Hello, I hope I got the right forum here. My question refers to OpenVPN v2.3.12 in Windows 7 x64 SP1, on both clients & server: The configuration on both server & client are working (I can refer to them, if necessary). However, if I try to establish a client-side connection to my home server which should route all the internet traffic through my server, I always check this using a trace route, eg. "tracert http://www.heise.de" in a cmd. After the first connection, the standard node appears. The internet traffic is [b]not[/b] routed, but I'm completely connected to my home net. If I reconnect, and again use trace route, now it shows my home router correctly on top of the hop list. Does anybody know the reason for this? I got only one error in the status log: "NOTE: FlushIpNetTable failed on interface [14] {21BA3A38-868B-4248-B432-C395CA272A4E} (status=1168) : Element nicht gefunden" (element not found) This appears both on the first and on the second connection, so it might be not important. The server pushes the home route, the client pulls the gateway (because I have other connections which don't want to route all their internet traffic through my computer). If anyone has any tips for me, I'd appreciate it. :) Thanks, vangrunz

Please see: [url=https://forums.openvpn.net/viewtopic.php?f=30&t=22603]HOWTO: Request Help ![/url]

Your server config is missing --[b]server[/b]

It's working instead of [b]server[/b] with [b]mode server[/b].

Actually, it is [i]not[/i] working .. :ugeek: See [b]--server[/b] in [url=https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage]The Manual[/url] .. Read it carefully.

[quote="TinCanTech"]Your server config is missing --[b]server[/b][/quote][quote="vangrunz"]I'm using bridge mode on my server.[/quote][quote="vangrunz"]Don't use --[b]server[/b] if you are ethernet bridging. Use --[b]server-bridge[/b] instead[/quote] [list] :twisted: [/list]

Windows: Redirection Gateway only works after reconnection

vangrunz

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.

TinCanTech

Please see:
HOWTO: Request Help !

vangrunz

Can you quickly tell me please what I've done wrong?

I'm using the free community edition, in the version as stated above.

Additionally, I'll append my configurations:

Server: local [my IP]

port [my Port]

proto udp

dev tap

dev-node OpenVPN

ca [ca.crt]
cert [server.crt]
key [server.key]

dh dh4096.pem

mode server
tls-server

push "route 192.168.x.x 255.255.255.255"

client-to-client

ping-timer-rem
keepalive 10 120

tls-auth ta.key 0 # This file is secret

tls-cipher TLS-DHE-RSA-WITH-AES-256-CBC-SHA

auth SHA512

cipher AES-256-OFB

comp-lzo

max-clients 5

persist-key
persist-tun

reneg-sec 0

status openvpn-status.log

log [server.log]
log-append [server.log]

verb 3 Client: client

dev tap

dev-node OpenVPN

proto udp

remote [my host] [my port]

route-gateway 192.168.x.x
redirect-gateway def1

route-method exe
route-delay 2

resolv-retry infinite

nobind

persist-key
persist-tun

reneg-sec 0

ca [ca.crt]
cert [xx.pem]
key [client.key]

ns-cert-type server

tls-auth ta.key 1

tls-cipher TLS-DHE-RSA-WITH-AES-256-CBC-SHA

auth SHA512

cipher AES-256-OFB

comp-lzo

verb 3

log [client.log]
log-append [client.log] IPs and names have been altered due to privacy.

Sorry for inconveniences!

TinCanTech

Your server config is missing --server

vangrunz

It's working instead of server with mode server.

TinCanTech

Actually, it is not working .. :ugeek:

See --server in The Manual .. Read it carefully.

vangrunz

I'm not sure why you're telling me this. I may put a citation from your source:

Starting with OpenVPN 2.0, a multi-client TCP/UDP server mode is supported, and can be enabled with the --mode server option. In server mode, OpenVPN will listen on a single port for incoming client connections. All client connections will be routed through a single tun or tap interface. This mode is designed for scalability and should be able to support hundreds or even thousands of clients on sufficiently fast hardware. SSL/TLS authentication must be used in this mode.

--server network netmask ['nopool']
A helper directive designed to simplify the configuration of OpenVPN's server mode. This directive will set up an OpenVPN server which will allocate addresses to clients out of the given network/netmask. The server itself will take the ".1" address of the given network for use as the server-side endpoint of the local TUN/TAP interface.

For example, --server 10.8.0.0 255.255.255.0 expands as follows:

mode server
tls-server
push "topology [topology]"

if dev tun AND (topology == net30 OR topology == p2p):
ifconfig 10.8.0.1 10.8.0.2
if !nopool:
ifconfig-pool 10.8.0.4 10.8.0.251
route 10.8.0.0 255.255.255.0
if client-to-client:
push "route 10.8.0.0 255.255.255.0"
else if topology == net30:
push "route 10.8.0.1"

if dev tap OR (dev tun AND topology == subnet):
ifconfig 10.8.0.1 255.255.255.0
if !nopool:
ifconfig-pool 10.8.0.2 10.8.0.254 255.255.255.0
push "route-gateway 10.8.0.1"
if route-gateway unset:
route-gateway 10.8.0.2

Don't use --server if you are ethernet bridging. Use --server-bridge instead.

I'm using bridge mode on my server. Not every client is in the same subnet as I am, so pushing a gateway from the server to the client may result in a loss of internet communication due to an unreachable gateway. Therefore, I pull it client-side, if I need it.

My configuration with a client that pulls the gateway (as stated in client.ovpn) is working, except this one point:

On the first connection, the gateway is not set correctly on the client. I have to reconnect because the gateway route is not working. Maybe that's a windows 7 problem, but I have it with different hardware (multiple PCs and laptops), so my thought was that it might be known or common in the OpenVPN community. This is also a security problem, because when you're connected in an untrustworthy environment and thinking all your internet traffic is routed through your home station, this is not the case. As stated, I always check this with a simple trace route. If your pulled VPN gateway is not the first hop in your list, then your Internet traffic is not routed through the VPN tunnel.

vangrunz

I'll append my log files. First one is from the client, second from the server.

It's splitted into three parts:
1: 1st connection
2: disconnecting for 2nd connection
3: 2nd connection

Sun Oct 23 14:10:46 2016 OpenVPN 2.3.12 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Aug 23 2016
Sun Oct 23 14:10:46 2016 Windows version 6.1 (Windows 7) 64bit
Sun Oct 23 14:10:46 2016 library versions: OpenSSL 1.0.1t 3 May 2016, LZO 2.09
Sun Oct 23 14:10:46 2016 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Sun Oct 23 14:10:46 2016 Need hold release from management interface, waiting...
Sun Oct 23 14:10:47 2016 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Sun Oct 23 14:10:47 2016 MANAGEMENT: CMD 'state on'
Sun Oct 23 14:10:47 2016 MANAGEMENT: CMD 'log all on'
Sun Oct 23 14:10:47 2016 MANAGEMENT: CMD 'hold off'
Sun Oct 23 14:10:47 2016 MANAGEMENT: CMD 'hold release'
Sun Oct 23 14:10:47 2016 MANAGEMENT: CMD 'proxy NONE '
Sun Oct 23 14:10:48 2016 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
Sun Oct 23 14:10:48 2016 Outgoing Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Sun Oct 23 14:10:48 2016 Incoming Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Sun Oct 23 14:10:48 2016 Socket Buffers: R=[8192->8192] S=[8192->8192]
Sun Oct 23 14:10:48 2016 MANAGEMENT: >STATE:1477224648,RESOLVE,,,
Sun Oct 23 14:10:48 2016 UDPv4 link local: [undef]
Sun Oct 23 14:10:48 2016 UDPv4 link remote: [AF_INET][my internet vpn server ip]:[server port]
Sun Oct 23 14:10:48 2016 MANAGEMENT: >STATE:1477224648,WAIT,,,
Sun Oct 23 14:10:48 2016 MANAGEMENT: >STATE:1477224648,AUTH,,,
Sun Oct 23 14:10:48 2016 TLS: Initial packet from [AF_INET][my internet vpn server ip]:[server port], sid=x x
Sun Oct 23 14:10:49 2016 VERIFY OK: depth=1, C=[...]
Sun Oct 23 14:10:49 2016 VERIFY OK: nsCertType=SERVER
Sun Oct 23 14:10:49 2016 VERIFY OK: depth=0, C=[...]
Sun Oct 23 14:10:51 2016 Data Channel Encrypt: Cipher 'AES-256-OFB' initialized with 256 bit key
Sun Oct 23 14:10:51 2016 Data Channel Encrypt: Using 512 bit message hash 'SHA512' for HMAC authentication
Sun Oct 23 14:10:51 2016 Data Channel Decrypt: Cipher 'AES-256-OFB' initialized with 256 bit key
Sun Oct 23 14:10:51 2016 Data Channel Decrypt: Using 512 bit message hash 'SHA512' for HMAC authentication
Sun Oct 23 14:10:51 2016 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 4096 bit RSA
Sun Oct 23 14:10:51 2016 [vpnserver] Peer Connection Initiated with [AF_INET][my internet vpn server ip]:[server port]
Sun Oct 23 14:10:53 2016 MANAGEMENT: >STATE:1477224653,GET_CONFIG,,,
Sun Oct 23 14:10:55 2016 SENT CONTROL [vpnserver]: 'PUSH_REQUEST' (status=1)
Sun Oct 23 14:10:55 2016 PUSH: Received control message: 'PUSH_REPLY,route 192.168.0.0 255.255.255.255,ping 10,ping-restart 120'
Sun Oct 23 14:10:55 2016 OPTIONS IMPORT: timers and/or timeouts modified
Sun Oct 23 14:10:55 2016 OPTIONS IMPORT: route options modified
Sun Oct 23 14:10:55 2016 ROUTE_GATEWAY [local internet gateway]/255.255.255.255 I=22 HWADDR=00:00:00:00:00:00
Sun Oct 23 14:10:55 2016 open_tun, tt->ipv6=0
Sun Oct 23 14:10:55 2016 TAP-WIN32 device [OpenVPN] opened: \\.\Global\{21BA3A38-868B-4248-B432-C395CA272A4E}.tap
Sun Oct 23 14:10:55 2016 TAP-Windows Driver Version 9.21
Sun Oct 23 14:10:55 2016 NOTE: FlushIpNetTable failed on interface [14] {21BA3A38-868B-4248-B432-C395CA272A4E} (status=1168) : Element nicht gefunden.
Sun Oct 23 14:10:57 2016 TEST ROUTES: 0/2 succeeded len=1 ret=0 a=0 u/d=up
Sun Oct 23 14:10:57 2016 Route: Waiting for TUN/TAP interface to come up...
Sun Oct 23 14:10:59 2016 TEST ROUTES: 0/2 succeeded len=1 ret=0 a=0 u/d=up
Sun Oct 23 14:10:59 2016 Route: Waiting for TUN/TAP interface to come up...
Sun Oct 23 14:11:01 2016 TEST ROUTES: 0/2 succeeded len=1 ret=0 a=0 u/d=up
Sun Oct 23 14:11:01 2016 Route: Waiting for TUN/TAP interface to come up...
Sun Oct 23 14:11:03 2016 TEST ROUTES: 0/2 succeeded len=1 ret=0 a=0 u/d=up
Sun Oct 23 14:11:03 2016 Route: Waiting for TUN/TAP interface to come up...
Sun Oct 23 14:11:04 2016 TEST ROUTES: 0/2 succeeded len=1 ret=0 a=0 u/d=up
Sun Oct 23 14:11:04 2016 Route: Waiting for TUN/TAP interface to come up...
Sun Oct 23 14:11:05 2016 TEST ROUTES: 2/2 succeeded len=1 ret=1 a=0 u/d=up
Sun Oct 23 14:11:05 2016 C:\Windows\system32\route.exe ADD [my internet vpn server ip] MASK 255.255.255.255 [local internet gateway]
Sun Oct 23 14:11:05 2016 env_block: add PATH=C:\Windows\System32;C:\Windows;C:\Windows\System32\Wbem
Sun Oct 23 14:11:05 2016 C:\Windows\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 [vpn gateway]
Sun Oct 23 14:11:05 2016 env_block: add PATH=C:\Windows\System32;C:\Windows;C:\Windows\System32\Wbem
Sun Oct 23 14:11:05 2016 C:\Windows\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 [vpn gateway]
Sun Oct 23 14:11:05 2016 env_block: add PATH=C:\Windows\System32;C:\Windows;C:\Windows\System32\Wbem
Sun Oct 23 14:11:05 2016 MANAGEMENT: >STATE:1477224665,ADD_ROUTES,,,
Sun Oct 23 14:11:05 2016 C:\Windows\system32\route.exe ADD 192.168.0.0 MASK 255.255.255.255 [vpn gateway]
Sun Oct 23 14:11:05 2016 env_block: add PATH=C:\Windows\System32;C:\Windows;C:\Windows\System32\Wbem
Sun Oct 23 14:11:05 2016 Initialization Sequence Completed
Sun Oct 23 14:11:05 2016 MANAGEMENT: >STATE:1477224665,CONNECTED,SUCCESS,,[my internet vpn server ip]

Now the disconnect, deleting routes:

Sun Oct 23 14:11:41 2016 MANAGEMENT: CMD 'signal SIGHUP'
Sun Oct 23 14:11:41 2016 C:\Windows\system32\route.exe DELETE 192.168.0.0 MASK 255.255.255.255 [vpn gateway]
Sun Oct 23 14:11:41 2016 env_block: add PATH=C:\Windows\System32;C:\Windows;C:\Windows\System32\Wbem
Sun Oct 23 14:11:41 2016 C:\Windows\system32\route.exe DELETE [my internet vpn server ip] MASK 255.255.255.255 [local internet gateway]
Sun Oct 23 14:11:41 2016 env_block: add PATH=C:\Windows\System32;C:\Windows;C:\Windows\System32\Wbem
Sun Oct 23 14:11:41 2016 C:\Windows\system32\route.exe DELETE 0.0.0.0 MASK 128.0.0.0 [vpn gateway]
Sun Oct 23 14:11:41 2016 env_block: add PATH=C:\Windows\System32;C:\Windows;C:\Windows\System32\Wbem
Sun Oct 23 14:11:41 2016 C:\Windows\system32\route.exe DELETE 128.0.0.0 MASK 128.0.0.0 [vpn gateway]
Sun Oct 23 14:11:41 2016 env_block: add PATH=C:\Windows\System32;C:\Windows;C:\Windows\System32\Wbem
Sun Oct 23 14:11:41 2016 Closing TUN/TAP interface
Sun Oct 23 14:11:41 2016 SIGHUP[hard,] received, process restarting
Sun Oct 23 14:11:41 2016 MANAGEMENT: >STATE:1477224701,RECONNECTING,SIGHUP,,

Now the 2nd connection attempt:

Sun Oct 23 14:11:41 2016 OpenVPN 2.3.12 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Aug 23 2016
Sun Oct 23 14:11:41 2016 Windows version 6.1 (Windows 7) 64bit
Sun Oct 23 14:11:41 2016 library versions: OpenSSL 1.0.1t 3 May 2016, LZO 2.09
Sun Oct 23 14:11:41 2016 Restart pause, 2 second(s)
Sun Oct 23 14:11:43 2016 MANAGEMENT: CMD 'proxy NONE '
Sun Oct 23 14:11:44 2016 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
Sun Oct 23 14:11:44 2016 Outgoing Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Sun Oct 23 14:11:44 2016 Incoming Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Sun Oct 23 14:11:44 2016 Socket Buffers: R=[8192->8192] S=[8192->8192]
Sun Oct 23 14:11:44 2016 MANAGEMENT: >STATE:1477224704,RESOLVE,,,
Sun Oct 23 14:11:45 2016 UDPv4 link local: [undef]
Sun Oct 23 14:11:45 2016 UDPv4 link remote: [AF_INET][my internet vpn server ip]:[port]
Sun Oct 23 14:11:45 2016 MANAGEMENT: >STATE:1477224705,WAIT,,,
Sun Oct 23 14:11:45 2016 MANAGEMENT: >STATE:1477224705,AUTH,,,
Sun Oct 23 14:11:45 2016 TLS: Initial packet from [AF_INET][my internet vpn server ip]:[port], sid=f6d9648e e8cefbec
Sun Oct 23 14:11:45 2016 VERIFY OK: depth=1, C=[...]
Sun Oct 23 14:11:45 2016 VERIFY OK: nsCertType=SERVER
Sun Oct 23 14:11:45 2016 VERIFY OK: depth=0, C=[...]
Sun Oct 23 14:11:46 2016 Data Channel Encrypt: Cipher 'AES-256-OFB' initialized with 256 bit key
Sun Oct 23 14:11:46 2016 Data Channel Encrypt: Using 512 bit message hash 'SHA512' for HMAC authentication
Sun Oct 23 14:11:46 2016 Data Channel Decrypt: Cipher 'AES-256-OFB' initialized with 256 bit key
Sun Oct 23 14:11:46 2016 Data Channel Decrypt: Using 512 bit message hash 'SHA512' for HMAC authentication
Sun Oct 23 14:11:46 2016 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 4096 bit RSA
Sun Oct 23 14:11:46 2016 [vpnserver] Peer Connection Initiated with [AF_INET][my internet vpn server ip]:[port]
Sun Oct 23 14:11:47 2016 MANAGEMENT: >STATE:1477224707,GET_CONFIG,,,
Sun Oct 23 14:11:48 2016 SENT CONTROL [vpnserver]: 'PUSH_REQUEST' (status=1)
Sun Oct 23 14:11:48 2016 PUSH: Received control message: 'PUSH_REPLY,route 192.168.0.0 255.255.255.255,ping 10,ping-restart 120'
Sun Oct 23 14:11:48 2016 OPTIONS IMPORT: timers and/or timeouts modified
Sun Oct 23 14:11:48 2016 OPTIONS IMPORT: route options modified
Sun Oct 23 14:11:48 2016 ROUTE_GATEWAY [local internet gateway]/255.255.255.255 I=22 HWADDR=00:00:00:00:00:00
Sun Oct 23 14:11:48 2016 open_tun, tt->ipv6=0
Sun Oct 23 14:11:48 2016 TAP-WIN32 device [OpenVPN] opened: \\.\Global\{21BA3A38-868B-4248-B432-C395CA272A4E}.tap
Sun Oct 23 14:11:48 2016 TAP-Windows Driver Version 9.21
Sun Oct 23 14:11:48 2016 NOTE: FlushIpNetTable failed on interface [14] {21BA3A38-868B-4248-B432-C395CA272A4E} (status=1168) : Element nicht gefunden.
Sun Oct 23 14:11:50 2016 TEST ROUTES: 0/2 succeeded len=1 ret=0 a=0 u/d=up
Sun Oct 23 14:11:50 2016 Route: Waiting for TUN/TAP interface to come up...
Sun Oct 23 14:11:52 2016 TEST ROUTES: 0/2 succeeded len=1 ret=0 a=0 u/d=up
Sun Oct 23 14:11:52 2016 Route: Waiting for TUN/TAP interface to come up...
Sun Oct 23 14:11:53 2016 TEST ROUTES: 0/2 succeeded len=1 ret=0 a=0 u/d=up
Sun Oct 23 14:11:53 2016 Route: Waiting for TUN/TAP interface to come up...
Sun Oct 23 14:11:54 2016 TEST ROUTES: 0/2 succeeded len=1 ret=0 a=0 u/d=up
Sun Oct 23 14:11:54 2016 Route: Waiting for TUN/TAP interface to come up...
Sun Oct 23 14:11:55 2016 TEST ROUTES: 0/2 succeeded len=1 ret=0 a=0 u/d=up
Sun Oct 23 14:11:55 2016 Route: Waiting for TUN/TAP interface to come up...
Sun Oct 23 14:11:56 2016 TEST ROUTES: 0/2 succeeded len=1 ret=0 a=0 u/d=up
Sun Oct 23 14:11:56 2016 Route: Waiting for TUN/TAP interface to come up...
Sun Oct 23 14:11:57 2016 TEST ROUTES: 0/2 succeeded len=1 ret=0 a=0 u/d=up
Sun Oct 23 14:11:57 2016 Route: Waiting for TUN/TAP interface to come up...
Sun Oct 23 14:11:58 2016 TEST ROUTES: 2/2 succeeded len=1 ret=1 a=0 u/d=up
Sun Oct 23 14:11:58 2016 C:\Windows\system32\route.exe ADD [my internet vpn server ip] MASK 255.255.255.255 [local internet gateway]
Sun Oct 23 14:11:58 2016 env_block: add PATH=C:\Windows\System32;C:\Windows;C:\Windows\System32\Wbem
Sun Oct 23 14:11:58 2016 C:\Windows\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 [vpn gateway]
Sun Oct 23 14:11:58 2016 env_block: add PATH=C:\Windows\System32;C:\Windows;C:\Windows\System32\Wbem
Sun Oct 23 14:11:58 2016 C:\Windows\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 [vpn gateway]
Sun Oct 23 14:11:58 2016 env_block: add PATH=C:\Windows\System32;C:\Windows;C:\Windows\System32\Wbem
Sun Oct 23 14:11:58 2016 MANAGEMENT: >STATE:1477224718,ADD_ROUTES,,,
Sun Oct 23 14:11:58 2016 C:\Windows\system32\route.exe ADD 192.168.0.0 MASK 255.255.255.255 [vpn gateway]
Sun Oct 23 14:11:58 2016 env_block: add PATH=C:\Windows\System32;C:\Windows;C:\Windows\System32\Wbem
Sun Oct 23 14:11:58 2016 Initialization Sequence Completed
Sun Oct 23 14:11:58 2016 MANAGEMENT: >STATE:1477224718,CONNECTED,SUCCESS,,[my internet vpn server ip]

And here comes the server:

1st connection:

Sun Oct 23 14:11:10 2016 client ip:23117 TLS: Initial packet from [AF_INET]client ip:23117, sid=x x
Sun Oct 23 14:11:12 2016 client ip:23117 VERIFY OK: depth=1, C=[...]
Sun Oct 23 14:11:12 2016 client ip:23117 VERIFY OK: depth=0, C=[...]
Sun Oct 23 14:11:12 2016 client ip:23117 Data Channel Encrypt: Cipher 'AES-256-OFB' initialized with 256 bit key
Sun Oct 23 14:11:12 2016 client ip:23117 Data Channel Encrypt: Using 512 bit message hash 'SHA512' for HMAC authentication
Sun Oct 23 14:11:12 2016 client ip:23117 Data Channel Decrypt: Cipher 'AES-256-OFB' initialized with 256 bit key
Sun Oct 23 14:11:12 2016 client ip:23117 Data Channel Decrypt: Using 512 bit message hash 'SHA512' for HMAC authentication
Sun Oct 23 14:11:12 2016 client ip:23117 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 4096 bit RSA
Sun Oct 23 14:11:12 2016 client ip:23117 [vpnclient] Peer Connection Initiated with [AF_INET]client ip:23117
Sun Oct 23 14:11:12 2016 vpnclient/client ip:23117 MULTI: no dynamic or static remote --ifconfig address is available for vpnclient/client ip:23117
Sun Oct 23 14:11:16 2016 vpnclient/client ip:23117 PUSH: Received control message: 'PUSH_REQUEST'
Sun Oct 23 14:11:16 2016 vpnclient/client ip:23117 send_push_reply(): safe_cap=940
Sun Oct 23 14:11:16 2016 vpnclient/client ip:23117 SENT CONTROL [vpnclient]: 'PUSH_REPLY,route 192.168.0.0 255.255.255.255,ping 10,ping-restart 120' (status=1)
Sun Oct 23 14:11:26 2016 vpnclient/client ip:23117 MULTI: Learn: [mac address] -> vpnclient/client ip:23117
Sun Oct 23 14:11:29 2016 vpnclient/client ip:23117 MULTI: Learn: [mac address] -> vpnclient/client ip:23117

2nd connection:

Sun Oct 23 14:12:06 2016 client ip:25796 TLS: Initial packet from [AF_INET]client ip:25796, sid=x x
Sun Oct 23 14:12:07 2016 client ip:25796 VERIFY OK: depth=1, C=[...]
Sun Oct 23 14:12:07 2016 client ip:25796 VERIFY OK: depth=0, C=[...]
Sun Oct 23 14:12:07 2016 client ip:25796 Data Channel Encrypt: Cipher 'AES-256-OFB' initialized with 256 bit key
Sun Oct 23 14:12:07 2016 client ip:25796 Data Channel Encrypt: Using 512 bit message hash 'SHA512' for HMAC authentication
Sun Oct 23 14:12:07 2016 client ip:25796 Data Channel Decrypt: Cipher 'AES-256-OFB' initialized with 256 bit key
Sun Oct 23 14:12:07 2016 client ip:25796 Data Channel Decrypt: Using 512 bit message hash 'SHA512' for HMAC authentication
Sun Oct 23 14:12:07 2016 client ip:25796 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 4096 bit RSA
Sun Oct 23 14:12:07 2016 client ip:25796 [vpnclient] Peer Connection Initiated with [AF_INET]client ip:25796
Sun Oct 23 14:12:07 2016 MULTI: new connection by client 'vpnclient' will cause previous active sessions by this client to be dropped. Remember to use the --duplicate-cn option if you want multiple clients using the same certificate or username to concurrently connect.
Sun Oct 23 14:12:07 2016 MULTI: no dynamic or static remote --ifconfig address is available for vpnclient/client ip:25796
Sun Oct 23 14:12:09 2016 vpnclient/client ip:25796 PUSH: Received control message: 'PUSH_REQUEST'
Sun Oct 23 14:12:09 2016 vpnclient/client ip:25796 send_push_reply(): safe_cap=940
Sun Oct 23 14:12:09 2016 vpnclient/client ip:25796 SENT CONTROL [vpnclient]: 'PUSH_REPLY,route 192.168.0.0 255.255.255.255,ping 10,ping-restart 120' (status=1)
Sun Oct 23 14:12:09 2016 vpnclient/client ip:25796 MULTI: Learn: [mac address] -> vpnclient/client ip:25796
Sun Oct 23 14:12:20 2016 vpnclient/client ip:25796 MULTI: Learn: [mac address] -> vpnclient/client ip:25796

Except the hint of multiple connections from one client, I can't spot any differences between the two connection attempts.

TinCanTech

TinCanTech wroteYour server config is missing --server

vangrunz wroteI'm using bridge mode on my server.

vangrunz wroteDon't use --server if you are ethernet bridging. Use --server-bridge instead

:twisted:

vangrunz

Man...it's just the same:

--server-bridge ['nogw']

A helper directive similar to --server which is designed to simplify the configuration of OpenVPN's server mode in ethernet bridging configurations.

If --server-bridge is used without any parameters, it will enable a DHCP-proxy mode, where connecting OpenVPN clients will receive an IP address for their TAP adapter from the DHCP server running on the OpenVPN server-side LAN. Note that only clients that support the binding of a DHCP client with the TAP adapter (such as Windows) can support this mode. The optional nogw flag (advanced) indicates that gateway information should not be pushed to the client.

To configure ethernet bridging, you must first use your OS's bridging capability to bridge the TAP interface with the ethernet NIC interface. For example, on Linux this is done with the brctl tool, and with Windows XP it is done in the Network Connections Panel by selecting the ethernet and TAP adapters and right-clicking on "Bridge Connections".

Next you you must manually set the IP/netmask on the bridge interface. The gateway and netmask parameters to --server-bridge can be set to either the IP/netmask of the bridge interface, or the IP/netmask of the default gateway/router on the bridged subnet.

Finally, set aside a IP range in the bridged subnet, denoted by pool-start-IP and pool-end-IP, for OpenVPN to allocate to connecting clients.

For example, server-bridge 10.8.0.4 255.255.255.0 10.8.0.128 10.8.0.254 expands as follows:

mode server
tls-server

ifconfig-pool 10.8.0.128 10.8.0.254 255.255.255.0
push "route-gateway 10.8.0.4"

In another example, --server-bridge (without parameters) expands as follows:

mode server
tls-server

push "route-gateway dhcp"

Or --server-bridge nogw expands as follows:

mode server
tls-server

http://wiki.openvpn.eu/index.php/OpenVPN-Syntax

Again:
It is working. But not in the first connection.

vangrunz

*push*

Having still the same problem.

Doesn't have anybody any idea?

vangrunz

New update

This problem only affects the client.

Having an OpenVPN server constantly running, but restarting the client, I have to do a reconnection after the first establishment.

Pippin

Giving it a shot...

See --route-delay in manual.
https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage

TinCanTech

:lol: worth a shot in the dark .. :twisted:

vangrunz

Pippin wroteGiving it a shot...

See --route-delay in manual.
https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage

Thanks for reply.

In client config, there're the following directives present:

redirect-gateway def1

route-method exe
route-delay 2

I'll increase the values of route-delay and report what'll happen. That'll be next week.

vangrunz

The shot in the dark lightens up the room:

The value

route delay 2

is in fact too short. Increasing it to 10

route delay 10

works with the very first connection!

Thank you! The problem is now solved. 😃