In an OpenVPN network, Windows clients cannot access the host and other clients

Question

I have set up an OpenVPN network and I'd like to let every client in the network be able to connect to each other, ie. servers 10.8.0.1, 10.8.0.2 and 1.8.0.3 should be able to communicate over VPN and clients (running on various platforms) with IPs 10.8.0.10, 10.8.0.11, 10.8.0.12 should able to connect to all servers.

I have already set up servers 10.8.0.1 and 10.8.0.2 running Ubuntu 14.04 x64 and they seem to work properly, but I can't get a client running Windows with IP 10.8.0.10 to connect to both servers - connections seem to timeout.

Here's the server.conf running on 10.8.0.1:

port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
client-config-dir /etc/openvpn/staticclients
client-to-client
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3

There's no static IP definition in staticclients for the Windows client.

Here's the client.ovpn that I run on my Windows PC:

client
dev tun
proto udp
remote serverx.startup.io 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
ns-cert-type server
comp-lzo
verb 3

It connects properly, gets an IP assigned, but it can't connect to any IP in the network.

Here's the result of route print -4 ran on the client:

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.1.1     192.168.1.17     10
         10.8.0.8  255.255.255.252         On-link         10.8.0.10    276
        10.8.0.10  255.255.255.255         On-link         10.8.0.10    276
        10.8.0.11  255.255.255.255         On-link         10.8.0.10    276

What's wrong with my setup? Why I can't connect to the OpenVPN host and the second server from the client?

Answer 1

Suprisingly, the solution was to run OpenVPN as an admin, which is stated somewhere in the OpenVPN docs. You don't have to use it with dev tap, so it's not enforced by default.

Answer 2

Your subnet is wrong

10.8.0.8 255.255.255.252 On-link 10.8.0.10 276

10.8.0.1 and 10.8.0.2 apear on the different network to the system Therefore, all packets are routed to the default gateway 192.168.1.1

This page explains why do you get that subnet mask

There are some caveats to be aware of when using "tun" style devices on Windows: the --ifconfig endpoints chosen must be the two "middle" addresses in a 255.255.255.252 subnet.

Try dev tap

Upd: oh, you figured it out by yourself. windows route command requires elevation, so you weren't getting correct routes.