Redirect Gateway doesnt work for everything

Delet0r

Greetings fellas,

I have a little problem with redirecting my gateway. I set up a OpenVPN server for my lab in university. We need the vpn to activate temporary licenses from a remote locations. The licencse server is installed on the same machine as the openVPN and uses tcp port 25734 and 25735 which is allowed in all firewalls.
When I connect to the vpn I cant connect to the license server. When I tested the connection pings to the gateway of my server, google and the dns of my university are redirected over the vpn but when I try to ping my own server and other subnets the packages are sent via localhost. (tested with nmap)

My setup is a windows server 2012r2 and the client is a windows 10. The server is NAT configured because I dont have an ips in my subnet left.
local <my server ip>
port 1194
proto udp
dev tun

# ----------------------------------------------
# Zertifikate
# ----------------------------------------------

dh "C:\\Program Files\\OpenVPN\\server-keys\\dh1024.pem"
ca "C:\\Program Files\\OpenVPN\\server-keys\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\server-keys\\server.crt"
key "C:\\Program Files\\OpenVPN\\server-keys\\server.key"

# ----------------------------------------------
# Server-Setup
# ----------------------------------------------

topology subnet

server 10.8.0.0 255.255.255.0

push "route 10.8.0.0 255.255.255.0"
push "redirect-gateway def1"
push "dhcp-option DNS <dns server university>"

keepalive 10 120

comp-lzo

status "C:\\Program Files\\OpenVPN\\log\\openvpn-status.log"
log "C:\\Program Files\\OpenVPN\\log\\openvpn.log"
log-append "C:\\Program Files\\OpenVPN\\log\\openvpn.log"
verb 3

#mute 10 client

dev tun

proto udp
remote <ip vpn server> # VPN server IP : PORT
nobind

push "redirect-gateway def1"

keepalive 10 900
inactive 3600
comp-lzo
#persist-key
#persist-tun

verb 3

ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\config\\client.crt"
key "C:\\Program Files\\OpenVPN\\config\\client.key" Has anyone a idea why the Server does not redirect all of the traffic?

TinCanTech

Please post server & client:

> netstat -r

Delet0r

Server

===========================================================================
Interface List
 17...	***		   ......TAP-Windows Adapter V9
 13...	***		   ......Broadcom NetXtreme Gigabit Ethernet #2
 12...	***		   ......Broadcom NetXtreme Gigabit Ethernet
  1...........................Software Loopback Interface 1
 14...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
 15...00 00 00 00 00 00 00 e0 Microsoft 6to4 Adapter
 18...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination          Netmask          Gateway       Interface  Metric
          0.0.0.0            0.0.0.0     <server ip>      <server ip>     266
         10.8.0.0      255.255.255.0         On-link          10.8.0.1    276
         10.8.0.1    255.255.255.255         On-link          10.8.0.1    276
       10.8.0.255    255.255.255.255         On-link          10.8.0.1    276
        127.0.0.0          255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1    255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255    255.255.255.255         On-link         127.0.0.1    306
 <server subnet.0>     255.255.255.0         On-link       <server ip>    266
      <server ip>    255.255.255.255         On-link       <server ip>    266
 <server subnet.255> 255.255.255.255         On-link       <server ip>    266
        224.0.0.0          240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0          240.0.0.0         On-link          10.8.0.1    276
        224.0.0.0          240.0.0.0         On-link       <server ip>    266
  255.255.255.255    255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255    255.255.255.255         On-link          10.8.0.1    276
  255.255.255.255    255.255.255.255         On-link       <server ip>    266
===========================================================================

Client (nestat does not work with usb tethering so this is a netstat from another subnet)

===========================================================================
Schnittstellenliste
  3...		***	 ......Npcap Loopback Adapter
  6...		***	 ......Microsoft Wi-Fi Direct Virtual Adapter
  9...		***	 ......Intel(R) 82579LM Gigabit Network Connection
  2...		***	 ......TAP-Windows Adapter V9
  7...		***	 ......Intel(R) Centrino(R) Advanced-N 6205
  1...........................Software Loopback Interface 1
 19...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #4
 13...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #5
===========================================================================
IPv4-Routentabelle
===========================================================================
Aktive Routen:
     Netzwerkziel    Netzwerkmaske          Gateway    Schnittstelle Metrik
          0.0.0.0          0.0.0.0     <server gateway>   <client ip>    291
          0.0.0.0        128.0.0.0         10.8.0.1         10.8.0.2     35
         10.8.0.0    255.255.255.0   Auf Verbindung          10.8.0.2    291
         10.8.0.0    255.255.255.0         10.8.0.1         10.8.0.2     35
         10.8.0.2  255.255.255.255   Auf Verbindung          10.8.0.2    291
       10.8.0.255  255.255.255.255   Auf Verbindung          10.8.0.2    291
        127.0.0.0        255.0.0.0   Auf Verbindung         127.0.0.1    331
        127.0.0.1  255.255.255.255   Auf Verbindung         127.0.0.1    331
  127.255.255.255  255.255.255.255   Auf Verbindung         127.0.0.1    331
        128.0.0.0        128.0.0.0         10.8.0.1         10.8.0.2     35
 <server subnet.0>    255.255.255.0   Auf Verbindung     <client ip>    291
    <client ip>	 255.255.255.255   Auf Verbindung     <client ip>    291
   <server subnet.255>  255.255.255.255   Auf Verbindung     <client ip>    291
   <server ip>  	255.255.255.255     141.64.150.1    <client ip>     35
   <server ip>  	255.255.255.255         10.8.0.1         10.8.0.2     35
      169.254.0.0      255.255.0.0   Auf Verbindung   169.254.234.189    281
  169.254.234.189  255.255.255.255   Auf Verbindung   169.254.234.189    281
  169.254.255.255  255.255.255.255   Auf Verbindung   169.254.234.189    281
        224.0.0.0        240.0.0.0   Auf Verbindung         127.0.0.1    331
        224.0.0.0        240.0.0.0   Auf Verbindung     <client ip>    291
        224.0.0.0        240.0.0.0   Auf Verbindung   169.254.234.189    281
        224.0.0.0        240.0.0.0   Auf Verbindung          10.8.0.2    291
  255.255.255.255  255.255.255.255   Auf Verbindung         127.0.0.1    331
  255.255.255.255  255.255.255.255   Auf Verbindung     <client ip>   291
  255.255.255.255  255.255.255.255   Auf Verbindung   169.254.234.189    281
  255.255.255.255  255.255.255.255   Auf Verbindung          10.8.0.2    291
===========================================================================

TinCanTech

Are your server IP and client IP RFC1918 compliant, if so hiding them is of no consequence. It is important that they do not share the same subnet however, for example 192.168.0.0/24 ..

Delet0r

They do not share the same subnet.

TinCanTech

Delet0r wroteClient (nestat does not work with usb tethering so this is a netstat from another subnet)

I need the actual routing table .. try

> route print

Also, please append your sanitized client log file at --verb 4

Delet0r

Nice trick 🙂, it worked.

Routingtable

IPv4-Routentabelle

===========================================================================
Aktive Routen:
     Netzwerkziel    Netzwerkmaske          Gateway    Schnittstelle Metrik
          0.0.0.0          0.0.0.0   192.168.42.129     192.168.42.9     25
          0.0.0.0        128.0.0.0         10.8.0.1         10.8.0.2     35
         10.8.0.0    255.255.255.0   Auf Verbindung          10.8.0.2    291
         10.8.0.0    255.255.255.0         10.8.0.1         10.8.0.2     35
         10.8.0.2  255.255.255.255   Auf Verbindung          10.8.0.2    291
       10.8.0.255  255.255.255.255   Auf Verbindung          10.8.0.2    291
        127.0.0.0        255.0.0.0   Auf Verbindung         127.0.0.1    331
        127.0.0.1  255.255.255.255   Auf Verbindung         127.0.0.1    331
  127.255.255.255  255.255.255.255   Auf Verbindung         127.0.0.1    331
        128.0.0.0        128.0.0.0         10.8.0.1         10.8.0.2     35
   <server ip>         255.255.255.255   192.168.42.129     192.168.42.9     25
   <server ip>         255.255.255.255         10.8.0.1         10.8.0.2     35
      169.254.0.0      255.255.0.0   Auf Verbindung   169.254.234.189    281
  169.254.234.189  255.255.255.255   Auf Verbindung   169.254.234.189    281
  169.254.255.255  255.255.255.255   Auf Verbindung   169.254.234.189    281
     192.168.42.0    255.255.255.0   Auf Verbindung      192.168.42.9    281
     192.168.42.9  255.255.255.255   Auf Verbindung      192.168.42.9    281
   192.168.42.255  255.255.255.255   Auf Verbindung      192.168.42.9    281
        224.0.0.0        240.0.0.0   Auf Verbindung         127.0.0.1    331
        224.0.0.0        240.0.0.0   Auf Verbindung   169.254.234.189    281
        224.0.0.0        240.0.0.0   Auf Verbindung          10.8.0.2    291
        224.0.0.0        240.0.0.0   Auf Verbindung      192.168.42.9    281
  255.255.255.255  255.255.255.255   Auf Verbindung         127.0.0.1    331
  255.255.255.255  255.255.255.255   Auf Verbindung   169.254.234.189    281
  255.255.255.255  255.255.255.255   Auf Verbindung          10.8.0.2    291
  255.255.255.255  255.255.255.255   Auf Verbindung      192.168.42.9    281
===========================================================================

OpenVPN log verb 4:

Wed Jan 18 19:27:37 2017 us=831816 Current Parameter Settings:
Wed Jan 18 19:27:37 2017 us=862660   config = 'client.ovpn'
Wed Jan 18 19:27:37 2017 us=862660   mode = 0
Wed Jan 18 19:27:37 2017 us=862660   show_ciphers = DISABLED
Wed Jan 18 19:27:37 2017 us=862660   show_digests = DISABLED
Wed Jan 18 19:27:37 2017 us=862660   show_engines = DISABLED
Wed Jan 18 19:27:37 2017 us=862660   genkey = DISABLED
Wed Jan 18 19:27:37 2017 us=862660   key_pass_file = '[UNDEF]'
Wed Jan 18 19:27:37 2017 us=862660   show_tls_ciphers = DISABLED
Wed Jan 18 19:27:37 2017 us=862660 Connection profiles [default]:
Wed Jan 18 19:27:37 2017 us=862660   proto = udp
Wed Jan 18 19:27:37 2017 us=862660   local = '[UNDEF]'
Wed Jan 18 19:27:37 2017 us=862660   local_port = 0
Wed Jan 18 19:27:37 2017 us=862660   remote = '<server ip>'
Wed Jan 18 19:27:37 2017 us=862660   remote_port = 1194
Wed Jan 18 19:27:37 2017 us=862660   remote_float = DISABLED
Wed Jan 18 19:27:37 2017 us=862660   bind_defined = DISABLED
Wed Jan 18 19:27:37 2017 us=862660   bind_local = DISABLED
Wed Jan 18 19:27:37 2017 us=862660   connect_retry_seconds = 5
Wed Jan 18 19:27:37 2017 us=862660   connect_timeout = 10
Wed Jan 18 19:27:37 2017 us=862660   connect_retry_max = 0
Wed Jan 18 19:27:37 2017 us=862660   socks_proxy_server = '[UNDEF]'
Wed Jan 18 19:27:37 2017 us=862660   socks_proxy_port = 0
Wed Jan 18 19:27:37 2017 us=862660   socks_proxy_retry = DISABLED
Wed Jan 18 19:27:37 2017 us=862660   tun_mtu = 1500
Wed Jan 18 19:27:37 2017 us=862660   tun_mtu_defined = ENABLED
Wed Jan 18 19:27:37 2017 us=862660   link_mtu = 1500
Wed Jan 18 19:27:37 2017 us=862660   link_mtu_defined = DISABLED
Wed Jan 18 19:27:37 2017 us=862660   tun_mtu_extra = 0
Wed Jan 18 19:27:37 2017 us=862660   tun_mtu_extra_defined = DISABLED
Wed Jan 18 19:27:37 2017 us=862660   mtu_discover_type = -1
Wed Jan 18 19:27:37 2017 us=862660   fragment = 0
Wed Jan 18 19:27:37 2017 us=862660   mssfix = 1450
Wed Jan 18 19:27:37 2017 us=862660   explicit_exit_notification = 0
Wed Jan 18 19:27:37 2017 us=862660 Connection profiles END
Wed Jan 18 19:27:37 2017 us=862660   remote_random = DISABLED
Wed Jan 18 19:27:37 2017 us=862660   ipchange = '[UNDEF]'
Wed Jan 18 19:27:37 2017 us=862660   dev = 'tun'
Wed Jan 18 19:27:37 2017 us=862660   dev_type = '[UNDEF]'
Wed Jan 18 19:27:37 2017 us=862660   dev_node = '[UNDEF]'
Wed Jan 18 19:27:37 2017 us=862660   lladdr = '[UNDEF]'
Wed Jan 18 19:27:37 2017 us=862660   topology = 1
Wed Jan 18 19:27:37 2017 us=862660   tun_ipv6 = DISABLED
Wed Jan 18 19:27:37 2017 us=862660   ifconfig_local = '[UNDEF]'
Wed Jan 18 19:27:37 2017 us=862660   ifconfig_remote_netmask = '[UNDEF]'
Wed Jan 18 19:27:37 2017 us=862660   ifconfig_noexec = DISABLED
Wed Jan 18 19:27:37 2017 us=862660   ifconfig_nowarn = DISABLED
Wed Jan 18 19:27:37 2017 us=862660   ifconfig_ipv6_local = '[UNDEF]'
Wed Jan 18 19:27:37 2017 us=862660   ifconfig_ipv6_netbits = 0
Wed Jan 18 19:27:37 2017 us=862660   ifconfig_ipv6_remote = '[UNDEF]'
Wed Jan 18 19:27:37 2017 us=862660   shaper = 0
Wed Jan 18 19:27:37 2017 us=862660   mtu_test = 0
Wed Jan 18 19:27:37 2017 us=862660   mlock = DISABLED
Wed Jan 18 19:27:37 2017 us=862660   keepalive_ping = 10
Wed Jan 18 19:27:37 2017 us=862660   keepalive_timeout = 900
Wed Jan 18 19:27:37 2017 us=862660   inactivity_timeout = 3600
Wed Jan 18 19:27:37 2017 us=862660   ping_send_timeout = 10
Wed Jan 18 19:27:37 2017 us=862660   ping_rec_timeout = 900
Wed Jan 18 19:27:37 2017 us=863673   ping_rec_timeout_action = 2
Wed Jan 18 19:27:37 2017 us=863673   ping_timer_remote = DISABLED
Wed Jan 18 19:27:37 2017 us=863673   remap_sigusr1 = 0
Wed Jan 18 19:27:37 2017 us=863673   persist_tun = DISABLED
Wed Jan 18 19:27:37 2017 us=863673   persist_local_ip = DISABLED
Wed Jan 18 19:27:37 2017 us=863673   persist_remote_ip = DISABLED
Wed Jan 18 19:27:37 2017 us=863673   persist_key = DISABLED
Wed Jan 18 19:27:37 2017 us=863673   passtos = DISABLED
Wed Jan 18 19:27:37 2017 us=863673   resolve_retry_seconds = 1000000000
Wed Jan 18 19:27:37 2017 us=863673   username = '[UNDEF]'
Wed Jan 18 19:27:37 2017 us=863673   groupname = '[UNDEF]'
Wed Jan 18 19:27:37 2017 us=863673   chroot_dir = '[UNDEF]'
Wed Jan 18 19:27:37 2017 us=863673   cd_dir = '[UNDEF]'
Wed Jan 18 19:27:37 2017 us=863673   writepid = '[UNDEF]'
Wed Jan 18 19:27:37 2017 us=863673   up_script = '[UNDEF]'
Wed Jan 18 19:27:37 2017 us=863673   down_script = '[UNDEF]'
Wed Jan 18 19:27:37 2017 us=863673   down_pre = DISABLED
Wed Jan 18 19:27:37 2017 us=863673   up_restart = DISABLED
Wed Jan 18 19:27:37 2017 us=863673   up_delay = DISABLED
Wed Jan 18 19:27:37 2017 us=863673   daemon = DISABLED
Wed Jan 18 19:27:37 2017 us=863673   inetd = 0
Wed Jan 18 19:27:37 2017 us=863673   log = ENABLED
Wed Jan 18 19:27:37 2017 us=863673   suppress_timestamps = DISABLED
Wed Jan 18 19:27:37 2017 us=863673   nice = 0
Wed Jan 18 19:27:37 2017 us=863673   verbosity = 4
Wed Jan 18 19:27:37 2017 us=863673   mute = 0
Wed Jan 18 19:27:37 2017 us=863673   gremlin = 0
Wed Jan 18 19:27:37 2017 us=863673   status_file = '[UNDEF]'
Wed Jan 18 19:27:37 2017 us=863673   status_file_version = 1
Wed Jan 18 19:27:37 2017 us=863673   status_file_update_freq = 60
Wed Jan 18 19:27:37 2017 us=863673   occ = ENABLED
Wed Jan 18 19:27:37 2017 us=863673   rcvbuf = 0
Wed Jan 18 19:27:37 2017 us=863673   sndbuf = 0
Wed Jan 18 19:27:37 2017 us=863673   sockflags = 0
Wed Jan 18 19:27:37 2017 us=863673   fast_io = DISABLED
Wed Jan 18 19:27:37 2017 us=863673   lzo = 7
Wed Jan 18 19:27:37 2017 us=863673   route_script = '[UNDEF]'
Wed Jan 18 19:27:37 2017 us=863673   route_default_gateway = '[UNDEF]'
Wed Jan 18 19:27:37 2017 us=863673   route_default_metric = 0
Wed Jan 18 19:27:37 2017 us=863673   route_noexec = DISABLED
Wed Jan 18 19:27:37 2017 us=863673   route_delay = 5
Wed Jan 18 19:27:37 2017 us=863673   route_delay_window = 30
Wed Jan 18 19:27:37 2017 us=863673   route_delay_defined = ENABLED
Wed Jan 18 19:27:37 2017 us=863673   route_nopull = DISABLED
Wed Jan 18 19:27:37 2017 us=863673   route_gateway_via_dhcp = DISABLED
Wed Jan 18 19:27:37 2017 us=863673   max_routes = 100
Wed Jan 18 19:27:37 2017 us=863673   allow_pull_fqdn = DISABLED
Wed Jan 18 19:27:37 2017 us=863673   management_addr = '127.0.0.1'
Wed Jan 18 19:27:37 2017 us=863673   management_port = 25341
Wed Jan 18 19:27:37 2017 us=863673   management_user_pass = 'stdin'
Wed Jan 18 19:27:37 2017 us=863673   management_log_history_cache = 250
Wed Jan 18 19:27:37 2017 us=863673   management_echo_buffer_size = 100
Wed Jan 18 19:27:37 2017 us=863673   management_write_peer_info_file = '[UNDEF]'
Wed Jan 18 19:27:37 2017 us=863673   management_client_user = '[UNDEF]'
Wed Jan 18 19:27:37 2017 us=863673   management_client_group = '[UNDEF]'
Wed Jan 18 19:27:37 2017 us=863673   management_flags = 6
Wed Jan 18 19:27:37 2017 us=863673   shared_secret_file = '[UNDEF]'
Wed Jan 18 19:27:37 2017 us=863673   key_direction = 0
Wed Jan 18 19:27:37 2017 us=863673   ciphername_defined = ENABLED
Wed Jan 18 19:27:37 2017 us=863673   ciphername = 'BF-CBC'
Wed Jan 18 19:27:37 2017 us=863673   authname_defined = ENABLED
Wed Jan 18 19:27:37 2017 us=863673   authname = 'SHA1'
Wed Jan 18 19:27:37 2017 us=863673   prng_hash = 'SHA1'
Wed Jan 18 19:27:37 2017 us=863673   prng_nonce_secret_len = 16
Wed Jan 18 19:27:37 2017 us=863673   keysize = 0
Wed Jan 18 19:27:37 2017 us=863673   engine = DISABLED
Wed Jan 18 19:27:37 2017 us=863673   replay = ENABLED
Wed Jan 18 19:27:37 2017 us=863673   mute_replay_warnings = DISABLED
Wed Jan 18 19:27:37 2017 us=863673   replay_window = 64
Wed Jan 18 19:27:37 2017 us=863673   replay_time = 15
Wed Jan 18 19:27:37 2017 us=863673   packet_id_file = '[UNDEF]'
Wed Jan 18 19:27:37 2017 us=863673   use_iv = ENABLED
Wed Jan 18 19:27:37 2017 us=863673   test_crypto = DISABLED
Wed Jan 18 19:27:37 2017 us=863673   tls_server = DISABLED
Wed Jan 18 19:27:37 2017 us=863673   tls_client = ENABLED
Wed Jan 18 19:27:37 2017 us=863673   key_method = 2
Wed Jan 18 19:27:37 2017 us=863673   ca_file = 'C:\Program Files\OpenVPN\config\ca.crt'
Wed Jan 18 19:27:37 2017 us=863673   ca_path = '[UNDEF]'
Wed Jan 18 19:27:37 2017 us=863673   dh_file = '[UNDEF]'
Wed Jan 18 19:27:37 2017 us=863673   cert_file = 'C:\Program Files\OpenVPN\config\client.crt'
Wed Jan 18 19:27:37 2017 us=863673   extra_certs_file = '[UNDEF]'
Wed Jan 18 19:27:37 2017 us=863673   priv_key_file = 'C:\Program Files\OpenVPN\config\client.key'
Wed Jan 18 19:27:37 2017 us=863673   pkcs12_file = '[UNDEF]'
Wed Jan 18 19:27:37 2017 us=863673   cryptoapi_cert = '[UNDEF]'
Wed Jan 18 19:27:37 2017 us=863673   cipher_list = '[UNDEF]'
Wed Jan 18 19:27:37 2017 us=863673   tls_verify = '[UNDEF]'
Wed Jan 18 19:27:37 2017 us=863673   tls_export_cert = '[UNDEF]'
Wed Jan 18 19:27:37 2017 us=863673   verify_x509_type = 0
Wed Jan 18 19:27:37 2017 us=863673   verify_x509_name = '[UNDEF]'
Wed Jan 18 19:27:37 2017 us=863673   crl_file = '[UNDEF]'
Wed Jan 18 19:27:37 2017 us=863673   ns_cert_type = 0
Wed Jan 18 19:27:37 2017 us=863673   remote_cert_ku[i] = 0
Wed Jan 18 19:27:37 2017 us=863673   remote_cert_ku[i] = 0
Wed Jan 18 19:27:37 2017 us=863673   remote_cert_ku[i] = 0
Wed Jan 18 19:27:37 2017 us=863673   remote_cert_ku[i] = 0
Wed Jan 18 19:27:37 2017 us=863673   remote_cert_ku[i] = 0
Wed Jan 18 19:27:37 2017 us=863673   remote_cert_ku[i] = 0
Wed Jan 18 19:27:37 2017 us=863673   remote_cert_ku[i] = 0
Wed Jan 18 19:27:37 2017 us=863673   remote_cert_ku[i] = 0
Wed Jan 18 19:27:37 2017 us=863673   remote_cert_ku[i] = 0
Wed Jan 18 19:27:37 2017 us=863673   remote_cert_ku[i] = 0
Wed Jan 18 19:27:37 2017 us=863673   remote_cert_ku[i] = 0
Wed Jan 18 19:27:37 2017 us=863673   remote_cert_ku[i] = 0
Wed Jan 18 19:27:37 2017 us=863673   remote_cert_ku[i] = 0
Wed Jan 18 19:27:37 2017 us=863673   remote_cert_ku[i] = 0
Wed Jan 18 19:27:37 2017 us=863673   remote_cert_ku[i] = 0
Wed Jan 18 19:27:37 2017 us=863673   remote_cert_ku[i] = 0
Wed Jan 18 19:27:37 2017 us=863673   remote_cert_eku = '[UNDEF]'
Wed Jan 18 19:27:37 2017 us=863673   ssl_flags = 0
Wed Jan 18 19:27:37 2017 us=863673   tls_timeout = 2
Wed Jan 18 19:27:37 2017 us=863673   renegotiate_bytes = -1
Wed Jan 18 19:27:37 2017 us=863673   renegotiate_packets = 0
Wed Jan 18 19:27:37 2017 us=863673   renegotiate_seconds = 3600
Wed Jan 18 19:27:37 2017 us=863673   handshake_window = 60
Wed Jan 18 19:27:37 2017 us=863673   transition_window = 3600
Wed Jan 18 19:27:37 2017 us=864666   single_session = DISABLED
Wed Jan 18 19:27:37 2017 us=864666   push_peer_info = DISABLED
Wed Jan 18 19:27:37 2017 us=864666   tls_exit = DISABLED
Wed Jan 18 19:27:37 2017 us=864666   tls_auth_file = '[UNDEF]'
Wed Jan 18 19:27:37 2017 us=864666   pkcs11_protected_authentication = DISABLED
Wed Jan 18 19:27:37 2017 us=864666   pkcs11_protected_authentication = DISABLED
Wed Jan 18 19:27:37 2017 us=864666   pkcs11_protected_authentication = DISABLED
Wed Jan 18 19:27:37 2017 us=864666   pkcs11_protected_authentication = DISABLED
Wed Jan 18 19:27:37 2017 us=864666   pkcs11_protected_authentication = DISABLED
Wed Jan 18 19:27:37 2017 us=864666   pkcs11_protected_authentication = DISABLED
Wed Jan 18 19:27:37 2017 us=864666   pkcs11_protected_authentication = DISABLED
Wed Jan 18 19:27:37 2017 us=864666   pkcs11_protected_authentication = DISABLED
Wed Jan 18 19:27:37 2017 us=864666   pkcs11_protected_authentication = DISABLED
Wed Jan 18 19:27:37 2017 us=864666   pkcs11_protected_authentication = DISABLED
Wed Jan 18 19:27:37 2017 us=864666   pkcs11_protected_authentication = DISABLED
Wed Jan 18 19:27:37 2017 us=864666   pkcs11_protected_authentication = DISABLED
Wed Jan 18 19:27:37 2017 us=864666   pkcs11_protected_authentication = DISABLED
Wed Jan 18 19:27:37 2017 us=864666   pkcs11_protected_authentication = DISABLED
Wed Jan 18 19:27:37 2017 us=864666   pkcs11_protected_authentication = DISABLED
Wed Jan 18 19:27:37 2017 us=864666   pkcs11_protected_authentication = DISABLED
Wed Jan 18 19:27:37 2017 us=864666   pkcs11_private_mode = 00000000
Wed Jan 18 19:27:37 2017 us=864666   pkcs11_private_mode = 00000000
Wed Jan 18 19:27:37 2017 us=864666   pkcs11_private_mode = 00000000
Wed Jan 18 19:27:37 2017 us=864666   pkcs11_private_mode = 00000000
Wed Jan 18 19:27:37 2017 us=864666   pkcs11_private_mode = 00000000
Wed Jan 18 19:27:37 2017 us=864666   pkcs11_private_mode = 00000000
Wed Jan 18 19:27:37 2017 us=864666   pkcs11_private_mode = 00000000
Wed Jan 18 19:27:37 2017 us=864666   pkcs11_private_mode = 00000000
Wed Jan 18 19:27:37 2017 us=864666   pkcs11_private_mode = 00000000
Wed Jan 18 19:27:37 2017 us=864666   pkcs11_private_mode = 00000000
Wed Jan 18 19:27:37 2017 us=864666   pkcs11_private_mode = 00000000
Wed Jan 18 19:27:37 2017 us=864666   pkcs11_private_mode = 00000000
Wed Jan 18 19:27:37 2017 us=864666   pkcs11_private_mode = 00000000
Wed Jan 18 19:27:37 2017 us=864666   pkcs11_private_mode = 00000000
Wed Jan 18 19:27:37 2017 us=864666   pkcs11_private_mode = 00000000
Wed Jan 18 19:27:37 2017 us=864666   pkcs11_private_mode = 00000000
Wed Jan 18 19:27:37 2017 us=864666   pkcs11_cert_private = DISABLED
Wed Jan 18 19:27:37 2017 us=864666   pkcs11_cert_private = DISABLED
Wed Jan 18 19:27:37 2017 us=864666   pkcs11_cert_private = DISABLED
Wed Jan 18 19:27:37 2017 us=864666   pkcs11_cert_private = DISABLED
Wed Jan 18 19:27:37 2017 us=864666   pkcs11_cert_private = DISABLED
Wed Jan 18 19:27:37 2017 us=864666   pkcs11_cert_private = DISABLED
Wed Jan 18 19:27:37 2017 us=864666   pkcs11_cert_private = DISABLED
Wed Jan 18 19:27:37 2017 us=864666   pkcs11_cert_private = DISABLED
Wed Jan 18 19:27:37 2017 us=864666   pkcs11_cert_private = DISABLED
Wed Jan 18 19:27:37 2017 us=864666   pkcs11_cert_private = DISABLED
Wed Jan 18 19:27:37 2017 us=864666   pkcs11_cert_private = DISABLED
Wed Jan 18 19:27:37 2017 us=864666   pkcs11_cert_private = DISABLED
Wed Jan 18 19:27:37 2017 us=864666   pkcs11_cert_private = DISABLED
Wed Jan 18 19:27:37 2017 us=864666   pkcs11_cert_private = DISABLED
Wed Jan 18 19:27:37 2017 us=864666   pkcs11_cert_private = DISABLED
Wed Jan 18 19:27:37 2017 us=864666   pkcs11_cert_private = DISABLED
Wed Jan 18 19:27:37 2017 us=864666   pkcs11_pin_cache_period = -1
Wed Jan 18 19:27:37 2017 us=864666   pkcs11_id = '[UNDEF]'
Wed Jan 18 19:27:37 2017 us=864666   pkcs11_id_management = DISABLED
Wed Jan 18 19:27:37 2017 us=864666   server_network = 0.0.0.0
Wed Jan 18 19:27:37 2017 us=864666   server_netmask = 0.0.0.0
Wed Jan 18 19:27:37 2017 us=884797   server_network_ipv6 = ::
Wed Jan 18 19:27:37 2017 us=884797   server_netbits_ipv6 = 0
Wed Jan 18 19:27:37 2017 us=884797   server_bridge_ip = 0.0.0.0
Wed Jan 18 19:27:37 2017 us=884797   server_bridge_netmask = 0.0.0.0
Wed Jan 18 19:27:37 2017 us=884797   server_bridge_pool_start = 0.0.0.0
Wed Jan 18 19:27:37 2017 us=884797   server_bridge_pool_end = 0.0.0.0
Wed Jan 18 19:27:37 2017 us=884797   push_entry = 'redirect-gateway def1'
Wed Jan 18 19:27:37 2017 us=884797   ifconfig_pool_defined = DISABLED
Wed Jan 18 19:27:37 2017 us=884797   ifconfig_pool_start = 0.0.0.0
Wed Jan 18 19:27:37 2017 us=884797   ifconfig_pool_end = 0.0.0.0
Wed Jan 18 19:27:37 2017 us=884797   ifconfig_pool_netmask = 0.0.0.0
Wed Jan 18 19:27:37 2017 us=884797   ifconfig_pool_persist_filename = '[UNDEF]'
Wed Jan 18 19:27:37 2017 us=884797   ifconfig_pool_persist_refresh_freq = 600
Wed Jan 18 19:27:37 2017 us=884797   ifconfig_ipv6_pool_defined = DISABLED
Wed Jan 18 19:27:37 2017 us=884797   ifconfig_ipv6_pool_base = ::
Wed Jan 18 19:27:37 2017 us=884797   ifconfig_ipv6_pool_netbits = 0
Wed Jan 18 19:27:37 2017 us=884797   n_bcast_buf = 256
Wed Jan 18 19:27:37 2017 us=884797   tcp_queue_limit = 64
Wed Jan 18 19:27:37 2017 us=884797   real_hash_size = 256
Wed Jan 18 19:27:37 2017 us=884797   virtual_hash_size = 256
Wed Jan 18 19:27:37 2017 us=884797   client_connect_script = '[UNDEF]'
Wed Jan 18 19:27:37 2017 us=884797   learn_address_script = '[UNDEF]'
Wed Jan 18 19:27:37 2017 us=884797   client_disconnect_script = '[UNDEF]'
Wed Jan 18 19:27:37 2017 us=884797   client_config_dir = '[UNDEF]'
Wed Jan 18 19:27:37 2017 us=884797   ccd_exclusive = DISABLED
Wed Jan 18 19:27:37 2017 us=884797   tmp_dir = 'C:\Users\Delet0r\AppData\Local\Temp\'
Wed Jan 18 19:27:37 2017 us=884797   push_ifconfig_defined = DISABLED
Wed Jan 18 19:27:37 2017 us=884797   push_ifconfig_local = 0.0.0.0
Wed Jan 18 19:27:37 2017 us=884797   push_ifconfig_remote_netmask = 0.0.0.0
Wed Jan 18 19:27:37 2017 us=884797   push_ifconfig_ipv6_defined = DISABLED
Wed Jan 18 19:27:37 2017 us=884797   push_ifconfig_ipv6_local = ::/0
Wed Jan 18 19:27:37 2017 us=884797   push_ifconfig_ipv6_remote = ::
Wed Jan 18 19:27:37 2017 us=884797   enable_c2c = DISABLED
Wed Jan 18 19:27:37 2017 us=884797   duplicate_cn = DISABLED
Wed Jan 18 19:27:37 2017 us=884797   cf_max = 0
Wed Jan 18 19:27:37 2017 us=884797   cf_per = 0
Wed Jan 18 19:27:37 2017 us=884797   max_clients = 1024
Wed Jan 18 19:27:37 2017 us=884797   max_routes_per_client = 256
Wed Jan 18 19:27:37 2017 us=884797   auth_user_pass_verify_script = '[UNDEF]'
Wed Jan 18 19:27:37 2017 us=884797   auth_user_pass_verify_script_via_file = DISABLED
Wed Jan 18 19:27:37 2017 us=884797   client = ENABLED
Wed Jan 18 19:27:37 2017 us=884797   pull = ENABLED
Wed Jan 18 19:27:37 2017 us=884797   auth_user_pass_file = '[UNDEF]'
Wed Jan 18 19:27:37 2017 us=884797   show_net_up = DISABLED
Wed Jan 18 19:27:37 2017 us=884797   route_method = 0
Wed Jan 18 19:27:37 2017 us=884797   block_outside_dns = DISABLED
Wed Jan 18 19:27:37 2017 us=884797   ip_win32_defined = DISABLED
Wed Jan 18 19:27:37 2017 us=884797   ip_win32_type = 3
Wed Jan 18 19:27:37 2017 us=884797   dhcp_masq_offset = 0
Wed Jan 18 19:27:37 2017 us=884797   dhcp_lease_time = 31536000
Wed Jan 18 19:27:37 2017 us=884797   tap_sleep = 0
Wed Jan 18 19:27:37 2017 us=884797   dhcp_options = DISABLED
Wed Jan 18 19:27:37 2017 us=884797   dhcp_renew = DISABLED
Wed Jan 18 19:27:37 2017 us=884797   dhcp_pre_release = DISABLED
Wed Jan 18 19:27:37 2017 us=884797   dhcp_release = DISABLED
Wed Jan 18 19:27:37 2017 us=884797   domain = '[UNDEF]'
Wed Jan 18 19:27:37 2017 us=884797   netbios_scope = '[UNDEF]'
Wed Jan 18 19:27:37 2017 us=884797   netbios_node_type = 0
Wed Jan 18 19:27:37 2017 us=884797   disable_nbt = DISABLED
Wed Jan 18 19:27:37 2017 us=884797 OpenVPN 2.3.13 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Nov  3 2016
Wed Jan 18 19:27:37 2017 us=884797 Windows version 6.2 (Windows 8 or greater) 64bit
Wed Jan 18 19:27:37 2017 us=884797 library versions: OpenSSL 1.0.1u  22 Sep 2016, LZO 2.09
Enter Management Password:
Wed Jan 18 19:27:37 2017 us=884797 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25341
Wed Jan 18 19:27:37 2017 us=884797 Need hold release from management interface, waiting...
Wed Jan 18 19:27:38 2017 us=107169 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25341
Wed Jan 18 19:27:38 2017 us=222797 MANAGEMENT: CMD 'state on'
Wed Jan 18 19:27:38 2017 us=222797 MANAGEMENT: CMD 'log all on'
Wed Jan 18 19:27:38 2017 us=391271 MANAGEMENT: CMD 'hold off'
Wed Jan 18 19:27:38 2017 us=391271 MANAGEMENT: CMD 'hold release'
Wed Jan 18 19:27:38 2017 us=391271 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Wed Jan 18 19:27:38 2017 us=638689 LZO compression initialized
Wed Jan 18 19:27:38 2017 us=638689 Control Channel MTU parms [ L:1542 D:1212 EF:38 EB:0 ET:0 EL:3 ]
Wed Jan 18 19:27:38 2017 us=638689 Socket Buffers: R=[65536->65536] S=[65536->65536]
Wed Jan 18 19:27:38 2017 us=638689 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:143 ET:0 EL:3 AF:3/1 ]
Wed Jan 18 19:27:38 2017 us=638689 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Wed Jan 18 19:27:38 2017 us=638689 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Wed Jan 18 19:27:38 2017 us=638689 Local Options hash (VER=V4): '41690919'
Wed Jan 18 19:27:38 2017 us=638689 Expected Remote Options hash (VER=V4): '530fdded'
Wed Jan 18 19:27:38 2017 us=638689 UDPv4 link local: [undef]
Wed Jan 18 19:27:38 2017 us=638689 UDPv4 link remote: [AF_INET]<server ip>:1194
Wed Jan 18 19:27:38 2017 us=638689 MANAGEMENT: >STATE:1484764058,WAIT,,,
Wed Jan 18 19:27:38 2017 us=638689 MANAGEMENT: >STATE:1484764058,AUTH,,,
Wed Jan 18 19:27:38 2017 us=638689 TLS: Initial packet from [AF_INET]<server ip>:1194, sid=80f192ed b16520a6
Wed Jan 18 19:27:38 2017 us=638689 VERIFY OK: depth=1, C=DE, ST=, L=, O=NRL, OU=OpenVPN, CN=, name=BONO, 
emailAddress=mail@host.domain
Wed Jan 18 19:27:38 2017 us=638689 VERIFY OK: depth=0, C=DE, ST=, L=, O=NRL, OU=OpenVPN, CN=, name=BONO, emailAddress=mail@host.domain
Wed Jan 18 19:27:38 2017 us=655675 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Jan 18 19:27:38 2017 us=655675 WARNING: INSECURE cipher with block size less than 128 bit (64 bit).  This allows attacks like SWEET32.  Mitigate by using a --cipher with a larger block size (e.g. AES-256-CBC).
Wed Jan 18 19:27:38 2017 us=655675 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Jan 18 19:27:38 2017 us=655675 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Jan 18 19:27:38 2017 us=655675 WARNING: INSECURE cipher with block size less than 128 bit (64 bit).  This allows attacks like SWEET32.  Mitigate by using a --cipher with a larger block size (e.g. AES-256-CBC).
Wed Jan 18 19:27:38 2017 us=655675 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Jan 18 19:27:38 2017 us=655675 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 1024 bit RSA
Wed Jan 18 19:27:38 2017 us=656675 [bono.neurorobotik.de] Peer Connection Initiated with [AF_INET]<server ip>:1194
Wed Jan 18 19:27:39 2017 us=672497 MANAGEMENT: >STATE:1484764059,GET_CONFIG,,,
Wed Jan 18 19:27:40 2017 us=678511 SENT CONTROL [bono.neurorobotik.de]: 'PUSH_REQUEST' (status=1)
Wed Jan 18 19:27:40 2017 us=679463 PUSH: Received control message: 'PUSH_REPLY,route 10.8.0.0 255.255.255.0,route <server ip> 255.255.255.255,redirect-gateway def1,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.8.0.2 255.255.255.0'
Wed Jan 18 19:27:40 2017 us=680482 OPTIONS IMPORT: timers and/or timeouts modified
Wed Jan 18 19:27:40 2017 us=680482 OPTIONS IMPORT: --ifconfig/up options modified
Wed Jan 18 19:27:40 2017 us=680482 OPTIONS IMPORT: route options modified
Wed Jan 18 19:27:40 2017 us=680482 OPTIONS IMPORT: route-related options modified
Wed Jan 18 19:27:40 2017 us=749064 ROUTE_GATEWAY 141.64.150.1/255.255.255.0 I=9 HWADDR=f0:de:f1:7a:13:f9
Wed Jan 18 19:27:40 2017 us=818103 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Jan 18 19:27:40 2017 us=818103 MANAGEMENT: >STATE:1484764060,ASSIGN_IP,,10.8.0.2,
Wed Jan 18 19:27:40 2017 us=818103 open_tun, tt->ipv6=0
Wed Jan 18 19:27:40 2017 us=818103 TAP-WIN32 device [Ethernet 2] opened: \\.\Global\{0FE15A1F-1253-4C87-A6C3-B44292B96017}.tap
Wed Jan 18 19:27:40 2017 us=818103 TAP-Windows Driver Version 9.21 
Wed Jan 18 19:27:40 2017 us=818103 TAP-Windows MTU=1500
Wed Jan 18 19:27:40 2017 us=818103 Set TAP-Windows TUN subnet mode network/local/netmask = 10.8.0.0/10.8.0.2/255.255.255.0 [SUCCEEDED]
Wed Jan 18 19:27:40 2017 us=818103 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.2/255.255.255.0 on interface {0FE15A1F-1253-4C87-A6C3-B44292B96017} [DHCP-serv: 10.8.0.254, lease-time: 31536000]
Wed Jan 18 19:27:40 2017 us=818103 Successful ARP Flush on interface [2] {0FE15A1F-1253-4C87-A6C3-B44292B96017}
Wed Jan 18 19:27:45 2017 us=284052 TEST ROUTES: 3/3 succeeded len=2 ret=1 a=0 u/d=up
Wed Jan 18 19:27:45 2017 us=284052 C:\WINDOWS\system32\route.exe ADD <server ip> MASK 255.255.255.255 <gateway ip>
Wed Jan 18 19:27:45 2017 us=299662 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=35 and dwForwardType=4
Wed Jan 18 19:27:45 2017 us=299662 Route addition via IPAPI succeeded [adaptive]
Wed Jan 18 19:27:45 2017 us=299662 C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.8.0.1
Wed Jan 18 19:27:45 2017 us=299662 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=35 and dwForwardType=4
Wed Jan 18 19:27:45 2017 us=299662 Route addition via IPAPI succeeded [adaptive]
Wed Jan 18 19:27:45 2017 us=299662 C:\WINDOWS\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.8.0.1
Wed Jan 18 19:27:45 2017 us=315303 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=35 and dwForwardType=4
Wed Jan 18 19:27:45 2017 us=315303 Route addition via IPAPI succeeded [adaptive]
Wed Jan 18 19:27:45 2017 us=315303 MANAGEMENT: >STATE:1484764065,ADD_ROUTES,,,
Wed Jan 18 19:27:45 2017 us=315303 C:\WINDOWS\system32\route.exe ADD 10.8.0.0 MASK 255.255.255.0 10.8.0.1
Wed Jan 18 19:27:45 2017 us=315303 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=35 and dwForwardType=4
Wed Jan 18 19:27:45 2017 us=315303 Route addition via IPAPI succeeded [adaptive]
Wed Jan 18 19:27:45 2017 us=315303 C:\WINDOWS\system32\route.exe ADD <server ip> MASK 255.255.255.255 10.8.0.1
Wed Jan 18 19:27:45 2017 us=331920 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=35 and dwForwardType=4
Wed Jan 18 19:27:45 2017 us=331920 Route addition via IPAPI succeeded [adaptive]
Wed Jan 18 19:27:45 2017 us=331920 Initialization Sequence Completed
Wed Jan 18 19:27:45 2017 us=332419 MANAGEMENT: >STATE:1484764065,CONNECTED,SUCCESS,10.8.0.2,<server ip>

TinCanTech

I do not understand why this route is being pushed:

Delet0r wroteWed Jan 18 19:27:40 2017 us=679463 PUSH: Received control message: 'PUSH_REPLY,route 10.8.0.0 255.255.255.0,route <server ip> 255.255.255.255,redirect-gateway def1,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.8.0.2 255.255.255.0'

Delet0r wrote

 <server ip>         255.255.255.255         10.8.0.1         10.8.0.2     35

But it is probably wrong ..

Perhaps that should be the DNS server and pushed via --DHCP-option DNS ip.add.re.ss

Delet0r

I double checked my configs and restarted the server. In my server config I push three routes the virtual subnet route, the redirect and the dns route with the correct ip adress and in my client config I only push the redirect gateway. I cant figure out why it pushes the server ip.

TinCanTech

Your server config has:

Delet0r wrote

push "dhcp-option DNS <dns server university>"

But your server does not push this:

Delet0r wroteWed Jan 18 19:27:40 2017 us=679463 PUSH: Received control message: 'PUSH_REPLY,route 10.8.0.0 255.255.255.0,route <server ip> 255.255.255.255,redirect-gateway def1,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.8.0.2 255.255.255.0'

:?:

Delet0r

Ok I found the reason why it does not push the dns. I had a backup copy of my config in my config folde and the server used that.

Received control message: 'PUSH_REPLY,route 10.8.0.0 255.255.255.0,redirect-gateway def1,dhcp-option DNS < ip dns server >,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.8.0.2 255.255.255.0'

Unfortunatly the problem still exists. In an other forum I found out that the push of redirect has two rules. Rule number 1 forwarding the traffic to the openVPN's public ip using the current default gateway and rule number fowarding all other traffic through the OpenVPN.

So the problem probably is that when I try to reach my license server, which has the same ip as the openVPN, the request goes through my default gateway.

Is that so and if yes is there a way to circumvent that without using another ip adress?

TinCanTech

Use the server tunnel address 10.8.0.1

Delet0r

I thought about that too but the server only supports one ip.

TinCanTech

You mean your licence server ?

Delet0r

Yeah I do, sry.

TinCanTech

I may be able to help with that but it has nothing to do with openvpn:

tincanteksup <at> gmail

Zam rafael

push "dhcp-option DNS <dns server university>"