Just saw configuration for Kaspersky: Options->Network->Port settings->Monitor sellected ports only. There is port 8000. It's there by default. Because as I remember now, port 8000 tcp is ofen used for proxy. That's why kaspersky need to verify the traffic. OpenVPN does not send suspicious traffic, but some configuration of Kaspersky may block encripted data. Or delete this port from Kaspersky, or use standart OpenVPN port 1194.
Even if the hacker does not know the username and password can he do something??
Can be tryied known bugs of OpenVPN. It's not much. And it's a more lower chance that some hacker will be interested in getting into your LAN.