt requires some specific ip table rules.
on the dd-wrt forum i found some topics regarding the same problem. These rules solved the problem.

#werkende port forward command
iptables -t nat -A POSTROUTING -j MASQUERADE

#allow the VPN server to accept OpenVPN, DNS, SSH, and ping protocols
iptables -I INPUT -p udp --dport 1194 -j ACCEPT 
iptables -I INPUT -p udp --dport 53 -j ACCEPT 
iptables -I INPUT -p udp --dport 22 -j ACCEPT 
iptables -I INPUT -p icmp -j ACCEPT 

#forward the VPN tunnel network
iptables -I FORWARD 1 --source 10.8.0.0/24 -j ACCEPT

#Specific lines for working redirect gateway 
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o br0 -j MASQUERADE 
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j MASQUERADE 

#allow the VPN tunnel network to connect to the LAN network of the VPN server router
iptables -I FORWARD -i br0 -o tun0 -j ACCEPT 
iptables -I FORWARD -i tun0 -o br0 -j ACCEPT

Thanks TinCanTech for you support in solving my problem.! :-D

TinCanTech

Great .. thanks for letting us know your solution 8-)