OpenVPN Setup, Unable to access internet

nickkeane

DNS works fine when not on OpenVPN. When connected to OpenVPN while "Redirect Default Gateway" is enabled, internet access doesn't work but i can access devices on my regular subnet (but not on vpn subnet). OpenVPN subnet is 192.168.2.XXX and regular subnet is 192.168.1.XXX. Devices are eth0 and tun0. Using Netgear router w/ DD-WRT installed.

When "Redirect Default Gateway" is not enabled, I cannot access the dd-wrt router interface via 192.168.1.1 or 192.168.2.1.

Client OVPN

client

remote REDACTED 1194

remote-cert-tls server
dev tun0
proto udp

resolv-retry infinite
nobind
persist-key
persist-tun
tun-mtu 1500
fragment 1300

redirect-gateway def1
comp-lzo
mssfix 1390
float

cipher AES-256-CBC
auth SHA256

route-delay 30

ca ca.crt
cert client.crt
key client.key

Server OVPN

Router Setup

Router DNSMasq

Router Firewall

IP Config

Ping Testing

TinCanTech

nickkeane wrote client
cipher none

So it is technically not a virtual private network .. you should probably sort that out.

Also, you are using two of the most common subnets on your network, you should change them sometime.

nickkeane

I removed the "cipher none" line.

I'll probably change the subnets later for readability purposes, but I'm pretty sure 192.168.2.X is not being used for anything other than as the OpenVPN subnet, so I doubt using that is an issue.

Connecting to the OpenVPN server seems to go through fine. Still can't connect to the internet (google.com, facebook.com, etc.) when on it though.
Maybe the firewall/server config settings are wrong? I'm new to openvpn config and iptables so there might be a typo or an issue I'm not recognizing, a missing rule or setting, etc.

TinCanTech

nickkeane wrote I removed the "cipher none" line.

Good.

nickkeane wrote I'll probably change the subnets later for readability purposes, but I'm pretty sure 192.168.2.X is not being used for anything other than as the OpenVPN subnet, so I doubt using that is an issue.

I recommend changing them .. it is just to easy to get a network conflict but it can wait for now.

nickkeane wrote Connecting to the OpenVPN server seems to go through fine.

Logs at verb 4 please, see: https://forums.openvpn.net/viewtopic.php?f=30&t=22603#p68963

nickkeane wrote Still can't connect to the internet (google.com, facebook.com, etc.) when on it though.
Maybe the firewall/server config settings are wrong? I'm new to openvpn config and iptables so there might be a typo or an issue I'm not recognizing, a missing rule or setting, etc.

Check your firewall rules and IP_Forwarding, see: https://community.openvpn.net/openvpn/wiki/HOWTO#Routingallclienttrafficincludingweb-trafficthroughtheVPN

nickkeane

Here is the server log after adding "verb 4" and connecting to the VPN. I will look at the firewall and forwarding rules in a bit.

Serverlog:
20190325 15:06:27 W WARNING: Using --management on a TCP port WITHOUT passwords is STRONGLY discouraged and considered insecure
20190325 15:06:27 Current Parameter Settings:
20190325 15:06:27 config = '/tmp/openvpn/openvpn.conf'
20190325 15:06:27 mode = 1
20190325 15:06:27 NOTE: --mute triggered...
20190325 15:06:27 235 variation(s) on previous 3 message(s) suppressed by --mute
20190325 15:06:27 I OpenVPN 2.4.6 arm-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on Sep 23 2018
20190325 15:06:27 I library versions: OpenSSL 1.1.1 11 Sep 2018 LZO 2.09
20190325 15:06:27 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:14
20190325 15:06:27 W WARNING: using --duplicate-cn and --client-config-dir together is probably not what you want
20190325 15:06:27 W NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
20190325 15:06:27 Diffie-Hellman initialized with 2048 bit key
20190325 15:06:27 TLS-Auth MTU parms [ L:1622 D:1212 EF:38 EB:0 ET:0 EL:3 ]
20190325 15:06:27 I TUN/TAP device tun0 opened
20190325 15:06:27 TUN/TAP TX queue length set to 100
20190325 15:06:27 D do_ifconfig tt->did_ifconfig_ipv6_setup=0
20190325 15:06:27 I /sbin/ifconfig tun0 192.168.2.1 netmask 255.255.255.0 mtu 1500 broadcast 192.168.2.255
20190325 15:06:27 Data Channel MTU parms [ L:1622 D:1390 EF:122 EB:406 ET:0 EL:3 ]
20190325 15:06:27 Socket Buffers: R=[180224->180224] S=[180224->180224]
20190325 15:06:27 I UDPv4 link local (bound): [AF_INET][undef]:1194
20190325 15:06:27 I UDPv4 link remote: [AF_UNSPEC]
20190325 15:06:27 MULTI: multi_init called r=256 v=256
20190325 15:06:27 IFCONFIG POOL: base=192.168.2.2 size=252 ipv6=0
20190325 15:06:27 I Initialization Sequence Completed
20190325 15:07:04 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:14
20190325 15:07:04 D MANAGEMENT: CMD 'state'
20190325 15:07:04 MANAGEMENT: Client disconnected
20190325 15:07:04 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:14
20190325 15:07:04 D MANAGEMENT: CMD 'state'
20190325 15:07:04 MANAGEMENT: Client disconnected
20190325 15:07:04 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:14
20190325 15:07:04 D MANAGEMENT: CMD 'state'
20190325 15:07:04 MANAGEMENT: Client disconnected
20190325 15:07:04 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:14
20190325 15:07:04 MANAGEMENT: Client disconnected
20190325 15:07:04 NOTE: --mute triggered...
20190325 15:07:04 1 variation(s) on previous 3 message(s) suppressed by --mute
20190325 15:07:04 D MANAGEMENT: CMD 'status 2'
20190325 15:07:04 MANAGEMENT: Client disconnected
20190325 15:07:04 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:14
20190325 15:07:04 D MANAGEMENT: CMD 'status 2'
20190325 15:07:04 MANAGEMENT: Client disconnected
20190325 15:07:04 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:14
20190325 15:07:04 D MANAGEMENT: CMD 'log 500'
20190325 15:07:04 MANAGEMENT: Client disconnected
20190325 15:07:07 MULTI: multi_create_instance called
20190325 15:07:07 192.168.1.30:60804 Re-using SSL/TLS context
20190325 15:07:07 192.168.1.30:60804 LZO compression initializing
20190325 15:07:07 192.168.1.30:60804 Control Channel MTU parms [ L:1626 D:1212 EF:38 EB:0 ET:0 EL:3 ]
20190325 15:07:07 192.168.1.30:60804 Data Channel MTU parms [ L:1626 D:1390 EF:126 EB:407 ET:0 EL:3 ]
20190325 15:07:07 192.168.1.30:60804 Fragmentation MTU parms [ L:1626 D:1390 EF:125 EB:407 ET:1 EL:3 ]
20190325 15:07:07 192.168.1.30:60804 Local Options String (VER=V4): 'V4 dev-type tun link-mtu 1574 tun-mtu 1500 proto UDPv4 comp-lzo mtu-dynamic cipher AES-256-CBC auth SHA256 keysize 256 key-method 2 tls-server'
20190325 15:07:07 192.168.1.30:60804 Expected Remote Options String (VER=V4): 'V4 dev-type tun link-mtu 1574 tun-mtu 1500 proto UDPv4 comp-lzo mtu-dynamic cipher AES-256-CBC auth SHA256 keysize 256 key-method 2 tls-client'
20190325 15:07:07 192.168.1.30:60804 TLS: Initial packet from [AF_INET]192.168.1.30:60804 sid=0961e696 638154a8
20190325 15:07:07 192.168.1.30:60804 VERIFY OK: depth=1 C=US ST=DE L=Wilmington O=OpenVPN OU=REDACTED CN=REDACTED name=server emailAddress=nickkeane23@gmail.com
20190325 15:07:07 192.168.1.30:60804 VERIFY OK: depth=0 C=US ST=DE L=Wilmington O=OpenVPN OU=REDACTED CN=DefaultClient name=DefaultClient emailAddress=nickkeane23@gmail.com
20190325 15:07:07 I 192.168.1.30:60804 peer info: IV_VER=2.4.7
20190325 15:07:07 I 192.168.1.30:60804 peer info: IV_PLAT=win
20190325 15:07:07 I 192.168.1.30:60804 peer info: IV_PROTO=2
20190325 15:07:07 I 192.168.1.30:60804 peer info: IV_NCP=2
20190325 15:07:07 I 192.168.1.30:60804 peer info: IV_LZ4=1
20190325 15:07:07 I 192.168.1.30:60804 peer info: IV_LZ4v2=1
20190325 15:07:07 I 192.168.1.30:60804 peer info: IV_LZO=1
20190325 15:07:07 I 192.168.1.30:60804 peer info: IV_COMP_STUB=1
20190325 15:07:07 I 192.168.1.30:60804 peer info: IV_COMP_STUBv2=1
20190325 15:07:07 I 192.168.1.30:60804 peer info: IV_TCPNL=1
20190325 15:07:07 I 192.168.1.30:60804 peer info: IV_GUI_VER=OpenVPN_GUI_11
20190325 15:07:07 192.168.1.30:60804 Control Channel: TLSv1.2 cipher TLSv1.2 DHE-RSA-AES256-SHA256 4096 bit RSA
20190325 15:07:07 I 192.168.1.30:60804 [DefaultClient] Peer Connection Initiated with [AF_INET]192.168.1.30:60804
20190325 15:07:07 I DefaultClient/192.168.1.30:60804 MULTI_sva: pool returned IPv4=192.168.2.2 IPv6=(Not enabled)
20190325 15:07:07 DefaultClient/192.168.1.30:60804 OPTIONS IMPORT: reading client specific options from: /tmp/openvpn_cc_12afe71c59bf045f.tmp
20190325 15:07:07 DefaultClient/192.168.1.30:60804 MULTI: Learn: 192.168.2.2 -> DefaultClient/192.168.1.30:60804
20190325 15:07:07 DefaultClient/192.168.1.30:60804 MULTI: primary virtual IP for DefaultClient/192.168.1.30:60804: 192.168.2.2
20190325 15:07:09 DefaultClient/192.168.1.30:60804 PUSH: Received control message: 'PUSH_REQUEST'
20190325 15:07:09 DefaultClient/192.168.1.30:60804 SENT CONTROL [DefaultClient]: 'PUSH_REPLY redirect-gateway def1 route 192.168.1.0 255.255.255.0 dhcp-option DNS 208.67.222.222 dhcp-option DNS 208.67.222.220 redirect-gateway def1 route-gateway 192.168.2.1 topology subnet ping 10 ping-restart 120 ifconfig 192.168.2.2 255.255.255.0 peer-id 0 cipher AES-256-GCM' (status=1)
20190325 15:07:09 DefaultClient/192.168.1.30:60804 Data Channel: using negotiated cipher 'AES-256-GCM'
20190325 15:07:09 DefaultClient/192.168.1.30:60804 Data Channel MTU parms [ L:1554 D:1390 EF:54 EB:407 ET:0 EL:3 ]
20190325 15:07:09 DefaultClient/192.168.1.30:60804 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
20190325 15:07:09 DefaultClient/192.168.1.30:60804 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
20190325 15:07:09 DefaultClient/192.168.1.30:60804 MULTI: bad source address from client [::] packet dropped
20190325 15:07:43 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:14
20190325 15:07:43 D MANAGEMENT: CMD 'state'
20190325 15:07:43 MANAGEMENT: Client disconnected
20190325 15:07:43 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:14
20190325 15:07:43 D MANAGEMENT: CMD 'state'
20190325 15:07:43 MANAGEMENT: Client disconnected
20190325 15:07:43 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:14
20190325 15:07:43 D MANAGEMENT: CMD 'state'
20190325 15:07:43 MANAGEMENT: Client disconnected
20190325 15:07:43 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:14
20190325 15:07:43 MANAGEMENT: Client disconnected
20190325 15:07:43 NOTE: --mute triggered...
20190325 15:07:43 1 variation(s) on previous 3 message(s) suppressed by --mute
20190325 15:07:43 D MANAGEMENT: CMD 'status 2'
20190325 15:07:43 MANAGEMENT: Client disconnected
20190325 15:07:43 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:14
20190325 15:07:43 D MANAGEMENT: CMD 'status 2'
20190325 15:07:43 MANAGEMENT: Client disconnected
20190325 15:07:43 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:14
20190325 15:07:43 D MANAGEMENT: CMD 'log 500'
19700101 00:00:00

TinCanTech

There is a first time for everything !

All these pushed options should be separated by a comma (,)

nickkeane wrote 20190325 15:07:09 DefaultClient/192.168.1.30:60804 SENT CONTROL [DefaultClient]: 'PUSH_REPLY redirect-gateway def1 route 192.168.1.0 255.255.255.0 dhcp-option DNS 208.67.222.222 dhcp-option DNS 208.67.222.220 redirect-gateway def1 route-gateway 192.168.2.1 topology subnet ping 10 ping-restart 120 ifconfig 192.168.2.2 255.255.255.0 peer-id 0 cipher AES-256-GCM' (status=1)

So, I would be curious to know what your client makes of this, see the client log.

nickkeane wrote 20190325 15:07:09 DefaultClient/192.168.1.30:60804 MULTI: bad source address from client [::] packet dropped

You can safely ignore this.

nickkeane

I changed the NAT rule from,

iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o eth0 -j MASQUERADE

iptables -t nat -A POSTROUTING -s 192.168.2.0/24 -o eth0 -j MASQUERADE

in accordance with the guide you posted and restarted my router. Still getting the same issues.

TinCanTech

And you made sure to enable IP_Forwarding on the server ..

nickkeane

I'm not sure what you mean by options should be separated by a comma, all of the client and server addtl config options are on seperate lines.

Here is the client log I'm getting w/ verb 4 enabled when connecting

Mon Mar 25 11:39:34 2019 us=76393 Current Parameter Settings:
Mon Mar 25 11:39:34 2019 us=76393   config = 'client.ovpn'
Mon Mar 25 11:39:34 2019 us=76393   mode = 0
Mon Mar 25 11:39:34 2019 us=76393   show_ciphers = DISABLED
Mon Mar 25 11:39:34 2019 us=76393   show_digests = DISABLED
Mon Mar 25 11:39:34 2019 us=76393   show_engines = DISABLED
Mon Mar 25 11:39:34 2019 us=76393   genkey = DISABLED
Mon Mar 25 11:39:34 2019 us=76393   key_pass_file = '[UNDEF]'
Mon Mar 25 11:39:34 2019 us=76393   show_tls_ciphers = DISABLED
Mon Mar 25 11:39:34 2019 us=76393   connect_retry_max = 0
Mon Mar 25 11:39:34 2019 us=76393 Connection profiles [0]:
Mon Mar 25 11:39:34 2019 us=76393   proto = udp
Mon Mar 25 11:39:34 2019 us=76393   local = '[UNDEF]'
Mon Mar 25 11:39:34 2019 us=76393   local_port = '[UNDEF]'
Mon Mar 25 11:39:34 2019 us=76393   remote = 'REDACTED'
Mon Mar 25 11:39:34 2019 us=76393   remote_port = '1194'
Mon Mar 25 11:39:34 2019 us=76393   remote_float = ENABLED
Mon Mar 25 11:39:34 2019 us=76393   bind_defined = DISABLED
Mon Mar 25 11:39:34 2019 us=76393   bind_local = DISABLED
Mon Mar 25 11:39:34 2019 us=76393   bind_ipv6_only = DISABLED
Mon Mar 25 11:39:34 2019 us=76393   connect_retry_seconds = 5
Mon Mar 25 11:39:34 2019 us=76393   connect_timeout = 120
Mon Mar 25 11:39:34 2019 us=76393   socks_proxy_server = '[UNDEF]'
Mon Mar 25 11:39:34 2019 us=76393   socks_proxy_port = '[UNDEF]'
Mon Mar 25 11:39:34 2019 us=76393   tun_mtu = 1500
Mon Mar 25 11:39:34 2019 us=76393   tun_mtu_defined = ENABLED
Mon Mar 25 11:39:34 2019 us=76393   link_mtu = 1500
Mon Mar 25 11:39:34 2019 us=76393   link_mtu_defined = DISABLED
Mon Mar 25 11:39:34 2019 us=76393   tun_mtu_extra = 0
Mon Mar 25 11:39:34 2019 us=76393   tun_mtu_extra_defined = DISABLED
Mon Mar 25 11:39:34 2019 us=76393   mtu_discover_type = -1
Mon Mar 25 11:39:34 2019 us=76393   fragment = 1300
Mon Mar 25 11:39:34 2019 us=76393   mssfix = 1390
Mon Mar 25 11:39:34 2019 us=76393   explicit_exit_notification = 0
Mon Mar 25 11:39:34 2019 us=76393 Connection profiles END
Mon Mar 25 11:39:34 2019 us=76393   remote_random = DISABLED
Mon Mar 25 11:39:34 2019 us=76393   ipchange = '[UNDEF]'
Mon Mar 25 11:39:34 2019 us=76393   dev = 'tun0'
Mon Mar 25 11:39:34 2019 us=76393   dev_type = '[UNDEF]'
Mon Mar 25 11:39:34 2019 us=76393   dev_node = '[UNDEF]'
Mon Mar 25 11:39:34 2019 us=76393   lladdr = '[UNDEF]'
Mon Mar 25 11:39:34 2019 us=76393   topology = 1
Mon Mar 25 11:39:34 2019 us=76393   ifconfig_local = '[UNDEF]'
Mon Mar 25 11:39:34 2019 us=76393   ifconfig_remote_netmask = '[UNDEF]'
Mon Mar 25 11:39:34 2019 us=76393   ifconfig_noexec = DISABLED
Mon Mar 25 11:39:34 2019 us=76393   ifconfig_nowarn = DISABLED
Mon Mar 25 11:39:34 2019 us=76393   ifconfig_ipv6_local = '[UNDEF]'
Mon Mar 25 11:39:34 2019 us=76393   ifconfig_ipv6_netbits = 0
Mon Mar 25 11:39:34 2019 us=76393   ifconfig_ipv6_remote = '[UNDEF]'
Mon Mar 25 11:39:34 2019 us=76393   shaper = 0
Mon Mar 25 11:39:34 2019 us=76393   mtu_test = 0
Mon Mar 25 11:39:34 2019 us=76393   mlock = DISABLED
Mon Mar 25 11:39:34 2019 us=76393   keepalive_ping = 0
Mon Mar 25 11:39:34 2019 us=76393   keepalive_timeout = 0
Mon Mar 25 11:39:34 2019 us=76393   inactivity_timeout = 0
Mon Mar 25 11:39:34 2019 us=76393   ping_send_timeout = 0
Mon Mar 25 11:39:34 2019 us=76393   ping_rec_timeout = 0
Mon Mar 25 11:39:34 2019 us=76393   ping_rec_timeout_action = 0
Mon Mar 25 11:39:34 2019 us=76393   ping_timer_remote = DISABLED
Mon Mar 25 11:39:34 2019 us=76393   remap_sigusr1 = 0
Mon Mar 25 11:39:34 2019 us=76393   persist_tun = ENABLED
Mon Mar 25 11:39:34 2019 us=76393   persist_local_ip = DISABLED
Mon Mar 25 11:39:34 2019 us=76393   persist_remote_ip = DISABLED
Mon Mar 25 11:39:34 2019 us=76393   persist_key = ENABLED
Mon Mar 25 11:39:34 2019 us=76393   passtos = DISABLED
Mon Mar 25 11:39:34 2019 us=76393   resolve_retry_seconds = 1000000000
Mon Mar 25 11:39:34 2019 us=76393   resolve_in_advance = DISABLED
Mon Mar 25 11:39:34 2019 us=76393   username = '[UNDEF]'
Mon Mar 25 11:39:34 2019 us=76393   groupname = '[UNDEF]'
Mon Mar 25 11:39:34 2019 us=77390   chroot_dir = '[UNDEF]'
Mon Mar 25 11:39:34 2019 us=77390   cd_dir = '[UNDEF]'
Mon Mar 25 11:39:34 2019 us=77390   writepid = '[UNDEF]'
Mon Mar 25 11:39:34 2019 us=77390   up_script = '[UNDEF]'
Mon Mar 25 11:39:34 2019 us=77390   down_script = '[UNDEF]'
Mon Mar 25 11:39:34 2019 us=77390   down_pre = DISABLED
Mon Mar 25 11:39:34 2019 us=77390   up_restart = DISABLED
Mon Mar 25 11:39:34 2019 us=77390   up_delay = DISABLED
Mon Mar 25 11:39:34 2019 us=77390   daemon = DISABLED
Mon Mar 25 11:39:34 2019 us=77390   inetd = 0
Mon Mar 25 11:39:34 2019 us=77390   log = ENABLED
Mon Mar 25 11:39:34 2019 us=77390   suppress_timestamps = DISABLED
Mon Mar 25 11:39:34 2019 us=77390   machine_readable_output = DISABLED
Mon Mar 25 11:39:34 2019 us=77390   nice = 0
Mon Mar 25 11:39:34 2019 us=77390   verbosity = 4
Mon Mar 25 11:39:34 2019 us=77390   mute = 0
Mon Mar 25 11:39:34 2019 us=77390   gremlin = 0
Mon Mar 25 11:39:34 2019 us=77390   status_file = '[UNDEF]'
Mon Mar 25 11:39:34 2019 us=77390   status_file_version = 1
Mon Mar 25 11:39:34 2019 us=77390   status_file_update_freq = 60
Mon Mar 25 11:39:34 2019 us=77390   occ = ENABLED
Mon Mar 25 11:39:34 2019 us=77390   rcvbuf = 0
Mon Mar 25 11:39:34 2019 us=77390   sndbuf = 0
Mon Mar 25 11:39:34 2019 us=77390   sockflags = 0
Mon Mar 25 11:39:34 2019 us=77390   fast_io = DISABLED
Mon Mar 25 11:39:34 2019 us=77390   comp.alg = 2
Mon Mar 25 11:39:34 2019 us=77390   comp.flags = 1
Mon Mar 25 11:39:34 2019 us=77390   route_script = '[UNDEF]'
Mon Mar 25 11:39:34 2019 us=77390   route_default_gateway = '[UNDEF]'
Mon Mar 25 11:39:34 2019 us=77390   route_default_metric = 0
Mon Mar 25 11:39:34 2019 us=77390   route_noexec = DISABLED
Mon Mar 25 11:39:34 2019 us=77390   route_delay = 30
Mon Mar 25 11:39:34 2019 us=77390   route_delay_window = 30
Mon Mar 25 11:39:34 2019 us=77390   route_delay_defined = ENABLED
Mon Mar 25 11:39:34 2019 us=77390   route_nopull = DISABLED
Mon Mar 25 11:39:34 2019 us=77390   route_gateway_via_dhcp = DISABLED
Mon Mar 25 11:39:34 2019 us=77390   allow_pull_fqdn = DISABLED
Mon Mar 25 11:39:34 2019 us=77390   [redirect_default_gateway local=0]
Mon Mar 25 11:39:34 2019 us=77390   management_addr = '127.0.0.1'
Mon Mar 25 11:39:34 2019 us=77390   management_port = '25340'
Mon Mar 25 11:39:34 2019 us=77390   management_user_pass = 'stdin'
Mon Mar 25 11:39:34 2019 us=77390   management_log_history_cache = 250
Mon Mar 25 11:39:34 2019 us=77390   management_echo_buffer_size = 100
Mon Mar 25 11:39:34 2019 us=77390   management_write_peer_info_file = '[UNDEF]'
Mon Mar 25 11:39:34 2019 us=77390   management_client_user = '[UNDEF]'
Mon Mar 25 11:39:34 2019 us=77390   management_client_group = '[UNDEF]'
Mon Mar 25 11:39:34 2019 us=77390   management_flags = 6
Mon Mar 25 11:39:34 2019 us=77390   shared_secret_file = '[UNDEF]'
Mon Mar 25 11:39:34 2019 us=77390   key_direction = not set
Mon Mar 25 11:39:34 2019 us=77390   ciphername = 'AES-256-CBC'
Mon Mar 25 11:39:34 2019 us=77390   ncp_enabled = ENABLED
Mon Mar 25 11:39:34 2019 us=77390   ncp_ciphers = 'AES-256-GCM:AES-128-GCM'
Mon Mar 25 11:39:34 2019 us=77390   authname = 'SHA256'
Mon Mar 25 11:39:34 2019 us=77390   prng_hash = 'SHA1'
Mon Mar 25 11:39:34 2019 us=77390   prng_nonce_secret_len = 16
Mon Mar 25 11:39:34 2019 us=77390   keysize = 0
Mon Mar 25 11:39:34 2019 us=77390   engine = DISABLED
Mon Mar 25 11:39:34 2019 us=77390   replay = ENABLED
Mon Mar 25 11:39:34 2019 us=77390   mute_replay_warnings = DISABLED
Mon Mar 25 11:39:34 2019 us=77390   replay_window = 64
Mon Mar 25 11:39:34 2019 us=77390   replay_time = 15
Mon Mar 25 11:39:34 2019 us=77390   packet_id_file = '[UNDEF]'
Mon Mar 25 11:39:34 2019 us=77390   use_iv = ENABLED
Mon Mar 25 11:39:34 2019 us=77390   test_crypto = DISABLED
Mon Mar 25 11:39:34 2019 us=77390   tls_server = DISABLED
Mon Mar 25 11:39:34 2019 us=77390   tls_client = ENABLED
Mon Mar 25 11:39:34 2019 us=77390   key_method = 2
Mon Mar 25 11:39:34 2019 us=77390   ca_file = 'ca.crt'
Mon Mar 25 11:39:34 2019 us=77390   ca_path = '[UNDEF]'
Mon Mar 25 11:39:34 2019 us=77390   dh_file = '[UNDEF]'
Mon Mar 25 11:39:34 2019 us=77390   cert_file = 'client.crt'
Mon Mar 25 11:39:34 2019 us=77390   extra_certs_file = '[UNDEF]'
Mon Mar 25 11:39:34 2019 us=77390   priv_key_file = 'client.key'
Mon Mar 25 11:39:34 2019 us=77390   pkcs12_file = '[UNDEF]'
Mon Mar 25 11:39:34 2019 us=77390   cryptoapi_cert = '[UNDEF]'
Mon Mar 25 11:39:34 2019 us=77390   cipher_list = '[UNDEF]'
Mon Mar 25 11:39:34 2019 us=77390   cipher_list_tls13 = '[UNDEF]'
Mon Mar 25 11:39:34 2019 us=77390   tls_cert_profile = '[UNDEF]'
Mon Mar 25 11:39:34 2019 us=77390   tls_verify = '[UNDEF]'
Mon Mar 25 11:39:34 2019 us=77390   tls_export_cert = '[UNDEF]'
Mon Mar 25 11:39:34 2019 us=77390   verify_x509_type = 0
Mon Mar 25 11:39:34 2019 us=77390   verify_x509_name = '[UNDEF]'
Mon Mar 25 11:39:34 2019 us=77390   crl_file = '[UNDEF]'
Mon Mar 25 11:39:34 2019 us=77390   ns_cert_type = 0
Mon Mar 25 11:39:34 2019 us=77390   remote_cert_ku[i] = 65535
Mon Mar 25 11:39:34 2019 us=77390   remote_cert_ku[i] = 0
Mon Mar 25 11:39:34 2019 us=77390   remote_cert_ku[i] = 0
Mon Mar 25 11:39:34 2019 us=77390   remote_cert_ku[i] = 0
Mon Mar 25 11:39:34 2019 us=77390   remote_cert_ku[i] = 0
Mon Mar 25 11:39:34 2019 us=77390   remote_cert_ku[i] = 0
Mon Mar 25 11:39:34 2019 us=77390   remote_cert_ku[i] = 0
Mon Mar 25 11:39:34 2019 us=77390   remote_cert_ku[i] = 0
Mon Mar 25 11:39:34 2019 us=77390   remote_cert_ku[i] = 0
Mon Mar 25 11:39:34 2019 us=77390   remote_cert_ku[i] = 0
Mon Mar 25 11:39:34 2019 us=77390   remote_cert_ku[i] = 0
Mon Mar 25 11:39:34 2019 us=77390   remote_cert_ku[i] = 0
Mon Mar 25 11:39:34 2019 us=77390   remote_cert_ku[i] = 0
Mon Mar 25 11:39:34 2019 us=77390   remote_cert_ku[i] = 0
Mon Mar 25 11:39:34 2019 us=77390   remote_cert_ku[i] = 0
Mon Mar 25 11:39:34 2019 us=77390   remote_cert_ku[i] = 0
Mon Mar 25 11:39:34 2019 us=77390   remote_cert_eku = 'TLS Web Server Authentication'
Mon Mar 25 11:39:34 2019 us=77390   ssl_flags = 0
Mon Mar 25 11:39:34 2019 us=77390   tls_timeout = 2
Mon Mar 25 11:39:34 2019 us=77390   renegotiate_bytes = -1
Mon Mar 25 11:39:34 2019 us=77390   renegotiate_packets = 0
Mon Mar 25 11:39:34 2019 us=77390   renegotiate_seconds = 3600
Mon Mar 25 11:39:34 2019 us=77390   handshake_window = 60
Mon Mar 25 11:39:34 2019 us=77390   transition_window = 3600
Mon Mar 25 11:39:34 2019 us=77390   single_session = DISABLED
Mon Mar 25 11:39:34 2019 us=77390   push_peer_info = DISABLED
Mon Mar 25 11:39:34 2019 us=77390   tls_exit = DISABLED
Mon Mar 25 11:39:34 2019 us=77390   tls_auth_file = '[UNDEF]'
Mon Mar 25 11:39:34 2019 us=77390   tls_crypt_file = '[UNDEF]'
Mon Mar 25 11:39:34 2019 us=77390   pkcs11_protected_authentication = DISABLED
Mon Mar 25 11:39:34 2019 us=77390   pkcs11_protected_authentication = DISABLED
Mon Mar 25 11:39:34 2019 us=77390   pkcs11_protected_authentication = DISABLED
Mon Mar 25 11:39:34 2019 us=77390   pkcs11_protected_authentication = DISABLED
Mon Mar 25 11:39:34 2019 us=77390   pkcs11_protected_authentication = DISABLED
Mon Mar 25 11:39:34 2019 us=77390   pkcs11_protected_authentication = DISABLED
Mon Mar 25 11:39:34 2019 us=77390   pkcs11_protected_authentication = DISABLED
Mon Mar 25 11:39:34 2019 us=77390   pkcs11_protected_authentication = DISABLED
Mon Mar 25 11:39:34 2019 us=77390   pkcs11_protected_authentication = DISABLED
Mon Mar 25 11:39:34 2019 us=77390   pkcs11_protected_authentication = DISABLED
Mon Mar 25 11:39:34 2019 us=77390   pkcs11_protected_authentication = DISABLED
Mon Mar 25 11:39:34 2019 us=77390   pkcs11_protected_authentication = DISABLED
Mon Mar 25 11:39:34 2019 us=77390   pkcs11_protected_authentication = DISABLED
Mon Mar 25 11:39:34 2019 us=77390   pkcs11_protected_authentication = DISABLED
Mon Mar 25 11:39:34 2019 us=77390   pkcs11_protected_authentication = DISABLED
Mon Mar 25 11:39:34 2019 us=77390   pkcs11_protected_authentication = DISABLED
Mon Mar 25 11:39:34 2019 us=77390   pkcs11_private_mode = 00000000
Mon Mar 25 11:39:34 2019 us=77390   pkcs11_private_mode = 00000000
Mon Mar 25 11:39:34 2019 us=77390   pkcs11_private_mode = 00000000
Mon Mar 25 11:39:34 2019 us=77390   pkcs11_private_mode = 00000000
Mon Mar 25 11:39:34 2019 us=77390   pkcs11_private_mode = 00000000
Mon Mar 25 11:39:34 2019 us=77390   pkcs11_private_mode = 00000000
Mon Mar 25 11:39:34 2019 us=77390   pkcs11_private_mode = 00000000
Mon Mar 25 11:39:34 2019 us=77390   pkcs11_private_mode = 00000000
Mon Mar 25 11:39:34 2019 us=77390   pkcs11_private_mode = 00000000
Mon Mar 25 11:39:34 2019 us=77390   pkcs11_private_mode = 00000000
Mon Mar 25 11:39:34 2019 us=77390   pkcs11_private_mode = 00000000
Mon Mar 25 11:39:34 2019 us=77390   pkcs11_private_mode = 00000000
Mon Mar 25 11:39:34 2019 us=77390   pkcs11_private_mode = 00000000
Mon Mar 25 11:39:34 2019 us=77390   pkcs11_private_mode = 00000000
Mon Mar 25 11:39:34 2019 us=77390   pkcs11_private_mode = 00000000
Mon Mar 25 11:39:34 2019 us=77390   pkcs11_private_mode = 00000000
Mon Mar 25 11:39:34 2019 us=77390   pkcs11_cert_private = DISABLED
Mon Mar 25 11:39:34 2019 us=77390   pkcs11_cert_private = DISABLED
Mon Mar 25 11:39:34 2019 us=77390   pkcs11_cert_private = DISABLED
Mon Mar 25 11:39:34 2019 us=77390   pkcs11_cert_private = DISABLED
Mon Mar 25 11:39:34 2019 us=77390   pkcs11_cert_private = DISABLED
Mon Mar 25 11:39:34 2019 us=77390   pkcs11_cert_private = DISABLED
Mon Mar 25 11:39:34 2019 us=77390   pkcs11_cert_private = DISABLED
Mon Mar 25 11:39:34 2019 us=77390   pkcs11_cert_private = DISABLED
Mon Mar 25 11:39:34 2019 us=77390   pkcs11_cert_private = DISABLED
Mon Mar 25 11:39:34 2019 us=77390   pkcs11_cert_private = DISABLED
Mon Mar 25 11:39:34 2019 us=77390   pkcs11_cert_private = DISABLED
Mon Mar 25 11:39:34 2019 us=77390   pkcs11_cert_private = DISABLED
Mon Mar 25 11:39:34 2019 us=77390   pkcs11_cert_private = DISABLED
Mon Mar 25 11:39:34 2019 us=77390   pkcs11_cert_private = DISABLED
Mon Mar 25 11:39:34 2019 us=77390   pkcs11_cert_private = DISABLED
Mon Mar 25 11:39:34 2019 us=77390   pkcs11_cert_private = DISABLED
Mon Mar 25 11:39:34 2019 us=77390   pkcs11_pin_cache_period = -1
Mon Mar 25 11:39:34 2019 us=77390   pkcs11_id = '[UNDEF]'
Mon Mar 25 11:39:34 2019 us=77390   pkcs11_id_management = DISABLED
Mon Mar 25 11:39:34 2019 us=77390   server_network = 0.0.0.0
Mon Mar 25 11:39:34 2019 us=77390   server_netmask = 0.0.0.0
Mon Mar 25 11:39:34 2019 us=77390   server_network_ipv6 = ::
Mon Mar 25 11:39:34 2019 us=77390   server_netbits_ipv6 = 0
Mon Mar 25 11:39:34 2019 us=77390   server_bridge_ip = 0.0.0.0
Mon Mar 25 11:39:34 2019 us=77390   server_bridge_netmask = 0.0.0.0
Mon Mar 25 11:39:34 2019 us=77390   server_bridge_pool_start = 0.0.0.0
Mon Mar 25 11:39:34 2019 us=77390   server_bridge_pool_end = 0.0.0.0
Mon Mar 25 11:39:34 2019 us=77390   ifconfig_pool_defined = DISABLED
Mon Mar 25 11:39:34 2019 us=77390   ifconfig_pool_start = 0.0.0.0
Mon Mar 25 11:39:34 2019 us=77390   ifconfig_pool_end = 0.0.0.0
Mon Mar 25 11:39:34 2019 us=77390   ifconfig_pool_netmask = 0.0.0.0
Mon Mar 25 11:39:34 2019 us=77390   ifconfig_pool_persist_filename = '[UNDEF]'
Mon Mar 25 11:39:34 2019 us=77390   ifconfig_pool_persist_refresh_freq = 600
Mon Mar 25 11:39:34 2019 us=77390   ifconfig_ipv6_pool_defined = DISABLED
Mon Mar 25 11:39:34 2019 us=77390   ifconfig_ipv6_pool_base = ::
Mon Mar 25 11:39:34 2019 us=77390   ifconfig_ipv6_pool_netbits = 0
Mon Mar 25 11:39:34 2019 us=77390   n_bcast_buf = 256
Mon Mar 25 11:39:34 2019 us=77390   tcp_queue_limit = 64
Mon Mar 25 11:39:34 2019 us=77390   real_hash_size = 256
Mon Mar 25 11:39:34 2019 us=77390   virtual_hash_size = 256
Mon Mar 25 11:39:34 2019 us=77390   client_connect_script = '[UNDEF]'
Mon Mar 25 11:39:34 2019 us=77390   learn_address_script = '[UNDEF]'
Mon Mar 25 11:39:34 2019 us=77390   client_disconnect_script = '[UNDEF]'
Mon Mar 25 11:39:34 2019 us=77390   client_config_dir = '[UNDEF]'
Mon Mar 25 11:39:34 2019 us=77390   ccd_exclusive = DISABLED
Mon Mar 25 11:39:34 2019 us=77390   tmp_dir = 'C:\Users\nickk\AppData\Local\Temp\'
Mon Mar 25 11:39:34 2019 us=77390   push_ifconfig_defined = DISABLED
Mon Mar 25 11:39:34 2019 us=77390   push_ifconfig_local = 0.0.0.0
Mon Mar 25 11:39:34 2019 us=77390   push_ifconfig_remote_netmask = 0.0.0.0
Mon Mar 25 11:39:34 2019 us=77390   push_ifconfig_ipv6_defined = DISABLED
Mon Mar 25 11:39:34 2019 us=77390   push_ifconfig_ipv6_local = ::/0
Mon Mar 25 11:39:34 2019 us=77390   push_ifconfig_ipv6_remote = ::
Mon Mar 25 11:39:34 2019 us=77390   enable_c2c = DISABLED
Mon Mar 25 11:39:34 2019 us=77390   duplicate_cn = DISABLED
Mon Mar 25 11:39:34 2019 us=77390   cf_max = 0
Mon Mar 25 11:39:34 2019 us=78387   cf_per = 0
Mon Mar 25 11:39:34 2019 us=78387   max_clients = 1024
Mon Mar 25 11:39:34 2019 us=78387   max_routes_per_client = 256
Mon Mar 25 11:39:34 2019 us=78387   auth_user_pass_verify_script = '[UNDEF]'
Mon Mar 25 11:39:34 2019 us=78387   auth_user_pass_verify_script_via_file = DISABLED
Mon Mar 25 11:39:34 2019 us=78387   auth_token_generate = DISABLED
Mon Mar 25 11:39:34 2019 us=78387   auth_token_lifetime = 0
Mon Mar 25 11:39:34 2019 us=78387   client = ENABLED
Mon Mar 25 11:39:34 2019 us=78387   pull = ENABLED
Mon Mar 25 11:39:34 2019 us=78387   auth_user_pass_file = '[UNDEF]'
Mon Mar 25 11:39:34 2019 us=78387   show_net_up = DISABLED
Mon Mar 25 11:39:34 2019 us=78387   route_method = 0
Mon Mar 25 11:39:34 2019 us=78387   block_outside_dns = DISABLED
Mon Mar 25 11:39:34 2019 us=78387   ip_win32_defined = DISABLED
Mon Mar 25 11:39:34 2019 us=78387   ip_win32_type = 3
Mon Mar 25 11:39:34 2019 us=78387   dhcp_masq_offset = 0
Mon Mar 25 11:39:34 2019 us=78387   dhcp_lease_time = 31536000
Mon Mar 25 11:39:34 2019 us=78387   tap_sleep = 0
Mon Mar 25 11:39:34 2019 us=78387   dhcp_options = DISABLED
Mon Mar 25 11:39:34 2019 us=78387   dhcp_renew = DISABLED
Mon Mar 25 11:39:34 2019 us=78387   dhcp_pre_release = DISABLED
Mon Mar 25 11:39:34 2019 us=78387   domain = '[UNDEF]'
Mon Mar 25 11:39:34 2019 us=78387   netbios_scope = '[UNDEF]'
Mon Mar 25 11:39:34 2019 us=78387   netbios_node_type = 0
Mon Mar 25 11:39:34 2019 us=78387   disable_nbt = DISABLED
Mon Mar 25 11:39:34 2019 us=78387 OpenVPN 2.4.7 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Feb 21 2019
Mon Mar 25 11:39:34 2019 us=78387 Windows version 6.2 (Windows 8 or greater) 64bit
Mon Mar 25 11:39:34 2019 us=78387 library versions: OpenSSL 1.1.0j  20 Nov 2018, LZO 2.10
Enter Management Password:
Mon Mar 25 11:39:34 2019 us=78387 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Mon Mar 25 11:39:34 2019 us=78387 Need hold release from management interface, waiting...
Mon Mar 25 11:39:34 2019 us=552122 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Mon Mar 25 11:39:34 2019 us=652852 MANAGEMENT: CMD 'state on'
Mon Mar 25 11:39:34 2019 us=652852 MANAGEMENT: CMD 'log all on'
Mon Mar 25 11:39:34 2019 us=817413 MANAGEMENT: CMD 'echo all on'
Mon Mar 25 11:39:34 2019 us=818410 MANAGEMENT: CMD 'bytecount 5'
Mon Mar 25 11:39:34 2019 us=820404 MANAGEMENT: CMD 'hold off'
Mon Mar 25 11:39:34 2019 us=821401 MANAGEMENT: CMD 'hold release'
Mon Mar 25 11:39:34 2019 us=823396 LZO compression initializing
Mon Mar 25 11:39:34 2019 us=823396 Control Channel MTU parms [ L:1626 D:1212 EF:38 EB:0 ET:0 EL:3 ]
Mon Mar 25 11:39:34 2019 us=823396 MANAGEMENT: >STATE:1553528374,RESOLVE,,,,,,
Mon Mar 25 11:39:34 2019 us=826388 Data Channel MTU parms [ L:1626 D:1390 EF:126 EB:407 ET:0 EL:3 ]
Mon Mar 25 11:39:34 2019 us=826388 Fragmentation MTU parms [ L:1626 D:1300 EF:125 EB:407 ET:1 EL:3 ]
Mon Mar 25 11:39:34 2019 us=826388 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1574,tun-mtu 1500,proto UDPv4,comp-lzo,mtu-dynamic,cipher AES-256-CBC,auth SHA256,keysize 256,key-method 2,tls-client'
Mon Mar 25 11:39:34 2019 us=826388 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1574,tun-mtu 1500,proto UDPv4,comp-lzo,mtu-dynamic,cipher AES-256-CBC,auth SHA256,keysize 256,key-method 2,tls-server'
Mon Mar 25 11:39:34 2019 us=826388 TCP/UDP: Preserving recently used remote address: [AF_INET]REDACTED:1194
Mon Mar 25 11:39:34 2019 us=826388 Socket Buffers: R=[65536->65536] S=[65536->65536]
Mon Mar 25 11:39:34 2019 us=826388 UDP link local: (not bound)
Mon Mar 25 11:39:34 2019 us=826388 UDP link remote: [AF_INET]REDACTED:1194
Mon Mar 25 11:39:34 2019 us=826388 MANAGEMENT: >STATE:1553528374,WAIT,,,,,,
Mon Mar 25 11:39:34 2019 us=829380 MANAGEMENT: >STATE:1553528374,AUTH,,,,,,
Mon Mar 25 11:39:34 2019 us=829380 TLS: Initial packet from [AF_INET]192.168.1.1:1194, sid=e0d9c36a 24e0f3db
Mon Mar 25 11:39:35 2019 us=216346 VERIFY OK: depth=1, C=US, ST=DE, L=Wilmington, O=OpenVPN, OU=REDACTED, CN=REDACTED, name=server, emailAddress=nickkeane23@gmail.com
Mon Mar 25 11:39:35 2019 us=216346 VERIFY KU OK
Mon Mar 25 11:39:35 2019 us=216346 Validating certificate extended key usage
Mon Mar 25 11:39:35 2019 us=216346 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Mon Mar 25 11:39:35 2019 us=216346 VERIFY EKU OK
Mon Mar 25 11:39:35 2019 us=217343 VERIFY OK: depth=0, C=US, ST=DE, L=Wilmington, O=OpenVPN, OU=REDACTED, CN=REDACTED, name=server, emailAddress=nickkeane23@gmail.com
Mon Mar 25 11:39:35 2019 us=365946 Control Channel: TLSv1.2, cipher TLSv1.2 DHE-RSA-AES256-SHA256, 4096 bit RSA
Mon Mar 25 11:39:35 2019 us=365946 [REDACTED] Peer Connection Initiated with [AF_INET]192.168.1.1:1194
Mon Mar 25 11:39:36 2019 us=422124 MANAGEMENT: >STATE:1553528376,GET_CONFIG,,,,,,
Mon Mar 25 11:39:36 2019 us=422124 SENT CONTROL [REDACTED]: 'PUSH_REQUEST' (status=1)
Mon Mar 25 11:39:36 2019 us=424117 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,route 192.168.1.0 255.255.255.0,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.222.220,redirect-gateway def1,route-gateway 192.168.2.1,topology subnet,ping 10,ping-restart 120,ifconfig 192.168.2.2 255.255.255.0,peer-id 0,cipher AES-256-GCM'
Mon Mar 25 11:39:36 2019 us=424117 OPTIONS IMPORT: timers and/or timeouts modified
Mon Mar 25 11:39:36 2019 us=424117 OPTIONS IMPORT: --ifconfig/up options modified
Mon Mar 25 11:39:36 2019 us=424117 OPTIONS IMPORT: route options modified
Mon Mar 25 11:39:36 2019 us=424117 OPTIONS IMPORT: route-related options modified
Mon Mar 25 11:39:36 2019 us=424117 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Mon Mar 25 11:39:36 2019 us=424117 OPTIONS IMPORT: peer-id set
Mon Mar 25 11:39:36 2019 us=424117 OPTIONS IMPORT: adjusting link_mtu to 1629
Mon Mar 25 11:39:36 2019 us=424117 OPTIONS IMPORT: data channel crypto options modified
Mon Mar 25 11:39:36 2019 us=424117 Data Channel: using negotiated cipher 'AES-256-GCM'
Mon Mar 25 11:39:36 2019 us=424117 Data Channel MTU parms [ L:1557 D:1390 EF:57 EB:407 ET:0 EL:3 ]
Mon Mar 25 11:39:36 2019 us=424117 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Mon Mar 25 11:39:36 2019 us=424117 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Mon Mar 25 11:39:36 2019 us=424117 interactive service msg_channel=0
Mon Mar 25 11:39:36 2019 us=425115 ROUTE_GATEWAY 192.168.1.1/255.255.255.0 I=6 HWADDR=4c:cc:6a:0d:d6:25
Mon Mar 25 11:39:36 2019 us=431099 open_tun
Mon Mar 25 11:39:36 2019 us=431099 TAP-WIN32 device [Ethernet 2] opened: \\.\Global\{AFF5720A-B00D-440B-A4DA-D166729A8EE1}.tap
Mon Mar 25 11:39:36 2019 us=431099 TAP-Windows Driver Version 9.21 
Mon Mar 25 11:39:36 2019 us=431099 TAP-Windows MTU=1500
Mon Mar 25 11:39:36 2019 us=432096 Set TAP-Windows TUN subnet mode network/local/netmask = 192.168.2.0/192.168.2.2/255.255.255.0 [SUCCEEDED]
Mon Mar 25 11:39:36 2019 us=432096 Notified TAP-Windows driver to set a DHCP IP/netmask of 192.168.2.2/255.255.255.0 on interface {AFF5720A-B00D-440B-A4DA-D166729A8EE1} [DHCP-serv: 192.168.2.254, lease-time: 31536000]
Mon Mar 25 11:39:36 2019 us=432096 DHCP option string: 0608d043 deded043 dedc
Mon Mar 25 11:39:36 2019 us=432096 Successful ARP Flush on interface [28] {AFF5720A-B00D-440B-A4DA-D166729A8EE1}
Mon Mar 25 11:39:36 2019 us=441072 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Mon Mar 25 11:39:36 2019 us=441072 MANAGEMENT: >STATE:1553528376,ASSIGN_IP,,192.168.2.2,,,,
Mon Mar 25 11:40:06 2019 us=521669 TEST ROUTES: 2/2 succeeded len=1 ret=1 a=0 u/d=up
Mon Mar 25 11:40:06 2019 us=521669 C:\WINDOWS\system32\route.exe ADD 192.168.1.1 MASK 255.255.255.255 192.168.1.1 IF 6
Mon Mar 25 11:40:06 2019 us=522666 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=25 and dwForwardType=4
Mon Mar 25 11:40:06 2019 us=522666 Route addition via IPAPI succeeded [adaptive]
Mon Mar 25 11:40:06 2019 us=522666 C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 192.168.2.1
Mon Mar 25 11:40:06 2019 us=523664 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=35 and dwForwardType=4
Mon Mar 25 11:40:06 2019 us=523664 Route addition via IPAPI succeeded [adaptive]
Mon Mar 25 11:40:06 2019 us=523664 C:\WINDOWS\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 192.168.2.1
Mon Mar 25 11:40:06 2019 us=524661 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=35 and dwForwardType=4
Mon Mar 25 11:40:06 2019 us=524661 Route addition via IPAPI succeeded [adaptive]
Mon Mar 25 11:40:06 2019 us=524661 MANAGEMENT: >STATE:1553528406,ADD_ROUTES,,,,,,
Mon Mar 25 11:40:06 2019 us=524661 C:\WINDOWS\system32\route.exe ADD 192.168.1.0 MASK 255.255.255.0 192.168.2.1
Mon Mar 25 11:40:06 2019 us=525659 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=35 and dwForwardType=4
Mon Mar 25 11:40:06 2019 us=525659 Route addition via IPAPI succeeded [adaptive]
Mon Mar 25 11:40:06 2019 us=525659 Initialization Sequence Completed
Mon Mar 25 11:40:06 2019 us=525659 MANAGEMENT: >STATE:1553528406,CONNECTED,SUCCESS,192.168.2.2,192.168.1.1,1194,,

nickkeane

How do I enable IP_Forwarding? I don't see a guide for that in the link you posted.

I did a quick google search for IP_Forwarding and ran 'cat /proc/sys/net/ipv4/ip_forward' on the router and got '1' back so that should be enabled, if that's what you meant.

TinCanTech

nickkeane wrote I'm not sure what you mean by options should be separated by a comma

See your client log:

nickkeane wrote Mon Mar 25 11:39:36 2019 us=424117 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,route 192.168.1.0 255.255.255.0,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.222.220,redirect-gateway def1,route-gateway 192.168.2.1,topology subnet,ping 10,ping-restart 120,ifconfig 192.168.2.2 255.255.255.0,peer-id 0,cipher AES-256-GCM'

All the options are now comma delimited. I don't know how you managed to erase those commas from the server log .. but don't worry about it, I guess it's some bizarre quirk of your router.

nickkeane wrote How do I enable IP_Forwarding? I don't see that in the link you posted.

As your server is a router this is probably enabled by default.

You need to check the rest of your router setup because I can't really help with that.

nickkeane

So is the issue likely with the router firewall settings? Or the OpenVPN server settings on it? I'm not sure what to look for that could be wrong.

TinCanTech

Openvpn is correctly configured .. now you have to learn how your router enables clients access to the internet via the VPN, there is usually one tick box to select .. or something like that.

nickkeane

Good to know that the configuration is correct. Do you know what tickbox would need to be checked or toggled? I have to get this working asap.

TinCanTech

I am sorry but I do not use Netgear or DD-WRT so I don't know how to configure your router.

If all else fails you can contact me privately: tincanteksup <at> gmail

nickkeane

I figured it out. There were 2 issues at play with the last firewall rule - the tunnel was not using eth0 for outgoing packets (modern DD-WRT routers use vlan2 for outgoing WAN access, but this isn't always the case. It is in my case), so that had to be changed, and also there was a wildcard capture rule in the POSTROUTING table, so I had to insert the rules as the first ones, rather than append to the end of the table.

So the rule had to be changed from

iptables -t nat -A POSTROUTING -s 192.168.2.0/24 -o eth0 -j MASQUERADE

iptables -t nat -I POSTROUTING 1 -s 192.168.2.0/24 -o vlan2 -j MASQUERADE
iptables -t nat -I POSTROUTING 1 -s 192.168.2.0/24 -o br0 -j MASQUERADE

TinCanTech

Thanks for updating your thread 8-)