Asuswrt server with Rasbian client error

Pseudomax

Hi

I am new to this, so please bear with me ...

I am trying to setup a connection between two remote locations with the OpenVPN server being my Asus Router (using the stock Asuswrt firmware). I have a DDNS name and this works successfully with a different windows client that has 'viscosity' (or OpenVPN) installed by simply using the exported .ovpn file and adding the DDNS name (listed below as xx.xx.xx). Additional to the config below I also have added

block-outside-dns

which from my reading only works with Windows clients:

# Automatically generated configuration

# Tunnel options
proto udp4
multihome
port yyyy
dev tap21
sndbuf 0
rcvbuf 0
keepalive 10 30
up '/etc/openvpn/ovpn-up'
down '/etc/openvpn/ovpn-down'
setenv ovpn_type 0
setenv unit 1
script-security 2
daemon vpnserver1
verb 3
status-version 2
status status 10
comp-lzo adaptive
plugin /usr/lib/openvpn-plugin-auth-pam.so openvpn

# Server Mode
server-bridge
client-config-dir ccd
client-to-client
duplicate-cn
push "redirect-gateway def1"
push "dhcp-option DNS 192.168.1.1"
verify-client-cert none
username-as-common-name

# Data Channel Encryption Options
auth SHA1
cipher AES-256-CBC

# TLS Mode Options
ca ca.crt
dh dh.pem
cert server.crt
key server.key
tls-auth static.key

# Custom Configuration
~
~
~

remote xx.xx.xx yyyy
float
nobind
proto udp
dev tap

# Windows needs the TAP-Win32 adapter name from the Network Connections panel
# if you have more than one. On XP SP2, you may need to disable the firewall
# for the TAP adapter.
;dev-node MyTap
sndbuf 0
rcvbuf 0
keepalive 10 30
comp-lzo adaptive
auth-user-pass vpnlogin.txt
client
auth SHA1
cipher AES-256-CBC
remote-cert-tls server
verb 4

Using the windows clients I can connect to the server without any DNS leaks.

My problem comes when I try to setup up a separate router or VPN device to make a permanent connection between the sites as a client (ideally resources at both local sites will be available to each resource). What I have tried is to use another Asus router (this one with Asus Merlin), as well as a DD-WRT router, and finally a Raspberry Pi 3b+ with Rasbian installed. All cause the same problem...

They all connect (and on the server I am notified of a connection) but no tun0 is visible with

ifconfig

and in the log I have the following as errors:

sudo openvpn --config clientPoppy.ovpn

generates:

Sat Dec 26 13:12:47 2020 us=886911 WARNING: file 'vpnlogin.txt' is group or others accessible
Sat Dec 26 13:12:47 2020 us=887132 Current Parameter Settings:
Sat Dec 26 13:12:47 2020 us=887185   config = 'clientPoppy.ovpn'
Sat Dec 26 13:12:47 2020 us=887235   mode = 0
Sat Dec 26 13:12:47 2020 us=887284   persist_config = DISABLED
Sat Dec 26 13:12:47 2020 us=887332   persist_mode = 1
Sat Dec 26 13:12:47 2020 us=887380   show_ciphers = DISABLED
Sat Dec 26 13:12:47 2020 us=887429   show_digests = DISABLED
Sat Dec 26 13:12:47 2020 us=887475   show_engines = DISABLED
Sat Dec 26 13:12:47 2020 us=887520   genkey = DISABLED
Sat Dec 26 13:12:47 2020 us=887565   key_pass_file = '[UNDEF]'
Sat Dec 26 13:12:47 2020 us=887610   show_tls_ciphers = DISABLED
Sat Dec 26 13:12:47 2020 us=887659   connect_retry_max = 0
Sat Dec 26 13:12:47 2020 us=887707 Connection profiles [0]:
Sat Dec 26 13:12:47 2020 us=887756   proto = udp
Sat Dec 26 13:12:47 2020 us=887801   local = '[UNDEF]'
Sat Dec 26 13:12:47 2020 us=887849   local_port = '[UNDEF]'
Sat Dec 26 13:12:47 2020 us=887897   remote = 'xx.xx.xx'
Sat Dec 26 13:12:47 2020 us=887945   remote_port = 'yyyy'
Sat Dec 26 13:12:47 2020 us=887993   remote_float = ENABLED
Sat Dec 26 13:12:47 2020 us=888041   bind_defined = DISABLED
Sat Dec 26 13:12:47 2020 us=888086   bind_local = DISABLED
Sat Dec 26 13:12:47 2020 us=888134   bind_ipv6_only = DISABLED
Sat Dec 26 13:12:47 2020 us=888182   connect_retry_seconds = 5
Sat Dec 26 13:12:47 2020 us=888231   connect_timeout = 120
Sat Dec 26 13:12:47 2020 us=888278   socks_proxy_server = '[UNDEF]'
Sat Dec 26 13:12:47 2020 us=888324   socks_proxy_port = '[UNDEF]'
Sat Dec 26 13:12:47 2020 us=888374   tun_mtu = 1500
Sat Dec 26 13:12:47 2020 us=888422   tun_mtu_defined = ENABLED
Sat Dec 26 13:12:47 2020 us=888470   link_mtu = 1500
Sat Dec 26 13:12:47 2020 us=888518   link_mtu_defined = DISABLED
Sat Dec 26 13:12:47 2020 us=888564   tun_mtu_extra = 32
Sat Dec 26 13:12:47 2020 us=888618   tun_mtu_extra_defined = ENABLED
Sat Dec 26 13:12:47 2020 us=888667   mtu_discover_type = -1
Sat Dec 26 13:12:47 2020 us=888714   fragment = 0
Sat Dec 26 13:12:47 2020 us=888762   mssfix = 1450
Sat Dec 26 13:12:47 2020 us=888808   explicit_exit_notification = 0
Sat Dec 26 13:12:47 2020 us=888856 Connection profiles END
Sat Dec 26 13:12:47 2020 us=888904   remote_random = DISABLED
Sat Dec 26 13:12:47 2020 us=888951   ipchange = '[UNDEF]'
Sat Dec 26 13:12:47 2020 us=888999   dev = 'tap'
Sat Dec 26 13:12:47 2020 us=889044   dev_type = '[UNDEF]'
Sat Dec 26 13:12:47 2020 us=889092   dev_node = '[UNDEF]'
Sat Dec 26 13:12:47 2020 us=889139   lladdr = '[UNDEF]'
Sat Dec 26 13:12:47 2020 us=889187   topology = 1
Sat Dec 26 13:12:47 2020 us=889234   ifconfig_local = '[UNDEF]'
Sat Dec 26 13:12:47 2020 us=889280   ifconfig_remote_netmask = '[UNDEF]'
Sat Dec 26 13:12:47 2020 us=889330   ifconfig_noexec = DISABLED
Sat Dec 26 13:12:47 2020 us=889378   ifconfig_nowarn = DISABLED
Sat Dec 26 13:12:47 2020 us=889426   ifconfig_ipv6_local = '[UNDEF]'
Sat Dec 26 13:12:47 2020 us=889474   ifconfig_ipv6_netbits = 0
Sat Dec 26 13:12:47 2020 us=889520   ifconfig_ipv6_remote = '[UNDEF]'
Sat Dec 26 13:12:47 2020 us=889570   shaper = 0
Sat Dec 26 13:12:47 2020 us=889617   mtu_test = 0
Sat Dec 26 13:12:47 2020 us=889664   mlock = DISABLED
Sat Dec 26 13:12:47 2020 us=889713   keepalive_ping = 10
Sat Dec 26 13:12:47 2020 us=889758   keepalive_timeout = 30
Sat Dec 26 13:12:47 2020 us=889806   inactivity_timeout = 0
Sat Dec 26 13:12:47 2020 us=889854   ping_send_timeout = 10
Sat Dec 26 13:12:47 2020 us=889902   ping_rec_timeout = 30
Sat Dec 26 13:12:47 2020 us=889949   ping_rec_timeout_action = 2
Sat Dec 26 13:12:47 2020 us=889997   ping_timer_remote = DISABLED
Sat Dec 26 13:12:47 2020 us=890045   remap_sigusr1 = 0
Sat Dec 26 13:12:47 2020 us=890092   persist_tun = DISABLED
Sat Dec 26 13:12:47 2020 us=890140   persist_local_ip = DISABLED
Sat Dec 26 13:12:47 2020 us=890188   persist_remote_ip = DISABLED
Sat Dec 26 13:12:47 2020 us=890235   persist_key = DISABLED
Sat Dec 26 13:12:47 2020 us=890283   passtos = DISABLED
Sat Dec 26 13:12:47 2020 us=890331   resolve_retry_seconds = 1000000000
Sat Dec 26 13:12:47 2020 us=890379   resolve_in_advance = DISABLED
Sat Dec 26 13:12:47 2020 us=890426   username = '[UNDEF]'
Sat Dec 26 13:12:47 2020 us=890474   groupname = '[UNDEF]'
Sat Dec 26 13:12:47 2020 us=890521   chroot_dir = '[UNDEF]'
Sat Dec 26 13:12:47 2020 us=890568   cd_dir = '[UNDEF]'
Sat Dec 26 13:12:47 2020 us=890615   writepid = '[UNDEF]'
Sat Dec 26 13:12:47 2020 us=890663   up_script = '[UNDEF]'
Sat Dec 26 13:12:47 2020 us=890711   down_script = '[UNDEF]'
Sat Dec 26 13:12:47 2020 us=890758   down_pre = DISABLED
Sat Dec 26 13:12:47 2020 us=890806   up_restart = DISABLED
Sat Dec 26 13:12:47 2020 us=890853   up_delay = DISABLED
Sat Dec 26 13:12:47 2020 us=890901   daemon = DISABLED
Sat Dec 26 13:12:47 2020 us=890948   inetd = 0
Sat Dec 26 13:12:47 2020 us=890995   log = DISABLED
Sat Dec 26 13:12:47 2020 us=891042   suppress_timestamps = DISABLED
Sat Dec 26 13:12:47 2020 us=891090   machine_readable_output = DISABLED
Sat Dec 26 13:12:47 2020 us=891138   nice = 0
Sat Dec 26 13:12:47 2020 us=891185   verbosity = 4
Sat Dec 26 13:12:47 2020 us=891232   mute = 0
Sat Dec 26 13:12:47 2020 us=891279   gremlin = 0
Sat Dec 26 13:12:47 2020 us=891326   status_file = '[UNDEF]'
Sat Dec 26 13:12:47 2020 us=891374   status_file_version = 1
Sat Dec 26 13:12:47 2020 us=891422   status_file_update_freq = 60
Sat Dec 26 13:12:47 2020 us=891470   occ = ENABLED
Sat Dec 26 13:12:47 2020 us=891517   rcvbuf = 0
Sat Dec 26 13:12:47 2020 us=891564   sndbuf = 0
Sat Dec 26 13:12:47 2020 us=891610   mark = 0
Sat Dec 26 13:12:47 2020 us=891658   sockflags = 0
Sat Dec 26 13:12:47 2020 us=891705   fast_io = DISABLED
Sat Dec 26 13:12:47 2020 us=891752   comp.alg = 2
Sat Dec 26 13:12:47 2020 us=891801   comp.flags = 1
Sat Dec 26 13:12:47 2020 us=891849   route_script = '[UNDEF]'
Sat Dec 26 13:12:47 2020 us=891897   route_default_gateway = '[UNDEF]'
Sat Dec 26 13:12:47 2020 us=891947   route_default_metric = 0
Sat Dec 26 13:12:47 2020 us=891995   route_noexec = DISABLED
Sat Dec 26 13:12:47 2020 us=892044   route_delay = 0
Sat Dec 26 13:12:47 2020 us=892093   route_delay_window = 30
Sat Dec 26 13:12:47 2020 us=892193   route_delay_defined = DISABLED
Sat Dec 26 13:12:47 2020 us=892245   route_nopull = DISABLED
Sat Dec 26 13:12:47 2020 us=892294   route_gateway_via_dhcp = DISABLED
Sat Dec 26 13:12:47 2020 us=892342   allow_pull_fqdn = DISABLED
Sat Dec 26 13:12:47 2020 us=892391   management_addr = '[UNDEF]'
Sat Dec 26 13:12:47 2020 us=892439   management_port = '[UNDEF]'
Sat Dec 26 13:12:47 2020 us=892488   management_user_pass = '[UNDEF]'
Sat Dec 26 13:12:47 2020 us=892537   management_log_history_cache = 250
Sat Dec 26 13:12:47 2020 us=892587   management_echo_buffer_size = 100
Sat Dec 26 13:12:47 2020 us=892636   management_write_peer_info_file = '[UNDEF]'
Sat Dec 26 13:12:47 2020 us=892684   management_client_user = '[UNDEF]'
Sat Dec 26 13:12:47 2020 us=892734   management_client_group = '[UNDEF]'
Sat Dec 26 13:12:47 2020 us=892782   management_flags = 0
Sat Dec 26 13:12:47 2020 us=892831   shared_secret_file = '[UNDEF]'
Sat Dec 26 13:12:47 2020 us=892881   key_direction = not set
Sat Dec 26 13:12:47 2020 us=892929   ciphername = 'AES-256-CBC'
Sat Dec 26 13:12:47 2020 us=892977   ncp_enabled = ENABLED
Sat Dec 26 13:12:47 2020 us=893027   ncp_ciphers = 'AES-256-GCM:AES-128-GCM'
Sat Dec 26 13:12:47 2020 us=893075   authname = 'SHA1'
Sat Dec 26 13:12:47 2020 us=893123   prng_hash = 'SHA1'
Sat Dec 26 13:12:47 2020 us=893172   prng_nonce_secret_len = 16
Sat Dec 26 13:12:47 2020 us=893221   keysize = 0
Sat Dec 26 13:12:47 2020 us=893269   engine = DISABLED
Sat Dec 26 13:12:47 2020 us=893317   replay = ENABLED
Sat Dec 26 13:12:47 2020 us=893365   mute_replay_warnings = DISABLED
Sat Dec 26 13:12:47 2020 us=893413   replay_window = 64
Sat Dec 26 13:12:47 2020 us=893461   replay_time = 15
Sat Dec 26 13:12:47 2020 us=893509   packet_id_file = '[UNDEF]'
Sat Dec 26 13:12:47 2020 us=893558   use_iv = ENABLED
Sat Dec 26 13:12:47 2020 us=893605   test_crypto = DISABLED
Sat Dec 26 13:12:47 2020 us=893654   tls_server = DISABLED
Sat Dec 26 13:12:47 2020 us=893703   tls_client = ENABLED
Sat Dec 26 13:12:47 2020 us=893752   key_method = 2
Sat Dec 26 13:12:47 2020 us=893797   ca_file = '[[INLINE]]'
Sat Dec 26 13:12:47 2020 us=893843   ca_path = '[UNDEF]'
Sat Dec 26 13:12:47 2020 us=893889   dh_file = '[UNDEF]'
Sat Dec 26 13:12:47 2020 us=893934   cert_file = '[[INLINE]]'
Sat Dec 26 13:12:47 2020 us=893980   extra_certs_file = '[UNDEF]'
Sat Dec 26 13:12:47 2020 us=894026   priv_key_file = '[[INLINE]]'
Sat Dec 26 13:12:47 2020 us=894075   pkcs12_file = '[UNDEF]'
Sat Dec 26 13:12:47 2020 us=894123   cipher_list = '[UNDEF]'
Sat Dec 26 13:12:47 2020 us=894169   cipher_list_tls13 = '[UNDEF]'
Sat Dec 26 13:12:47 2020 us=894217   tls_cert_profile = '[UNDEF]'
Sat Dec 26 13:12:47 2020 us=894264   tls_verify = '[UNDEF]'
Sat Dec 26 13:12:47 2020 us=894312   tls_export_cert = '[UNDEF]'
Sat Dec 26 13:12:47 2020 us=894361   verify_x509_type = 0
Sat Dec 26 13:12:47 2020 us=894410   verify_x509_name = '[UNDEF]'
Sat Dec 26 13:12:47 2020 us=894459   crl_file = '[UNDEF]'
Sat Dec 26 13:12:47 2020 us=894507   ns_cert_type = 0
Sat Dec 26 13:12:47 2020 us=894556   remote_cert_ku[i] = 65535
Sat Dec 26 13:12:47 2020 us=894606   remote_cert_ku[i] = 0
Sat Dec 26 13:12:47 2020 us=894654   remote_cert_ku[i] = 0
Sat Dec 26 13:12:47 2020 us=894703   remote_cert_ku[i] = 0
Sat Dec 26 13:12:47 2020 us=894752   remote_cert_ku[i] = 0
Sat Dec 26 13:12:47 2020 us=894798   remote_cert_ku[i] = 0
Sat Dec 26 13:12:47 2020 us=894846   remote_cert_ku[i] = 0
Sat Dec 26 13:12:47 2020 us=894895   remote_cert_ku[i] = 0
Sat Dec 26 13:12:47 2020 us=894943   remote_cert_ku[i] = 0
Sat Dec 26 13:12:47 2020 us=894991   remote_cert_ku[i] = 0
Sat Dec 26 13:12:47 2020 us=895037   remote_cert_ku[i] = 0
Sat Dec 26 13:12:47 2020 us=895088   remote_cert_ku[i] = 0
Sat Dec 26 13:12:47 2020 us=895136   remote_cert_ku[i] = 0
Sat Dec 26 13:12:47 2020 us=895184   remote_cert_ku[i] = 0
Sat Dec 26 13:12:47 2020 us=895232   remote_cert_ku[i] = 0
Sat Dec 26 13:12:47 2020 us=895278   remote_cert_ku[i] = 0
Sat Dec 26 13:12:47 2020 us=895330   remote_cert_eku = 'TLS Web Server Authentication'
Sat Dec 26 13:12:47 2020 us=895380   ssl_flags = 0
Sat Dec 26 13:12:47 2020 us=895429   tls_timeout = 2
Sat Dec 26 13:12:47 2020 us=895477   renegotiate_bytes = -1
Sat Dec 26 13:12:47 2020 us=895526   renegotiate_packets = 0
Sat Dec 26 13:12:47 2020 us=895575   renegotiate_seconds = 3600
Sat Dec 26 13:12:47 2020 us=895623   handshake_window = 60
Sat Dec 26 13:12:47 2020 us=895671   transition_window = 3600
Sat Dec 26 13:12:47 2020 us=895719   single_session = DISABLED
Sat Dec 26 13:12:47 2020 us=895764   push_peer_info = DISABLED
Sat Dec 26 13:12:47 2020 us=895813   tls_exit = DISABLED
Sat Dec 26 13:12:47 2020 us=895861   tls_auth_file = '[[INLINE]]'
Sat Dec 26 13:12:47 2020 us=895910   tls_crypt_file = '[UNDEF]'
Sat Dec 26 13:12:47 2020 us=895976   pkcs11_protected_authentication = DISABLED
Sat Dec 26 13:12:47 2020 us=896026   pkcs11_protected_authentication = DISABLED
Sat Dec 26 13:12:47 2020 us=896075   pkcs11_protected_authentication = DISABLED
Sat Dec 26 13:12:47 2020 us=896125   pkcs11_protected_authentication = DISABLED
Sat Dec 26 13:12:47 2020 us=896174   pkcs11_protected_authentication = DISABLED
Sat Dec 26 13:12:47 2020 us=896223   pkcs11_protected_authentication = DISABLED
Sat Dec 26 13:12:47 2020 us=896272   pkcs11_protected_authentication = DISABLED
Sat Dec 26 13:12:47 2020 us=896321   pkcs11_protected_authentication = DISABLED
Sat Dec 26 13:12:47 2020 us=896371   pkcs11_protected_authentication = DISABLED
Sat Dec 26 13:12:47 2020 us=896420   pkcs11_protected_authentication = DISABLED
Sat Dec 26 13:12:47 2020 us=896470   pkcs11_protected_authentication = DISABLED
Sat Dec 26 13:12:47 2020 us=896517   pkcs11_protected_authentication = DISABLED
Sat Dec 26 13:12:47 2020 us=896568   pkcs11_protected_authentication = DISABLED
Sat Dec 26 13:12:47 2020 us=896618   pkcs11_protected_authentication = DISABLED
Sat Dec 26 13:12:47 2020 us=896667   pkcs11_protected_authentication = DISABLED
Sat Dec 26 13:12:47 2020 us=896715   pkcs11_protected_authentication = DISABLED
Sat Dec 26 13:12:47 2020 us=896764   pkcs11_private_mode = 00000000
Sat Dec 26 13:12:47 2020 us=896814   pkcs11_private_mode = 00000000
Sat Dec 26 13:12:47 2020 us=896863   pkcs11_private_mode = 00000000
Sat Dec 26 13:12:47 2020 us=896913   pkcs11_private_mode = 00000000
Sat Dec 26 13:12:47 2020 us=896962   pkcs11_private_mode = 00000000
Sat Dec 26 13:12:47 2020 us=897009   pkcs11_private_mode = 00000000
Sat Dec 26 13:12:47 2020 us=897058   pkcs11_private_mode = 00000000
Sat Dec 26 13:12:47 2020 us=897108   pkcs11_private_mode = 00000000
Sat Dec 26 13:12:47 2020 us=897157   pkcs11_private_mode = 00000000
Sat Dec 26 13:12:47 2020 us=897206   pkcs11_private_mode = 00000000
Sat Dec 26 13:12:47 2020 us=897254   pkcs11_private_mode = 00000000
Sat Dec 26 13:12:47 2020 us=897303   pkcs11_private_mode = 00000000
Sat Dec 26 13:12:47 2020 us=897351   pkcs11_private_mode = 00000000
Sat Dec 26 13:12:47 2020 us=897400   pkcs11_private_mode = 00000000
Sat Dec 26 13:12:47 2020 us=897449   pkcs11_private_mode = 00000000
Sat Dec 26 13:12:47 2020 us=897498   pkcs11_private_mode = 00000000
Sat Dec 26 13:12:47 2020 us=897546   pkcs11_cert_private = DISABLED
Sat Dec 26 13:12:47 2020 us=897595   pkcs11_cert_private = DISABLED
Sat Dec 26 13:12:47 2020 us=897644   pkcs11_cert_private = DISABLED
Sat Dec 26 13:12:47 2020 us=897692   pkcs11_cert_private = DISABLED
Sat Dec 26 13:12:47 2020 us=897740   pkcs11_cert_private = DISABLED
Sat Dec 26 13:12:47 2020 us=897789   pkcs11_cert_private = DISABLED
Sat Dec 26 13:12:47 2020 us=897837   pkcs11_cert_private = DISABLED
Sat Dec 26 13:12:47 2020 us=897886   pkcs11_cert_private = DISABLED
Sat Dec 26 13:12:47 2020 us=897934   pkcs11_cert_private = DISABLED
Sat Dec 26 13:12:47 2020 us=897983   pkcs11_cert_private = DISABLED
Sat Dec 26 13:12:47 2020 us=898031   pkcs11_cert_private = DISABLED
Sat Dec 26 13:12:47 2020 us=898079   pkcs11_cert_private = DISABLED
Sat Dec 26 13:12:47 2020 us=898127   pkcs11_cert_private = DISABLED
Sat Dec 26 13:12:47 2020 us=898176   pkcs11_cert_private = DISABLED
Sat Dec 26 13:12:47 2020 us=898224   pkcs11_cert_private = DISABLED
Sat Dec 26 13:12:47 2020 us=898272   pkcs11_cert_private = DISABLED
Sat Dec 26 13:12:47 2020 us=898322   pkcs11_pin_cache_period = -1
Sat Dec 26 13:12:47 2020 us=898370   pkcs11_id = '[UNDEF]'
Sat Dec 26 13:12:47 2020 us=898419   pkcs11_id_management = DISABLED
Sat Dec 26 13:12:47 2020 us=898473   server_network = 0.0.0.0
Sat Dec 26 13:12:47 2020 us=898525   server_netmask = 0.0.0.0
Sat Dec 26 13:12:47 2020 us=898616   server_network_ipv6 = ::
Sat Dec 26 13:12:47 2020 us=898667   server_netbits_ipv6 = 0
Sat Dec 26 13:12:47 2020 us=898720   server_bridge_ip = 0.0.0.0
Sat Dec 26 13:12:47 2020 us=898773   server_bridge_netmask = 0.0.0.0
Sat Dec 26 13:12:47 2020 us=898824   server_bridge_pool_start = 0.0.0.0
Sat Dec 26 13:12:47 2020 us=898874   server_bridge_pool_end = 0.0.0.0
Sat Dec 26 13:12:47 2020 us=898923   ifconfig_pool_defined = DISABLED
Sat Dec 26 13:12:47 2020 us=898975   ifconfig_pool_start = 0.0.0.0
Sat Dec 26 13:12:47 2020 us=899026   ifconfig_pool_end = 0.0.0.0
Sat Dec 26 13:12:47 2020 us=899079   ifconfig_pool_netmask = 0.0.0.0
Sat Dec 26 13:12:47 2020 us=899128   ifconfig_pool_persist_filename = '[UNDEF]'
Sat Dec 26 13:12:47 2020 us=899178   ifconfig_pool_persist_refresh_freq = 600
Sat Dec 26 13:12:47 2020 us=899228   ifconfig_ipv6_pool_defined = DISABLED
Sat Dec 26 13:12:47 2020 us=899279   ifconfig_ipv6_pool_base = ::
Sat Dec 26 13:12:47 2020 us=899328   ifconfig_ipv6_pool_netbits = 0
Sat Dec 26 13:12:47 2020 us=899378   n_bcast_buf = 256
Sat Dec 26 13:12:47 2020 us=899424   tcp_queue_limit = 64
Sat Dec 26 13:12:47 2020 us=899473   real_hash_size = 256
Sat Dec 26 13:12:47 2020 us=899522   virtual_hash_size = 256
Sat Dec 26 13:12:47 2020 us=899570   client_connect_script = '[UNDEF]'
Sat Dec 26 13:12:47 2020 us=899619   learn_address_script = '[UNDEF]'
Sat Dec 26 13:12:47 2020 us=899668   client_disconnect_script = '[UNDEF]'
Sat Dec 26 13:12:47 2020 us=899718   client_config_dir = '[UNDEF]'
Sat Dec 26 13:12:47 2020 us=899766   ccd_exclusive = DISABLED
Sat Dec 26 13:12:47 2020 us=899815   tmp_dir = '/tmp'
Sat Dec 26 13:12:47 2020 us=899863   push_ifconfig_defined = DISABLED
Sat Dec 26 13:12:47 2020 us=899915   push_ifconfig_local = 0.0.0.0
Sat Dec 26 13:12:47 2020 us=899968   push_ifconfig_remote_netmask = 0.0.0.0
Sat Dec 26 13:12:47 2020 us=900017   push_ifconfig_ipv6_defined = DISABLED
Sat Dec 26 13:12:47 2020 us=900069   push_ifconfig_ipv6_local = ::/0
Sat Dec 26 13:12:47 2020 us=900121   push_ifconfig_ipv6_remote = ::
Sat Dec 26 13:12:47 2020 us=900169   enable_c2c = DISABLED
Sat Dec 26 13:12:47 2020 us=900217   duplicate_cn = DISABLED
Sat Dec 26 13:12:47 2020 us=900266   cf_max = 0
Sat Dec 26 13:12:47 2020 us=900314   cf_per = 0
Sat Dec 26 13:12:47 2020 us=900362   max_clients = 1024
Sat Dec 26 13:12:47 2020 us=900411   max_routes_per_client = 256
Sat Dec 26 13:12:47 2020 us=900461   auth_user_pass_verify_script = '[UNDEF]'
Sat Dec 26 13:12:47 2020 us=900508   auth_user_pass_verify_script_via_file = DISABLED
Sat Dec 26 13:12:47 2020 us=900557   auth_token_generate = DISABLED
Sat Dec 26 13:12:47 2020 us=900606   auth_token_lifetime = 0
Sat Dec 26 13:12:47 2020 us=900654   port_share_host = '[UNDEF]'
Sat Dec 26 13:12:47 2020 us=900703   port_share_port = '[UNDEF]'
Sat Dec 26 13:12:47 2020 us=900751   client = ENABLED
Sat Dec 26 13:12:47 2020 us=900800   pull = ENABLED
Sat Dec 26 13:12:47 2020 us=900849   auth_user_pass_file = 'vpnlogin.txt'
Sat Dec 26 13:12:47 2020 us=900904 OpenVPN 2.4.7 arm-unknown-linux-gnueabihf [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Feb 20 2019
Sat Dec 26 13:12:47 2020 us=900986 library versions: OpenSSL 1.1.1d  10 Sep 2019, LZO 2.10
Sat Dec 26 13:12:47 2020 us=906479 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Dec 26 13:12:47 2020 us=906608 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Dec 26 13:12:47 2020 us=906670 LZO compression initializing
Sat Dec 26 13:12:47 2020 us=909269 Control Channel MTU parms [ L:1654 D:1184 EF:66 EB:0 ET:0 EL:3 ]
Sat Dec 26 13:12:47 2020 us=953974 Data Channel MTU parms [ L:1654 D:1450 EF:122 EB:411 ET:32 EL:3 ]
Sat Dec 26 13:12:47 2020 us=954138 Local Options String (VER=V4): 'V4,dev-type tap,link-mtu 1590,tun-mtu 1532,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client'
Sat Dec 26 13:12:47 2020 us=954180 Expected Remote Options String (VER=V4): 'V4,dev-type tap,link-mtu 1590,tun-mtu 1532,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-server'
Sat Dec 26 13:12:47 2020 us=954230 TCP/UDP: Preserving recently used remote address: [AF_INET]xx.xx.xx:yyyy
Sat Dec 26 13:12:47 2020 us=954297 Socket Buffers: R=[180224->180224] S=[180224->180224]
Sat Dec 26 13:12:47 2020 us=954329 UDP link local: (not bound)
Sat Dec 26 13:12:47 2020 us=954365 UDP link remote: [AF_INET]xx.xx.xx:yyyy
Sat Dec 26 13:12:48 2020 us=14719 TLS: Initial packet from [AF_INET]xx.xx.xx:yyyy, sid=c24f9113 89e8ab3b
Sat Dec 26 13:12:48 2020 us=15047 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Sat Dec 26 13:12:48 2020 us=93742 VERIFY OK: depth=1, C=TW, ST=TW, L=Taipei, O=ASUS, CN=GT-AX11000, emailAddress=me@myhost.mydomain
Sat Dec 26 13:12:48 2020 us=94601 VERIFY KU OK
Sat Dec 26 13:12:48 2020 us=94664 Validating certificate extended key usage
Sat Dec 26 13:12:48 2020 us=94700 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Sat Dec 26 13:12:48 2020 us=94733 VERIFY EKU OK
Sat Dec 26 13:12:48 2020 us=94764 VERIFY OK: depth=0, C=TW, ST=TW, L=Taipei, O=ASUS, CN=GT-AX11000, emailAddress=me@myhost.mydomain
Sat Dec 26 13:12:48 2020 us=219759 Control Channel: TLSv1.2, cipher TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Sat Dec 26 13:12:48 2020 us=219894 [GT-AX11000] Peer Connection Initiated with [AF_INET]xx.xx.xx:yyyy
Sat Dec 26 13:12:49 2020 us=261128 SENT CONTROL [GT-AX11000]: 'PUSH_REQUEST' (status=1)
Sat Dec 26 13:12:49 2020 us=319849 PUSH: Received control message: 'PUSH_REPLY,route 192.168.10.0 255.255.255.0,route 192.168.20.0 255.255.255.0,route 192.168.10.0 255.255.255.0,route 192.168.20.0 255.255.255.0,redirect-gateway def1,dhcp-option DNS 192.168.1.1,redirect-gateway 192.168.1.1 255.255.255.0,route-gateway dhcp,ping 10,ping-restart 30,peer-id 0,cipher AES-256-GCM'
Sat Dec 26 13:12:49 2020 us=320246 Options error: unknown --redirect-gateway flag: 192.168.1.1
Sat Dec 26 13:12:49 2020 us=320536 OPTIONS IMPORT: timers and/or timeouts modified
Sat Dec 26 13:12:49 2020 us=320676 OPTIONS IMPORT: route options modified
Sat Dec 26 13:12:49 2020 us=320807 OPTIONS IMPORT: route-related options modified
Sat Dec 26 13:12:49 2020 us=320938 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Sat Dec 26 13:12:49 2020 us=321067 OPTIONS IMPORT: peer-id set
Sat Dec 26 13:12:49 2020 us=321196 OPTIONS IMPORT: adjusting link_mtu to 1657
Sat Dec 26 13:12:49 2020 us=321323 OPTIONS IMPORT: data channel crypto options modified
Sat Dec 26 13:12:49 2020 us=321464 Data Channel: using negotiated cipher 'AES-256-GCM'
Sat Dec 26 13:12:49 2020 us=321642 Data Channel MTU parms [ L:1585 D:1450 EF:53 EB:411 ET:32 EL:3 ]
Sat Dec 26 13:12:49 2020 us=322540 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Sat Dec 26 13:12:49 2020 us=322715 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Sat Dec 26 13:12:49 2020 us=323369 ROUTE_GATEWAY 192.168.10.1/255.255.255.0 IFACE=eth0 HWADDR=b8:27:eb:97:2f:8a
Sat Dec 26 13:12:49 2020 us=323543 OpenVPN ROUTE: OpenVPN needs a gateway parameter for a --route option and no default was specified by either --route-gateway or --ifconfig options
Sat Dec 26 13:12:49 2020 us=323673 OpenVPN ROUTE: failed to parse/resolve route for host/network: 192.168.20.0
Sat Dec 26 13:12:49 2020 us=323760 OpenVPN ROUTE: OpenVPN needs a gateway parameter for a --route option and no default was specified by either --route-gateway or --ifconfig options
Sat Dec 26 13:12:49 2020 us=323835 OpenVPN ROUTE: failed to parse/resolve route for host/network: 192.168.10.0
Sat Dec 26 13:12:49 2020 us=323917 OpenVPN ROUTE: OpenVPN needs a gateway parameter for a --route option and no default was specified by either --route-gateway or --ifconfig options
Sat Dec 26 13:12:49 2020 us=323991 OpenVPN ROUTE: failed to parse/resolve route for host/network: 192.168.20.0
Sat Dec 26 13:12:49 2020 us=324072 OpenVPN ROUTE: OpenVPN needs a gateway parameter for a --route option and no default was specified by either --route-gateway or --ifconfig options
Sat Dec 26 13:12:49 2020 us=324145 OpenVPN ROUTE: failed to parse/resolve route for host/network: 192.168.10.0
Sat Dec 26 13:12:49 2020 us=350717 TUN/TAP device tap0 opened
Sat Dec 26 13:12:49 2020 us=351257 TUN/TAP TX queue length set to 100
Sat Dec 26 13:12:49 2020 us=351523 NOTE: unable to redirect default gateway -- VPN gateway parameter (--route-gateway or --ifconfig) is missing
Sat Dec 26 13:12:49 2020 us=351641 Initialization Sequence Completed
Sat Dec 26 13:13:19 2020 us=290029 [GT-AX11000] Inactivity timeout (--ping-restart), restarting
Sat Dec 26 13:13:19 2020 us=291017 TCP/UDP: Closing socket
Sat Dec 26 13:13:19 2020 us=291249 Closing TUN/TAP interface
Sat Dec 26 13:13:19 2020 us=342441 SIGUSR1[soft,ping-restart] received, process restarting
Sat Dec 26 13:13:19 2020 us=342630 Restart pause, 5 second(s)
Sat Dec 26 13:13:24 2020 us=347288 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Dec 26 13:13:24 2020 us=348232 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Dec 26 13:13:24 2020 us=348865 LZO compression initializing
Sat Dec 26 13:13:24 2020 us=349748 Control Channel MTU parms [ L:1654 D:1184 EF:66 EB:0 ET:0 EL:3 ]
Sat Dec 26 13:13:24 2020 us=350429 Data Channel MTU parms [ L:1654 D:1450 EF:122 EB:411 ET:32 EL:3 ]
Sat Dec 26 13:13:24 2020 us=351144 Local Options String (VER=V4): 'V4,dev-type tap,link-mtu 1590,tun-mtu 1532,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-client'
Sat Dec 26 13:13:24 2020 us=351598 Expected Remote Options String (VER=V4): 'V4,dev-type tap,link-mtu 1590,tun-mtu 1532,proto UDPv4,comp-lzo,cipher AES-256-CBC,auth SHA1,keysize 256,tls-auth,key-method 2,tls-server'
Sat Dec 26 13:13:24 2020 us=352068 TCP/UDP: Preserving recently used remote address: [AF_INET]xx.xx.xx:yyyy
Sat Dec 26 13:13:24 2020 us=352637 Socket Buffers: R=[180224->180224] S=[180224->180224]
Sat Dec 26 13:13:24 2020 us=353072 UDP link local: (not bound)
Sat Dec 26 13:13:24 2020 us=353597 UDP link remote: [AF_INET]xx.xx.xx:yyyy
Sat Dec 26 13:13:24 2020 us=415826 TLS: Initial packet from [AF_INET]xx.xx.xx:yyyy, sid=4148151a 654b4199
Sat Dec 26 13:13:24 2020 us=496915 VERIFY OK: depth=1, C=TW, ST=TW, L=Taipei, O=ASUS, CN=GT-AX11000, emailAddress=me@myhost.mydomain
Sat Dec 26 13:13:24 2020 us=499509 VERIFY KU OK
Sat Dec 26 13:13:24 2020 us=500192 Validating certificate extended key usage
Sat Dec 26 13:13:24 2020 us=500789 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Sat Dec 26 13:13:24 2020 us=501372 VERIFY EKU OK
Sat Dec 26 13:13:24 2020 us=501952 VERIFY OK: depth=0, C=TW, ST=TW, L=Taipei, O=ASUS, CN=GT-AX11000, emailAddress=me@myhost.mydomain
Sat Dec 26 13:13:24 2020 us=632886 Control Channel: TLSv1.2, cipher TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Sat Dec 26 13:13:24 2020 us=633660 [GT-AX11000] Peer Connection Initiated with [AF_INET]xx.xx.xx:yyyy
Sat Dec 26 13:13:25 2020 us=752504 SENT CONTROL [GT-AX11000]: 'PUSH_REQUEST' (status=1)
Sat Dec 26 13:13:25 2020 us=812797 PUSH: Received control message: 'PUSH_REPLY,route 192.168.10.0 255.255.255.0,route 192.168.20.0 255.255.255.0,route 192.168.10.0 255.255.255.0,route 192.168.20.0 255.255.255.0,redirect-gateway def1,dhcp-option DNS 192.168.1.1,redirect-gateway 192.168.1.1 255.255.255.0,route-gateway dhcp,ping 10,ping-restart 30,peer-id 2,cipher AES-256-GCM'
Sat Dec 26 13:13:25 2020 us=813835 Options error: unknown --redirect-gateway flag: 192.168.1.1
Sat Dec 26 13:13:25 2020 us=814580 OPTIONS IMPORT: timers and/or timeouts modified
Sat Dec 26 13:13:25 2020 us=815161 OPTIONS IMPORT: route options modified
Sat Dec 26 13:13:25 2020 us=815727 OPTIONS IMPORT: route-related options modified
Sat Dec 26 13:13:25 2020 us=816311 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Sat Dec 26 13:13:25 2020 us=816742 OPTIONS IMPORT: peer-id set
Sat Dec 26 13:13:25 2020 us=817159 OPTIONS IMPORT: adjusting link_mtu to 1657
Sat Dec 26 13:13:25 2020 us=817724 OPTIONS IMPORT: data channel crypto options modified
Sat Dec 26 13:13:25 2020 us=818312 Data Channel: using negotiated cipher 'AES-256-GCM'
Sat Dec 26 13:13:25 2020 us=818938 Data Channel MTU parms [ L:1585 D:1450 EF:53 EB:411 ET:32 EL:3 ]
Sat Dec 26 13:13:25 2020 us=820159 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Sat Dec 26 13:13:25 2020 us=820797 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Sat Dec 26 13:13:25 2020 us=821905 ROUTE_GATEWAY 192.168.10.1/255.255.255.0 IFACE=eth0 HWADDR=b8:27:eb:97:2f:8a
Sat Dec 26 13:13:25 2020 us=822658 OpenVPN ROUTE: OpenVPN needs a gateway parameter for a --route option and no default was specified by either --route-gateway or --ifconfig options
Sat Dec 26 13:13:25 2020 us=823269 OpenVPN ROUTE: failed to parse/resolve route for host/network: 192.168.20.0
Sat Dec 26 13:13:25 2020 us=823810 OpenVPN ROUTE: OpenVPN needs a gateway parameter for a --route option and no default was specified by either --route-gateway or --ifconfig options
Sat Dec 26 13:13:25 2020 us=824321 OpenVPN ROUTE: failed to parse/resolve route for host/network: 192.168.10.0
Sat Dec 26 13:13:25 2020 us=824898 OpenVPN ROUTE: OpenVPN needs a gateway parameter for a --route option and no default was specified by either --route-gateway or --ifconfig options
Sat Dec 26 13:13:25 2020 us=825408 OpenVPN ROUTE: failed to parse/resolve route for host/network: 192.168.20.0
Sat Dec 26 13:13:25 2020 us=825911 OpenVPN ROUTE: OpenVPN needs a gateway parameter for a --route option and no default was specified by either --route-gateway or --ifconfig options
Sat Dec 26 13:13:25 2020 us=826413 OpenVPN ROUTE: failed to parse/resolve route for host/network: 192.168.10.0
Sat Dec 26 13:13:25 2020 us=828490 TUN/TAP device tap0 opened
Sat Dec 26 13:13:25 2020 us=829943 TUN/TAP TX queue length set to 100
Sat Dec 26 13:13:25 2020 us=831234 NOTE: unable to redirect default gateway -- VPN gateway parameter (--route-gateway or --ifconfig) is missing
Sat Dec 26 13:13:25 2020 us=832197 Initialization Sequence Completed

Note, I ended the log above prematurely as it seems to get into a 'soft-reset' cycle endlessly...

I suspect it has to do with the gateway and iproute issues given that when I used the Asus Merlin router and imported the file directly. The connection was made successfully but I never received a local IP address (it remained 0.0.0.0). And the error in the logs above suggests this too (if I am understanding correctly).
If I add (as in the server config)

redirect-gateway 192.168.1.1

then I get:

Options error: unknown --redirect-gateway flag: 192.168.1.1

However, I assume that the GUI for Asuswrt means that

Direct clients to redirect Internet traffic		Yes

should already be doing this?

I have tried multiple methods without success, and assume with a working Windows client that this is something to do with the linux config files, but I have no idea how to fix this?!!

Additionally, I note that there are some suggestions on insecure methods... if you could direct me to tutorials on how best to secure passwords and other files then that would be appreciated. I read in one tutorial that OpenVPN should be possible to run without "sudo" but when I try I get additional errors suggesting that I will need to modify permissions further?

As I say, I have done a lot of reading, but recognise that "a little knowledge is a dangerous thing" ... so I do want to try and make sure that I don't inadvertently expose myself to bigger problems!!

Many thanks in advance!

UPDATE: I double checked the Windows client and it no longer seems to be receiving an IP via the Server's DHCP ... (I am almost sure it was, but it no longer does!)

Pseudomax

So an additional update...

I have been reading further, and (to prove I'm a noob) I found that adding the command

route-gateway 192.168.1.1

Took away the error about missing gateway!
This was instead of

redirect-gateway 192.168.1.1

which I had tried earlier in the first post...
However, I now have routing errors...
As some further background:
Server LAN: 192.168.1.0
Server IP (and gateway, DHCP etc): 192.168.1.1/24
Server WAN xx.xx.xx.xx
Client LAN: 192.168.10.0
Client IP (not the local gateway, but will be for clients connecting to VPN resources): 192.168.10.50/24
Client LAN Gateway IP: 192.168.10.1

The Asus router (server) is pushing the routes to the client, I have settings to stop this if not necessary...

Sun Dec 27 01:00:25 2020 us=371101 /sbin/ip route add xx.xx.xx.xx/32 via 192.168.10.1
Sun Dec 27 01:00:25 2020 us=385437 /sbin/ip route add 0.0.0.0/1 via 192.168.1.1
Error: Nexthop has invalid gateway.
Sun Dec 27 01:00:25 2020 us=396051 ERROR: Linux route add command failed: external program exited with error status: 2
Sun Dec 27 01:00:25 2020 us=396255 /sbin/ip route add 128.0.0.0/1 via 192.168.1.1
Error: Nexthop has invalid gateway.
Sun Dec 27 01:00:25 2020 us=406108 ERROR: Linux route add command failed: external program exited with error status: 2
Sun Dec 27 01:00:25 2020 us=406379 /sbin/ip route add 192.168.10.0/24 via 192.168.1.1
Error: Nexthop has invalid gateway.
Sun Dec 27 01:00:25 2020 us=416755 ERROR: Linux route add command failed: external program exited with error status: 2
Sun Dec 27 01:00:25 2020 us=417026 /sbin/ip route add 192.168.10.0/24 via 192.168.1.1
Error: Nexthop has invalid gateway.
Sun Dec 27 01:00:25 2020 us=426957 ERROR: Linux route add command failed: external program exited with error status: 2
Sun Dec 27 01:00:25 2020 us=427261 Initialization Sequence Completed

Thanks

TinCanTech

Pseudomax wrote Server LAN: 192.168.1.0

Set --verb 4 in your server config and then read your server log.

Pseudomax

TinCanTech wrote
Pseudomax wrote Server LAN: 192.168.1.0
Set --verb 4 in your server config and then read your server log.

@tincantech thanks for the reply... I have tried what you asked... by trying to change the config file for the router/server, but it appears that it is auto-generated and everytime I restart the router it is set back to 'verb 3' (I have SSH'ed into the router and changed the config.ovpn file as well as added verb 4 as a custom setting... there is no setting that permits me to change verb in the GUI settings directly).

I have also looked up some of the messages below, but help would be appreciated!!

The following is the only part with errors from the router log on a connection:

Dec 27 20:07:23 vpnserver1[2167]: 212.14.111.99:48919 PLUGIN_CALL: POST /usr/lib/openvpn-plugin-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=0
Dec 27 20:07:23 vpnserver1[2167]: 212.14.111.99:48919 TLS: Username/Password authentication succeeded for username 'UN2' [CN SET]
Dec 27 20:07:23 vpnserver1[2167]: 212.14.111.99:48919 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384
Dec 27 20:07:23 vpnserver1[2167]: 212.14.111.99:48919 [UN2] Peer Connection Initiated with [AF_INET]zz.zz.zz.zz:48919 (via [AF_INET]xx.xx.xx.xx%ppp0)
Dec 27 20:07:23 vpnserver1[2167]: UN2/212.14.111.99:48919 OPTIONS IMPORT: reading client specific options from: ccd/UN2
Dec 27 20:07:23 vpnserver1[2167]: UN2/212.14.111.99:48919 MULTI: no dynamic or static remote --ifconfig address is available for UN2/zz.zz.zz.zz:48919
Dec 27 20:07:23 vpnserver1[2167]: UN2/212.14.111.99:48919 MULTI: --iroute options rejected for UN2/zz.zz.zz.zz:48919 -- iroute only works with tun-style tunnels
Dec 27 20:07:24 vpnserver1[2167]: UN2/212.14.111.99:48919 PUSH: Received control message: 'PUSH_REQUEST'
Dec 27 20:07:24 vpnserver1[2167]: UN2/212.14.111.99:48919 SENT CONTROL [UN2]: 'PUSH_REPLY,route 192.168.10.0 255.255.255.0,route 192.168.10.0 255.255.255.0,redirect-gateway def1,dhcp-option DNS 192.168.1.1,route-gateway dhcp,ping 10,ping-restart 30,peer-id 1,cipher AES-256-GCM' (status=1)
Dec 27 20:07:24 vpnserver1[2167]: UN2/212.14.111.99:48919 Data Channel: using negotiated cipher 'AES-256-GCM'
Dec 27 20:07:24 vpnserver1[2167]: UN2/212.14.111.99:48919 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Dec 27 20:07:24 vpnserver1[2167]: UN2/212.14.111.99:48919 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Dec 27 20:07:32 vpnserver1[2167]: UN2/212.14.111.99:49884 [UN2] Inactivity timeout (--ping-restart), restarting
Dec 27 20:07:32 vpnserver1[2167]: UN2/212.14.111.99:49884 SIGUSR1[soft,ping-restart] received, client-instance restarting

The following are the lines I suspect are the problem:

Dec 27 20:07:23 vpnserver1[2167]: UN2/212.14.111.99:48919 MULTI: no dynamic or static remote --ifconfig address is available for UN2/zz.zz.zz.zz:48919
Dec 27 20:07:23 vpnserver1[2167]: UN2/212.14.111.99:48919 MULTI: --iroute options rejected for UN2/zz.zz.zz.zz:48919 -- iroute only works with tun-style tunnels

I have additionally taken the connection log from viscosity (which works) and maybe helpful?

Dec 27 9:21:41 PM: SIGUSR1[soft,ping-restart] received, process restarting
Dec 27 9:21:41 PM: State changed to Connecting
Dec 27 9:21:41 PM: Resolving address: "yy.yy.yy"
Dec 27 9:21:41 PM: Valid endpoint found: yy.yy.yy:4555:udp
Dec 27 9:21:42 PM: TCP/UDP: Preserving recently used remote address: [AF_INET]xx.xx.xx.xx:4555
Dec 27 9:21:42 PM: UDP link local: (not bound)
Dec 27 9:21:42 PM: UDP link remote: [AF_INET]xx.xx.xx.xx:4555
Dec 27 9:21:42 PM: State changed to Authenticating
Dec 27 9:21:42 PM: WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Dec 27 9:21:42 PM: [GT-AX11000] Peer Connection Initiated with [AF_INET]xx.xx.xx.xx:4555
Dec 27 9:21:42 PM: State changed to Connecting
Dec 27 9:21:42 PM: Awaiting adapter to come up...
Dec 27 9:21:43 PM: TAP-WIN32 device [clientPoppy] opened: \\?\root#net#0000#{adda4c48-c32e-4ef6-9602-b3252f082583}, index: 9
Dec 27 9:21:44 PM: Successful ARP Flush on interface [9] {2DFB282F-573D-42C8-8691-56C74832588F}
Dec 27 9:22:13 PM: Route addition via IPAPI failed. Fallback to route.exe
Dec 27 9:22:13 PM: Initialization Sequence Completed
Dec 27 9:22:14 PM: DNS set to Full:
Server - 192.168.1.1:53; Lookup Type - Any; Domains - None
Dec 27 9:22:14 PM: State changed to Connected

TinCanTech

Pseudomax wrote
TinCanTech wrote
Pseudomax wrote Server LAN: 192.168.1.0
Set --verb 4 in your server config and then read your server log.
@tincantech thanks for the reply... I have tried what you asked... by trying to change the config file for the router/server, but it appears that it is auto-generated and everytime I restart the router it is set back to 'verb 3'

Don't regenerate it then.

Also, check your manual for the setting and if it can't be set then report the problem to ASUS.

I suggest you set your VPN to use --dev tun.

Pseudomax

Thanks... but I need TAP as I need clients to see each other...

I have looked up Asus manuals but can't seem to find any refernce to 'verb' debugging ...

I am going to try Pritunl (there is a guide on installing on Rasp Pi 3b+) ... so perhaps this will work as well as viscosity and fill the gaps in my knowledge!!

Pseudomax

So after multiple attempts at trying different ideas (I was not able to install Pritunl as it does not work on an ARM64 device?!! ... nor after looking more into is it really providing anything more intelligent than the config file already has).

So I have returned to the steps I had above ... and I am sure that this is a routing problem (even though I can't get additional access to debug information from the Asus router ... I have searched and there is nothing I can find on increasing to 'verb 4')!! I therefore wonder whether someone could help me with the right routes to push and/or static routes for the tunnel... based on the information below?

As background, my home server (Asus router) is on a FTTP line with a Dynamic DNS being used. The remote router is actually provided by a community apartment block and therefore is already on a private subnet (and no port forwarding is allowed). On the LAN of the remote router (which is the local gateway) is a Raspberry pi that is being setup as an AP/Gateway for VPN traffic on the local LAN that I push to the VPN tunnel. The following are the subnets and IP's involved...

Home network: 192.168.1.0/24
Asus Router (OpenVPN server): 192.168.1.1/24

Remote Community subnet: 192.168.100.0 (provides my remote router with a WAN IP from this subnet)
My remote LAN: 192.168.10.0/24
My remote router: 192.168.10.1/24
The raspberry pi (VPN client/gateway): 192.168.10.50/24

The tunnel is run using TAP as I need bridging so clients can broadcast to each other. And the intention is to selectively use the Raspberry pi as a gateway for devices on the remote LAN that I only want to use the tunnel for all incoming/outgoing internet traffic.

Please could I get some help in routing all this traffic (it is essentially a route between 192.168.1.1 (internet gateway for the tunnel) and 192.168.10.50 that I need to route...

Many thanks!

TinCanTech

Pseudomax wrote I am sure that this is a routing problem

You are using --dev tap which means this has nothing to do with routing.

If you want the problem to be a routing problem then use --dev tun

Using a TAP device means you are connecting two networks with a wire (The data sent over the wire is encrypted and that is the only job which openvpn does in this situation).

When you join two networks with a wire you need to understand everything about both networks in order to make it work.

On top of that, you are using a router which you don't know how to use correctly and cannot even get a --verb 4 log out of openvpn..

Pseudomax wrote I have additionally taken the connection log from viscosity (which works) and maybe helpful?

Just use OpenVPN. o.0

<---snipped-other-stuff-too--->

I am tuning this one out ..

As a last resort, if you cannot solve this yourself then you can contact me privately but fees will apply.
tincanteksup@gmail.com

Good luck.