Changing to "topology subnet" not working

eV1Te

If I run the server with the default topology there is no problem, all clients can communicate to the servers lan. But I would like to migrate to "topology subnet" for several reasons.

So I just added "topology subnet" to my server config without changing anything else hoping that would be enough.

But that was not the case. The clients still connect without error but they cannot communicate through the tunnel, nothing goes through, not even pings. Strangely they stay connected without error even through I have specified "keepalive 10 60".

Are there recommended guidelines for migrating to "topology subnet"?
Do I need to manually add/change new routes on the server or client for example?

Server runs on linux and clients run a mix of windows/linux/android etc.
Server config (if I comment away "topology subnet" everything works fine):

push "route 192.168.200.0 255.255.255.0"
push "route 192.168.201.0 255.255.255.0"
dev tun
management 127.0.0.1 1195
server 192.168.201.0 255.255.255.0
client-to-client

topology subnet

dh dh1024.pem
ca ca.crt
cert server.crt
key server.key

max-clients 10
comp-lzo
persist-tun
persist-key

verb 3
log-append /var/log/openvpn.log
keepalive 10 60
reneg-sec 0

plugin radiusplugin.so radiusplugin.cnf
client-cert-not-required
username-as-common-name
duplicate-cn

status /tmp/ovpn_status_2_result 30
status-version 2
proto udp6
port 1194

TinCanTech

See --log & --verb (eg: 4) in The Manual v23x

eV1Te

Sorry for not including the logs at first.
Here are client and server logs after a fresh start and reconnect of the client and server. No additional lines appear in the logs after this for at least 30 minutes, both client and server reports that the connection is just fine (even through it is not fine).

Client log after connect:

Thu Sep 22 01:34:38 2016 us=651468 Current Parameter Settings:
Thu Sep 22 01:34:38 2016 us=651468   config = 'openvpn.ovpn'
Thu Sep 22 01:34:38 2016 us=651468   mode = 0
Thu Sep 22 01:34:38 2016 us=651468   show_ciphers = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   show_digests = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   show_engines = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   genkey = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   key_pass_file = '[UNDEF]'
Thu Sep 22 01:34:38 2016 us=651468   show_tls_ciphers = DISABLED
Thu Sep 22 01:34:38 2016 us=651468 Connection profiles [default]:
Thu Sep 22 01:34:38 2016 us=651468   proto = udp
Thu Sep 22 01:34:38 2016 us=651468   local = '[UNDEF]'
Thu Sep 22 01:34:38 2016 us=651468   local_port = 1194
Thu Sep 22 01:34:38 2016 us=651468   remote = 'richardandersson.net'
Thu Sep 22 01:34:38 2016 us=651468   remote_port = 1194
Thu Sep 22 01:34:38 2016 us=651468   remote_float = ENABLED
Thu Sep 22 01:34:38 2016 us=651468   bind_defined = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   bind_local = ENABLED
Thu Sep 22 01:34:38 2016 us=651468   connect_retry_seconds = 5
Thu Sep 22 01:34:38 2016 us=651468   connect_timeout = 10
Thu Sep 22 01:34:38 2016 us=651468   connect_retry_max = 0
Thu Sep 22 01:34:38 2016 us=651468   socks_proxy_server = '[UNDEF]'
Thu Sep 22 01:34:38 2016 us=651468   socks_proxy_port = 0
Thu Sep 22 01:34:38 2016 us=651468   socks_proxy_retry = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   tun_mtu = 1500
Thu Sep 22 01:34:38 2016 us=651468   tun_mtu_defined = ENABLED
Thu Sep 22 01:34:38 2016 us=651468   link_mtu = 1500
Thu Sep 22 01:34:38 2016 us=651468   link_mtu_defined = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   tun_mtu_extra = 0
Thu Sep 22 01:34:38 2016 us=651468   tun_mtu_extra_defined = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   mtu_discover_type = -1
Thu Sep 22 01:34:38 2016 us=651468   fragment = 0
Thu Sep 22 01:34:38 2016 us=651468   mssfix = 1450
Thu Sep 22 01:34:38 2016 us=651468   explicit_exit_notification = 0
Thu Sep 22 01:34:38 2016 us=651468 Connection profiles END
Thu Sep 22 01:34:38 2016 us=651468   remote_random = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   ipchange = '[UNDEF]'
Thu Sep 22 01:34:38 2016 us=651468   dev = 'tun'
Thu Sep 22 01:34:38 2016 us=651468   dev_type = '[UNDEF]'
Thu Sep 22 01:34:38 2016 us=651468   dev_node = '[UNDEF]'
Thu Sep 22 01:34:38 2016 us=651468   lladdr = '[UNDEF]'
Thu Sep 22 01:34:38 2016 us=651468   topology = 1
Thu Sep 22 01:34:38 2016 us=651468   tun_ipv6 = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   ifconfig_local = '[UNDEF]'
Thu Sep 22 01:34:38 2016 us=651468   ifconfig_remote_netmask = '[UNDEF]'
Thu Sep 22 01:34:38 2016 us=651468   ifconfig_noexec = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   ifconfig_nowarn = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   ifconfig_ipv6_local = '[UNDEF]'
Thu Sep 22 01:34:38 2016 us=651468   ifconfig_ipv6_netbits = 0
Thu Sep 22 01:34:38 2016 us=651468   ifconfig_ipv6_remote = '[UNDEF]'
Thu Sep 22 01:34:38 2016 us=651468   shaper = 0
Thu Sep 22 01:34:38 2016 us=651468   mtu_test = 0
Thu Sep 22 01:34:38 2016 us=651468   mlock = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   keepalive_ping = 10
Thu Sep 22 01:34:38 2016 us=651468   keepalive_timeout = 60
Thu Sep 22 01:34:38 2016 us=651468   inactivity_timeout = 0
Thu Sep 22 01:34:38 2016 us=651468   ping_send_timeout = 10
Thu Sep 22 01:34:38 2016 us=651468   ping_rec_timeout = 60
Thu Sep 22 01:34:38 2016 us=651468   ping_rec_timeout_action = 2
Thu Sep 22 01:34:38 2016 us=651468   ping_timer_remote = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   remap_sigusr1 = 0
Thu Sep 22 01:34:38 2016 us=651468   persist_tun = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   persist_local_ip = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   persist_remote_ip = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   persist_key = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   passtos = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   resolve_retry_seconds = 1000000000
Thu Sep 22 01:34:38 2016 us=651468   username = '[UNDEF]'
Thu Sep 22 01:34:38 2016 us=651468   groupname = '[UNDEF]'
Thu Sep 22 01:34:38 2016 us=651468   chroot_dir = '[UNDEF]'
Thu Sep 22 01:34:38 2016 us=651468   cd_dir = '[UNDEF]'
Thu Sep 22 01:34:38 2016 us=651468   writepid = '[UNDEF]'
Thu Sep 22 01:34:38 2016 us=651468   up_script = '[UNDEF]'
Thu Sep 22 01:34:38 2016 us=651468   down_script = '[UNDEF]'
Thu Sep 22 01:34:38 2016 us=651468   down_pre = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   up_restart = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   up_delay = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   daemon = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   inetd = 0
Thu Sep 22 01:34:38 2016 us=651468   log = ENABLED
Thu Sep 22 01:34:38 2016 us=651468   suppress_timestamps = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   nice = 0
Thu Sep 22 01:34:38 2016 us=651468   verbosity = 4
Thu Sep 22 01:34:38 2016 us=651468   mute = 0
Thu Sep 22 01:34:38 2016 us=651468   gremlin = 0
Thu Sep 22 01:34:38 2016 us=651468   status_file = '[UNDEF]'
Thu Sep 22 01:34:38 2016 us=651468   status_file_version = 1
Thu Sep 22 01:34:38 2016 us=651468   status_file_update_freq = 60
Thu Sep 22 01:34:38 2016 us=651468   occ = ENABLED
Thu Sep 22 01:34:38 2016 us=651468   rcvbuf = 0
Thu Sep 22 01:34:38 2016 us=651468   sndbuf = 0
Thu Sep 22 01:34:38 2016 us=651468   sockflags = 0
Thu Sep 22 01:34:38 2016 us=651468   fast_io = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   lzo = 7
Thu Sep 22 01:34:38 2016 us=651468   route_script = '[UNDEF]'
Thu Sep 22 01:34:38 2016 us=651468   route_default_gateway = '[UNDEF]'
Thu Sep 22 01:34:38 2016 us=651468   route_default_metric = 1000
Thu Sep 22 01:34:38 2016 us=651468   route_noexec = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   route_delay = 5
Thu Sep 22 01:34:38 2016 us=651468   route_delay_window = 30
Thu Sep 22 01:34:38 2016 us=651468   route_delay_defined = ENABLED
Thu Sep 22 01:34:38 2016 us=651468   route_nopull = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   route_gateway_via_dhcp = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   max_routes = 100
Thu Sep 22 01:34:38 2016 us=651468   allow_pull_fqdn = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   route 0.0.0.0/0.0.0.0/nil/nil
Thu Sep 22 01:34:38 2016 us=651468   management_addr = '[UNDEF]'
Thu Sep 22 01:34:38 2016 us=651468   management_port = 0
Thu Sep 22 01:34:38 2016 us=651468   management_user_pass = '[UNDEF]'
Thu Sep 22 01:34:38 2016 us=651468   management_log_history_cache = 250
Thu Sep 22 01:34:38 2016 us=651468   management_echo_buffer_size = 100
Thu Sep 22 01:34:38 2016 us=651468   management_write_peer_info_file = '[UNDEF]'
Thu Sep 22 01:34:38 2016 us=651468   management_client_user = '[UNDEF]'
Thu Sep 22 01:34:38 2016 us=651468   management_client_group = '[UNDEF]'
Thu Sep 22 01:34:38 2016 us=651468   management_flags = 0
Thu Sep 22 01:34:38 2016 us=651468   shared_secret_file = '[UNDEF]'
Thu Sep 22 01:34:38 2016 us=651468   key_direction = 0
Thu Sep 22 01:34:38 2016 us=651468   ciphername_defined = ENABLED
Thu Sep 22 01:34:38 2016 us=651468   ciphername = 'BF-CBC'
Thu Sep 22 01:34:38 2016 us=651468   authname_defined = ENABLED
Thu Sep 22 01:34:38 2016 us=651468   authname = 'SHA1'
Thu Sep 22 01:34:38 2016 us=651468   prng_hash = 'SHA1'
Thu Sep 22 01:34:38 2016 us=651468   prng_nonce_secret_len = 16
Thu Sep 22 01:34:38 2016 us=651468   keysize = 0
Thu Sep 22 01:34:38 2016 us=651468   engine = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   replay = ENABLED
Thu Sep 22 01:34:38 2016 us=651468   mute_replay_warnings = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   replay_window = 64
Thu Sep 22 01:34:38 2016 us=651468   replay_time = 15
Thu Sep 22 01:34:38 2016 us=651468   packet_id_file = '[UNDEF]'
Thu Sep 22 01:34:38 2016 us=651468   use_iv = ENABLED
Thu Sep 22 01:34:38 2016 us=651468   test_crypto = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   tls_server = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   tls_client = ENABLED
Thu Sep 22 01:34:38 2016 us=651468   key_method = 2
Thu Sep 22 01:34:38 2016 us=651468   ca_file = 'ca.crt'
Thu Sep 22 01:34:38 2016 us=651468   ca_path = '[UNDEF]'
Thu Sep 22 01:34:38 2016 us=651468   dh_file = '[UNDEF]'
Thu Sep 22 01:34:38 2016 us=651468   cert_file = '[UNDEF]'
Thu Sep 22 01:34:38 2016 us=651468   extra_certs_file = '[UNDEF]'
Thu Sep 22 01:34:38 2016 us=651468   priv_key_file = '[UNDEF]'
Thu Sep 22 01:34:38 2016 us=651468   pkcs12_file = '[UNDEF]'
Thu Sep 22 01:34:38 2016 us=651468   cryptoapi_cert = '[UNDEF]'
Thu Sep 22 01:34:38 2016 us=651468   cipher_list = '[UNDEF]'
Thu Sep 22 01:34:38 2016 us=651468   tls_verify = '[UNDEF]'
Thu Sep 22 01:34:38 2016 us=651468   tls_export_cert = '[UNDEF]'
Thu Sep 22 01:34:38 2016 us=651468   verify_x509_type = 0
Thu Sep 22 01:34:38 2016 us=651468   verify_x509_name = '[UNDEF]'
Thu Sep 22 01:34:38 2016 us=651468   crl_file = '[UNDEF]'
Thu Sep 22 01:34:38 2016 us=651468   ns_cert_type = 0
Thu Sep 22 01:34:38 2016 us=651468   remote_cert_ku[i] = 0
Thu Sep 22 01:34:38 2016 us=651468   remote_cert_ku[i] = 0
Thu Sep 22 01:34:38 2016 us=651468   remote_cert_ku[i] = 0
Thu Sep 22 01:34:38 2016 us=651468   remote_cert_ku[i] = 0
Thu Sep 22 01:34:38 2016 us=651468   remote_cert_ku[i] = 0
Thu Sep 22 01:34:38 2016 us=651468   remote_cert_ku[i] = 0
Thu Sep 22 01:34:38 2016 us=651468   remote_cert_ku[i] = 0
Thu Sep 22 01:34:38 2016 us=651468   remote_cert_ku[i] = 0
Thu Sep 22 01:34:38 2016 us=651468   remote_cert_ku[i] = 0
Thu Sep 22 01:34:38 2016 us=651468   remote_cert_ku[i] = 0
Thu Sep 22 01:34:38 2016 us=651468   remote_cert_ku[i] = 0
Thu Sep 22 01:34:38 2016 us=651468   remote_cert_ku[i] = 0
Thu Sep 22 01:34:38 2016 us=651468   remote_cert_ku[i] = 0
Thu Sep 22 01:34:38 2016 us=651468   remote_cert_ku[i] = 0
Thu Sep 22 01:34:38 2016 us=651468   remote_cert_ku[i] = 0
Thu Sep 22 01:34:38 2016 us=651468   remote_cert_ku[i] = 0
Thu Sep 22 01:34:38 2016 us=651468   remote_cert_eku = '[UNDEF]'
Thu Sep 22 01:34:38 2016 us=651468   ssl_flags = 0
Thu Sep 22 01:34:38 2016 us=651468   tls_timeout = 2
Thu Sep 22 01:34:38 2016 us=651468   renegotiate_bytes = 0
Thu Sep 22 01:34:38 2016 us=651468   renegotiate_packets = 0
Thu Sep 22 01:34:38 2016 us=651468   renegotiate_seconds = 3600
Thu Sep 22 01:34:38 2016 us=651468   handshake_window = 60
Thu Sep 22 01:34:38 2016 us=651468   transition_window = 3600
Thu Sep 22 01:34:38 2016 us=651468   single_session = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   push_peer_info = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   tls_exit = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   tls_auth_file = '[UNDEF]'
Thu Sep 22 01:34:38 2016 us=651468   pkcs11_protected_authentication = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   pkcs11_protected_authentication = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   pkcs11_protected_authentication = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   pkcs11_protected_authentication = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   pkcs11_protected_authentication = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   pkcs11_protected_authentication = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   pkcs11_protected_authentication = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   pkcs11_protected_authentication = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   pkcs11_protected_authentication = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   pkcs11_protected_authentication = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   pkcs11_protected_authentication = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   pkcs11_protected_authentication = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   pkcs11_protected_authentication = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   pkcs11_protected_authentication = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   pkcs11_protected_authentication = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   pkcs11_protected_authentication = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   pkcs11_private_mode = 00000000
Thu Sep 22 01:34:38 2016 us=651468   pkcs11_private_mode = 00000000
Thu Sep 22 01:34:38 2016 us=651468   pkcs11_private_mode = 00000000
Thu Sep 22 01:34:38 2016 us=651468   pkcs11_private_mode = 00000000
Thu Sep 22 01:34:38 2016 us=651468   pkcs11_private_mode = 00000000
Thu Sep 22 01:34:38 2016 us=651468   pkcs11_private_mode = 00000000
Thu Sep 22 01:34:38 2016 us=651468   pkcs11_private_mode = 00000000
Thu Sep 22 01:34:38 2016 us=651468   pkcs11_private_mode = 00000000
Thu Sep 22 01:34:38 2016 us=651468   pkcs11_private_mode = 00000000
Thu Sep 22 01:34:38 2016 us=651468   pkcs11_private_mode = 00000000
Thu Sep 22 01:34:38 2016 us=651468   pkcs11_private_mode = 00000000
Thu Sep 22 01:34:38 2016 us=651468   pkcs11_private_mode = 00000000
Thu Sep 22 01:34:38 2016 us=651468   pkcs11_private_mode = 00000000
Thu Sep 22 01:34:38 2016 us=651468   pkcs11_private_mode = 00000000
Thu Sep 22 01:34:38 2016 us=651468   pkcs11_private_mode = 00000000
Thu Sep 22 01:34:38 2016 us=651468   pkcs11_private_mode = 00000000
Thu Sep 22 01:34:38 2016 us=651468   pkcs11_cert_private = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   pkcs11_cert_private = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   pkcs11_cert_private = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   pkcs11_cert_private = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   pkcs11_cert_private = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   pkcs11_cert_private = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   pkcs11_cert_private = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   pkcs11_cert_private = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   pkcs11_cert_private = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   pkcs11_cert_private = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   pkcs11_cert_private = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   pkcs11_cert_private = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   pkcs11_cert_private = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   pkcs11_cert_private = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   pkcs11_cert_private = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   pkcs11_cert_private = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   pkcs11_pin_cache_period = -1
Thu Sep 22 01:34:38 2016 us=651468   pkcs11_id = '[UNDEF]'
Thu Sep 22 01:34:38 2016 us=651468   pkcs11_id_management = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   server_network = 0.0.0.0
Thu Sep 22 01:34:38 2016 us=651468   server_netmask = 0.0.0.0
Thu Sep 22 01:34:38 2016 us=651468   server_network_ipv6 = ::
Thu Sep 22 01:34:38 2016 us=651468   server_netbits_ipv6 = 0
Thu Sep 22 01:34:38 2016 us=651468   server_bridge_ip = 0.0.0.0
Thu Sep 22 01:34:38 2016 us=651468   server_bridge_netmask = 0.0.0.0
Thu Sep 22 01:34:38 2016 us=651468   server_bridge_pool_start = 0.0.0.0
Thu Sep 22 01:34:38 2016 us=651468   server_bridge_pool_end = 0.0.0.0
Thu Sep 22 01:34:38 2016 us=651468   ifconfig_pool_defined = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   ifconfig_pool_start = 0.0.0.0
Thu Sep 22 01:34:38 2016 us=651468   ifconfig_pool_end = 0.0.0.0
Thu Sep 22 01:34:38 2016 us=651468   ifconfig_pool_netmask = 0.0.0.0
Thu Sep 22 01:34:38 2016 us=651468   ifconfig_pool_persist_filename = '[UNDEF]'
Thu Sep 22 01:34:38 2016 us=651468   ifconfig_pool_persist_refresh_freq = 600
Thu Sep 22 01:34:38 2016 us=651468   ifconfig_ipv6_pool_defined = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   ifconfig_ipv6_pool_base = ::
Thu Sep 22 01:34:38 2016 us=651468   ifconfig_ipv6_pool_netbits = 0
Thu Sep 22 01:34:38 2016 us=651468   n_bcast_buf = 256
Thu Sep 22 01:34:38 2016 us=651468   tcp_queue_limit = 64
Thu Sep 22 01:34:38 2016 us=651468   real_hash_size = 256
Thu Sep 22 01:34:38 2016 us=651468   virtual_hash_size = 256
Thu Sep 22 01:34:38 2016 us=651468   client_connect_script = '[UNDEF]'
Thu Sep 22 01:34:38 2016 us=651468   learn_address_script = '[UNDEF]'
Thu Sep 22 01:34:38 2016 us=651468   client_disconnect_script = '[UNDEF]'
Thu Sep 22 01:34:38 2016 us=651468   client_config_dir = '[UNDEF]'
Thu Sep 22 01:34:38 2016 us=651468   ccd_exclusive = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   tmp_dir = 'C:\WINDOWS\TEMP\'
Thu Sep 22 01:34:38 2016 us=651468   push_ifconfig_defined = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   push_ifconfig_local = 0.0.0.0
Thu Sep 22 01:34:38 2016 us=651468   push_ifconfig_remote_netmask = 0.0.0.0
Thu Sep 22 01:34:38 2016 us=651468   push_ifconfig_ipv6_defined = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   push_ifconfig_ipv6_local = ::/0
Thu Sep 22 01:34:38 2016 us=651468   push_ifconfig_ipv6_remote = ::
Thu Sep 22 01:34:38 2016 us=651468   enable_c2c = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   duplicate_cn = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   cf_max = 0
Thu Sep 22 01:34:38 2016 us=651468   cf_per = 0
Thu Sep 22 01:34:38 2016 us=651468   max_clients = 1024
Thu Sep 22 01:34:38 2016 us=651468   max_routes_per_client = 256
Thu Sep 22 01:34:38 2016 us=651468   auth_user_pass_verify_script = '[UNDEF]'
Thu Sep 22 01:34:38 2016 us=651468   auth_user_pass_verify_script_via_file = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   client = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   pull = ENABLED
Thu Sep 22 01:34:38 2016 us=651468   auth_user_pass_file = 'login.ini'
Thu Sep 22 01:34:38 2016 us=651468   show_net_up = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   route_method = 0
Thu Sep 22 01:34:38 2016 us=651468   block_outside_dns = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   ip_win32_defined = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   ip_win32_type = 3
Thu Sep 22 01:34:38 2016 us=651468   dhcp_masq_offset = 0
Thu Sep 22 01:34:38 2016 us=651468   dhcp_lease_time = 31536000
Thu Sep 22 01:34:38 2016 us=651468   tap_sleep = 0
Thu Sep 22 01:34:38 2016 us=651468   dhcp_options = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   dhcp_renew = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   dhcp_pre_release = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   dhcp_release = DISABLED
Thu Sep 22 01:34:38 2016 us=651468   domain = '[UNDEF]'
Thu Sep 22 01:34:38 2016 us=651468   netbios_scope = '[UNDEF]'
Thu Sep 22 01:34:38 2016 us=651468   netbios_node_type = 0
Thu Sep 22 01:34:38 2016 us=651468   disable_nbt = DISABLED
Thu Sep 22 01:34:38 2016 us=651468 OpenVPN 2.3.11 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on May 10 2016
Thu Sep 22 01:34:38 2016 us=651468 Windows version 6.2 (Windows 8 or greater) 64bit
Thu Sep 22 01:34:38 2016 us=651468 library versions: OpenSSL 1.0.1t  3 May 2016, LZO 2.09
Thu Sep 22 01:34:38 2016 us=651468 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Thu Sep 22 01:34:38 2016 us=751483 LZO compression initialized
Thu Sep 22 01:34:38 2016 us=751483 Control Channel MTU parms [ L:1542 D:1212 EF:38 EB:0 ET:0 EL:3 ]
Thu Sep 22 01:34:38 2016 us=751483 Socket Buffers: R=[65536->65536] S=[65536->65536]
Thu Sep 22 01:34:38 2016 us=751483 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:143 ET:0 EL:3 AF:3/1 ]
Thu Sep 22 01:34:38 2016 us=751483 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Thu Sep 22 01:34:38 2016 us=751483 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Thu Sep 22 01:34:38 2016 us=751483 Local Options hash (VER=V4): '41690919'
Thu Sep 22 01:34:38 2016 us=751483 Expected Remote Options hash (VER=V4): '530fdded'
Thu Sep 22 01:34:38 2016 us=751483 UDPv4 link local (bound): [undef]
Thu Sep 22 01:34:38 2016 us=751483 UDPv4 link remote: [AF_INET]213.213.213.213:1194
Thu Sep 22 01:34:38 2016 us=761492 TLS Error: local/remote TLS keys are out of sync: [AF_INET]213.213.213.213:1194 [0]
Thu Sep 22 01:34:38 2016 us=761492 TLS: Initial packet from [AF_INET]213.213.213.213:1194, sid=a0ac8357 b7995905
Thu Sep 22 01:34:38 2016 us=761492 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Thu Sep 22 01:34:38 2016 us=791491 VERIFY OK: depth=1, C=TW, ST=Taiwan, L=Taipei, O=Synology Inc., OU=Certificate Authority, CN=Synology Inc. CA, emailAddress=product@synology.com
Thu Sep 22 01:34:38 2016 us=791491 VERIFY OK: depth=0, C=TW, ST=Taiwan, L=Taipei, O=Synology Inc., OU=FTP Team, CN=synology.com, emailAddress=product@synology.com
Thu Sep 22 01:34:39 2016 us=51474 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Sep 22 01:34:39 2016 us=51474 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Sep 22 01:34:39 2016 us=51474 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Sep 22 01:34:39 2016 us=51474 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Sep 22 01:34:39 2016 us=51474 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 1024 bit RSA
Thu Sep 22 01:34:39 2016 us=51474 [synology.com] Peer Connection Initiated with [AF_INET]213.213.213.213:1194
Thu Sep 22 01:34:41 2016 us=93810 SENT CONTROL [synology.com]: 'PUSH_REQUEST' (status=1)
Thu Sep 22 01:34:41 2016 us=113811 PUSH: Received control message: 'PUSH_REPLY,route 192.168.200.0 255.255.255.0,route 192.168.201.0 255.255.255.0,route-gateway 192.168.201.1,topology subnet,ping 10,ping-restart 60,ifconfig 192.168.201.2 255.255.255.0'
Thu Sep 22 01:34:41 2016 us=113811 OPTIONS IMPORT: timers and/or timeouts modified
Thu Sep 22 01:34:41 2016 us=113811 OPTIONS IMPORT: --ifconfig/up options modified
Thu Sep 22 01:34:41 2016 us=113811 OPTIONS IMPORT: route options modified
Thu Sep 22 01:34:41 2016 us=113811 OPTIONS IMPORT: route-related options modified
Thu Sep 22 01:34:41 2016 us=113811 ROUTE_GATEWAY 130.237.78.1/255.255.255.0 I=9 HWADDR=c8:2a:14:09:ab:eb
Thu Sep 22 01:34:41 2016 us=113811 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Thu Sep 22 01:34:41 2016 us=113811 open_tun, tt->ipv6=0
Thu Sep 22 01:34:41 2016 us=113811 TAP-WIN32 device [TAP] opened: \\.\Global\{397C04C1-76B2-4746-9D78-E47D6EFD5DBD}.tap
Thu Sep 22 01:34:41 2016 us=113811 TAP-Windows Driver Version 9.21 
Thu Sep 22 01:34:41 2016 us=113811 TAP-Windows MTU=1500
Thu Sep 22 01:34:41 2016 us=113811 Set TAP-Windows TUN subnet mode network/local/netmask = 192.168.201.0/192.168.201.2/255.255.255.0 [SUCCEEDED]
Thu Sep 22 01:34:41 2016 us=113811 Notified TAP-Windows driver to set a DHCP IP/netmask of 192.168.201.2/255.255.255.0 on interface {397C04C1-76B2-4746-9D78-E47D6EFD5DBD} [DHCP-serv: 192.168.201.254, lease-time: 31536000]
Thu Sep 22 01:34:41 2016 us=113811 Successful ARP Flush on interface [6] {397C04C1-76B2-4746-9D78-E47D6EFD5DBD}
Thu Sep 22 01:34:46 2016 us=590968 TEST ROUTES: 3/3 succeeded len=3 ret=1 a=0 u/d=up
Thu Sep 22 01:34:46 2016 us=590968 C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 0.0.0.0 192.168.201.1 METRIC 1000
Thu Sep 22 01:34:46 2016 us=604973 Route addition via IPAPI succeeded [adaptive]
Thu Sep 22 01:34:46 2016 us=605474 C:\WINDOWS\system32\route.exe ADD 192.168.200.0 MASK 255.255.255.0 192.168.201.1 METRIC 1000
Thu Sep 22 01:34:46 2016 us=610977 Route addition via IPAPI succeeded [adaptive]
Thu Sep 22 01:34:46 2016 us=610977 C:\WINDOWS\system32\route.exe ADD 192.168.201.0 MASK 255.255.255.0 192.168.201.1 METRIC 1000
Thu Sep 22 01:34:46 2016 us=620987 Route addition via IPAPI succeeded [adaptive]
Thu Sep 22 01:34:46 2016 us=620987 Initialization Sequence Completed

Server log:

Thu Sep 22 01:41:38 2016 us=966039 Current Parameter Settings:
Thu Sep 22 01:41:38 2016 us=966388   config = 'openvpn.conf.user'
Thu Sep 22 01:41:38 2016 us=966456   mode = 1
Thu Sep 22 01:41:38 2016 us=966504   persist_config = DISABLED
Thu Sep 22 01:41:38 2016 us=966549   persist_mode = 1
Thu Sep 22 01:41:38 2016 us=966594   show_ciphers = DISABLED
Thu Sep 22 01:41:38 2016 us=966638   show_digests = DISABLED
Thu Sep 22 01:41:38 2016 us=966681   show_engines = DISABLED
Thu Sep 22 01:41:38 2016 us=966725   genkey = DISABLED
Thu Sep 22 01:41:38 2016 us=966768   key_pass_file = '[UNDEF]'
Thu Sep 22 01:41:38 2016 us=966811   show_tls_ciphers = DISABLED
Thu Sep 22 01:41:38 2016 us=966856 Connection profiles [default]:
Thu Sep 22 01:41:38 2016 us=966902   proto = udp6
Thu Sep 22 01:41:38 2016 us=966945   local = '[UNDEF]'
Thu Sep 22 01:41:38 2016 us=966989   local_port = 1194
Thu Sep 22 01:41:38 2016 us=967031   remote = '[UNDEF]'
Thu Sep 22 01:41:38 2016 us=967074   remote_port = 1194
Thu Sep 22 01:41:38 2016 us=967118   remote_float = DISABLED
Thu Sep 22 01:41:38 2016 us=967161   bind_defined = DISABLED
Thu Sep 22 01:41:38 2016 us=967204   bind_local = ENABLED
Thu Sep 22 01:41:38 2016 us=967248   connect_retry_seconds = 5
Thu Sep 22 01:41:38 2016 us=967292   connect_timeout = 10
Thu Sep 22 01:41:38 2016 us=967347   connect_retry_max = 0
Thu Sep 22 01:41:38 2016 us=967393   socks_proxy_server = '[UNDEF]'
Thu Sep 22 01:41:38 2016 us=967438   socks_proxy_port = 0
Thu Sep 22 01:41:38 2016 us=967481   socks_proxy_retry = DISABLED
Thu Sep 22 01:41:38 2016 us=967525   tun_mtu = 1500
Thu Sep 22 01:41:38 2016 us=967568   tun_mtu_defined = ENABLED
Thu Sep 22 01:41:38 2016 us=967612   link_mtu = 1500
Thu Sep 22 01:41:38 2016 us=967655   link_mtu_defined = DISABLED
Thu Sep 22 01:41:38 2016 us=967699   tun_mtu_extra = 0
Thu Sep 22 01:41:38 2016 us=967742   tun_mtu_extra_defined = DISABLED
Thu Sep 22 01:41:38 2016 us=967785   mtu_discover_type = -1
Thu Sep 22 01:41:38 2016 us=967828   fragment = 0
Thu Sep 22 01:41:38 2016 us=967871   mssfix = 1450
Thu Sep 22 01:41:38 2016 us=967914   explicit_exit_notification = 0
Thu Sep 22 01:41:38 2016 us=967957 Connection profiles END
Thu Sep 22 01:41:38 2016 us=968001   remote_random = DISABLED
Thu Sep 22 01:41:38 2016 us=968044   ipchange = '[UNDEF]'
Thu Sep 22 01:41:38 2016 us=968087   dev = 'tun'
Thu Sep 22 01:41:38 2016 us=968130   dev_type = '[UNDEF]'
Thu Sep 22 01:41:38 2016 us=968173   dev_node = '[UNDEF]'
Thu Sep 22 01:41:38 2016 us=968216   lladdr = '[UNDEF]'
Thu Sep 22 01:41:38 2016 us=968259   topology = 3
Thu Sep 22 01:41:38 2016 us=968302   tun_ipv6 = DISABLED
Thu Sep 22 01:41:38 2016 us=968345   ifconfig_local = '192.168.201.1'
Thu Sep 22 01:41:38 2016 us=968389   ifconfig_remote_netmask = '255.255.255.0'
Thu Sep 22 01:41:38 2016 us=968432   ifconfig_noexec = DISABLED
Thu Sep 22 01:41:38 2016 us=968475   ifconfig_nowarn = DISABLED
Thu Sep 22 01:41:38 2016 us=968518   ifconfig_ipv6_local = '[UNDEF]'
Thu Sep 22 01:41:38 2016 us=968562   ifconfig_ipv6_netbits = 0
Thu Sep 22 01:41:38 2016 us=968605   ifconfig_ipv6_remote = '[UNDEF]'
Thu Sep 22 01:41:38 2016 us=968648   shaper = 0
Thu Sep 22 01:41:38 2016 us=968692   mtu_test = 0
Thu Sep 22 01:41:38 2016 us=968735   mlock = DISABLED
Thu Sep 22 01:41:38 2016 us=968779   keepalive_ping = 10
Thu Sep 22 01:41:38 2016 us=968822   keepalive_timeout = 60
Thu Sep 22 01:41:38 2016 us=968865   inactivity_timeout = 0
Thu Sep 22 01:41:38 2016 us=968909   ping_send_timeout = 10
Thu Sep 22 01:41:38 2016 us=968953   ping_rec_timeout = 120
Thu Sep 22 01:41:38 2016 us=968996   ping_rec_timeout_action = 2
Thu Sep 22 01:41:38 2016 us=969044   ping_timer_remote = DISABLED
Thu Sep 22 01:41:38 2016 us=969100   remap_sigusr1 = 0
Thu Sep 22 01:41:38 2016 us=969146   persist_tun = ENABLED
Thu Sep 22 01:41:38 2016 us=969190   persist_local_ip = DISABLED
Thu Sep 22 01:41:38 2016 us=969234   persist_remote_ip = DISABLED
Thu Sep 22 01:41:38 2016 us=969277   persist_key = ENABLED
Thu Sep 22 01:41:38 2016 us=969323   passtos = DISABLED
Thu Sep 22 01:41:38 2016 us=969370   resolve_retry_seconds = 1000000000
Thu Sep 22 01:41:38 2016 us=969433   username = '[UNDEF]'
Thu Sep 22 01:41:38 2016 us=969479   groupname = '[UNDEF]'
Thu Sep 22 01:41:38 2016 us=969523   chroot_dir = '[UNDEF]'
Thu Sep 22 01:41:38 2016 us=969567   cd_dir = '/usr/syno/etc/packages/VPNCenter/openvpn'
Thu Sep 22 01:41:38 2016 us=969611   writepid = '/var/run/ovpn_server.pid'
Thu Sep 22 01:41:38 2016 us=969654   up_script = '[UNDEF]'
Thu Sep 22 01:41:38 2016 us=969698   down_script = '[UNDEF]'
Thu Sep 22 01:41:38 2016 us=969741   down_pre = DISABLED
Thu Sep 22 01:41:38 2016 us=969784   up_restart = DISABLED
Thu Sep 22 01:41:38 2016 us=969827   up_delay = DISABLED
Thu Sep 22 01:41:38 2016 us=969870   daemon = ENABLED
Thu Sep 22 01:41:38 2016 us=969913   inetd = 0
Thu Sep 22 01:41:38 2016 us=969956   log = ENABLED
Thu Sep 22 01:41:38 2016 us=969999   suppress_timestamps = DISABLED
Thu Sep 22 01:41:38 2016 us=970042   nice = 0
Thu Sep 22 01:41:38 2016 us=970086   verbosity = 4
Thu Sep 22 01:41:38 2016 us=970129   mute = 0
Thu Sep 22 01:41:38 2016 us=970173   gremlin = 0
Thu Sep 22 01:41:38 2016 us=970216   status_file = '/tmp/ovpn_status_2_result'
Thu Sep 22 01:41:38 2016 us=970260   status_file_version = 2
Thu Sep 22 01:41:38 2016 us=970304   status_file_update_freq = 30
Thu Sep 22 01:41:38 2016 us=970347   occ = ENABLED
Thu Sep 22 01:41:38 2016 us=970390   rcvbuf = 0
Thu Sep 22 01:41:38 2016 us=970433   sndbuf = 0
Thu Sep 22 01:41:38 2016 us=970476   mark = 0
Thu Sep 22 01:41:38 2016 us=970519   sockflags = 0
Thu Sep 22 01:41:38 2016 us=970562   fast_io = DISABLED
Thu Sep 22 01:41:38 2016 us=970606   lzo = 7
Thu Sep 22 01:41:38 2016 us=970648   route_script = '[UNDEF]'
Thu Sep 22 01:41:38 2016 us=970692   route_default_gateway = '192.168.201.2'
Thu Sep 22 01:41:38 2016 us=970736   route_default_metric = 0
Thu Sep 22 01:41:38 2016 us=970780   route_noexec = DISABLED
Thu Sep 22 01:41:38 2016 us=970824   route_delay = 0
Thu Sep 22 01:41:38 2016 us=970868   route_delay_window = 30
Thu Sep 22 01:41:38 2016 us=970912   route_delay_defined = DISABLED
Thu Sep 22 01:41:38 2016 us=970956   route_nopull = DISABLED
Thu Sep 22 01:41:38 2016 us=971000   route_gateway_via_dhcp = DISABLED
Thu Sep 22 01:41:38 2016 us=971044   max_routes = 100
Thu Sep 22 01:41:38 2016 us=971088   allow_pull_fqdn = DISABLED
Thu Sep 22 01:41:38 2016 us=971132   management_addr = '127.0.0.1'
Thu Sep 22 01:41:38 2016 us=971178   management_port = 1195
Thu Sep 22 01:41:38 2016 us=971223   management_user_pass = '[UNDEF]'
Thu Sep 22 01:41:38 2016 us=971269   management_log_history_cache = 250
Thu Sep 22 01:41:38 2016 us=971313   management_echo_buffer_size = 100
Thu Sep 22 01:41:38 2016 us=971357   management_write_peer_info_file = '[UNDEF]'
Thu Sep 22 01:41:38 2016 us=971401   management_client_user = '[UNDEF]'
Thu Sep 22 01:41:38 2016 us=971446   management_client_group = '[UNDEF]'
Thu Sep 22 01:41:38 2016 us=971490   management_flags = 0
Thu Sep 22 01:41:38 2016 us=971542   plugin[0] /var/packages/VPNCenter/target/lib/radiusplugin.so '[/var/packages/VPNCenter/target/lib/radiusplugin.so] [/var/packages/VPNCenter/target/etc/openvpn/radiusplugin.cnf]'
Thu Sep 22 01:41:38 2016 us=971589   shared_secret_file = '[UNDEF]'
Thu Sep 22 01:41:38 2016 us=971634   key_direction = 0
Thu Sep 22 01:41:38 2016 us=971678   ciphername_defined = ENABLED
Thu Sep 22 01:41:38 2016 us=971722   ciphername = 'BF-CBC'
Thu Sep 22 01:41:38 2016 us=971766   authname_defined = ENABLED
Thu Sep 22 01:41:38 2016 us=971809   authname = 'SHA1'
Thu Sep 22 01:41:38 2016 us=971853   prng_hash = 'SHA1'
Thu Sep 22 01:41:38 2016 us=971897   prng_nonce_secret_len = 16
Thu Sep 22 01:41:38 2016 us=971942   keysize = 0
Thu Sep 22 01:41:38 2016 us=971986   engine = DISABLED
Thu Sep 22 01:41:38 2016 us=972030   replay = ENABLED
Thu Sep 22 01:41:38 2016 us=972073   mute_replay_warnings = DISABLED
Thu Sep 22 01:41:38 2016 us=972117   replay_window = 64
Thu Sep 22 01:41:38 2016 us=972162   replay_time = 15
Thu Sep 22 01:41:38 2016 us=972205   packet_id_file = '[UNDEF]'
Thu Sep 22 01:41:38 2016 us=972249   use_iv = ENABLED
Thu Sep 22 01:41:38 2016 us=972309   test_crypto = DISABLED
Thu Sep 22 01:41:38 2016 us=972355   tls_server = ENABLED
Thu Sep 22 01:41:38 2016 us=972399   tls_client = DISABLED
Thu Sep 22 01:41:38 2016 us=972443   key_method = 2
Thu Sep 22 01:41:38 2016 us=972489   ca_file = '/var/packages/VPNCenter/target/etc/openvpn/keys/ca.crt'
Thu Sep 22 01:41:38 2016 us=972532   ca_path = '[UNDEF]'
Thu Sep 22 01:41:38 2016 us=972577   dh_file = '/var/packages/VPNCenter/target/etc/openvpn/keys/dh1024.pem'
Thu Sep 22 01:41:38 2016 us=972622   cert_file = '/var/packages/VPNCenter/target/etc/openvpn/keys/server.crt'
Thu Sep 22 01:41:38 2016 us=972666   extra_certs_file = '[UNDEF]'
Thu Sep 22 01:41:38 2016 us=972711   priv_key_file = '/var/packages/VPNCenter/target/etc/openvpn/keys/server.key'
Thu Sep 22 01:41:38 2016 us=972755   pkcs12_file = '[UNDEF]'
Thu Sep 22 01:41:38 2016 us=972799   cipher_list = '[UNDEF]'
Thu Sep 22 01:41:38 2016 us=972843   tls_verify = '[UNDEF]'
Thu Sep 22 01:41:38 2016 us=972887   tls_export_cert = '[UNDEF]'
Thu Sep 22 01:41:38 2016 us=972931   verify_x509_type = 0
Thu Sep 22 01:41:38 2016 us=972975   verify_x509_name = '[UNDEF]'
Thu Sep 22 01:41:38 2016 us=973019   crl_file = '[UNDEF]'
Thu Sep 22 01:41:38 2016 us=973063   ns_cert_type = 0
Thu Sep 22 01:41:38 2016 us=973107   remote_cert_ku[i] = 0
Thu Sep 22 01:41:38 2016 us=973151   remote_cert_ku[i] = 0
Thu Sep 22 01:41:38 2016 us=973195   remote_cert_ku[i] = 0
Thu Sep 22 01:41:38 2016 us=973240   remote_cert_ku[i] = 0
Thu Sep 22 01:41:38 2016 us=973289   remote_cert_ku[i] = 0
Thu Sep 22 01:41:38 2016 us=973333   remote_cert_ku[i] = 0
Thu Sep 22 01:41:38 2016 us=973376   remote_cert_ku[i] = 0
Thu Sep 22 01:41:38 2016 us=973420   remote_cert_ku[i] = 0
Thu Sep 22 01:41:38 2016 us=973463   remote_cert_ku[i] = 0
Thu Sep 22 01:41:38 2016 us=973507   remote_cert_ku[i] = 0
Thu Sep 22 01:41:38 2016 us=973551   remote_cert_ku[i] = 0
Thu Sep 22 01:41:38 2016 us=973596   remote_cert_ku[i] = 0
Thu Sep 22 01:41:38 2016 us=973639   remote_cert_ku[i] = 0
Thu Sep 22 01:41:38 2016 us=973683   remote_cert_ku[i] = 0
Thu Sep 22 01:41:38 2016 us=973866   remote_cert_ku[i] = 0
Thu Sep 22 01:41:38 2016 us=973918   remote_cert_ku[i] = 0
Thu Sep 22 01:41:38 2016 us=973963   remote_cert_eku = '[UNDEF]'
Thu Sep 22 01:41:38 2016 us=974007   ssl_flags = 3
Thu Sep 22 01:41:38 2016 us=974052   tls_timeout = 2
Thu Sep 22 01:41:38 2016 us=974096   renegotiate_bytes = 0
Thu Sep 22 01:41:38 2016 us=974140   renegotiate_packets = 0
Thu Sep 22 01:41:38 2016 us=974185   renegotiate_seconds = 0
Thu Sep 22 01:41:38 2016 us=974229   handshake_window = 60
Thu Sep 22 01:41:38 2016 us=974273   transition_window = 3600
Thu Sep 22 01:41:38 2016 us=974316   single_session = DISABLED
Thu Sep 22 01:41:38 2016 us=974359   push_peer_info = DISABLED
Thu Sep 22 01:41:38 2016 us=974402   tls_exit = DISABLED
Thu Sep 22 01:41:38 2016 us=974446   tls_auth_file = '[UNDEF]'
Thu Sep 22 01:41:38 2016 us=974496   server_network = 192.168.201.0
Thu Sep 22 01:41:38 2016 us=974546   server_netmask = 255.255.255.0
Thu Sep 22 01:41:38 2016 us=974617   server_network_ipv6 = ::
Thu Sep 22 01:41:38 2016 us=974666   server_netbits_ipv6 = 0
Thu Sep 22 01:41:38 2016 us=974715   server_bridge_ip = 0.0.0.0
Thu Sep 22 01:41:38 2016 us=974764   server_bridge_netmask = 0.0.0.0
Thu Sep 22 01:41:38 2016 us=974812   server_bridge_pool_start = 0.0.0.0
Thu Sep 22 01:41:38 2016 us=974860   server_bridge_pool_end = 0.0.0.0
Thu Sep 22 01:41:38 2016 us=974905   push_entry = 'route 192.168.200.0 255.255.255.0'
Thu Sep 22 01:41:38 2016 us=974950   push_entry = 'route 192.168.201.0 255.255.255.0'
Thu Sep 22 01:41:38 2016 us=974994   push_entry = 'route-gateway 192.168.201.1'
Thu Sep 22 01:41:38 2016 us=975039   push_entry = 'topology subnet'
Thu Sep 22 01:41:38 2016 us=975082   push_entry = 'ping 10'
Thu Sep 22 01:41:38 2016 us=975126   push_entry = 'ping-restart 60'
Thu Sep 22 01:41:38 2016 us=975170   ifconfig_pool_defined = ENABLED
Thu Sep 22 01:41:38 2016 us=975219   ifconfig_pool_start = 192.168.201.2
Thu Sep 22 01:41:38 2016 us=975278   ifconfig_pool_end = 192.168.201.253
Thu Sep 22 01:41:38 2016 us=975345   ifconfig_pool_netmask = 255.255.255.0
Thu Sep 22 01:41:38 2016 us=975392   ifconfig_pool_persist_filename = '[UNDEF]'
Thu Sep 22 01:41:38 2016 us=975438   ifconfig_pool_persist_refresh_freq = 600
Thu Sep 22 01:41:38 2016 us=975482   ifconfig_ipv6_pool_defined = DISABLED
Thu Sep 22 01:41:38 2016 us=975529   ifconfig_ipv6_pool_base = ::
Thu Sep 22 01:41:38 2016 us=975574   ifconfig_ipv6_pool_netbits = 0
Thu Sep 22 01:41:38 2016 us=975618   n_bcast_buf = 256
Thu Sep 22 01:41:38 2016 us=975662   tcp_queue_limit = 64
Thu Sep 22 01:41:38 2016 us=975705   real_hash_size = 256
Thu Sep 22 01:41:38 2016 us=975750   virtual_hash_size = 256
Thu Sep 22 01:41:38 2016 us=975793   client_connect_script = '[UNDEF]'
Thu Sep 22 01:41:38 2016 us=975836   learn_address_script = '[UNDEF]'
Thu Sep 22 01:41:38 2016 us=975880   client_disconnect_script = '[UNDEF]'
Thu Sep 22 01:41:38 2016 us=975926   client_config_dir = '/usr/syno/etc/packages/VPNCenter/openvpn/'
Thu Sep 22 01:41:38 2016 us=975969   ccd_exclusive = DISABLED
Thu Sep 22 01:41:38 2016 us=976012   tmp_dir = '/tmp'
Thu Sep 22 01:41:38 2016 us=976056   push_ifconfig_defined = DISABLED
Thu Sep 22 01:41:38 2016 us=976104   push_ifconfig_local = 0.0.0.0
Thu Sep 22 01:41:38 2016 us=976151   push_ifconfig_remote_netmask = 0.0.0.0
Thu Sep 22 01:41:38 2016 us=976196   push_ifconfig_ipv6_defined = DISABLED
Thu Sep 22 01:41:38 2016 us=976244   push_ifconfig_ipv6_local = ::/0
Thu Sep 22 01:41:38 2016 us=976291   push_ifconfig_ipv6_remote = ::
Thu Sep 22 01:41:38 2016 us=976335   enable_c2c = ENABLED
Thu Sep 22 01:41:38 2016 us=976379   duplicate_cn = DISABLED
Thu Sep 22 01:41:38 2016 us=976422   cf_max = 0
Thu Sep 22 01:41:38 2016 us=976466   cf_per = 0
Thu Sep 22 01:41:38 2016 us=976509   max_clients = 20
Thu Sep 22 01:41:38 2016 us=976553   max_routes_per_client = 256
Thu Sep 22 01:41:38 2016 us=976597   auth_user_pass_verify_script = '[UNDEF]'
Thu Sep 22 01:41:38 2016 us=976641   auth_user_pass_verify_script_via_file = DISABLED
Thu Sep 22 01:41:38 2016 us=976685   port_share_host = '[UNDEF]'
Thu Sep 22 01:41:38 2016 us=976728   port_share_port = 0
Thu Sep 22 01:41:38 2016 us=976772   client = DISABLED
Thu Sep 22 01:41:38 2016 us=976815   pull = DISABLED
Thu Sep 22 01:41:38 2016 us=976859   auth_user_pass_file = '[UNDEF]'
Thu Sep 22 01:41:38 2016 us=976908 OpenVPN 2.3.11 armle-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Jul  7 2016
Thu Sep 22 01:41:38 2016 us=976980 library versions: OpenSSL 1.0.1t-fips  3 May 2016, LZO 2.09
Thu Sep 22 01:41:38 2016 us=979116 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:1195
Thu Sep 22 01:41:38 2016 RADIUS-PLUGIN: Configfile name: /var/packages/VPNCenter/target/etc/openvpn/radiusplugin.cnf.
Thu Sep 22 01:41:38 2016 us=982917 PLUGIN_INIT: POST /var/packages/VPNCenter/target/lib/radiusplugin.so '[/var/packages/VPNCenter/target/lib/radiusplugin.so] [/var/packages/VPNCenter/target/etc/openvpn/radiusplugin.cnf]' intercepted=PLUGIN_AUTH_USER_PASS_VERIFY|PLUGIN_CLIENT_CONNECT|PLUGIN_CLIENT_DISCONNECT
Thu Sep 22 01:41:38 2016 us=984732 Diffie-Hellman initialized with 1024 bit key
Thu Sep 22 01:41:38 2016 us=984871 WARNING: POTENTIALLY DANGEROUS OPTION --client-cert-not-required may accept clients which do not present a certificate
Thu Sep 22 01:41:38 2016 us=987617 TLS-Auth MTU parms [ L:1542 D:1212 EF:38 EB:0 ET:0 EL:3 ]
Thu Sep 22 01:41:38 2016 us=987855 Socket Buffers: R=[180224->180224] S=[180224->180224]
Thu Sep 22 01:41:38 2016 us=989332 TUN/TAP device tun0 opened
Thu Sep 22 01:41:38 2016 us=989539 TUN/TAP TX queue length set to 100
Thu Sep 22 01:41:38 2016 us=989642 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Thu Sep 22 01:41:38 2016 us=990107 /sbin/ifconfig tun0 192.168.201.1 netmask 255.255.255.0 mtu 1500 broadcast 192.168.201.255
Thu Sep 22 01:41:38 2016 us=995276 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:143 ET:0 EL:3 AF:3/1 ]
Thu Sep 22 01:41:38 2016 us=995420 UDPv6 link local (bound): [undef]
Thu Sep 22 01:41:38 2016 us=995483 UDPv6 link remote: [undef]
Thu Sep 22 01:41:38 2016 us=995586 MULTI: multi_init called, r=256 v=256
Thu Sep 22 01:41:38 2016 us=995787 IFCONFIG POOL: base=192.168.201.2 size=252, ipv6=0
Thu Sep 22 01:41:38 2016 us=995932 Initialization Sequence Completed
Thu Sep 22 01:42:33 2016 us=656882 MULTI: multi_create_instance called
Thu Sep 22 01:42:33 2016 us=657132 ::ffff:123.123.123.123(1194) Re-using SSL/TLS context
Thu Sep 22 01:42:33 2016 us=657279 ::ffff:123.123.123.123(1194) LZO compression initialized
Thu Sep 22 01:42:33 2016 us=657641 ::ffff:123.123.123.123(1194) Control Channel MTU parms [ L:1542 D:1212 EF:38 EB:0 ET:0 EL:3 ]
Thu Sep 22 01:42:33 2016 us=657730 ::ffff:123.123.123.123(1194) Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:143 ET:0 EL:3 AF:3/1 ]
Thu Sep 22 01:42:33 2016 us=657878 ::ffff:123.123.123.123(1194) Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Thu Sep 22 01:42:33 2016 us=657938 ::ffff:123.123.123.123(1194) Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Thu Sep 22 01:42:33 2016 us=658037 ::ffff:123.123.123.123(1194) Local Options hash (VER=V4): '530fdded'
Thu Sep 22 01:42:33 2016 us=658115 ::ffff:123.123.123.123(1194) Expected Remote Options hash (VER=V4): '41690919'
Thu Sep 22 01:42:33 2016 us=658299 ::ffff:123.123.123.123(1194) TLS: Initial packet from [AF_INET6]::ffff:123.123.123.123:1194, sid=f022151c 1921e010
Thu Sep 22 01:42:33 2016 RADIUS-PLUGIN: FOREGROUND THREAD: Auth_user_pass_verify thread started.
Thu Sep 22 01:42:33 2016 RADIUS-PLUGIN: FOREGROUND THREAD: New user.
Thu Sep 22 01:42:33 2016 RADIUS-PLUGIN: No attributes Acct Interim Interval or bad length.
Thu Sep 22 01:42:33 2016 RADIUS-PLUGIN: Client config file was not written, overwriteccfiles is false
.Thu Sep 22 01:42:33 2016 RADIUS-PLUGIN: FOREGROUND THREAD: Add user to map.
Thu Sep 22 01:42:33 2016 us=956714 ::ffff:123.123.123.123(1194) PLUGIN_CALL: POST /var/packages/VPNCenter/target/lib/radiusplugin.so/PLUGIN_AUTH_USER_PASS_VERIFY status=0
Thu Sep 22 01:42:33 2016 us=956912 ::ffff:123.123.123.123(1194) TLS: Username/Password authentication succeeded for username 'clientXX' [CN SET]
Thu Sep 22 01:42:33 2016 us=957854 ::ffff:123.123.123.123(1194) Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Sep 22 01:42:33 2016 us=957970 ::ffff:123.123.123.123(1194) Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Sep 22 01:42:33 2016 us=958247 ::ffff:123.123.123.123(1194) Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Sep 22 01:42:33 2016 us=958332 ::ffff:123.123.123.123(1194) Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Sep 22 01:42:33 2016 us=966928 ::ffff:123.123.123.123(1194) Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384
Thu Sep 22 01:42:33 2016 us=967120 ::ffff:123.123.123.123(1194) [clientXX] Peer Connection Initiated with [AF_INET6]::ffff:123.123.123.123:1194
Thu Sep 22 01:42:33 2016 us=967342 clientXX/::ffff:123.123.123.123(1194) OPTIONS IMPORT: reading client specific options from: /usr/syno/etc/packages/VPNCenter/openvpn//clientXX
Thu Sep 22 01:42:33 2016 us=996187 clientXX/::ffff:123.123.123.123(1194) PLUGIN_CALL: POST /var/packages/VPNCenter/target/lib/radiusplugin.so/PLUGIN_CLIENT_CONNECT status=0
Thu Sep 22 01:42:33 2016 us=996372 clientXX/::ffff:123.123.123.123(1194) OPTIONS IMPORT: reading client specific options from: /tmp/openvpn_cc_884455e57cbb2be97fc306ac3585f87d.tmp
Thu Sep 22 01:42:33 2016 us=996643 clientXX/::ffff:123.123.123.123(1194) MULTI: Learn: 192.168.201.2 -> clientXX/::ffff:123.123.123.123(1194)
Thu Sep 22 01:42:33 2016 us=996746 clientXX/::ffff:123.123.123.123(1194) MULTI: primary virtual IP for clientXX/::ffff:123.123.123.123(1194): 192.168.201.2
Thu Sep 22 01:42:36 2016 us=223437 clientXX/::ffff:123.123.123.123(1194) PUSH: Received control message: 'PUSH_REQUEST'
Thu Sep 22 01:42:36 2016 us=223577 clientXX/::ffff:123.123.123.123(1194) send_push_reply(): safe_cap=940
Thu Sep 22 01:42:36 2016 us=223797 clientXX/::ffff:123.123.123.123(1194) SENT CONTROL [clientXX]: 'PUSH_REPLY,route 192.168.200.0 255.255.255.0,route 192.168.201.0 255.255.255.0,route-gateway 192.168.201.1,topology subnet,ping 10,ping-restart 60,ifconfig 192.168.201.2 255.255.255.0' (status=1)
Thu Sep 22 01:42:36 2016 us=713932 clientXX/::ffff:123.123.123.123(1194) MULTI: bad source address from client [::], packet dropped

TinCanTech

According to your logs, if:

eV1Te wrotenothing goes through, not even pings.

this is probably a firewall which has not been configured with the new subnet/mask. This is the key to resolving your problem.

eV1Te wroteStrangely they stay connected without error even through I have specified "keepalive 10 60".

This is to be expected; the openvpn ping mechanism is internal, it is not an operating system generated ping.

The point is, openvpn is working normally and passing data .. but your setup is not allowing packets to traverse the tunnel.

eV1Te

TinCanTech wroteAccording to your logs, if:
eV1Te wrotenothing goes through, not even pings.
this is probably a firewall which has not been configured with the new subnet/mask. This is the key to resolving your problem.

eV1Te wroteStrangely they stay connected without error even through I have specified "keepalive 10 60".
This is to be expected; the openvpn ping mechanism is internal, it is not an operating system generated ping.

The point is, openvpn is working normally and passing data .. but your setup is not allowing packets to traverse the tunnel.

Thank you for your reply, I have done some more troubleshooting over the past few days but I can not seem to find the problem. I am not an expert on linux firewalls, but as far as I can see the firewall has not been changed and it does not contain any netmask/subnet specific entries that needs to be changed.

I would appreciate it if someone with more experience could point out what is wrong in my setup.

Here are some information about the network and the server (which is also the gateway/nat) when using "topology subnet"
VPN network 192.168.201.0
LAN network 192.168.200.0
Internet censored 123.123.123.123

ifconfig on openvpn interface

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:192.168.201.1  P-t-P:192.168.201.1  Mask:255.255.255.0
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1
          RX packets:6 errors:0 dropped:0 overruns:0 frame:0
          TX packets:212 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100
          RX bytes:332 (332.0 B)  TX bytes:221000 (215.8 KiB)

route -ne

Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         123.123.123.1    0.0.0.0         UG        0 0          0 eth0
123.123.123.0    0.0.0.0         255.255.252.0   U         0 0          0 eth0
192.168.200.0   0.0.0.0         255.255.255.0   U         0 0          0 lbr0
192.168.201.0   0.0.0.0         255.255.255.0   U         0 0          0 gbr0
192.168.201.0   0.0.0.0         255.255.255.0   U         0 0          0 tun0

The values below are the exact same when running the default topology in openvpn:
iptables -vnx --table nat -L

Chain PREROUTING (policy ACCEPT 1957 packets, 191773 bytes)
    pkts      bytes target     prot opt in     out     source               destination
 2956069 263508407 RESOLVE_SRM_PREROUTING  all  --  *      *       0.0.0.0/0            0.0.0.0/0
 2956063 263507832 PORT_FORWARD_PREROUTING  all  --  *      *       0.0.0.0/0            0.0.0.0/0
                  
Chain INPUT (policy ACCEPT 271 packets, 17175 bytes)
    pkts      bytes target     prot opt in     out     source               destination
                  
Chain OUTPUT (policy ACCEPT 185 packets, 22684 bytes)
    pkts      bytes target     prot opt in     out     source               destination
                  
Chain POSTROUTING (policy ACCEPT 406 packets, 57427 bytes)
    pkts      bytes target     prot opt in     out     source               destination
 1094058 109020267 NAT_LOOPBACK_POSTROUTING  all  --  *      *       0.0.0.0/0            0.0.0.0/0
 1093976 109009692 SNAT_POSTROUTING  all  --  *      *       0.0.0.0/0            0.0.0.0/0
                  
Chain DMZ_FORWARD_RULE (1 references)
    pkts      bytes target     prot opt in     out     source               destination
                  
Chain NAT_LOOPBACK_POSTROUTING (1 references)
    pkts      bytes target     prot opt in     out     source               destination
     341    38293 MASQUERADE  all  --  *      *       0.0.0.0/0            0.0.0.0/0            mark match 0x2000/0x2000
                  
Chain NUPNPD (1 references)
    pkts      bytes target     prot opt in     out     source               destination
   34571  3188465 DNAT       udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:55842 to:192.168.200.10:55842
      26     1464 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:15456 to:192.168.200.10:15456
     263    33383 DNAT       udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:15456 to:192.168.200.10:15456
                  
Chain PORT_FORWARD_PREROUTING (1 references)
    pkts      bytes target     prot opt in     out     source               destination
 2223650 200403989 PORT_FORWARD_RULE  all  --  *      *       0.0.0.0/0            123.123.123.123
 2215963 199993722 NUPNPD     all  --  *      *       0.0.0.0/0            123.123.123.123
 1891331 160973449 DMZ_FORWARD_RULE  all  --  *      *       0.0.0.0/0            123.123.123.123
                  
Chain PORT_FORWARD_RULE (1 references)
    pkts      bytes target     prot opt in     out     source               destination
       9      420 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 21,2222,55536:55543 to:192.168.200.20
     750    41649 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 80,443 to:192.168.200.20
    5320   276608 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:3390 to:192.168.200.10:3389
    1595    90830 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:32400 to:192.168.200.20:32400
      13      760 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpts:5000:5001 to:192.168.200.20
                  
Chain RESOLVE_SRM_PREROUTING (1 references)
    pkts      bytes target     prot opt in     out     source               destination
       0        0 DNAT       tcp  --  lbr0   *       0.0.0.0/0            0.0.0.0/0            tcp dpt:53 STRING match  "|06726f757465720873796e6f6c6f677903636f6d|" ALGO name bm TO 65535 to:192.168.200.1:5440
       0        0 DNAT       udp  --  lbr0   *       0.0.0.0/0            0.0.0.0/0            udp dpt:53 STRING match  "|06726f757465720873796e6f6c6f677903636f6d|" ALGO name bm TO 65535 to:192.168.200.1:5440
                  
Chain SNAT_POSTROUTING (1 references)
    pkts      bytes target     prot opt in     out     source               destination
    1639   213657 RETURN     all  --  *      lo      0.0.0.0/0            0.0.0.0/0
  366062 47670466 RETURN     all  --  *      lbr0    0.0.0.0/0            0.0.0.0/0
      95    11944 RETURN     all  --  *      gbr0    0.0.0.0/0            0.0.0.0/0
  726180 61113625 MASQUERADE  all  --  *      *       0.0.0.0/0            0.0.0.0/0

iptables -vnx --table filter -L

Chain INPUT (policy ACCEPT 250 packets, 35131 bytes)
    pkts      bytes target     prot opt in     out     source               destination
     878   112009 INPUT_FIREWALL  all  --  *      *       0.0.0.0/0            0.0.0.0/0
   39949  6397539 URL_BLOCKER_FILTER  all  --  *      *       0.0.0.0/0            0.0.0.0/0
                  
Chain FORWARD (policy ACCEPT 143 packets, 21822 bytes)
    pkts      bytes target     prot opt in     out     source               destination
     257    34036 FORWARD_FIREWALL  all  --  *      *       0.0.0.0/0            0.0.0.0/0
     146    22269 VPN_PASSTHROUGH  all  --  *      *       0.0.0.0/0            0.0.0.0/0
                  
Chain OUTPUT (policy ACCEPT 388 packets, 121714 bytes)
    pkts      bytes target     prot opt in     out     source               destination
                  
Chain FORWARD_FIREWALL (1 references)
    pkts      bytes target     prot opt in     out     source               destination
       0        0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            state INVALID
      88    17088 RETURN     all  --  lbr0   lbr0    0.0.0.0/0            0.0.0.0/0
       2      120 RETURN     all  --  lbr0   gbr0    0.0.0.0/0            0.0.0.0/0
       0        0 RETURN     all  --  gbr0   gbr0    0.0.0.0/0            0.0.0.0/0
       0        0 RETURN     all  --  gbr0   lbr0    0.0.0.0/0            0.0.0.0/0
     102    11117 SYNO_FORWARD_ACCEPT  all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
      17     2015 RETURN     all  --  *      lbr0    0.0.0.0/0            0.0.0.0/0
       0        0 RETURN     all  --  *      gbr0    0.0.0.0/0            0.0.0.0/0
                  
Chain INPUT_FIREWALL (1 references)
    pkts      bytes target     prot opt in     out     source               destination
       0        0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0            state INVALID
     132    16527 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0
     270    39163 RETURN     all  --  lbr0   *       0.0.0.0/0            0.0.0.0/0
       0        0 RETURN     all  --  gbr0   *       0.0.0.0/0            0.0.0.0/0
     101    19507 SYNO_INPUT_ACCEPT  all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
       0        0 RETURN     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 1194
       0        0 RETURN     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 8000,8001
     359    35528 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0
                  
Chain SYNO_FORWARD_ACCEPT (1 references)
    pkts      bytes target     prot opt in     out     source               destination
 2033401 774915500 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0
                  
Chain SYNO_INPUT_ACCEPT (1 references)
    pkts      bytes target     prot opt in     out     source               destination
  352779 132559415 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0
                  
Chain URL_BLOCKER_FILTER (1 references)
    pkts      bytes target     prot opt in     out     source               destination
       0        0 DROP       tcp  --  lbr0   *       0.0.0.0/0            0.0.0.0/0            tcp dpt:5010
       0        0 DROP       tcp  --  lbr0   *       0.0.0.0/0            0.0.0.0/0            tcp dpt:5011
       0        0 DROP       tcp  --  gbr0   *       0.0.0.0/0            0.0.0.0/0            tcp dpt:5010
       0        0 DROP       tcp  --  gbr0   *       0.0.0.0/0            0.0.0.0/0            tcp dpt:5011
                  
Chain VPN_PASSTHROUGH (1 references)
    pkts      bytes target     prot opt in     out     source               destination
       0        0 RETURN     udp  --  lbr0   *       0.0.0.0/0            0.0.0.0/0            udp dpt:1701
       0        0 RETURN     udp  --  *      lbr0    0.0.0.0/0            0.0.0.0/0            udp dpt:1701
       0        0 RETURN     ah   --  *      lbr0    0.0.0.0/0            0.0.0.0/0
       0        0 RETURN     ah   --  lbr0   *       0.0.0.0/0            0.0.0.0/0
       0        0 RETURN     esp  --  *      lbr0    0.0.0.0/0            0.0.0.0/0
       0        0 RETURN     esp  --  lbr0   *       0.0.0.0/0            0.0.0.0/0
       0        0 RETURN     udp  --  *      lbr0    0.0.0.0/0            0.0.0.0/0            udp dpt:4500
       0        0 RETURN     udp  --  lbr0   *       0.0.0.0/0            0.0.0.0/0            udp dpt:4500
       0        0 RETURN     udp  --  *      lbr0    0.0.0.0/0            0.0.0.0/0            udp dpt:500
       0        0 RETURN     udp  --  lbr0   *       0.0.0.0/0            0.0.0.0/0            udp dpt:500
       0        0 RETURN     47   --  lbr0   *       0.0.0.0/0            0.0.0.0/0
       0        0 RETURN     tcp  --  lbr0   *       0.0.0.0/0            0.0.0.0/0            tcp dpt:1723
       0        0 RETURN     47   --  *      lbr0    0.0.0.0/0            0.0.0.0/0
       0        0 RETURN     tcp  --  *      lbr0    0.0.0.0/0            0.0.0.0/0            tcp dpt:1723

TinCanTech

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.

eV1Te

Your question regarding the network bridges made me find the problem I think (VPN is working so far at least).

lbr0 is the LAN bridge (bridging wifi interface with the wired connection) but gbr0 has the same IP as tun0 (openvpn) so I at first assumed it had to do with openvpn. I have mostly run openvpn in bridged mode on other servers previously so I didn't think so much about this at first (forgetting that this is a routing VPN).

Now when I started digging deeper it seems that gbr0 is a leftover network bridge from a "guest network" function in the NAT server software I am using (Synology Routing Manager). But even though this "guest network" is disabled and not used the bridge still exists and by pure chance it happened to have the same IP as the current VPN network :o

Interestingly when using the old but still default topology mode in openvpn (topology net30) the VPN worked just fine even though there was an IP conflict. But when switching to the more common topology of one subnet for the entire VPN (topology subnet) this conflict seems to have blocked all traffic from flowing through the tunnel.

I just moved the guest network bridge gbr0 to a different IP and now the VPN is working with "topology subnet" without changing anything else. Although I have yet to evaluate it's performance over a longer period of time.

Thanks again, sometimes it helps to have someone to ask the simple questions for one to realize what part of the chain is wrong.

TinCanTech

eV1Te wroteThanks again, sometimes it helps to have someone to ask the simple questions

yeah ..

eV1Te wroteI would appreciate it if someone with more experience could point out what is wrong in my setup

You should learn what you are doing before you cast aspersions .. :evil:

eV1Te

TinCanTech wrote
eV1Te wroteI would appreciate it if someone with more experience could point out what is wrong in my setup
You should learn what you are doing before you cast aspersions .. :evil:

I'm sorry if you misinterpreted what I said, I was unclear with the phrase "someone with more experience". I was referring to someone with more experience than myself and not someone with more experience than you. (English is not my native language)

In short what I meant to say is that I appreciate any help that I can get from you (or anyone else on the forum) with more experience than me. 🙂