Need help with OpenVPN client connecting to server

ksnoopy

My OpenVPN client can connect to the server. However, when it is
connected the client cannot access any websites. My goal is to route
internet traffic through the VPN. Annoylingly, everything worked great
until my server crashed and everything needed to be re-configured. I
am missing some important step, but no matter where I search I cannot
find the answer.

My server configuration:
Windows Server 2003 R2 (64-bit)

Here is what I have tried:
1) Enable Routing and Remote Service in services.msc
2) Set IPEnableRouter to 1 in regedit
3) Disable the firewall
4) I have tried port 1194 & 11943, since I can connect from the client
I doubt this is the problem

Here is the server.ovpn:
port 11943 # This is the port OpenVPN is running on - make sure the
router is port forwarding this port to the above IP
proto udp # UDP tends to perform better than TCP for VPN
dev tun
ca "C:\\Program Files (x86)\\OpenVPN\\easy-rsa\\keys\\ca.crt"
cert "C:\\Program Files (x86)\\OpenVPN\\easy-rsa\\keys\\server.crt"
key "C:\\Program Files (x86)\\OpenVPN\\easy-rsa\\keys\\server.key" #
This file should be kept secret
dh "C:\\Program Files (x86)\\OpenVPN\\easy-rsa\\keys\\dh1024.pem"
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
keepalive 10 120
cipher BF-CBC # Blowfish (default) encryption
comp-lzo
max-clients 100 # Assign the maximum number of clients here
persist-key
persist-tun
status openvpn-status.log
push "redirect-gateway def1"
push "dhcp-option DNS 10.8.0.1"
verb 3

Here is the server.log:
Mon Dec 19 20:34:21 2011 OpenVPN 2.1.4 i686-pc-mingw32 [SSL] [LZO2]
[PKCS11] built on Nov 8 2010
Mon Dec 19 20:34:21 2011 NOTE: OpenVPN 2.1 requires '--script-security
2' or higher to call user-defined scripts or executables
Mon Dec 19 20:34:21 2011 Diffie-Hellman initialized with 1024 bit key
Mon Dec 19 20:34:21 2011 TLS-Auth MTU parms [ L:1542 D:138 EF:38 EB:0
ET:0 EL:0 ]
Mon Dec 19 20:34:21 2011 Socket Buffers: R=[8192->8192] S=[8192->8192]
Mon Dec 19 20:34:21 2011 ROUTE default_gateway=74.54.62.113
Mon Dec 19 20:34:21 2011 TAP-WIN32 device [Local Area Connection 3]
opened: \\.\Global\{F3938C17-02EE-44E6-B420-13559B6048CC}.tap
Mon Dec 19 20:34:21 2011 TAP-Win32 Driver Version 9.7
Mon Dec 19 20:34:21 2011 TAP-Win32 MTU=1500
Mon Dec 19 20:34:21 2011 Notified TAP-Win32 driver to set a DHCP
IP/netmask of 10.8.0.1/255.255.255.252 on interface
{F3938C17-02EE-44E6-B420-13559B6048CC} [DHCP-serv: 10.8.0.2,
lease-time: 31536000]
Mon Dec 19 20:34:21 2011 Sleeping for 2 seconds...
Mon Dec 19 20:34:23 2011 Successful ARP Flush on interface [13]
{F3938C17-02EE-44E6-B420-13559B6048CC}
Mon Dec 19 20:34:23 2011 C:\WINDOWS\system32\route.exe ADD 10.8.0.0
MASK 255.255.255.0 10.8.0.2
OK!
Mon Dec 19 20:34:23 2011 Data Channel MTU parms [ L:1542 D:1400 EF:42
EB:135 ET:0 EL:0 AF:3/1 ]
Mon Dec 19 20:34:23 2011 UDPv4 link local (bound): [undef]:11943
Mon Dec 19 20:34:23 2011 UDPv4 link remote: [undef]
Mon Dec 19 20:34:23 2011 MULTI: multi_init called, r=256 v=256
Mon Dec 19 20:34:23 2011 IFCONFIG POOL: base=10.8.0.4 size=62
Mon Dec 19 20:34:23 2011 IFCONFIG POOL LIST
Mon Dec 19 20:34:23 2011 client5,10.8.0.4
Mon Dec 19 20:34:23 2011 Initialization Sequence Completed
Mon Dec 19 20:34:49 2011 MULTI: multi_create_instance called
Mon Dec 19 20:34:49 2011 114.249.198.119:60331 Re-using SSL/TLS context
Mon Dec 19 20:34:49 2011 114.249.198.119:60331 LZO compression initialized
Mon Dec 19 20:34:49 2011 114.249.198.119:60331 Control Channel MTU
parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Mon Dec 19 20:34:49 2011 114.249.198.119:60331 Data Channel MTU parms
[ L:1542 D:1400 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Mon Dec 19 20:34:49 2011 114.249.198.119:60331 Local Options hash
(VER=V4): '530fdded'
Mon Dec 19 20:34:49 2011 114.249.198.119:60331 Expected Remote Options
hash (VER=V4): '41690919'
Mon Dec 19 20:34:49 2011 114.249.198.119:60331 TLS: Initial packet
from 114.249.198.119:60331, sid=d118dfcb a5948f35
Mon Dec 19 20:34:52 2011 114.249.198.119:60331 VERIFY OK: depth=1,
/C=US/ST=WA/L=Seattle/O=Justin/CN=JustinVPN/emailAddress=justin@gmail.com
Mon Dec 19 20:34:52 2011 114.249.198.119:60331 VERIFY OK: depth=0,
/C=US/ST=WA/O=Justin/CN=client5/emailAddress=justin@gmail.com
Mon Dec 19 20:34:54 2011 114.249.198.119:60331 Data Channel Encrypt:
Cipher 'BF-CBC' initialized with 128 bit key
Mon Dec 19 20:34:54 2011 114.249.198.119:60331 Data Channel Encrypt:
Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Dec 19 20:34:54 2011 114.249.198.119:60331 Data Channel Decrypt:
Cipher 'BF-CBC' initialized with 128 bit key
Mon Dec 19 20:34:54 2011 114.249.198.119:60331 Data Channel Decrypt:
Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Dec 19 20:34:54 2011 114.249.198.119:60331 Control Channel: TLSv1,
cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Mon Dec 19 20:34:54 2011 114.249.198.119:60331 [client5] Peer
Connection Initiated with 114.249.198.119:60331
Mon Dec 19 20:34:54 2011 client5/114.249.198.119:60331 MULTI: Learn:
10.8.0.6 -> client5/114.249.198.119:60331
Mon Dec 19 20:34:54 2011 client5/114.249.198.119:60331 MULTI: primary
virtual IP for client5/114.249.198.119:60331: 10.8.0.6
Mon Dec 19 20:34:56 2011 client5/114.249.198.119:60331 PUSH: Received
control message: 'PUSH_REQUEST'
Mon Dec 19 20:34:56 2011 client5/114.249.198.119:60331 SENT CONTROL
[client5]: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS
10.8.0.1,route 10.8.0.1,topology net30,ping 10,ping-restart
120,ifconfig 10.8.0.6 10.8.0.5' (status=1)

Here is the output from "route PRINT":
===========================================================================
Interface List
13 ...00 ff f3 93 8c 17 ...... TAP-Win32 Adapter V9
10 ...00 25 64 3c 4f 08 ...... Broadcom NetXtreme Gigabit Ethernet
1 ........................... Software Loopback Interface 1
19 ...00 00 00 00 00 00 00 e0 isatap.{313017E4-BC00-4131-8A7C-FDDA83773B11}
20 ...00 00 00 00 00 00 00 e0 6TO4 Adapter
15 ...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
12 ...02 00 54 55 4e 01 ...... Teredo Tunneling Pseudo-Interface
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 74.54.62.113 74.54.62.114 31
10.8.0.0 255.255.255.0 10.8.0.2 10.8.0.1 31
10.8.0.0 255.255.255.252 On-link 10.8.0.1 286
10.8.0.1 255.255.255.255 On-link 10.8.0.1 286
10.8.0.3 255.255.255.255 On-link 10.8.0.1 286
74.54.62.112 255.255.255.248 On-link 74.54.62.114 286
74.54.62.114 255.255.255.255 On-link 74.54.62.114 286
74.54.62.119 255.255.255.255 On-link 74.54.62.114 286
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 74.54.62.114 286
224.0.0.0 240.0.0.0 On-link 10.8.0.1 286
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 74.54.62.114 286
255.255.255.255 255.255.255.255 On-link 10.8.0.1 286
===========================================================================
Persistent Routes:
Network Address Netmask Gateway Address Metric
0.0.0.0 0.0.0.0 74.54.62.113 1
===========================================================================

IPv6 Route Table
===========================================================================
Active Routes:
If Metric Network Destination Gateway
20 1140 ::/0 2002:c058:6301::c058:6301
1 306 ::1/128 On-link
20 1040 2002::/16 On-link
20 296 2002:4a36:3e72::4a36:3e72/128
On-link
10 286 fe80::/64 On-link
13 286 fe80::/64 On-link
10 286 fe80::7d40:f5ca:71c4:de8d/128
On-link
13 286 fe80::b836:9d0d:ff14:ac5b/128
On-link
1 306 ff00::/8 On-link
10 286 ff00::/8 On-link
13 286 ff00::/8 On-link
===========================================================================
Persistent Routes:
None

Mimiko

push "dhcp-option DNS 10.8.0.1"

Your server does not have a DNS service. So use

push "dhcp-option DNS 8.8.8.8"

ksnoopy

Thank you for suggestion, but it did not fix my problem.

On the client, after a successful connect to the OpenVPN server, I
tried to ping http://www.google.com. It gets the correct IP address, but the
"request times out". If I ping the OpenVPN server 10.8.0.1, then it
succeeds.

I suspect that my problem is related to an IP routing issue on the
OpenVPN server, but cannot figure out what is causing it.

Mimiko

Than if you did find that tracroute is stopping on server, chek the forwarding on server: http://openvpn.net/index.php/open-source/faq/77-server/265-how-do-i-enable-ip-forwarding.html and adjust iptables to do masquerading.

ksnoopy

I already enabled IP forwarding using the registry setting described,
and rebooted the server. It does not fix my problem. If you look at
the output from "routes" included in original post, it seems like
OpenVPN is setting up the routing correctly.

Any ideas?

Thanks,
Jason

janjust

are you masquerading outbound traffic? take a look at this tutorial :
https://forums.openvpn.net/topic7806.html

ksnoopy

That was it! Works great now. Thanks janjust & Mimiko for all the help!