Hello, I am building a server running Xen where OpenVPN server is installed on a guest OS (Ubuntu Xenial minimal install). I can successfully connect to the VPN using windows and android clients however I am not able to access the internet through the tunnel. I cannot ping server or tunnel while VPN is connected. I believe I have missed something when I created the routing rules. Can someone help correct my mistake? Xen Dom0 network is bridged to DomU and I use openvswitch. I have created a MAC address for the Dom0 nic as a VIF parameter in the Xen guest config file and assigned a DHCP reservation by my external router so the DomU always has IP address 192.168.0.136. My openVPN server creates a tunneling interface to the eth0 IP 192.168.0.136. **************************** Server Config File **************************** proto udp dev tun ca /etc/openvpn/ca.crt cert /etc/openvpn/myVPNsrv.crt key /etc/openvpn/myVPNsrv.key # This file should be kept secret dh /etc/openvpn/dh2048.pem topology subnet server 10.8.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt push "redirect-gateway def1 bypass-dhcp" push "dhcp-option DNS 8.8.8.8" push "dhcp-option DNS 8.8.4.4" keepalive 10 60 tls-auth /etc/openvpn/ta.tlsauth 0 cipher BF-CBC comp-lzo max-clients 4 persist-key persist-tun persist-local-ip status openvpn-status.log verb 7 **************************** Client Config File **************************** client dev tun dev-type tun topology subnet dev-node "Ethernet 3" # Windows name for TAP adapter proto udp remote 192.168.0.136 1194 resolv-retry infinite nobind persist-key persist-tun ca "C:\\Program Files\\OpenVPN\\config\\ca.crt" cert "C:\\Program Files\\OpenVPN\\config\\client1b.crt" key "C:\\Program Files\\OpenVPN\\config\\client1b.key" tls-auth "C:\\Program Files\\OpenVPN\\config\\ta.tlsauth" 1 tls-remote "myVPNsrv" ns-cert-type server cipher BF-CBC comp-lzo verb 7 **************************** ifconfig **************************** eth0 Link encap:Ethernet HWaddr 00:16:3e:67:00:e7 inet addr:192.168.0.136 Bcast:192.168.0.255 Mask:255.255.255.0 inet6 addr: fe80::216:3eff:fe67:e7/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:6534 errors:0 dropped:0 overruns:0 frame:0 TX packets:165 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:1232035 (1.2 MB) TX bytes:35680 (35.6 KB) lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MTU:65536 Metric:1 RX packets:172 errors:0 dropped:0 overruns:0 frame:0 TX packets:172 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1 RX bytes:12560 (12.5 KB) TX bytes:12560 (12.5 KB) tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 inet addr:10.8.0.1 P-t-P:10.8.0.1 Mask:255.255.255.0 UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:100 RX bytes:0 (0.0 B) TX bytes:0 (0.0 B) **************************** netstat -rn **************************** Kernel IP routing table Destination Gateway Genmask Flags MSS Window irtt Iface 0.0.0.0 192.168.0.1 0.0.0.0 UG 0 0 0 eth0 10.8.0.0 192.168.0.1 255.255.255.0 UG 0 0 0 eth0 10.8.0.0 0.0.0.0 255.255.255.0 U 0 0 0 tun0 192.168.0.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0 *********************** IPtable rules placed in /etc/rc.local *********************** ## Method 2 where routing and OpenVPN not running on default gateway # https://community.openvpn.net/openvpn/wiki/BridgingAndRouting iptables -I FORWARD -i tun0 -o eth0 \ -s 10.8.0.0/24 -d 192.168.0.0/24 \ -m conntrack --ctstate NEW -j ACCEPT iptables -I FORWARD -m conntrack --ctstate RELATED,ESTABLISHED \ -j ACCEPT # Rule suggested by https://secure-computing.net/wiki/index.php/Graph route add -net 10.8.0.0/24 gw 192.168.0.1 iptables -A INPUT -i eth0 -m state -- state NEW -p udp --dport 1194 -j ACCEPT iptables -A INPUT -i tun+ -j ACCEPT # Allow TUN interface connections to be forwarded through other interfaces iptables -A FORWARD -i tun+ -j ACCEPT iptables -A FORWARD -i tun- -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -A FORWARD -i eth0 -o tun+ -m state --state RELATED,ESTABLISHED -j ACCEPT # NAT the VPN client traffic to the internet iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -0 eth0 -j MASQUERADE exit 0

[quote="potentialcustomer"] I cannot ping server or tunnel while VPN is connected[/quote]Looks like you have all the bases covered .. except this one:[quote="potentialcustomer"]My openVPN server creates a tunneling interface to the eth0 IP 192.168.0.136[/quote]Because: NOTE: [list]your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create [b]routing conflicts[/b] if you connect to the VPN server from public locations such as internet cafes that use the same subnet.[/list] :arrow: [u]Never[/u] use 192.168.0.0/24 or 192.168.1.0/24 (or other common subnets) for your OpenVPN Server LAN :!: [list]You are advised to change your server LAN to a more unique [url=http://en.wikipedia.org/wiki/Private_network]RFC1918[/url] compliant subnet. f.e 192.168.143.0/24[/list] And this one .. Also, ensure [url=https://community.openvpn.net/openvpn/wiki/265-how-do-i-enable-ip-forwarding]IP forwarding[/url] is enabled on your server.

Thank you so much for your reply. I have no experience in network engineering so this is somewhat of a science project. I have do intend to harden the design and change port and IP addresses once I prove my system is functional. These typical addresses are used commonly in examples so I will use them until I am satisfied that everything works. IPV4 forwarding is enabled in /etc/sysctl.conf since I have uncommented: net.ipv4.ip_forward=1 # in the future I will add IPV6 support for mobile devices Can you (or anyone) suggest methods to troubleshoot or resolve this issue? Does the fact that I use Xen bridging from DomU to Dom0 create problems for using tunneling in Dom0 (where my OpenVPN server exists)?

[quote="potentialcustomer"] These typical addresses are used commonly in examples so I will use them until I am satisfied that everything works.[/quote]I would resolve probable subnet conflicts first. It is such a common problem you can grep the openvpn source and find the warning hard coded ..

Thank you again. I have changed my server IP from 192.168.0.136 to 192.168.136.136 however it did not resolve my issue. In order to make this change I have modified the following: 1) My router only permits port forwarding on one subnet therefore I changed the router configuration for DHCP from 192.168.0.* to 192.168.136.* as well as updated port forwarding 192.168.0.136 1194 to 192.168.136.136 1194. 2) Modified OpenVPN server config with updated IP address 3) Modified /etc/rc.local IP table rules to support 192.168.136.136 4) I created new keys/certificates after the IP change (probably unnecessarily) ************ OpenVPN server.conf *************** [b]local 192.168.136.136[/b] port 1194 management 127.0.0.1 1194 proto udp dev tun ca /etc/openvpn/ca.crt cert /etc/openvpn/MyVPNsrv.crt key /etc/openvpn/MyVPNsrv.key # This file should be kept secret dh /etc/openvpn/dh2048.pem topology subnet server 10.8.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt push "redirect-gateway def1 bypass-dhcp" push "dhcp-option DNS 8.8.8.8" push "dhcp-option DNS 8.8.4.4" keepalive 10 60 tls-auth /etc/openvpn/ta.tlsauth 0 # This file is secret cipher BF-CBC # Blowfish (default) comp-lzo max-clients 4 persist-key persist-tun persist-local-ip status openvpn-status.log verb 7 ************** OpenVPN Client config *************** client dev tun dev-type tun topology subnet dev-node "Ethernet 3" proto udp [b]remote 192.168.136.136 1194[/b] resolv-retry infinite nobind persist-key persist-tun ca "C:\\Program Files\\OpenVPN\\config\\ca.crt" cert "C:\\Program Files\\OpenVPN\\config\\client1c.crt" key "C:\\Program Files\\OpenVPN\\config\\client1c.key" tls-auth "C:\\Program Files\\OpenVPN\\config\\ta.tlsauth" 1 tls-remote "warconstVPNsrv" ns-cert-type server cipher BF-CBC # Blowfish (default) comp-lzo verb 7 *************** netstat -rn **************** Kernel IP routing table Destination Gateway Genmask Flags MSS Window irtt Iface [b]0.0.0.0 192.168.136.1 0.0.0.0 UG 0 0 0 eth0 10.8.0.0 192.168.136.1 255.255.255.0 UG 0 0 0 eth0[/b] 10.8.0.0 0.0.0.0 255.255.255.0 U 0 0 0 tun0 [b]192.168.136.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0[/b] ************* iproute ********************** [b]default via 192.168.136.1 dev eth0 10.8.0.0/24 via 192.168.136.1 dev eth0 [/b] 10.8.0.0/24 dev tun0 proto kernel scope link src 10.8.0.1 [b]192.168.136.0/24 dev eth0 proto kernel scope link src 192.168.136.136 [/b] Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface [b]default 192.168.136.1 0.0.0.0 UG 0 0 0 eth0 10.8.0.0 192.168.136.1 255.255.255.0 UG 0 0 0 eth0 [/b] 10.8.0.0 * 255.255.255.0 U 0 0 0 tun0 [b]192.168.136.0 * 255.255.255.0 U 0 0 0 eth0[/b]

You should only need --[b]verb 4[/b] for your logs .. change them both then post your client log.

[b]Thank you again @TinCanTech[/b] I have changed log to verb 4 for both server and client. ********************** Client log *************************** Tue Jul 19 14:20:42 2016 DEPRECATED OPTION: --tls-remote, please update your configuration Tue Jul 19 14:20:42 2016 us=24261 Current Parameter Settings: Tue Jul 19 14:20:42 2016 us=24261 config = 'MyVPNclient.ovpn' Tue Jul 19 14:20:42 2016 us=24261 mode = 0 Tue Jul 19 14:20:42 2016 us=24261 show_ciphers = DISABLED Tue Jul 19 14:20:42 2016 us=24261 show_digests = DISABLED Tue Jul 19 14:20:42 2016 us=24261 show_engines = DISABLED Tue Jul 19 14:20:42 2016 us=24261 genkey = DISABLED Tue Jul 19 14:20:42 2016 us=24261 key_pass_file = '[UNDEF]' Tue Jul 19 14:20:42 2016 us=24261 show_tls_ciphers = DISABLED Tue Jul 19 14:20:42 2016 us=24261 Connection profiles [default]: Tue Jul 19 14:20:42 2016 us=24261 proto = udp Tue Jul 19 14:20:42 2016 us=24261 local = '[UNDEF]' Tue Jul 19 14:20:42 2016 us=24261 local_port = 0 Tue Jul 19 14:20:42 2016 us=24261 remote = '192.168.136.136' Tue Jul 19 14:20:42 2016 us=24261 remote_port = 1194 Tue Jul 19 14:20:42 2016 us=24261 remote_float = DISABLED Tue Jul 19 14:20:42 2016 us=24261 bind_defined = DISABLED Tue Jul 19 14:20:42 2016 us=24261 bind_local = DISABLED Tue Jul 19 14:20:42 2016 us=24261 connect_retry_seconds = 5 Tue Jul 19 14:20:42 2016 us=24261 connect_timeout = 10 Tue Jul 19 14:20:42 2016 us=24261 connect_retry_max = 0 Tue Jul 19 14:20:42 2016 us=24261 socks_proxy_server = '[UNDEF]' Tue Jul 19 14:20:42 2016 us=24261 socks_proxy_port = 0 Tue Jul 19 14:20:42 2016 us=24261 socks_proxy_retry = DISABLED Tue Jul 19 14:20:42 2016 us=24261 tun_mtu = 1500 Tue Jul 19 14:20:42 2016 us=24261 tun_mtu_defined = ENABLED Tue Jul 19 14:20:42 2016 us=24261 link_mtu = 1500 Tue Jul 19 14:20:42 2016 us=24261 link_mtu_defined = DISABLED Tue Jul 19 14:20:42 2016 us=24261 tun_mtu_extra = 0 Tue Jul 19 14:20:42 2016 us=24261 tun_mtu_extra_defined = DISABLED Tue Jul 19 14:20:42 2016 us=24261 mtu_discover_type = -1 Tue Jul 19 14:20:42 2016 us=24261 fragment = 0 Tue Jul 19 14:20:42 2016 us=24261 mssfix = 1450 Tue Jul 19 14:20:42 2016 us=24261 explicit_exit_notification = 0 Tue Jul 19 14:20:42 2016 us=24261 Connection profiles END Tue Jul 19 14:20:42 2016 us=24261 remote_random = DISABLED Tue Jul 19 14:20:42 2016 us=24261 ipchange = '[UNDEF]' Tue Jul 19 14:20:42 2016 us=24261 dev = 'tun' Tue Jul 19 14:20:42 2016 us=24261 dev_type = 'tun' Tue Jul 19 14:20:42 2016 us=24261 dev_node = 'Ethernet 3' Tue Jul 19 14:20:42 2016 us=24261 lladdr = '[UNDEF]' Tue Jul 19 14:20:42 2016 us=24261 topology = 3 Tue Jul 19 14:20:42 2016 us=24261 tun_ipv6 = DISABLED Tue Jul 19 14:20:42 2016 us=24261 ifconfig_local = '[UNDEF]' Tue Jul 19 14:20:42 2016 us=24261 ifconfig_remote_netmask = '[UNDEF]' Tue Jul 19 14:20:42 2016 us=24261 ifconfig_noexec = DISABLED Tue Jul 19 14:20:42 2016 us=24261 ifconfig_nowarn = DISABLED Tue Jul 19 14:20:42 2016 us=24261 ifconfig_ipv6_local = '[UNDEF]' Tue Jul 19 14:20:42 2016 us=24261 ifconfig_ipv6_netbits = 0 Tue Jul 19 14:20:42 2016 us=24261 ifconfig_ipv6_remote = '[UNDEF]' Tue Jul 19 14:20:42 2016 us=24261 shaper = 0 Tue Jul 19 14:20:42 2016 us=24261 mtu_test = 0 Tue Jul 19 14:20:42 2016 us=24261 mlock = DISABLED Tue Jul 19 14:20:42 2016 us=24261 keepalive_ping = 0 Tue Jul 19 14:20:42 2016 us=24261 keepalive_timeout = 0 Tue Jul 19 14:20:42 2016 us=24261 inactivity_timeout = 0 Tue Jul 19 14:20:42 2016 us=24261 ping_send_timeout = 0 Tue Jul 19 14:20:42 2016 us=24261 ping_rec_timeout = 0 Tue Jul 19 14:20:42 2016 us=24261 ping_rec_timeout_action = 0 Tue Jul 19 14:20:42 2016 us=24261 ping_timer_remote = DISABLED Tue Jul 19 14:20:42 2016 us=24261 remap_sigusr1 = 0 Tue Jul 19 14:20:42 2016 us=24261 persist_tun = ENABLED Tue Jul 19 14:20:42 2016 us=24261 persist_local_ip = DISABLED Tue Jul 19 14:20:42 2016 us=24261 persist_remote_ip = DISABLED Tue Jul 19 14:20:42 2016 us=24261 persist_key = ENABLED Tue Jul 19 14:20:42 2016 us=24261 passtos = DISABLED Tue Jul 19 14:20:42 2016 us=24261 resolve_retry_seconds = 1000000000 Tue Jul 19 14:20:42 2016 us=24261 username = '[UNDEF]' Tue Jul 19 14:20:42 2016 us=24261 groupname = '[UNDEF]' Tue Jul 19 14:20:42 2016 us=24261 chroot_dir = '[UNDEF]' Tue Jul 19 14:20:42 2016 us=24261 cd_dir = '[UNDEF]' Tue Jul 19 14:20:42 2016 us=24261 writepid = '[UNDEF]' Tue Jul 19 14:20:42 2016 us=24261 up_script = '[UNDEF]' Tue Jul 19 14:20:42 2016 us=24261 down_script = '[UNDEF]' Tue Jul 19 14:20:42 2016 us=24261 down_pre = DISABLED Tue Jul 19 14:20:42 2016 us=24261 up_restart = DISABLED Tue Jul 19 14:20:42 2016 us=24261 up_delay = DISABLED Tue Jul 19 14:20:42 2016 us=24261 daemon = DISABLED Tue Jul 19 14:20:42 2016 us=24261 inetd = 0 Tue Jul 19 14:20:42 2016 us=24261 log = ENABLED Tue Jul 19 14:20:42 2016 us=24261 suppress_timestamps = DISABLED Tue Jul 19 14:20:42 2016 us=24261 nice = 0 Tue Jul 19 14:20:42 2016 us=24261 verbosity = 4 Tue Jul 19 14:20:42 2016 us=24261 mute = 0 Tue Jul 19 14:20:42 2016 us=24261 gremlin = 0 Tue Jul 19 14:20:42 2016 us=24261 status_file = '[UNDEF]' Tue Jul 19 14:20:42 2016 us=24261 status_file_version = 1 Tue Jul 19 14:20:42 2016 us=24261 status_file_update_freq = 60 Tue Jul 19 14:20:42 2016 us=24261 occ = ENABLED Tue Jul 19 14:20:42 2016 us=24261 rcvbuf = 0 Tue Jul 19 14:20:42 2016 us=24261 sndbuf = 0 Tue Jul 19 14:20:42 2016 us=24261 sockflags = 0 Tue Jul 19 14:20:42 2016 us=24261 fast_io = DISABLED Tue Jul 19 14:20:42 2016 us=24261 lzo = 7 Tue Jul 19 14:20:42 2016 us=24261 route_script = '[UNDEF]' Tue Jul 19 14:20:42 2016 us=24261 route_default_gateway = '[UNDEF]' Tue Jul 19 14:20:42 2016 us=24261 route_default_metric = 0 Tue Jul 19 14:20:42 2016 us=24261 route_noexec = DISABLED Tue Jul 19 14:20:42 2016 us=24261 route_delay = 5 Tue Jul 19 14:20:42 2016 us=24261 route_delay_window = 30 Tue Jul 19 14:20:42 2016 us=24261 route_delay_defined = ENABLED Tue Jul 19 14:20:42 2016 us=24261 route_nopull = DISABLED Tue Jul 19 14:20:42 2016 us=24261 route_gateway_via_dhcp = DISABLED Tue Jul 19 14:20:42 2016 us=24261 max_routes = 100 Tue Jul 19 14:20:42 2016 us=24261 allow_pull_fqdn = DISABLED Tue Jul 19 14:20:42 2016 us=24261 management_addr = '127.0.0.1' Tue Jul 19 14:20:42 2016 us=24261 management_port = 25340 Tue Jul 19 14:20:42 2016 us=24261 management_user_pass = 'stdin' Tue Jul 19 14:20:42 2016 us=24261 management_log_history_cache = 250 Tue Jul 19 14:20:42 2016 us=24261 management_echo_buffer_size = 100 Tue Jul 19 14:20:42 2016 us=24261 management_write_peer_info_file = '[UNDEF]' Tue Jul 19 14:20:42 2016 us=24261 management_client_user = '[UNDEF]' Tue Jul 19 14:20:42 2016 us=24261 management_client_group = '[UNDEF]' Tue Jul 19 14:20:42 2016 us=24261 management_flags = 6 Tue Jul 19 14:20:42 2016 us=24261 shared_secret_file = '[UNDEF]' Tue Jul 19 14:20:42 2016 us=24261 key_direction = 2 Tue Jul 19 14:20:42 2016 us=24261 ciphername_defined = ENABLED Tue Jul 19 14:20:42 2016 us=24261 ciphername = 'BF-CBC' Tue Jul 19 14:20:42 2016 us=24261 authname_defined = ENABLED Tue Jul 19 14:20:42 2016 us=24261 authname = 'SHA1' Tue Jul 19 14:20:42 2016 us=24261 prng_hash = 'SHA1' Tue Jul 19 14:20:42 2016 us=24261 prng_nonce_secret_len = 16 Tue Jul 19 14:20:42 2016 us=24261 keysize = 0 Tue Jul 19 14:20:42 2016 us=24261 engine = DISABLED Tue Jul 19 14:20:42 2016 us=24261 replay = ENABLED Tue Jul 19 14:20:42 2016 us=24261 mute_replay_warnings = DISABLED Tue Jul 19 14:20:42 2016 us=24261 replay_window = 64 Tue Jul 19 14:20:42 2016 us=24261 replay_time = 15 Tue Jul 19 14:20:42 2016 us=24261 packet_id_file = '[UNDEF]' Tue Jul 19 14:20:42 2016 us=24261 use_iv = ENABLED Tue Jul 19 14:20:42 2016 us=24261 test_crypto = DISABLED Tue Jul 19 14:20:42 2016 us=24261 tls_server = DISABLED Tue Jul 19 14:20:42 2016 us=24261 tls_client = ENABLED Tue Jul 19 14:20:42 2016 us=24261 key_method = 2 Tue Jul 19 14:20:42 2016 us=24261 ca_file = 'C:\Program Files\OpenVPN\config\ca.crt' Tue Jul 19 14:20:42 2016 us=24261 ca_path = '[UNDEF]' Tue Jul 19 14:20:42 2016 us=24261 dh_file = '[UNDEF]' Tue Jul 19 14:20:42 2016 us=24261 cert_file = 'C:\Program Files\OpenVPN\config\client1c.crt' Tue Jul 19 14:20:42 2016 us=24261 extra_certs_file = '[UNDEF]' Tue Jul 19 14:20:42 2016 us=24261 priv_key_file = 'C:\Program Files\OpenVPN\config\client1c.key' Tue Jul 19 14:20:42 2016 us=24261 pkcs12_file = '[UNDEF]' Tue Jul 19 14:20:42 2016 us=24261 cryptoapi_cert = '[UNDEF]' Tue Jul 19 14:20:42 2016 us=24261 cipher_list = '[UNDEF]' Tue Jul 19 14:20:42 2016 us=24261 tls_verify = '[UNDEF]' Tue Jul 19 14:20:42 2016 us=24261 tls_export_cert = '[UNDEF]' Tue Jul 19 14:20:42 2016 us=24261 verify_x509_type = 259 Tue Jul 19 14:20:42 2016 us=24261 verify_x509_name = 'MyVPNsrv' Tue Jul 19 14:20:42 2016 us=24261 crl_file = '[UNDEF]' Tue Jul 19 14:20:42 2016 us=24261 ns_cert_type = 1 Tue Jul 19 14:20:42 2016 us=24261 remote_cert_ku[i] = 0 Tue Jul 19 14:20:42 2016 us=24261 remote_cert_ku[i] = 0 Tue Jul 19 14:20:42 2016 us=24261 remote_cert_ku[i] = 0 Tue Jul 19 14:20:42 2016 us=24261 remote_cert_ku[i] = 0 Tue Jul 19 14:20:42 2016 us=24261 remote_cert_ku[i] = 0 Tue Jul 19 14:20:42 2016 us=24261 remote_cert_ku[i] = 0 Tue Jul 19 14:20:42 2016 us=24261 remote_cert_ku[i] = 0 Tue Jul 19 14:20:42 2016 us=24261 remote_cert_ku[i] = 0 Tue Jul 19 14:20:42 2016 us=24261 remote_cert_ku[i] = 0 Tue Jul 19 14:20:42 2016 us=24261 remote_cert_ku[i] = 0 Tue Jul 19 14:20:42 2016 us=24261 remote_cert_ku[i] = 0 Tue Jul 19 14:20:42 2016 us=24261 remote_cert_ku[i] = 0 Tue Jul 19 14:20:42 2016 us=24261 remote_cert_ku[i] = 0 Tue Jul 19 14:20:42 2016 us=24261 remote_cert_ku[i] = 0 Tue Jul 19 14:20:42 2016 us=24261 remote_cert_ku[i] = 0 Tue Jul 19 14:20:42 2016 us=24261 remote_cert_ku[i] = 0 Tue Jul 19 14:20:42 2016 us=24261 remote_cert_eku = '[UNDEF]' Tue Jul 19 14:20:42 2016 us=24261 ssl_flags = 0 Tue Jul 19 14:20:42 2016 us=24261 tls_timeout = 2 Tue Jul 19 14:20:42 2016 us=24261 renegotiate_bytes = 0 Tue Jul 19 14:20:42 2016 us=24261 renegotiate_packets = 0 Tue Jul 19 14:20:42 2016 us=24261 renegotiate_seconds = 3600 Tue Jul 19 14:20:42 2016 us=24261 handshake_window = 60 Tue Jul 19 14:20:42 2016 us=24261 transition_window = 3600 Tue Jul 19 14:20:42 2016 us=24261 single_session = DISABLED Tue Jul 19 14:20:42 2016 us=24261 push_peer_info = DISABLED Tue Jul 19 14:20:42 2016 us=24261 tls_exit = DISABLED Tue Jul 19 14:20:42 2016 us=24261 tls_auth_file = 'C:\Program Files\OpenVPN\config\ta.tlsauth' Tue Jul 19 14:20:42 2016 us=24261 pkcs11_protected_authentication = DISABLED Tue Jul 19 14:20:42 2016 us=24261 pkcs11_protected_authentication = DISABLED Tue Jul 19 14:20:42 2016 us=24261 pkcs11_protected_authentication = DISABLED Tue Jul 19 14:20:42 2016 us=24261 pkcs11_protected_authentication = DISABLED Tue Jul 19 14:20:42 2016 us=24261 pkcs11_protected_authentication = DISABLED Tue Jul 19 14:20:42 2016 us=24261 pkcs11_protected_authentication = DISABLED Tue Jul 19 14:20:42 2016 us=24261 pkcs11_protected_authentication = DISABLED Tue Jul 19 14:20:42 2016 us=24261 pkcs11_protected_authentication = DISABLED Tue Jul 19 14:20:42 2016 us=24261 pkcs11_protected_authentication = DISABLED Tue Jul 19 14:20:42 2016 us=24261 pkcs11_protected_authentication = DISABLED Tue Jul 19 14:20:42 2016 us=24261 pkcs11_protected_authentication = DISABLED Tue Jul 19 14:20:42 2016 us=24261 pkcs11_protected_authentication = DISABLED Tue Jul 19 14:20:42 2016 us=24261 pkcs11_protected_authentication = DISABLED Tue Jul 19 14:20:42 2016 us=24261 pkcs11_protected_authentication = DISABLED Tue Jul 19 14:20:42 2016 us=24261 pkcs11_protected_authentication = DISABLED Tue Jul 19 14:20:42 2016 us=24261 pkcs11_protected_authentication = DISABLED Tue Jul 19 14:20:42 2016 us=24261 pkcs11_private_mode = 00000000 Tue Jul 19 14:20:42 2016 us=24261 pkcs11_private_mode = 00000000 Tue Jul 19 14:20:42 2016 us=24261 pkcs11_private_mode = 00000000 Tue Jul 19 14:20:42 2016 us=24261 pkcs11_private_mode = 00000000 Tue Jul 19 14:20:42 2016 us=24261 pkcs11_private_mode = 00000000 Tue Jul 19 14:20:42 2016 us=24261 pkcs11_private_mode = 00000000 Tue Jul 19 14:20:42 2016 us=24261 pkcs11_private_mode = 00000000 Tue Jul 19 14:20:42 2016 us=24261 pkcs11_private_mode = 00000000 Tue Jul 19 14:20:42 2016 us=24261 pkcs11_private_mode = 00000000 Tue Jul 19 14:20:42 2016 us=24261 pkcs11_private_mode = 00000000 Tue Jul 19 14:20:42 2016 us=24261 pkcs11_private_mode = 00000000 Tue Jul 19 14:20:42 2016 us=24261 pkcs11_private_mode = 00000000 Tue Jul 19 14:20:42 2016 us=24261 pkcs11_private_mode = 00000000 Tue Jul 19 14:20:42 2016 us=24261 pkcs11_private_mode = 00000000 Tue Jul 19 14:20:42 2016 us=24261 pkcs11_private_mode = 00000000 Tue Jul 19 14:20:42 2016 us=24261 pkcs11_private_mode = 00000000 Tue Jul 19 14:20:42 2016 us=24261 pkcs11_cert_private = DISABLED Tue Jul 19 14:20:42 2016 us=24261 pkcs11_cert_private = DISABLED Tue Jul 19 14:20:42 2016 us=24261 pkcs11_cert_private = DISABLED Tue Jul 19 14:20:42 2016 us=24261 pkcs11_cert_private = DISABLED Tue Jul 19 14:20:42 2016 us=24261 pkcs11_cert_private = DISABLED Tue Jul 19 14:20:42 2016 us=24261 pkcs11_cert_private = DISABLED Tue Jul 19 14:20:42 2016 us=24261 pkcs11_cert_private = DISABLED Tue Jul 19 14:20:42 2016 us=24261 pkcs11_cert_private = DISABLED Tue Jul 19 14:20:42 2016 us=24261 pkcs11_cert_private = DISABLED Tue Jul 19 14:20:42 2016 us=24261 pkcs11_cert_private = DISABLED Tue Jul 19 14:20:42 2016 us=24261 pkcs11_cert_private = DISABLED Tue Jul 19 14:20:42 2016 us=24261 pkcs11_cert_private = DISABLED Tue Jul 19 14:20:42 2016 us=24261 pkcs11_cert_private = DISABLED Tue Jul 19 14:20:42 2016 us=39886 pkcs11_cert_private = DISABLED Tue Jul 19 14:20:42 2016 us=39886 pkcs11_cert_private = DISABLED Tue Jul 19 14:20:42 2016 us=39886 pkcs11_cert_private = DISABLED Tue Jul 19 14:20:42 2016 us=39886 pkcs11_pin_cache_period = -1 Tue Jul 19 14:20:42 2016 us=39886 pkcs11_id = '[UNDEF]' Tue Jul 19 14:20:42 2016 us=39886 pkcs11_id_management = DISABLED Tue Jul 19 14:20:42 2016 us=39886 server_network = 0.0.0.0 Tue Jul 19 14:20:42 2016 us=39886 server_netmask = 0.0.0.0 Tue Jul 19 14:20:42 2016 us=39886 server_network_ipv6 = :: Tue Jul 19 14:20:42 2016 us=39886 server_netbits_ipv6 = 0 Tue Jul 19 14:20:42 2016 us=39886 server_bridge_ip = 0.0.0.0 Tue Jul 19 14:20:42 2016 us=39886 server_bridge_netmask = 0.0.0.0 Tue Jul 19 14:20:42 2016 us=39886 server_bridge_pool_start = 0.0.0.0 Tue Jul 19 14:20:42 2016 us=39886 server_bridge_pool_end = 0.0.0.0 Tue Jul 19 14:20:42 2016 us=39886 ifconfig_pool_defined = DISABLED Tue Jul 19 14:20:42 2016 us=39886 ifconfig_pool_start = 0.0.0.0 Tue Jul 19 14:20:42 2016 us=39886 ifconfig_pool_end = 0.0.0.0 Tue Jul 19 14:20:42 2016 us=39886 ifconfig_pool_netmask = 0.0.0.0 Tue Jul 19 14:20:42 2016 us=39886 ifconfig_pool_persist_filename = '[UNDEF]' Tue Jul 19 14:20:42 2016 us=39886 ifconfig_pool_persist_refresh_freq = 600 Tue Jul 19 14:20:42 2016 us=39886 ifconfig_ipv6_pool_defined = DISABLED Tue Jul 19 14:20:42 2016 us=39886 ifconfig_ipv6_pool_base = :: Tue Jul 19 14:20:42 2016 us=39886 ifconfig_ipv6_pool_netbits = 0 Tue Jul 19 14:20:42 2016 us=39886 n_bcast_buf = 256 Tue Jul 19 14:20:42 2016 us=39886 tcp_queue_limit = 64 Tue Jul 19 14:20:42 2016 us=39886 real_hash_size = 256 Tue Jul 19 14:20:42 2016 us=39886 virtual_hash_size = 256 Tue Jul 19 14:20:42 2016 us=39886 client_connect_script = '[UNDEF]' Tue Jul 19 14:20:42 2016 us=39886 learn_address_script = '[UNDEF]' Tue Jul 19 14:20:42 2016 us=39886 client_disconnect_script = '[UNDEF]' Tue Jul 19 14:20:42 2016 us=39886 client_config_dir = '[UNDEF]' Tue Jul 19 14:20:42 2016 us=39886 ccd_exclusive = DISABLED Tue Jul 19 14:20:42 2016 us=39886 tmp_dir = 'C:\Users\me\AppData\Local\Temp\' Tue Jul 19 14:20:42 2016 us=39886 push_ifconfig_defined = DISABLED Tue Jul 19 14:20:42 2016 us=39886 push_ifconfig_local = 0.0.0.0 Tue Jul 19 14:20:42 2016 us=39886 push_ifconfig_remote_netmask = 0.0.0.0 Tue Jul 19 14:20:42 2016 us=39886 push_ifconfig_ipv6_defined = DISABLED Tue Jul 19 14:20:42 2016 us=39886 push_ifconfig_ipv6_local = ::/0 Tue Jul 19 14:20:42 2016 us=39886 push_ifconfig_ipv6_remote = :: Tue Jul 19 14:20:42 2016 us=39886 enable_c2c = DISABLED Tue Jul 19 14:20:42 2016 us=39886 duplicate_cn = DISABLED Tue Jul 19 14:20:42 2016 us=39886 cf_max = 0 Tue Jul 19 14:20:42 2016 us=39886 cf_per = 0 Tue Jul 19 14:20:42 2016 us=39886 max_clients = 1024 Tue Jul 19 14:20:42 2016 us=39886 max_routes_per_client = 256 Tue Jul 19 14:20:42 2016 us=39886 auth_user_pass_verify_script = '[UNDEF]' Tue Jul 19 14:20:42 2016 us=39886 auth_user_pass_verify_script_via_file = DISABLED Tue Jul 19 14:20:42 2016 us=39886 client = ENABLED Tue Jul 19 14:20:42 2016 us=39886 pull = ENABLED Tue Jul 19 14:20:42 2016 us=39886 auth_user_pass_file = '[UNDEF]' Tue Jul 19 14:20:42 2016 us=39886 show_net_up = DISABLED Tue Jul 19 14:20:42 2016 us=39886 route_method = 0 Tue Jul 19 14:20:42 2016 us=39886 block_outside_dns = DISABLED Tue Jul 19 14:20:42 2016 us=39886 ip_win32_defined = DISABLED Tue Jul 19 14:20:42 2016 us=39886 ip_win32_type = 3 Tue Jul 19 14:20:42 2016 us=39886 dhcp_masq_offset = 0 Tue Jul 19 14:20:42 2016 us=39886 dhcp_lease_time = 31536000 Tue Jul 19 14:20:42 2016 us=39886 tap_sleep = 0 Tue Jul 19 14:20:42 2016 us=39886 dhcp_options = DISABLED Tue Jul 19 14:20:42 2016 us=39886 dhcp_renew = DISABLED Tue Jul 19 14:20:42 2016 us=39886 dhcp_pre_release = DISABLED Tue Jul 19 14:20:42 2016 us=39886 dhcp_release = DISABLED Tue Jul 19 14:20:42 2016 us=39886 domain = '[UNDEF]' Tue Jul 19 14:20:42 2016 us=39886 netbios_scope = '[UNDEF]' Tue Jul 19 14:20:42 2016 us=39886 netbios_node_type = 0 Tue Jul 19 14:20:42 2016 us=39886 disable_nbt = DISABLED Tue Jul 19 14:20:42 2016 us=39886 OpenVPN 2.3.11 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on May 10 2016 Tue Jul 19 14:20:42 2016 us=39886 Windows version 6.2 (Windows 8 or greater) 64bit Tue Jul 19 14:20:42 2016 us=39886 library versions: OpenSSL 1.0.1t 3 May 2016, LZO 2.09 Enter Management Password: Tue Jul 19 14:20:42 2016 us=39886 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340 Tue Jul 19 14:20:42 2016 us=39886 Need hold release from management interface, waiting... Tue Jul 19 14:20:42 2016 us=149423 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340 Tue Jul 19 14:20:42 2016 us=258840 MANAGEMENT: CMD 'state on' Tue Jul 19 14:20:42 2016 us=258840 MANAGEMENT: CMD 'log all on' Tue Jul 19 14:20:42 2016 us=602413 MANAGEMENT: CMD 'hold off' Tue Jul 19 14:20:42 2016 us=602413 MANAGEMENT: CMD 'hold release' Tue Jul 19 14:20:42 2016 us=977432 Control Channel Authentication: using 'C:\Program Files\OpenVPN\config\ta.tlsauth' as a OpenVPN static key file Tue Jul 19 14:20:42 2016 us=977432 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication Tue Jul 19 14:20:42 2016 us=977432 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication Tue Jul 19 14:20:42 2016 us=977432 LZO compression initialized Tue Jul 19 14:20:42 2016 us=977432 Control Channel MTU parms [ L:1542 D:1184 EF:66 EB:0 ET:0 EL:3 ] Tue Jul 19 14:20:42 2016 us=977432 Socket Buffers: R=[65536->65536] S=[65536->65536] Tue Jul 19 14:20:42 2016 us=977432 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:143 ET:0 EL:3 AF:3/1 ] Tue Jul 19 14:20:42 2016 us=977432 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-client' Tue Jul 19 14:20:42 2016 us=977432 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 0,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-server' Tue Jul 19 14:20:42 2016 us=977432 Local Options hash (VER=V4): '504e774e' Tue Jul 19 14:20:42 2016 us=977432 Expected Remote Options hash (VER=V4): '14168603' Tue Jul 19 14:20:42 2016 us=977432 UDPv4 link local: [undef] Tue Jul 19 14:20:42 2016 us=977432 UDPv4 link remote: [AF_INET]192.168.136.136:1194 Tue Jul 19 14:20:42 2016 us=977432 MANAGEMENT: >STATE:1468952442,WAIT,,, Tue Jul 19 14:20:42 2016 us=977432 MANAGEMENT: >STATE:1468952442,AUTH,,, Tue Jul 19 14:20:42 2016 us=977432 TLS: Initial packet from [AF_INET]192.168.136.136:1194, sid=a7500b2a d7329c22 Tue Jul 19 14:20:43 2016 us=8685 VERIFY OK: depth=1, /C=US/ST=PA/L=Carlisle/O=MyName/OU=MyVPN/CN=MyVPNsrv/name=MyVPNsrv/emailAddress=My@pa.net Tue Jul 19 14:20:43 2016 us=8685 VERIFY OK: nsCertType=SERVER Tue Jul 19 14:20:43 2016 us=8685 VERIFY X509NAME OK: /C=US/ST=PA/L=Carlisle/O=MyName/OU=MyVPN/CN=MyVPNsrv/name=MyVPNsrv/emailAddress=My@pa.net Tue Jul 19 14:20:43 2016 us=8685 VERIFY OK: depth=0, /C=US/ST=PA/L=Carlisle/O=MyName/OU=MyVPN/CN=MyVPNsrv/name=MyVPNsrv/emailAddress=My@pa.net Tue Jul 19 14:20:43 2016 us=86820 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key Tue Jul 19 14:20:43 2016 us=86820 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication Tue Jul 19 14:20:43 2016 us=86820 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key Tue Jul 19 14:20:43 2016 us=86820 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication Tue Jul 19 14:20:43 2016 us=86820 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 2048 bit RSA Tue Jul 19 14:20:43 2016 us=86820 [MyVPNsrv] Peer Connection Initiated with [AF_INET]192.168.136.136:1194 Tue Jul 19 14:20:44 2016 us=196420 MANAGEMENT: >STATE:1468952444,GET_CONFIG,,, Tue Jul 19 14:20:45 2016 us=305833 SENT CONTROL [MyVPNsrv]: 'PUSH_REQUEST' (status=1) Tue Jul 19 14:20:45 2016 us=305833 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 60,ifconfig 10.8.0.3 255.255.255.0' Tue Jul 19 14:20:45 2016 us=305833 OPTIONS IMPORT: timers and/or timeouts modified Tue Jul 19 14:20:45 2016 us=305833 OPTIONS IMPORT: --ifconfig/up options modified Tue Jul 19 14:20:45 2016 us=305833 OPTIONS IMPORT: route options modified Tue Jul 19 14:20:45 2016 us=305833 OPTIONS IMPORT: route-related options modified Tue Jul 19 14:20:45 2016 us=305833 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified Tue Jul 19 14:20:45 2016 us=336928 ROUTE_GATEWAY 192.168.136.1/255.255.255.0 I=19 HWADDR=40:e2:30:1b:c1:d7 Tue Jul 19 14:20:45 2016 us=383963 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0 Tue Jul 19 14:20:45 2016 us=383963 MANAGEMENT: >STATE:1468952445,ASSIGN_IP,,10.8.0.3, Tue Jul 19 14:20:45 2016 us=383963 open_tun, tt->ipv6=0 Tue Jul 19 14:20:45 2016 us=383963 TAP-WIN32 device [Ethernet 3] opened: \\.\Global\{49E6F44D-02DD-4740-88A3-3C209BB2A835}.tap Tue Jul 19 14:20:45 2016 us=383963 TAP-Windows Driver Version 9.21 Tue Jul 19 14:20:45 2016 us=383963 TAP-Windows MTU=1500 Tue Jul 19 14:20:45 2016 us=383963 Set TAP-Windows TUN subnet mode network/local/netmask = 10.8.0.0/10.8.0.3/255.255.255.0 [SUCCEEDED] Tue Jul 19 14:20:45 2016 us=383963 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.3/255.255.255.0 on interface {49E6F44D-02DD-4740-88A3-3C209BB2A835} [DHCP-serv: 10.8.0.254, lease-time: 31536000] Tue Jul 19 14:20:45 2016 us=383963 DHCP option string: 06080808 08080808 0404 Tue Jul 19 14:20:45 2016 us=399433 Successful ARP Flush on interface [21] {49E6F44D-02DD-4740-88A3-3C209BB2A835} Tue Jul 19 14:20:50 2016 us=55914 TEST ROUTES: 1/1 succeeded len=0 ret=1 a=0 u/d=up Tue Jul 19 14:20:50 2016 us=55914 C:\Windows\system32\route.exe ADD 192.168.136.136 MASK 255.255.255.255 192.168.136.1 IF 19 Tue Jul 19 14:20:50 2016 us=55914 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=25 and dwForwardType=4 Tue Jul 19 14:20:50 2016 us=55914 Route addition via IPAPI succeeded [adaptive] Tue Jul 19 14:20:50 2016 us=55914 C:\Windows\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.8.0.1 Tue Jul 19 14:20:50 2016 us=55914 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4 Tue Jul 19 14:20:50 2016 us=55914 Route addition via IPAPI succeeded [adaptive] Tue Jul 19 14:20:50 2016 us=55914 C:\Windows\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.8.0.1 Tue Jul 19 14:20:50 2016 us=71540 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4 Tue Jul 19 14:20:50 2016 us=71540 Route addition via IPAPI succeeded [adaptive] Tue Jul 19 14:20:50 2016 us=71540 Initialization Sequence Completed Tue Jul 19 14:20:50 2016 us=71540 MANAGEMENT: >STATE:1468952450,CONNECTED,SUCCESS,10.8.0.3,192.168.136.136 Tue Jul 19 14:21:47 2016 us=940367 TCP/UDP: Closing socket Tue Jul 19 14:21:47 2016 us=941370 C:\Windows\system32\route.exe DELETE 192.168.136.136 MASK 255.255.255.255 192.168.136.1 Tue Jul 19 14:21:47 2016 us=948390 Route deletion via IPAPI succeeded [adaptive] Tue Jul 19 14:21:47 2016 us=948390 C:\Windows\system32\route.exe DELETE 0.0.0.0 MASK 128.0.0.0 10.8.0.1 Tue Jul 19 14:21:47 2016 us=957394 Route deletion via IPAPI succeeded [adaptive] Tue Jul 19 14:21:47 2016 us=957394 C:\Windows\system32\route.exe DELETE 128.0.0.0 MASK 128.0.0.0 10.8.0.1 Tue Jul 19 14:21:47 2016 us=965405 Route deletion via IPAPI succeeded [adaptive] Tue Jul 19 14:21:47 2016 us=965405 Closing TUN/TAP interface Tue Jul 19 14:21:47 2016 us=988441 SIGTERM[hard,] received, process exiting Tue Jul 19 14:21:47 2016 us=988441 MANAGEMENT: >STATE:1468952507,EXITING,SIGTERM,,

According to the logs, everything is working as it should .. now you need to try from a remote location. I presume you have enabled IP forwarding on the server ..

I will try to access the server from a remote location. I assume I only need to modify the client IP to be the server public IP? I tried using a non-windows client (an android phone connected to the LAN using wireless - not 4G) while I SSH into the server. I noticed a lot of packets dropped. I suspect this is the case with windows clients as well. I did a little bit of searching for "multi bad source address from client packet dropped" and found a couple of promising solutions all pointing to routing problems. I am investigating those solutions now. Here is a snippet of what I saw when I run systemctl status openvpn@MyVPNsrv ● openvpn@MyVPNsrv.service - OpenVPN connection to MyVPNsrv Loaded: loaded (/etc/systemd/system/multi-user.target.wants/openvpn@MyVPNsrv.service; disabled; vendor preset: enabled) Active: active (running) since Tue 2016-07-19 14:19:34 EDT; 55min ago Docs: man:openvpn(8) https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage https://community.openvpn.net/openvpn/wiki/HOWTO Process: 3800 ExecStart=/usr/sbin/openvpn --daemon ovpn-%i --status /run/openvpn/%i.status 10 --cd /etc/openvpn --script-security 2 --config /etc/openvpn/% Main PID: 3804 (openvpn) CGroup: /system.slice/system-openvpn.slice/openvpn@MyVPNsrv.service └─3804 /usr/sbin/openvpn --daemon ovpn-MyVPNsrv --status /run/openvpn/MyVPNsrv.status 10 --cd /etc/openvpn --script-security 2 --confi Jul 19 15:14:11 Mysrv ovpn-MyVPNsrv[3804]: client2c/192.168.136.112:46606 MULTI: bad source address from client [192.168.136.112], packet dropped Jul 19 15:14:11 Mysrv ovpn-MyVPNsrv[3804]: client2c/192.168.136.112:46606 MULTI: bad source address from client [192.168.136.112], packet dropped Jul 19 15:14:11 Mysrv ovpn-MyVPNsrv[3804]: client2c/192.168.136.112:46606 MULTI: bad source address from client [192.168.136.112], packet dropped Jul 19 15:14:12 Mysrv ovpn-MyVPNsrv[3804]: client2c/192.168.136.112:46606 MULTI: bad source address from client [192.168.136.112], packet dropped Jul 19 15:14:17 Mysrv ovpn-MyVPNsrv[3804]: client2c/192.168.136.112:46606 MULTI: bad source address from client [192.168.136.112], packet dropped Jul 19 15:14:20 Mysrv ovpn-MyVPNsrv[3804]: client2c/192.168.136.112:46606 MULTI: bad source address from client [192.168.136.112], packet dropped Jul 19 15:14:27 Mysrv ovpn-MyVPNsrv[3804]: client2c/192.168.136.112:46606 MULTI: bad source address from client [192.168.136.112], packet dropped Jul 19 15:14:31 Mysrv ovpn-MyVPNsrv[3804]: client2c/192.168.136.112:46606 MULTI: bad source address from client [192.168.136.112], packet dropped Jul 19 15:14:37 Mysrv ovpn-MyVPNsrv[3804]: client2c/192.168.136.112:46606 MULTI: bad source address from client [192.168.136.112], packet dropped Jul 19 15:14:41 Mysrv ovpn-MyVPNsrv[3804]: client2c/192.168.136.112:46606 MULTI: bad source address from client [192.168.136.112], packet dropped

For now you can ignore the dropped packets .. they are packets with the source address of your eth0 not tun0 but they are sent over the VPN. In time you can add --[b]iroute[/b]'s for them, if you actually need it. See: [url=http://openvpn.net/index.php/open-source/documentation/howto.html#scope]HOWTO: Expanding the scope of the VPN to include additional machines[/url]

This morning I was able to successfully connect to my VPN using my android phone and the 4G network. Unfortunately I was still not able to load any webpages through the phone's browser while the VPN was connected. I took the following actions however could not determine that there was any problem. I appreciate any insight to the potential causes of internet traffic not loading. 1) I captured packets using tcpdump: tcpdump -i eth0 udp port 1194 tcpdump -i tun0 udp 2) I ran traceroute to my phone's VPN IP address 3) Changed MTU from 1500 to 1000 for both eth0 and tun0 - made no difference ********************* tcpdump -i eth0 udp port 1194 **************************** tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes 12:06:25.243789 IP 192.168.136.136.openvpn > 162.sub-XXX-XXX-XXX.myvzw.com.5121: UDP, length 53 12:06:29.186285 IP 162.sub-XXX-XXX-XXX.myvzw.com.5121 > 192.168.136.136.openvpn: UDP, length 53 12:06:35.225829 IP 192.168.136.136.openvpn > 162.sub-XXX-XXX-XXX.myvzw.com.5121: UDP, length 53 12:06:39.203721 IP 162.sub-XXX-XXX-XXX.myvzw.com.5121 > 192.168.136.136.openvpn: UDP, length 53 12:06:45.390503 IP 192.168.136.136.openvpn > 162.sub-XXX-XXX-XXX.myvzw.com.5121: UDP, length 53 12:06:49.187674 IP 162.sub-XXX-XXX-XXX.myvzw.com.5121 > 192.168.136.136.openvpn: UDP, length 53 ******************** tcpdump -i tun0 udp ************************** tcpdump -i tun0 udp tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on tun0, link-type RAW (Raw IP), capture size 262144 bytes 12:07:39.767832 IP 10.8.0.5.60479 > google-public-dns-a.google.com.domain: 29202+ AAAA? lgemobilewidget.accu-weather.com. (50) 12:07:44.800368 IP 10.8.0.5.47192 > google-public-dns-b.google.com.domain: 29202+ AAAA? lgemobilewidget.accu-weather.com. (50) 12:07:49.783355 IP 10.8.0.5.48116 > google-public-dns-a.google.com.domain: 11120+ A? lgemobilewidget.accu-weather.com. (50) 12:07:54.775705 IP 10.8.0.5.41108 > google-public-dns-b.google.com.domain: 11120+ A? lgemobilewidget.accu-weather.com. (50) ********* Traceroute to my phone's VPN IP address *************** traceroute to 10.8.0.5 (10.8.0.5), 30 hops max, 60 byte packets 1 192.168.136.1 (192.168.136.1) 0.689 ms 0.721 ms 1.023 ms 2 10.23.22.1 (10.23.22.1) 23.457 ms 24.814 ms 25.986 ms 3 G101-0-0-30.HRBGPA-LCR-21.verizon-gni.net (100.41.XXX.XXX) 28.219 ms !N * *

[Solved] VPN connects but no traffic

TinCanTech

Great .. thanks for letting us know 8-)

« Previous Page