Recommended Posts

Hey Guys,

I've currently got a OpenVPN setup where I can simply connect to my home pfSense Server from work and use my Local Network.

My Network is on the 10.0.1.0/24 Range

My OpenVPN is on the 10.0.3.0/24 Range

Now I'll be taking a trip to Vancouver soon and I access various sites that require me to have my WAN IP, so connecting from my Hotels WAN will not allow me access, so I've setup a Secondary OpenVPN Server on the 10.0.4.0/24 Range.

Primary VPN uses port 1194

Secondary VPN uses port 1195

I've ticked the "Force all client generated traffic through the tunnel." Option and setup the following advanced commands

"push "redirect-gateway def1";push "dhcp-option DNS 10.0.1.1";verb 1;mute-replay-warnings"

Finally I have Manual NATing enabled so I've setup the following rule

WAN 10.0.4.0/24.

Now I can connect to my VPN without issue, but I do see the following: UDPv4 link local (bound): [undef]:1194 <-- surely this should be 1195?

I cannot ping anything on the WAN but can connect to my LAN. For example, ping 208.67.222.222 returns 100% packet loss but ping 10.0.1.1 returns normaly.

Any ideas on where to go from here?

Ok I just tested this with adding

redirect-gateway def1

To my local config - nothing done on the server settings at all

I verified that my outside IP is now showing as the public IP of my openvpn server

post-14624-0-02994400-1328718156.jpg

And you can just look with a route print on your client to see that it changed the default gateway to go to the openvpn connection

d:\&gt;route print
===========================================================================
Interface List
0x3 ...00 1c 23 53 cf 38 ...... Broadcom NetXtreme 57xx Gigabit Controller - SecuRemote Miniport
0x7 ...00 ff 79 1a 85 63 ...... TAP-Win32 Adapter V9 - SecuRemote Miniport
===========================================================================
===========================================================================
Active Routes:
Network Destination		Netmask		  Gateway	   Interface  Metric
		  0.0.0.0		128.0.0.0	   10.0.200.5	  10.0.200.6	   1
	   10.0.200.1  255.255.255.255	   10.0.200.5	  10.0.200.6	   1
	   10.0.200.4  255.255.255.252	   10.0.200.6	  10.0.200.6	   30
	   10.0.200.6  255.255.255.255		127.0.0.1	   127.0.0.1	   30
   10.255.255.255  255.255.255.255	   10.0.200.6	  10.0.200.6	   30
		127.0.0.0		255.0.0.0		127.0.0.1	   127.0.0.1	   1
		128.0.0.0		128.0.0.0	   10.0.200.5	  10.0.200.6	   1
	  192.168.1.0	255.255.255.0	   10.0.200.5	  10.0.200.6	   1
		224.0.0.0		240.0.0.0	   10.0.200.6	  10.0.200.6	   30
	 255.255.255.255  255.255.255.255	   10.0.200.6			   2	   1
  255.255.255.255  255.255.255.255	   10.0.200.6			   8	   1
  255.255.255.255  255.255.255.255	   10.0.200.6			   5	   1
  255.255.255.255  255.255.255.255	   10.0.200.6			   6	   1
  255.255.255.255  255.255.255.255	   10.0.200.6	  10.0.200.6	   1
  255.255.255.255  255.255.255.255	   10.0.200.6			   4	   1
Default Gateway:		10.0.200.5
===========================================================================
Persistent Routes:
  None

I snipped out some routes and some of the other interfaces - but this shows all the routes pointing to my openvpn connection and default.

here is output of ipconfig /all for my openvpn interface on this client

Ethernet adapter ovpn:

		Connection-specific DNS Suffix  . :
		Description . . . . . . . . . . . : TAP-Win32 Adapter V9
		Physical Address. . . . . . . . . : 00-FF-79-1A-85-63
		Dhcp Enabled. . . . . . . . . . . : Yes
		Autoconfiguration Enabled . . . . : Yes
		IP Address. . . . . . . . . . . . : 10.0.200.6
		Subnet Mask . . . . . . . . . . . : 255.255.255.252
		Default Gateway . . . . . . . . . : 10.0.200.5
		DHCP Server . . . . . . . . . . . : 10.0.200.5
		DNS Servers . . . . . . . . . . . : 192.168.1.253
		Lease Obtained. . . . . . . . . . : Wednesday, February 08, 2012 10:18:57 AM
		Lease Expires . . . . . . . . . . : Thursday, February 07, 2013 10:18:57 AM

I think your maybe over complicating it ;)

I think you're right. Tell me Mr Budman - what is the easiest way to setup a VPN in pfSense for WAN Forwarding? lol. I'm going to go back and delete all my initial config and wait on your response.

The easiest way is to just run the wizard ;)

Here is my config if that helps

post-14624-0-82935100-1328719625_thumb.j

Prob going to have to download/save that to make anything out. I run on tcp 443 to make sure the port is open. 1194 udp is a port that may or may not be open depending on where you are. I can tell you for sure its not open at my work ;)

And I can not even go direct out on 443, I have to bounce the openvpn connection off the http proxy. You can setup to use a http proxy in the openvpn gui client.

You happen to know where the actual .conf file is stored on pfsense - happy to post that for you. Just not sure where its at off the top of my head.. And the settings might even be stored in the pfsense config .xml - not exactly sure.

I can show you my client config

dev tun
persist-tun
persist-key
proto tcp-client
cipher AES-128-CBC
tls-client
client
resolv-retry infinite
remote snipped.snipped.net 443
pkcs12 pfsense-TCP-443.p12
tls-auth pfsense-TCP-443-tls.key 1
comp-lzo
verb 4
#redirect-gateway def1

That redirect was just added for my test, and now I have it remarked out - I don't need that function here at work. If I need to tunnel through my vpn connection I just use ssh through my openvpn to my linux box on my private lan ip 192.168.1.7 and use putty as socks proxy for my browser.

Wait wait wait, I've already got a working OpenVPN Server, the issue is running a Second OpenVPN Server that will take ALL traffic from my remote PC and put it through the OpenVPN Servers WAN.

So even though i'm in Canada, I get an IP from the UK.

I used the Wizard but it didn't work in this case, like I said, I can browse remote shares no issue and ping everything on the remote network, but nothing on the WAN.

Why do you need run 2 copies of the server - just put that redirect in your local config file when you want to route traffic through your vpn connection.

Look at your route on your client when you make your connection - if default is not your openvpn connection then no your not going to route internet traffic through your opevnvpn. All you need to do is tell the client to use the openvpn connection as your default route. Or if you want to get fancy you can route whatever specific networks you want through the vpn and others not.

For example if you only need to use the UK connection for one site, then just route that sites IP through your vpn connection - you don't need to route all traffic through the vpn if you don't want to.

By default the only route you will see is for the network on other side of the vpn connection.

exmaple

Active Routes:
Network Destination		Netmask		  Gateway	   Interface  Metric
	  192.168.1.0	255.255.255.0	   10.0.200.5	  10.0.200.6	   1

But if you want you should just be able to hit the + sign and add a different config listening on different port and set to push the redirect, etc.

post-14624-0-65364500-1328721438.jpg

Just not seeing why you would need to - just setup whatever routes you want on your local client config.

edit: btw what firewall rules do you have on the openvpn tab? Possible your blocking outside access?

post-14624-0-06436500-1328721604.jpg

Okay,

I deleted the second connection and appended redirect-gateway def1 to my client config.

Server Config looks like this:

openvpnserver.png

And my OpenVPN rules look like this:

openvpnfirewall.png

Routes on the client looks like this:

PRE-VPN Connection:


C:\Users\cpressland>route print
===========================================================================
Interface List
16...00 ff 81 3d 2e c8 ......TAP-Win32 Adapter V9
13...f0 7b cb a8 3a c3 ......Bluetooth Device (Personal Area Network)
12...00 23 14 8d c2 ac ......Intel(R) Centrino(R) Advanced-N 6200 AGN
11...00 26 b9 d3 0d 42 ......Intel(R) 82577LM Gigabit Network Connection
1...........................Software Loopback Interface 1
20...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
17...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
18...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #3
19...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #4
===========================================================================
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 172.22.104.1 172.22.105.194 10
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
172.22.104.0 255.255.252.0 On-link 172.22.105.194 266
172.22.105.194 255.255.255.255 On-link 172.22.105.194 266
172.22.107.255 255.255.255.255 On-link 172.22.105.194 266
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 172.22.105.194 266
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 172.22.105.194 266
===========================================================================
Persistent Routes:
None
IPv6 Route Table
===========================================================================
Active Routes:
If Metric Network Destination Gateway
1 306 ::1/128 On-link
11 266 fe80::/64 On-link
11 266 fe80::fd45:a3d8:21fb:9164/128
On-link
1 306 ff00::/8 On-link
11 266 ff00::/8 On-link
===========================================================================
Persistent Routes:
None
[/CODE]

Post VPN Connection:

[CODE]
C:\Users\cpressland>route print
===========================================================================
Interface List
16...00 ff 81 3d 2e c8 ......TAP-Win32 Adapter V9
13...f0 7b cb a8 3a c3 ......Bluetooth Device (Personal Area Network)
12...00 23 14 8d c2 ac ......Intel(R) Centrino(R) Advanced-N 6200 AGN
11...00 26 b9 d3 0d 42 ......Intel(R) 82577LM Gigabit Network Connection
1...........................Software Loopback Interface 1
20...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
17...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
18...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #3
19...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #4
===========================================================================
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 172.22.104.1 172.22.105.194 10
0.0.0.0 128.0.0.0 10.0.3.9 10.0.3.10 30
10.0.1.0 255.255.255.0 10.0.3.9 10.0.3.10 30
10.0.3.1 255.255.255.255 10.0.3.9 10.0.3.10 30
10.0.3.8 255.255.255.252 On-link 10.0.3.10 286
10.0.3.10 255.255.255.255 On-link 10.0.3.10 286
10.0.3.11 255.255.255.255 On-link 10.0.3.10 286
86.21.116.233 255.255.255.255 172.22.104.1 172.22.105.194 10
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
128.0.0.0 128.0.0.0 10.0.3.9 10.0.3.10 30
172.22.104.0 255.255.252.0 On-link 172.22.105.194 266
172.22.105.194 255.255.255.255 On-link 172.22.105.194 266
172.22.107.255 255.255.255.255 On-link 172.22.105.194 266
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 172.22.105.194 266
224.0.0.0 240.0.0.0 On-link 10.0.3.10 286
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 172.22.105.194 266
255.255.255.255 255.255.255.255 On-link 10.0.3.10 286
===========================================================================
Persistent Routes:
None
IPv6 Route Table
===========================================================================
Active Routes:
If Metric Network Destination Gateway
1 306 ::1/128 On-link
11 266 fe80::/64 On-link
16 286 fe80::/64 On-link
16 286 fe80::6153:2b19:538c:b4a3/128
On-link
11 266 fe80::fd45:a3d8:21fb:9164/128
On-link
1 306 ff00::/8 On-link
11 266 ff00::/8 On-link
16 286 ff00::/8 On-link
===========================================================================
Persistent Routes:
None
[/CODE]

Additionally, here is the client side OpenVPN log.


Thu Feb 09 10:17:52 2012 OpenVPN 2.2.2 Win32-MSVC++ [SSL] [LZO2] [PKCS11] built on Dec 15 2011
Thu Feb 09 10:17:52 2012 IMPORTANT: OpenVPN's default port number is now 1194, based on an official port number assignment by IANA. OpenVPN 2.0-beta16 and earlier used 5000 as the default port.
Thu Feb 09 10:17:52 2012 WARNING: Make sure you understand the semantics of --tls-remote before using it (see the man page).
Thu Feb 09 10:17:52 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Thu Feb 09 10:17:52 2012 Control Channel Authentication: using 'pfsense-udp-1194-tls.key' as a OpenVPN static key file
Thu Feb 09 10:17:52 2012 LZO compression initialized
Thu Feb 09 10:17:52 2012 UDPv4 link local (bound): [undef]:1194
Thu Feb 09 10:17:52 2012 UDPv4 link remote: 86.21.116.233:1194
Thu Feb 09 10:17:52 2012 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Thu Feb 09 10:17:54 2012 [Road_Warrior_Server_Cert] Peer Connection Initiated with 86.21.116.233:1194
Thu Feb 09 10:17:57 2012 TAP-WIN32 device [Local Area Connection 3] opened: \\.\Global\{813D2EC8-AC96-4AF8-9FB7-7F1B6AC69728}.tap
Thu Feb 09 10:17:57 2012 Notified TAP-Win32 driver to set a DHCP IP/netmask of 10.0.3.10/255.255.255.252 on interface {813D2EC8-AC96-4AF8-9FB7-7F1B6AC69728} [DHCP-serv: 10.0.3.9, lease-time: 31536000]
Thu Feb 09 10:17:57 2012 Successful ARP Flush on interface [16] {813D2EC8-AC96-4AF8-9FB7-7F1B6AC69728}
Thu Feb 09 10:18:02 2012 Initialization Sequence Completed
[/CODE]

As of right now, I can ping everything on my Local Network from Home like 10.0.1.5 (Local File Server), RDP into everything etc, but I cannot get an Internet Connection.

And here is my OpenVPN Config File.

[CODE]
dev tun
persist-tun
persist-key
proto udp
cipher BF-CBC
tls-client
client
resolv-retry infinite
remote 86.21.116.233 1194
tls-remote Road Warrior Server Cert
auth-user-pass pass.txt
pkcs12 pfsense-udp-1194.p12
tls-auth pfsense-udp-1194-tls.key 1
comp-lzo
redirect-gateway def1
[/CODE]

Well no **** you can not -- where is your default route??

your 0.0.0.0 route is 172.22.104.1

That is who your going to talk to for any network you do not have a specific route too.

I would suggest you add the verb 4 like I have or even 5 so we can get some more detail from your log. Once I get to work today I will post my log of connecting.

As Requested verb5:


Thu Feb 09 13:40:51 2012 us=900000 Current Parameter Settings:
Thu Feb 09 13:40:51 2012 us=900000 config = 'pfsense-udp-1194.ovpn'
Thu Feb 09 13:40:51 2012 us=900000 mode = 0
Thu Feb 09 13:40:51 2012 us=900000 show_ciphers = DISABLED
Thu Feb 09 13:40:51 2012 us=900000 show_digests = DISABLED
Thu Feb 09 13:40:51 2012 us=900000 show_engines = DISABLED
Thu Feb 09 13:40:51 2012 us=900000 genkey = DISABLED
Thu Feb 09 13:40:51 2012 us=900000 key_pass_file = '[UNDEF]'
Thu Feb 09 13:40:51 2012 us=900000 show_tls_ciphers = DISABLED
Thu Feb 09 13:40:51 2012 us=900000 Connection profiles [default]:
Thu Feb 09 13:40:51 2012 us=900000 proto = udp
Thu Feb 09 13:40:51 2012 us=900000 local = '[UNDEF]'
Thu Feb 09 13:40:51 2012 us=900000 local_port = 1194
Thu Feb 09 13:40:51 2012 us=900000 remote = '86.21.116.233'
Thu Feb 09 13:40:51 2012 us=900000 remote_port = 1194
Thu Feb 09 13:40:51 2012 us=900000 remote_float = DISABLED
Thu Feb 09 13:40:51 2012 us=900000 bind_defined = DISABLED
Thu Feb 09 13:40:51 2012 us=900000 bind_local = ENABLED
Thu Feb 09 13:40:51 2012 us=900000 connect_retry_seconds = 5
Thu Feb 09 13:40:51 2012 us=900000 connect_timeout = 10
Thu Feb 09 13:40:51 2012 us=900000 connect_retry_max = 0
Thu Feb 09 13:40:51 2012 us=900000 socks_proxy_server = '[UNDEF]'
Thu Feb 09 13:40:51 2012 us=900000 socks_proxy_port = 0
Thu Feb 09 13:40:51 2012 us=900000 socks_proxy_retry = DISABLED
Thu Feb 09 13:40:51 2012 us=900000 Connection profiles END
Thu Feb 09 13:40:51 2012 us=900000 remote_random = DISABLED
Thu Feb 09 13:40:51 2012 us=900000 ipchange = '[UNDEF]'
Thu Feb 09 13:40:51 2012 us=900000 dev = 'tun'
Thu Feb 09 13:40:51 2012 us=900000 dev_type = '[UNDEF]'
Thu Feb 09 13:40:51 2012 us=900000 dev_node = '[UNDEF]'
Thu Feb 09 13:40:51 2012 us=900000 lladdr = '[UNDEF]'
Thu Feb 09 13:40:51 2012 us=900000 topology = 1
Thu Feb 09 13:40:51 2012 us=900000 tun_ipv6 = DISABLED
Thu Feb 09 13:40:51 2012 us=900000 ifconfig_local = '[UNDEF]'
Thu Feb 09 13:40:51 2012 us=900000 ifconfig_remote_netmask = '[UNDEF]'
Thu Feb 09 13:40:51 2012 us=900000 ifconfig_noexec = DISABLED
Thu Feb 09 13:40:51 2012 us=900000 ifconfig_nowarn = DISABLED
Thu Feb 09 13:40:51 2012 us=900000 shaper = 0
Thu Feb 09 13:40:51 2012 us=900000 tun_mtu = 1500
Thu Feb 09 13:40:51 2012 us=900000 tun_mtu_defined = ENABLED
Thu Feb 09 13:40:51 2012 us=900000 link_mtu = 1500
Thu Feb 09 13:40:51 2012 us=900000 link_mtu_defined = DISABLED
Thu Feb 09 13:40:51 2012 us=900000 tun_mtu_extra = 0
Thu Feb 09 13:40:51 2012 us=900000 tun_mtu_extra_defined = DISABLED
Thu Feb 09 13:40:51 2012 us=900000 fragment = 0
Thu Feb 09 13:40:51 2012 us=900000 mtu_discover_type = -1
Thu Feb 09 13:40:51 2012 us=900000 mtu_test = 0
Thu Feb 09 13:40:51 2012 us=900000 mlock = DISABLED
Thu Feb 09 13:40:51 2012 us=900000 keepalive_ping = 0
Thu Feb 09 13:40:51 2012 us=900000 keepalive_timeout = 0
Thu Feb 09 13:40:51 2012 us=900000 inactivity_timeout = 0
Thu Feb 09 13:40:51 2012 us=900000 ping_send_timeout = 0
Thu Feb 09 13:40:51 2012 us=900000 ping_rec_timeout = 0
Thu Feb 09 13:40:51 2012 us=900000 ping_rec_timeout_action = 0
Thu Feb 09 13:40:51 2012 us=900000 ping_timer_remote = DISABLED
Thu Feb 09 13:40:51 2012 us=900000 remap_sigusr1 = 0
Thu Feb 09 13:40:51 2012 us=900000 explicit_exit_notification = 0
Thu Feb 09 13:40:51 2012 us=900000 persist_tun = ENABLED
Thu Feb 09 13:40:51 2012 us=900000 persist_local_ip = DISABLED
Thu Feb 09 13:40:51 2012 us=900000 persist_remote_ip = DISABLED
Thu Feb 09 13:40:51 2012 us=900000 persist_key = ENABLED
Thu Feb 09 13:40:51 2012 us=900000 mssfix = 1450
Thu Feb 09 13:40:51 2012 us=900000 resolve_retry_seconds = 1000000000
Thu Feb 09 13:40:51 2012 us=900000 username = '[UNDEF]'
Thu Feb 09 13:40:51 2012 us=900000 groupname = '[UNDEF]'
Thu Feb 09 13:40:51 2012 us=900000 chroot_dir = '[UNDEF]'
Thu Feb 09 13:40:51 2012 us=900000 cd_dir = '[UNDEF]'
Thu Feb 09 13:40:51 2012 us=900000 writepid = '[UNDEF]'
Thu Feb 09 13:40:51 2012 us=962000 up_script = '[UNDEF]'
Thu Feb 09 13:40:51 2012 us=962000 down_script = '[UNDEF]'
Thu Feb 09 13:40:51 2012 us=962000 down_pre = DISABLED
Thu Feb 09 13:40:51 2012 us=962000 up_restart = DISABLED
Thu Feb 09 13:40:51 2012 us=962000 up_delay = DISABLED
Thu Feb 09 13:40:51 2012 us=962000 daemon = DISABLED
Thu Feb 09 13:40:51 2012 us=962000 inetd = 0
Thu Feb 09 13:40:51 2012 us=962000 log = DISABLED
Thu Feb 09 13:40:51 2012 us=962000 suppress_timestamps = DISABLED
Thu Feb 09 13:40:51 2012 us=962000 nice = 0
Thu Feb 09 13:40:51 2012 us=962000 verbosity = 5
Thu Feb 09 13:40:51 2012 us=962000 mute = 0
Thu Feb 09 13:40:51 2012 us=962000 gremlin = 0
Thu Feb 09 13:40:51 2012 us=962000 status_file = '[UNDEF]'
Thu Feb 09 13:40:51 2012 us=962000 status_file_version = 1
Thu Feb 09 13:40:51 2012 us=962000 status_file_update_freq = 60
Thu Feb 09 13:40:51 2012 us=962000 occ = ENABLED
Thu Feb 09 13:40:51 2012 us=962000 rcvbuf = 0
Thu Feb 09 13:40:51 2012 us=978000 sndbuf = 0
Thu Feb 09 13:40:51 2012 us=978000 sockflags = 0
Thu Feb 09 13:40:51 2012 us=978000 fast_io = DISABLED
Thu Feb 09 13:40:51 2012 us=978000 lzo = 7
Thu Feb 09 13:40:51 2012 us=978000 route_script = '[UNDEF]'
Thu Feb 09 13:40:51 2012 us=978000 route_default_gateway = '[UNDEF]'
Thu Feb 09 13:40:51 2012 us=978000 route_default_metric = 0
Thu Feb 09 13:40:51 2012 us=978000 route_noexec = DISABLED
Thu Feb 09 13:40:51 2012 us=978000 route_delay = 5
Thu Feb 09 13:40:51 2012 us=978000 route_delay_window = 30
Thu Feb 09 13:40:51 2012 us=978000 route_delay_defined = ENABLED
Thu Feb 09 13:40:51 2012 us=978000 route_nopull = DISABLED
Thu Feb 09 13:40:51 2012 us=978000 route_gateway_via_dhcp = DISABLED
Thu Feb 09 13:40:51 2012 us=978000 max_routes = 100
Thu Feb 09 13:40:51 2012 us=978000 allow_pull_fqdn = DISABLED
Thu Feb 09 13:40:51 2012 us=978000 [redirect_default_gateway local=0]
Thu Feb 09 13:40:52 2012 us=9000 management_addr = '[UNDEF]'
Thu Feb 09 13:40:52 2012 us=9000 management_port = 0
Thu Feb 09 13:40:52 2012 us=9000 management_user_pass = '[UNDEF]'
Thu Feb 09 13:40:52 2012 us=9000 management_log_history_cache = 250
Thu Feb 09 13:40:52 2012 us=9000 management_echo_buffer_size = 100
Thu Feb 09 13:40:52 2012 us=9000 management_write_peer_info_file = '[UNDEF]'
Thu Feb 09 13:40:52 2012 us=9000 management_client_user = '[UNDEF]'
Thu Feb 09 13:40:52 2012 us=9000 management_client_group = '[UNDEF]'
Thu Feb 09 13:40:52 2012 us=9000 management_flags = 0
Thu Feb 09 13:40:52 2012 us=9000 shared_secret_file = '[UNDEF]'
Thu Feb 09 13:40:52 2012 us=9000 key_direction = 2
Thu Feb 09 13:40:52 2012 us=9000 ciphername_defined = ENABLED
Thu Feb 09 13:40:52 2012 us=9000 ciphername = 'BF-CBC'
Thu Feb 09 13:40:52 2012 us=9000 authname_defined = ENABLED
Thu Feb 09 13:40:52 2012 us=9000 authname = 'SHA1'
Thu Feb 09 13:40:52 2012 us=9000 prng_hash = 'SHA1'
Thu Feb 09 13:40:52 2012 us=25000 prng_nonce_secret_len = 16
Thu Feb 09 13:40:52 2012 us=25000 keysize = 0
Thu Feb 09 13:40:52 2012 us=25000 engine = DISABLED
Thu Feb 09 13:40:52 2012 us=25000 replay = ENABLED
Thu Feb 09 13:40:52 2012 us=25000 mute_replay_warnings = DISABLED
Thu Feb 09 13:40:52 2012 us=25000 replay_window = 64
Thu Feb 09 13:40:52 2012 us=25000 replay_time = 15
Thu Feb 09 13:40:52 2012 us=25000 packet_id_file = '[UNDEF]'
Thu Feb 09 13:40:52 2012 us=25000 use_iv = ENABLED
Thu Feb 09 13:40:52 2012 us=25000 test_crypto = DISABLED
Thu Feb 09 13:40:52 2012 us=25000 tls_server = DISABLED
Thu Feb 09 13:40:52 2012 us=25000 tls_client = ENABLED
Thu Feb 09 13:40:52 2012 us=25000 key_method = 2
Thu Feb 09 13:40:52 2012 us=25000 ca_file = '[UNDEF]'
Thu Feb 09 13:40:52 2012 us=25000 ca_path = '[UNDEF]'
Thu Feb 09 13:40:52 2012 us=25000 dh_file = '[UNDEF]'
Thu Feb 09 13:40:52 2012 us=25000 cert_file = '[UNDEF]'
Thu Feb 09 13:40:52 2012 us=25000 priv_key_file = '[UNDEF]'
Thu Feb 09 13:40:52 2012 us=40000 pkcs12_file = 'pfsense-udp-1194.p12'
Thu Feb 09 13:40:52 2012 us=40000 cryptoapi_cert = '[UNDEF]'
Thu Feb 09 13:40:52 2012 us=40000 cipher_list = '[UNDEF]'
Thu Feb 09 13:40:52 2012 us=40000 tls_verify = '[UNDEF]'
Thu Feb 09 13:40:52 2012 us=40000 tls_export_cert = '[UNDEF]'
Thu Feb 09 13:40:52 2012 us=40000 tls_remote = 'Road'
Thu Feb 09 13:40:52 2012 us=40000 crl_file = '[UNDEF]'
Thu Feb 09 13:40:52 2012 us=40000 ns_cert_type = 0
Thu Feb 09 13:40:52 2012 us=40000 remote_cert_ku[i] = 0
Thu Feb 09 13:40:52 2012 us=40000 remote_cert_ku[i] = 0
Thu Feb 09 13:40:52 2012 us=40000 remote_cert_ku[i] = 0
Thu Feb 09 13:40:52 2012 us=40000 remote_cert_ku[i] = 0
Thu Feb 09 13:40:52 2012 us=40000 remote_cert_ku[i] = 0
Thu Feb 09 13:40:52 2012 us=40000 remote_cert_ku[i] = 0
Thu Feb 09 13:40:52 2012 us=40000 remote_cert_ku[i] = 0
Thu Feb 09 13:40:52 2012 us=40000 remote_cert_ku[i] = 0
Thu Feb 09 13:40:52 2012 us=56000 remote_cert_ku[i] = 0
Thu Feb 09 13:40:52 2012 us=56000 remote_cert_ku[i] = 0
Thu Feb 09 13:40:52 2012 us=56000 remote_cert_ku[i] = 0
Thu Feb 09 13:40:52 2012 us=56000 remote_cert_ku[i] = 0
Thu Feb 09 13:40:52 2012 us=56000 remote_cert_ku[i] = 0
Thu Feb 09 13:40:52 2012 us=56000 remote_cert_ku[i] = 0
Thu Feb 09 13:40:52 2012 us=56000 remote_cert_ku[i] = 0
Thu Feb 09 13:40:52 2012 us=56000 remote_cert_ku[i] = 0
Thu Feb 09 13:40:52 2012 us=56000 remote_cert_eku = '[UNDEF]'
Thu Feb 09 13:40:52 2012 us=56000 tls_timeout = 2
Thu Feb 09 13:40:52 2012 us=56000 renegotiate_bytes = 0
Thu Feb 09 13:40:52 2012 us=56000 renegotiate_packets = 0
Thu Feb 09 13:40:52 2012 us=56000 renegotiate_seconds = 3600
Thu Feb 09 13:40:52 2012 us=56000 handshake_window = 60
Thu Feb 09 13:40:52 2012 us=56000 transition_window = 3600
Thu Feb 09 13:40:52 2012 us=56000 single_session = DISABLED
Thu Feb 09 13:40:52 2012 us=72000 push_peer_info = DISABLED
Thu Feb 09 13:40:52 2012 us=72000 tls_exit = DISABLED
Thu Feb 09 13:40:52 2012 us=72000 tls_auth_file = 'pfsense-udp-1194-tls.key'
Thu Feb 09 13:40:52 2012 us=72000 pkcs11_protected_authentication = DISABLED
Thu Feb 09 13:40:52 2012 us=72000 pkcs11_protected_authentication = DISABLED
Thu Feb 09 13:40:52 2012 us=72000 pkcs11_protected_authentication = DISABLED
Thu Feb 09 13:40:52 2012 us=72000 pkcs11_protected_authentication = DISABLED
Thu Feb 09 13:40:52 2012 us=72000 pkcs11_protected_authentication = DISABLED
Thu Feb 09 13:40:52 2012 us=72000 pkcs11_protected_authentication = DISABLED
Thu Feb 09 13:40:52 2012 us=72000 pkcs11_protected_authentication = DISABLED
Thu Feb 09 13:40:52 2012 us=72000 pkcs11_protected_authentication = DISABLED
Thu Feb 09 13:40:52 2012 us=72000 pkcs11_protected_authentication = DISABLED
Thu Feb 09 13:40:52 2012 us=72000 pkcs11_protected_authentication = DISABLED
Thu Feb 09 13:40:52 2012 us=87000 pkcs11_protected_authentication = DISABLED
Thu Feb 09 13:40:52 2012 us=87000 pkcs11_protected_authentication = DISABLED
Thu Feb 09 13:40:52 2012 us=87000 pkcs11_protected_authentication = DISABLED
Thu Feb 09 13:40:52 2012 us=87000 pkcs11_protected_authentication = DISABLED
Thu Feb 09 13:40:52 2012 us=87000 pkcs11_protected_authentication = DISABLED
Thu Feb 09 13:40:52 2012 us=87000 pkcs11_protected_authentication = DISABLED
Thu Feb 09 13:40:52 2012 us=87000 pkcs11_private_mode = 00000000
Thu Feb 09 13:40:52 2012 us=87000 pkcs11_private_mode = 00000000
Thu Feb 09 13:40:52 2012 us=87000 pkcs11_private_mode = 00000000
Thu Feb 09 13:40:52 2012 us=87000 pkcs11_private_mode = 00000000
Thu Feb 09 13:40:52 2012 us=87000 pkcs11_private_mode = 00000000
Thu Feb 09 13:40:52 2012 us=87000 pkcs11_private_mode = 00000000
Thu Feb 09 13:40:52 2012 us=87000 pkcs11_private_mode = 00000000
Thu Feb 09 13:40:52 2012 us=87000 pkcs11_private_mode = 00000000
Thu Feb 09 13:40:52 2012 us=103000 pkcs11_private_mode = 00000000
Thu Feb 09 13:40:52 2012 us=103000 pkcs11_private_mode = 00000000
Thu Feb 09 13:40:52 2012 us=103000 pkcs11_private_mode = 00000000
Thu Feb 09 13:40:52 2012 us=103000 pkcs11_private_mode = 00000000
Thu Feb 09 13:40:52 2012 us=103000 pkcs11_private_mode = 00000000
Thu Feb 09 13:40:52 2012 us=103000 pkcs11_private_mode = 00000000
Thu Feb 09 13:40:52 2012 us=103000 pkcs11_private_mode = 00000000
Thu Feb 09 13:40:52 2012 us=103000 pkcs11_private_mode = 00000000
Thu Feb 09 13:40:52 2012 us=103000 pkcs11_cert_private = DISABLED
Thu Feb 09 13:40:52 2012 us=103000 pkcs11_cert_private = DISABLED
Thu Feb 09 13:40:52 2012 us=103000 pkcs11_cert_private = DISABLED
Thu Feb 09 13:40:52 2012 us=103000 pkcs11_cert_private = DISABLED
Thu Feb 09 13:40:52 2012 us=103000 pkcs11_cert_private = DISABLED
Thu Feb 09 13:40:52 2012 us=103000 pkcs11_cert_private = DISABLED
Thu Feb 09 13:40:52 2012 us=118000 pkcs11_cert_private = DISABLED
Thu Feb 09 13:40:52 2012 us=118000 pkcs11_cert_private = DISABLED
Thu Feb 09 13:40:52 2012 us=118000 pkcs11_cert_private = DISABLED
Thu Feb 09 13:40:52 2012 us=118000 pkcs11_cert_private = DISABLED
Thu Feb 09 13:40:52 2012 us=118000 pkcs11_cert_private = DISABLED
Thu Feb 09 13:40:52 2012 us=118000 pkcs11_cert_private = DISABLED
Thu Feb 09 13:40:52 2012 us=118000 pkcs11_cert_private = DISABLED
Thu Feb 09 13:40:52 2012 us=118000 pkcs11_cert_private = DISABLED
Thu Feb 09 13:40:52 2012 us=118000 pkcs11_cert_private = DISABLED
Thu Feb 09 13:40:52 2012 us=118000 pkcs11_cert_private = DISABLED
Thu Feb 09 13:40:52 2012 us=118000 pkcs11_pin_cache_period = -1
Thu Feb 09 13:40:52 2012 us=118000 pkcs11_id = '[UNDEF]'
Thu Feb 09 13:40:52 2012 us=118000 pkcs11_id_management = DISABLED
Thu Feb 09 13:40:52 2012 us=118000 server_network = 0.0.0.0
Thu Feb 09 13:40:52 2012 us=134000 server_netmask = 0.0.0.0
Thu Feb 09 13:40:52 2012 us=134000 server_bridge_ip = 0.0.0.0
Thu Feb 09 13:40:52 2012 us=134000 server_bridge_netmask = 0.0.0.0
Thu Feb 09 13:40:52 2012 us=134000 server_bridge_pool_start = 0.0.0.0
Thu Feb 09 13:40:52 2012 us=134000 server_bridge_pool_end = 0.0.0.0
Thu Feb 09 13:40:52 2012 us=134000 ifconfig_pool_defined = DISABLED
Thu Feb 09 13:40:52 2012 us=134000 ifconfig_pool_start = 0.0.0.0
Thu Feb 09 13:40:52 2012 us=134000 ifconfig_pool_end = 0.0.0.0
Thu Feb 09 13:40:52 2012 us=134000 ifconfig_pool_netmask = 0.0.0.0
Thu Feb 09 13:40:52 2012 us=134000 ifconfig_pool_persist_filename = '[UNDEF]'
Thu Feb 09 13:40:52 2012 us=134000 ifconfig_pool_persist_refresh_freq = 600
Thu Feb 09 13:40:52 2012 us=134000 n_bcast_buf = 256
Thu Feb 09 13:40:52 2012 us=134000 tcp_queue_limit = 64
Thu Feb 09 13:40:52 2012 us=134000 real_hash_size = 256
Thu Feb 09 13:40:52 2012 us=134000 virtual_hash_size = 256
Thu Feb 09 13:40:52 2012 us=150000 client_connect_script = '[UNDEF]'
Thu Feb 09 13:40:52 2012 us=150000 learn_address_script = '[UNDEF]'
Thu Feb 09 13:40:52 2012 us=150000 client_disconnect_script = '[UNDEF]'
Thu Feb 09 13:40:52 2012 us=150000 client_config_dir = '[UNDEF]'
Thu Feb 09 13:40:52 2012 us=150000 ccd_exclusive = DISABLED
Thu Feb 09 13:40:52 2012 us=150000 tmp_dir = 'C:\Users\CPRESS~1\AppData\Local\Temp\'
Thu Feb 09 13:40:52 2012 us=150000 push_ifconfig_defined = DISABLED
Thu Feb 09 13:40:52 2012 us=150000 push_ifconfig_local = 0.0.0.0
Thu Feb 09 13:40:52 2012 us=150000 push_ifconfig_remote_netmask = 0.0.0.0
Thu Feb 09 13:40:52 2012 us=150000 enable_c2c = DISABLED
Thu Feb 09 13:40:52 2012 us=150000 duplicate_cn = DISABLED
Thu Feb 09 13:40:52 2012 us=150000 cf_max = 0
Thu Feb 09 13:40:52 2012 us=150000 cf_per = 0
Thu Feb 09 13:40:52 2012 us=150000 max_clients = 1024
Thu Feb 09 13:40:52 2012 us=150000 max_routes_per_client = 256
Thu Feb 09 13:40:52 2012 us=150000 auth_user_pass_verify_script = '[UNDEF]'
Thu Feb 09 13:40:52 2012 us=150000 auth_user_pass_verify_script_via_file = DISABLED
Thu Feb 09 13:40:52 2012 us=150000 ssl_flags = 0
Thu Feb 09 13:40:52 2012 us=150000 client = ENABLED
Thu Feb 09 13:40:52 2012 us=150000 pull = ENABLED
Thu Feb 09 13:40:52 2012 us=150000 auth_user_pass_file = 'pass.txt'
Thu Feb 09 13:40:52 2012 us=150000 show_net_up = DISABLED
Thu Feb 09 13:40:52 2012 us=150000 route_method = 0
Thu Feb 09 13:40:52 2012 us=150000 ip_win32_defined = DISABLED
Thu Feb 09 13:40:52 2012 us=150000 ip_win32_type = 3
Thu Feb 09 13:40:52 2012 us=150000 dhcp_masq_offset = 0
Thu Feb 09 13:40:52 2012 us=150000 dhcp_lease_time = 31536000
Thu Feb 09 13:40:52 2012 us=150000 tap_sleep = 0
Thu Feb 09 13:40:52 2012 us=150000 dhcp_options = DISABLED
Thu Feb 09 13:40:52 2012 us=150000 dhcp_renew = DISABLED
Thu Feb 09 13:40:52 2012 us=165000 dhcp_pre_release = DISABLED
Thu Feb 09 13:40:52 2012 us=165000 dhcp_release = DISABLED
Thu Feb 09 13:40:52 2012 us=165000 domain = '[UNDEF]'
Thu Feb 09 13:40:52 2012 us=165000 netbios_scope = '[UNDEF]'
Thu Feb 09 13:40:52 2012 us=165000 netbios_node_type = 0
Thu Feb 09 13:40:52 2012 us=165000 disable_nbt = DISABLED
Thu Feb 09 13:40:52 2012 us=165000 OpenVPN 2.2.2 Win32-MSVC++ [SSL] [LZO2] [PKCS11] built on Dec 15 2011
Thu Feb 09 13:40:52 2012 us=165000 IMPORTANT: OpenVPN's default port number is now 1194, based on an official port number assignment by IANA. OpenVPN 2.0-beta16 and earlier used 5000 as the default port.
Thu Feb 09 13:40:52 2012 us=165000 WARNING: Make sure you understand the semantics of --tls-remote before using it (see the man page).
Thu Feb 09 13:40:52 2012 us=165000 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Thu Feb 09 13:40:52 2012 us=352000 Control Channel Authentication: using 'pfsense-udp-1194-tls.key' as a OpenVPN static key file
Thu Feb 09 13:40:52 2012 us=352000 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Feb 09 13:40:52 2012 us=352000 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Feb 09 13:40:52 2012 us=352000 LZO compression initialized
Thu Feb 09 13:40:52 2012 us=352000 Control Channel MTU parms [ L:1542 D:166 EF:66 EB:0 ET:0 EL:0 ]
Thu Feb 09 13:40:52 2012 us=352000 Socket Buffers: R=[8192->8192] S=[8192->8192]
Thu Feb 09 13:40:52 2012 us=368000 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Thu Feb 09 13:40:52 2012 us=368000 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-client'
Thu Feb 09 13:40:52 2012 us=368000 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 0,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-server'
Thu Feb 09 13:40:52 2012 us=368000 Local Options hash (VER=V4): '504e774e'
Thu Feb 09 13:40:52 2012 us=368000 Expected Remote Options hash (VER=V4): '14168603'
Thu Feb 09 13:40:52 2012 us=368000 UDPv4 link local (bound): [undef]:1194
Thu Feb 09 13:40:52 2012 us=368000 UDPv4 link remote: 86.21.116.233:1194
Thu Feb 09 13:40:52 2012 us=384000 TLS: Initial packet from 86.21.116.233:1194, sid=d7c340a1 23ca60a6
Thu Feb 09 13:40:52 2012 us=384000 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Thu Feb 09 13:40:52 2012 us=462000 VERIFY OK: depth=1, <snipped>
Thu Feb 09 13:40:52 2012 us=462000 VERIFY X509NAME OK: <snipped>
Thu Feb 09 13:40:52 2012 us=462000 VERIFY OK: depth=0, <snipped>
Thu Feb 09 13:40:52 2012 us=540000 Replay-window backtrack occurred [1]
Thu Feb 09 13:40:52 2012 us=540000 Replay-window backtrack occurred [2]
Thu Feb 09 13:40:52 2012 us=977000 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Feb 09 13:40:52 2012 us=977000 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Feb 09 13:40:52 2012 us=977000 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Feb 09 13:40:52 2012 us=977000 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Feb 09 13:40:53 2012 us=8000 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Thu Feb 09 13:40:53 2012 us=23000 [Road_Warrior_Server_Cert] Peer Connection Initiated with 86.21.116.233:1194
Thu Feb 09 13:40:55 2012 us=67000 SENT CONTROL [Road_Warrior_Server_Cert]: 'PUSH_REQUEST' (status=1)
Thu Feb 09 13:40:55 2012 us=83000 PUSH: Received control message: 'PUSH_REPLY,route 10.0.1.0 255.255.255.0,route 10.0.3.1,topology net30,ping 10,ping-restart 60,ifconfig 10.0.3.10 10.0.3.9'
Thu Feb 09 13:40:55 2012 us=83000 OPTIONS IMPORT: timers and/or timeouts modified
Thu Feb 09 13:40:55 2012 us=83000 OPTIONS IMPORT: --ifconfig/up options modified
Thu Feb 09 13:40:55 2012 us=83000 OPTIONS IMPORT: route options modified
Thu Feb 09 13:40:55 2012 us=98000 ROUTE default_gateway=172.22.104.1
Thu Feb 09 13:40:55 2012 us=129000 TAP-WIN32 device [Local Area Connection 3] opened: \\.\Global\{813D2EC8-AC96-4AF8-9FB7-7F1B6AC69728}.tap
Thu Feb 09 13:40:55 2012 us=145000 TAP-Win32 Driver Version 9.9
Thu Feb 09 13:40:55 2012 us=145000 TAP-Win32 MTU=1500
Thu Feb 09 13:40:55 2012 us=145000 Notified TAP-Win32 driver to set a DHCP IP/netmask of 10.0.3.10/255.255.255.252 on interface {813D2EC8-AC96-4AF8-9FB7-7F1B6AC69728} [DHCP-serv: 10.0.3.9, lease-time: 31536000]
Thu Feb 09 13:40:55 2012 us=145000 Successful ARP Flush on interface [16] {813D2EC8-AC96-4AF8-9FB7-7F1B6AC69728}
Thu Feb 09 13:41:00 2012 us=979000 TEST ROUTES: 3/3 succeeded len=2 ret=1 a=0 u/d=up
Thu Feb 09 13:41:00 2012 us=979000 C:\WINDOWS\system32\route.exe ADD 86.21.116.233 MASK 255.255.255.255 172.22.104.1
Thu Feb 09 13:41:00 2012 us=995000 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=10 and dwForwardType=4
Thu Feb 09 13:41:00 2012 us=995000 Route addition via IPAPI succeeded [adaptive]
Thu Feb 09 13:41:00 2012 us=995000 C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.0.3.9
Thu Feb 09 13:41:00 2012 us=995000 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Thu Feb 09 13:41:00 2012 us=995000 Route addition via IPAPI succeeded [adaptive]
Thu Feb 09 13:41:00 2012 us=995000 C:\WINDOWS\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.0.3.9
Thu Feb 09 13:41:01 2012 us=11000 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Thu Feb 09 13:41:01 2012 us=11000 Route addition via IPAPI succeeded [adaptive]
Thu Feb 09 13:41:01 2012 us=11000 C:\WINDOWS\system32\route.exe ADD 10.0.1.0 MASK 255.255.255.0 10.0.3.9
Thu Feb 09 13:41:01 2012 us=11000 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Thu Feb 09 13:41:01 2012 us=11000 Route addition via IPAPI succeeded [adaptive]
Thu Feb 09 13:41:01 2012 us=26000 C:\WINDOWS\system32\route.exe ADD 10.0.3.1 MASK 255.255.255.255 10.0.3.9
Thu Feb 09 13:41:01 2012 us=26000 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Thu Feb 09 13:41:01 2012 us=26000 Route addition via IPAPI succeeded [adaptive]
Thu Feb 09 13:41:01 2012 us=26000 Initialization Sequence Completed
[/CODE]

well this doesn't look right

Thu Feb 09 13:40:55 2012 us=98000 ROUTE default_gateway=172.22.104.1

I will be headed to the office in about an hour -- when I get in I will connect in and see what mine shows.

Just try changing your default route on the client with the route command to 10.0.3.9

Off the top of my head I believe

route add 0.0.0.0 mask 0.0.0.0 10.0.3.9

You prob have to delete your old route, and or change it to point to the 10.0.3.9 which is the interface on the other end of your tunnel.

edit:

I assume you are on windows 7, and your running the openvpn gui elevated with full admin rights/

Okay, here is it after running the route command I got the following:


C:\Windows\system32>route add 0.0.0.0 mask 0.0.0.0 10.0.3.9
The route addition failed: The object already exists.
[/CODE]

I have full Admin Rights on this Win 7 Laptop, but is it possible a GPO on the domain is effecting this?

Again what is your ROUTE?? You would never go down the tunnel to ping anything on the internet if your route does not tell you to go there.

do a tracert 8.8.8.8 and see where you go - from your route table your not going to go down the tunnel. From your route table your going to go to that 172.22.104.1 address if there is no specific route to the network.

like I said you might have to delete or change the route - you normally do not have 2 default routes.. Which is what

The route addition failed: The object already exists.

is saying.

edit: doesn't matter if your full admin or not - unless you run elevated prompt as admin, your not admin. Same with say the openvpn gui -- if your just running it as your account it does not have admin rights. You need to run it elevated with admin rights.

edit2: So again from your route table and the output of your openvpn connection that says

Thu Feb 09 13:40:55 2012 us=98000 ROUTE default_gateway=172.22.104.1

Your box is going to talk to that IP if your trying to talk to some IP that you don't have a specific route too. Now you do have a route for your 10.0.1 network. Right here

10.0.1.0 255.255.255.0 10.0.3.9 10.0.3.10

This tells your machine hey if you want to talk to anything on the 10.0.1.0/24 to send it to 10.0.3.9 using your interface 10.0.3.10.

But if your wanting to talk to say neowin.net on 74.204.71.247 -- where is that going to go, you don't have a route for that IP.. So it goes to your default route - which is currently that 172.22.104.1, so NO Its not going to go down your vpn connection to get there.

Right so, post connecting to OpenVPN I have the following setup:


C:\Windows\system32>route print
===========================================================================
Interface List
16...00 ff 81 3d 2e c8 ......TAP-Win32 Adapter V9
13...f0 7b cb a8 3a c3 ......Bluetooth Device (Personal Area Network)
12...00 23 14 8d c2 ac ......Intel(R) Centrino(R) Advanced-N 6200 AGN
11...00 26 b9 d3 0d 42 ......Intel(R) 82577LM Gigabit Network Connection
1...........................Software Loopback Interface 1
20...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
17...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
18...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #3
19...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #4
32...00 00 00 00 00 00 00 e0 Microsoft Teredo Tunneling Adapter
===========================================================================
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 172.22.104.1 172.22.105.194 10
0.0.0.0 0.0.0.0 10.0.3.9 10.0.3.10 31
0.0.0.0 128.0.0.0 10.0.3.9 10.0.3.10 30
10.0.1.0 255.255.255.0 10.0.3.9 10.0.3.10 30
10.0.3.1 255.255.255.255 10.0.3.9 10.0.3.10 30
10.0.3.8 255.255.255.252 On-link 10.0.3.10 286
10.0.3.10 255.255.255.255 On-link 10.0.3.10 286
10.0.3.11 255.255.255.255 On-link 10.0.3.10 286
86.21.116.233 255.255.255.255 172.22.104.1 172.22.105.194 10
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
128.0.0.0 128.0.0.0 10.0.3.9 10.0.3.10 30
172.22.104.0 255.255.252.0 On-link 172.22.105.194 266
172.22.105.194 255.255.255.255 On-link 172.22.105.194 266
172.22.107.255 255.255.255.255 On-link 172.22.105.194 266
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 172.22.105.194 266
224.0.0.0 240.0.0.0 On-link 10.0.3.10 286
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 172.22.105.194 266
255.255.255.255 255.255.255.255 On-link 10.0.3.10 286
===========================================================================
Persistent Routes:
None
IPv6 Route Table
===========================================================================
Active Routes:
If Metric Network Destination Gateway
1 306 ::1/128 On-link
11 266 fe80::/64 On-link
16 286 fe80::/64 On-link
16 286 fe80::6153:2b19:538c:b4a3/128
On-link
11 266 fe80::fd45:a3d8:21fb:9164/128
On-link
1 306 ff00::/8 On-link
11 266 ff00::/8 On-link
16 286 ff00::/8 On-link
===========================================================================
Persistent Routes:
None
[/CODE]

So I delete the top level route.

[CODE]
route delete 0.0.0.0 mask 0.0.0.0 172.22.104.1
OK!
[/CODE]

Which brings me to the following setup:

[CODE]
C:\Windows\system32>route print
===========================================================================
Interface List
16...00 ff 81 3d 2e c8 ......TAP-Win32 Adapter V9
13...f0 7b cb a8 3a c3 ......Bluetooth Device (Personal Area Network)
12...00 23 14 8d c2 ac ......Intel(R) Centrino(R) Advanced-N 6200 AGN
11...00 26 b9 d3 0d 42 ......Intel(R) 82577LM Gigabit Network Connection
1...........................Software Loopback Interface 1
20...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
17...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
18...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #3
19...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #4
32...00 00 00 00 00 00 00 e0 Microsoft Teredo Tunneling Adapter
===========================================================================
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 10.0.3.9 10.0.3.10 31
0.0.0.0 128.0.0.0 10.0.3.9 10.0.3.10 30
10.0.1.0 255.255.255.0 10.0.3.9 10.0.3.10 30
10.0.3.1 255.255.255.255 10.0.3.9 10.0.3.10 30
10.0.3.8 255.255.255.252 On-link 10.0.3.10 286
10.0.3.10 255.255.255.255 On-link 10.0.3.10 286
10.0.3.11 255.255.255.255 On-link 10.0.3.10 286
86.21.116.233 255.255.255.255 172.22.104.1 172.22.105.194 10
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
128.0.0.0 128.0.0.0 10.0.3.9 10.0.3.10 30
172.22.104.0 255.255.252.0 On-link 172.22.105.194 266
172.22.105.194 255.255.255.255 On-link 172.22.105.194 266
172.22.107.255 255.255.255.255 On-link 172.22.105.194 266
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 172.22.105.194 266
224.0.0.0 240.0.0.0 On-link 10.0.3.10 286
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 172.22.105.194 266
255.255.255.255 255.255.255.255 On-link 10.0.3.10 286
===========================================================================
Persistent Routes:
None
IPv6 Route Table
===========================================================================
Active Routes:
If Metric Network Destination Gateway
1 306 ::1/128 On-link
11 266 fe80::/64 On-link
16 286 fe80::/64 On-link
16 286 fe80::6153:2b19:538c:b4a3/128
On-link
11 266 fe80::fd45:a3d8:21fb:9164/128
On-link
1 306 ff00::/8 On-link
11 266 ff00::/8 On-link
16 286 ff00::/8 On-link
===========================================================================
Persistent Routes:
None
[/CODE]

Now, I cannot see any issues there at all, albeit from my limited knowledge of how this works. But this brings me to believe the issue is OpenVPN Server Side, not OpenVPN Client Side.

do a tracert 8.8.8.8

I don't see any dns being pushed, so how would you resolve say www.neowin.net so that you have an IP to route?

I'm walking out the door for work.. Hop on later to see any more info you have and continue to troubleshoot, and this way I will have remote access to my openvpn server to test.

btw.

Here is my server config just for reference.

dev ovpns1
dev-type tun
tun-ipv6
dev-node /dev/tun1
writepid /var/run/openvpn_server1.pid
#user nobody
#group nobody
script-security 3
daemon
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
proto tcp-server
cipher AES-128-CBC
up /usr/local/sbin/ovpn-linkup
down /usr/local/sbin/ovpn-linkdown
local 24.13.xxx.xxx
tls-server
server 10.0.200.0 255.255.255.0
client-config-dir /var/etc/openvpn-csc
tls-verify /var/etc/openvpn/server1.tls-verify.php
lport 443
management /var/etc/openvpn/server1.sock unix
max-clients 4
push "route 192.168.1.0 255.255.255.0"
push "dhcp-option DNS 192.168.1.253"
ca /var/etc/openvpn/server1.ca
cert /var/etc/openvpn/server1.cert
key /var/etc/openvpn/server1.key
dh /etc/dh-parameters.1024
crl-verify /var/etc/openvpn/server1.crl-verify
tls-auth /var/etc/openvpn/server1.tls-auth 0
comp-lzo
persist-remote-ip
float

from /var/etc/openvpn on pfsense server1.conf

Okay,

Here is my server config


dev ovpns2
dev-type tun
dev-node /dev/tun2
writepid /var/run/openvpn_server2.pid
#user nobody
#group nobody
script-security 3
daemon
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
proto udp
cipher BF-CBC
up /usr/local/sbin/ovpn-linkup
down /usr/local/sbin/ovpn-linkdown
local 86.21.116.233
tls-server
server 10.0.3.0 255.255.255.0
client-config-dir /var/etc/openvpn-csc
username-as-common-name
auth-user-pass-verify /var/etc/openvpn/server2.php via-env
tls-verify /var/etc/openvpn/server2.tls-verify.php
lport 1194
management /var/etc/openvpn/server2.sock unix
max-clients 20
push "route 10.0.1.0 255.255.255.0"
push "dhcp-option DNS 10.0.1.1"
ca /var/etc/openvpn/server2.ca
cert /var/etc/openvpn/server2.cert
key /var/etc/openvpn/server2.key
dh /etc/dh-parameters.1024
tls-auth /var/etc/openvpn/server2.tls-auth 0
comp-lzo
persist-remote-ip
float
[/CODE]

I'm going to continue diagnosing now. *please note I've only just added the DNS option based on comparing with your conf file.

Yep - After a reboot it still works. You don't think it was literally the OpenVPN daemon just needed restarting do you?! After all that?!

Thanks Budman, this has actually been a very educational experience.

To be honest there is nothing in the openvpn server that should of blocked your access to the outside, and pfsense is already setup to nat your connection to the internet, etc. So unless you had some firewall rule blocking access - pfsense should allow openvpn clients to access the internet - comes down to if the client will route traffic through the vpn or not for networks other than what is on the other end of the tunnel.

If I had to guess I would say maybe you were not getting dns before - did you try the tracert before you rebooted? So does your local network have dns? So you were trying to go to say www.whatsmyip.org and it was showing you your local connections nat IP. Or was just not working?

So is the redirect-gateway item working now - or do you have to manually set the default gateway?

Other problem I have seen when trying to do what your doing is the dns server being used through the pfsense not being set to allow the vpn network to query it, ie the 10.0.200 in my case. Depends on what your using for dns on the vpn network.. I use unbound on pfsense so had to create a ACL to allow vpn clients using a 10.0.200.x address to be able to query it.

The good thing is its working! ;)

edit: BTW you by no means need to have your vpn clients use the dns on your pfsense side -- I do that because I use dns to query for my machines on my pfsense network. And her at work you can not directly query dns on this network, have to use the proxy. The local dns will not resolve outside addresses.. So for it to work when I route traffic through my vpn connection I need a dns server that will resolve outside addresses. Like my pfsense box.

Oh really? I'm using Unbound also, I didn't realise that it blocked any connections at all. What was the ACL you setup? I assume 10.0.3.0/24 would be sufficient?

I agree it does look to be a DNS Issue, I just can't believe I missed that. I suppose the simplest explanation is usually the correct one.

Well since your tunnel network is so close to in number - it might be that falls under the same mask in your acl?

post-14624-0-32456900-1328881350_thumb.j

But yeah you have to allow networks to query unbound. If your able to query and don't have it in a ACL, maybe unbound is not working?

I snipped out part of that ipv6 range - because this a global public range and no reason to make that public.

This topic is now closed to further replies.
  • Posts

    • Ooooh! Two editorial from Paul Hill on the same day! Is it my birthday or something? 😉 Okay, let's see if I get it right. SearXNG develops a meta-search engine app. Individuals install it on their relays. Users connect to these relays to have their own identity-stripping meta-search engine instead of relying on DuckDuckGo. And some of these volunteers have listed their SearXNG instances on SearX.space. That was a lot of wrap my head around. I hope I haven't missed anything.
    • You sound like some Ukrainians in Crimea before 2014: "I didn't vote for USSR disbanding - I want Ukraine to be part of Russia again" 🤣
    • Uninstalr 3.1 by Razvan Serea Introducing Uninstalr: Easy to use and very accurate software uninstaller for Windows. It can uninstall multiple apps at the same time and we think it’s pretty cool. Developed with expertise by Macecraft Software - the minds behind jv16 PowerTools. Key Features Batch uninstall many apps at the same time. Supports unattended uninstallation of apps. Supports monitoring of new software installations. Also detects portable apps and previously uninstalled software leftovers. Shows all the data added to your system by installed software on a file by file basis. Shows all the data it will remove before starting the uninstallation. Filter and search the list of installed software. According to our benchmark, Uninstalr is the most accurate software uninstaller by leaving the least amount of leftovers when uninstalling apps. Supports detection and uninstallation of Microsoft Store, Steam, Big Fish Game System, Chocolatey, NuGet and Ninite installed software. Supports Windows Dark Mode. Supports Windows 11, 10, 8 and 7. Comes with these translations builtin: Chinese Simplified, Chinese Traditional, Czech, Danish, English, Filipino, Finnish, French, German, Greek, Hindi, Hungarian, Indonesian, Italian, Japanese, Korean, Malay, Norwegian, Polish, Portuguese, Romanian, Slovak, Spanish, Swedish, Thai, Turkish, Ukrainian and Vietnamese. Has a single executable file portable version and a normal setup version. Uninstalr is freeware, lightweight and easy to use. No bells and whistles, no nonsense. Uninstalr’s custom uninstallation engine has a dedicated support for the detection and uninstallation of 15 types of apps: Normal Windows apps Microsoft Store apps Portable apps Chocolatey apps Ninite apps PortableApps.com apps Steam games EA App games Epic Games Store games Riot platform games GOG Galaxy games WarGaming.net games Battle.net games itch.io games Big Fish platform games Uninstalr 3.1 changelog: Key Changes Uninstalr now starts and shows the list of installed apps faster after the initial scan has been completed, and with much smaller memory usage. Uninstalr now detects and highlights apps that automatically start with Windows. Greatly improved the detection of portable apps. Improvements New feature: Uninstalr now detects and highlights apps that automatically start with Windows. New feature: Uninstalr now highlights possible leftovers and apps from Russia and China. This can be disabled from the Settings. New feature: A new filter that allows you to show only software that is installed to other than the system drive. New feature: Users can now select to always do the deepest and the most accurate scan for installed apps, at the cost of the analysis taking a longer time. Greatly improved the detection of portable apps, such as added dedicated support for MiTeC, EZ Tools and SysInternals tools. Improved support for portable apps installed via Windows System Control Center (WSCC). NirSoft portable apps are now listed with "NirSoft" prefix for easier identification. Improved the speed of uninstalling apps. The main installed software listing search will now find "Xbox GameBar" if you search for "Game bar" and vice versa. The tooltip now displays more detailed information of the installed apps, such as its registry key and uninstaller path. The links in the About section now look more like clickable links. The main menu is now more clearly indicated in the main user interface. Microsoft Teams Meeting Add-in for Microsoft Office ships with some Windows 11 installations and is now considered a builtin Windows app and only listed if builtin Windows apps filter is enabled. Added a Help button to the main user interface that opens the help section of the website. Added an option not to close Uninstalr after uninstallation. If you open the Uninstalr website from the app, the website now receives the version number of your current Uninstalr version and warns you if you are using anything but the latest version. Improved the accuracy of the New Software Monitor. Improved confirmation messages for Steam and other platform related uninstalls. Improved the uninstallation performance of Steam games. Fixes: Known bug fixed: Some installed app names are capitalized incorrectly, such as "CCleaner Portable" is listed as "ccleaner portable". Known bug fixed: Some apps can be listed twice, for example, Smart Defrag can be listed once as Smart Defrag and then Smart Defrag Home. Known bug fixed: On the pre-uninstallation screen, the Scripts checkbox can be checked by default on Dark Mode but not on the normal mode. Known bug fixed: Perform Deep Analysis can be started only by clicking the button, not via the Right Click menu, main menu or F4 keyboard shortcut. Muse Hub could be incorrectly listed as Adobe Muse. SyncTrayzor was incorrectly detected as two unrelated software, SyncTrayzor and Syncthing. Smart Defrag was incorrectly listed twice as Smart Defrag 11 and Smart Defrag Home. It was possible to enter non-printable characters to the search input boxes of the main screen, and the path listing screen, which caused the UI to look funny. Changing the translation from Settings, especially many times in a row, caused the UI to distort. If you had multiple instances of portable apps on your system, such as the 64b and 32b versions of the same portable app, typically only one of them was detected, not both. In some very rare cases, Uninstalr UI could start with random characters in its search input boxes, which could make the UI look rather confusing. This was a rare issue, only reported by two users. The pre-uninstallation screen could display non-existing paths for example as the software's installation directory or main exe file. This was a cosmetic issue. New Software Monitor cannot detect the installation of Claude. Selecting all the found software made the UI look funny with the top panel covering everything else (because the names of all the selected software were listed there). Sometimes a Steam game could be listed a normal app instead of a Steam game. If the system restart after an uninstallation is delayed, e.g. because of Windows Updates being installed, this additional delay is incorrectly added to the time how long the uninstallation process took. This cosmetic bug could cause the program incorrectly report an uninstallation time longer than the actual uninstallation time. Uninstalling Minecraft could simply fail. The Only scan the system drive for installed apps setting does not fully work. If some apps are installed to a non system drive and this setting is enabled, the app could still be detected and listed on the main user interface. Changing any settings could also incorrectly alter the Only Scan The System Drive For Installed Apps setting. Microsoft OneDrive and Copilot are not always detected. If you enter something to the search filter field, then select the text and press the Delete key, this triggers the Uninstall button click even if your intent was to delete the text input. If you press the F5 key to refresh the screen during the uninstallation loading screen, the program will crash. If you enabled some setting, such as "Do not analyze installed app installation sizes", it could automatically be unchecked later. Uninstalr doesn't warn you if you try to remove Fortec antivirus. There should be a warning if user attempts to remove any antivirus or antimalware type program. Such programs should not be uninstalled using a third party uninstaller, as they are typically protected against automated uninstallation, for security reasons. With "Do not analyze installed app installation sizes" option checked from the Settings, Uninstalr could still display some installation size related elements in the UI which was confusing. The "Only scan the system drive" option moved under Improve Scan Speed from the General settings. If two software have the exact same name and version number, selecting both of them for uninstallation fails because only one is actually selected. Sorting the installed apps by size sometimes fails and the order is incorrect. The "Don't show which paths are currently analyzed" did not work correctly - some parts of the UI still show the currently analyzed path with this setting checked. The "Don't list software less than 10 MB" filter did not work correctly - some apps smaller than 10 MB could still be listed. Uninstalr could start very quickly and display an empty list of detected apps. Restarting the app usually fixed the issue and the list of installed apps was properly displayed. If you placed portable Uninstalr to a same folder with other portable apps, those were not detected because Uninstalr automatically added its installation folder to the ignore list. When trying to uninstall some specific software, Uninstalr could get stuck on the Searching for more data relating to the app phase. Uninstalr could sometimes do a silent uninstallation even if user had unchecked the Perform a silent uninstallation option. Known issues: Uninstalr can fail to run with an Out Of Memory error in systems that have a lot of installed apps. Using the New Software Monitor tool multiple times during one session can cause the program to get stuck on the Scanning stage. The "uninstallation completed" message box sometimes closes when the user moves the mouse cursor over the button before user clicks it. There is no feedback for the user after Fix Information feature has been used. The Right Click menu's Select by publisher option can display the number of apps per each publisher without correct vertical alignment. The default user interface might not display all of the found installed apps if you have over 600 installed apps. If you do, using the Screen Reader Compatible Interface solves the issue. Leftover apptype filter checkbox is shown in red font only in Dark Mode. Clicking the app's icon from the Windows Taskbar doesn't minimize/restore the app like other apps. The warning about an app that user wishes to uninstall being related to some other app user did not select can sometimes be inaccurate. If app's language is changed without restarting Uninstalr, the list of installed software might not automatically refresh. When software is being uninstalled, the UI can say it is processing paths unrelating to the uninstalled app. This is purely cosmetic and does not mean these paths are removed. Uninstalr might not properly detect and/or uninstall Steam games if they are installed to a drive different than Steam's default location in C:\. You might see "This action is only valid for products that are currently installed" error message from Windows Installer during uninstallation. This is a cosmetic issue. Download: Uninstalr 3.1 | 7.1 MB (Free, paid version available) Download: Uninstalr Setup 3.1 View: Uninstalr Website | Screenshot Get alerted to all of our Software updates on Twitter at @NeowinSoftware
    • I and many others did not vote to get out of the E.u because of Putin or Farage, we did so for our own reasons. You don't have to tel me what my own did or did not do when it comes to the E.U. The EEC is or was the European Economic Community, a different beast to what the E.U is now.The EEC was a mainly about trading, the E.U have gone far beyond that and as I have said before, is now more of a United States of Europe. The U.K did not vote to join a United States of Europe. Anyway, they did not want us in there in the first place, Charles de Gaulle stopped us joining as he claimed we didn’t agree with the core ideas of integration. He was not wrong and that is why we voted out of the E.U when the time came. I was not old enough to vote the first time. My only regret is that we did not have the referendum years ago and got out years ago. If we rejoined, we would have to agree to join the Euro and no doubt Schengen, agree with freedom of movement, we have enough problem with people coming over here as it is. i have no problem with people coming over here if they work and don't try to push their way of life onto us. The E.U has a currency, freedom of movement, an anthem a flag, a parliament, well they are there, not sure if they do anything. Don't sound like something that is just for trading. Oh yeah, also wanted a euro Army. How many stupid rules have the E.U made that we had to follow? I doubt I will see the Uk rejoin the E.U, which suits me. Oh yeah, my partner is Polish, she came over here before Poland joined the E.U and she got fed up of people just coming over here with ease, while she had to struggle. She is now a British citizen and have been for a fair few years
    • Hello, Paul. Thanks for the editorial. It was interesting. I'm going research more into the app and its concept. Of course, if you know me at all, you know that I'd say your articles needs some editing! I always do, don't I? For instance, the article occasionally mentions relays before defining it.
  • Recent Achievements

    • Week One Done
      flexorcist earned a badge
      Week One Done
    • One Month Later
      Woland13 earned a badge
      One Month Later
    • Week One Done
      Woland13 earned a badge
      Week One Done
    • One Year In
      bernmeister earned a badge
      One Year In
    • Week One Done
      Scoobystu earned a badge
      Week One Done
  • Popular Contributors

    1. 1
      +primortal
      495
    2. 2
      +Edouard
      226
    3. 3
      PsYcHoKiLLa
      153
    4. 4
      Steven P.
      75
    5. 5
      FloatingFatMan
      71
  • Tell a friend

    Love Neowin? Tell a friend!