OVPN server setup help.

RouterOS Beginner Basics
1

I am trying to get openvpn server to work, so far no luck! I followed https://www.async.fi/2012/01/mikrotik-openvpn-server/ added all rules into firewall… The client connects to the server for about 10 sec then disconnects, I can see this activity in the log file. While the client keeps displaying. “Obtaining configuration”

TCP connection established from 192.168.0.200
: using encoding - BF-128-CBC/SHA1
a logged in, 192.168.1.95
: connected
: terminating… - peer disconnected
a logged out, 13 0 53 0 1


client
dev tap
remote x.x.x.x
proto tcp-client
tls-client
ca ca.crt
cert ec2.crt
key ec2.key
auth-user-pass
pull
nobind
persist-key
resolv-retry infinite
verb 3
script-security 2 system
route 192.168.88.0 255.255.255.0 192.168.89.1
auth-nocache

2

I got it to connect finally, but it shows "WARNING: No server certificate verification method has been enabled." It is enabled on the OVPEN Server.

Also I cannot ping any of the Local lan network inside the vpn.


\



Wed Apr 08 15:43:13 2015 OpenVPN 2.3.6 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Mar 19 2015
Wed Apr 08 15:43:13 2015 library versions: OpenSSL 1.0.1m 19 Mar 2015, LZO 2.08
Enter Management Password:
Wed Apr 08 15:43:13 2015 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Wed Apr 08 15:43:13 2015 Need hold release from management interface, waiting...
Wed Apr 08 15:43:13 2015 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Wed Apr 08 15:43:14 2015 MANAGEMENT: CMD 'state on'
Wed Apr 08 15:43:14 2015 MANAGEMENT: CMD 'log all on'
Wed Apr 08 15:43:14 2015 MANAGEMENT: CMD 'hold off'
Wed Apr 08 15:43:14 2015 MANAGEMENT: CMD 'hold release'
Wed Apr 08 15:43:16 2015 MANAGEMENT: CMD 'username "Auth" "a"'
Wed Apr 08 15:43:16 2015 MANAGEMENT: CMD 'password [...]'
Wed Apr 08 15:43:16 2015 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Wed Apr 08 15:43:16 2015 Socket Buffers: R=[65536->65536] S=[65536->65536]
Wed Apr 08 15:43:16 2015 Attempting to establish TCP connection with [AF_INET]192.168.0.14:1194 [nonblock]
Wed Apr 08 15:43:16 2015 MANAGEMENT: >STATE:1428522196,TCP_CONNECT,,,
Wed Apr 08 15:43:17 2015 TCP connection established with [AF_INET]192.168.0.14:1194
Wed Apr 08 15:43:17 2015 TCPv4_CLIENT link local: [undef]
Wed Apr 08 15:43:17 2015 TCPv4_CLIENT link remote: [AF_INET]192.168.0.14:1194
Wed Apr 08 15:43:17 2015 MANAGEMENT: >STATE:1428522197,WAIT,,,
Wed Apr 08 15:43:17 2015 MANAGEMENT: >STATE:1428522197,AUTH,,,
Wed Apr 08 15:43:17 2015 TLS: Initial packet from [AF_INET]192.168.0.14:1194, sid=d517ff04 731b7d75
Wed Apr 08 15:43:17 2015 VERIFY OK: depth=1, C=CA, ST=ON, L=Vaughan, O=abc.com, OU=abc.com, CN=abc.com, name=abc.com, emailAddress=admin@abc.com
Wed Apr 08 15:43:17 2015 VERIFY OK: depth=0, C=CA, ST=ON, L=Vaughan, O=abc.com, OU=abc.com, CN=abc.com, name=abc.com, emailAddress=admin@abc.com
Wed Apr 08 15:43:18 2015 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Wed Apr 08 15:43:18 2015 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Apr 08 15:43:18 2015 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Wed Apr 08 15:43:18 2015 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Apr 08 15:43:18 2015 Control Channel: TLSv1, cipher TLSv1/SSLv3 AES256-SHA, 2048 bit RSA
Wed Apr 08 15:43:18 2015 [abc.com] Peer Connection Initiated with [AF_INET]192.168.0.14:1194
Wed Apr 08 15:43:19 2015 MANAGEMENT: >STATE:1428522199,GET_CONFIG,,,
Wed Apr 08 15:43:20 2015 SENT CONTROL [abc.com]: 'PUSH_REQUEST' (status=1)
Wed Apr 08 15:43:25 2015 SENT CONTROL [abc.com]: 'PUSH_REQUEST' (status=1)
Wed Apr 08 15:43:30 2015 SENT CONTROL [abc.com]: 'PUSH_REQUEST' (status=1)
Wed Apr 08 15:43:30 2015 PUSH: Received control message: 'PUSH_REPLY,route-gateway 192.168.89.64,ifconfig 192.168.89.95 255.255.255.0'
Wed Apr 08 15:43:30 2015 OPTIONS IMPORT: --ifconfig/up options modified
Wed Apr 08 15:43:30 2015 OPTIONS IMPORT: route-related options modified
Wed Apr 08 15:43:30 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Apr 08 15:43:30 2015 MANAGEMENT: >STATE:1428522210,ASSIGN_IP,,192.168.89.95,
Wed Apr 08 15:43:30 2015 open_tun, tt->ipv6=0
Wed Apr 08 15:43:30 2015 TAP-WIN32 device [Local Area Connection] opened: \.\Global{584CA0C3-D71C-41ED-980C-596CE2FE1D17}.tap
Wed Apr 08 15:43:30 2015 TAP-Windows Driver Version 9.9
Wed Apr 08 15:43:30 2015 Notified TAP-Windows driver to set a DHCP IP/netmask of 192.168.89.95/255.255.255.0 on interface {584CA0C3-D71C-41ED-980C-596CE2FE1D17} [DHCP-serv: 192.168.89.0, lease-time: 31536000]
Wed Apr 08 15:43:30 2015 Successful ARP Flush on interface [36] {584CA0C3-D71C-41ED-980C-596CE2FE1D17}
Wed Apr 08 15:43:32 2015 TEST ROUTES: 1/1 succeeded len=1 ret=1 a=0 u/d=up
Wed Apr 08 15:43:32 2015 MANAGEMENT: >STATE:1428522212,ADD_ROUTES,,,
Wed Apr 08 15:43:32 2015 C:\Windows\system32\route.exe ADD 192.168.88.0 MASK 255.255.255.0 192.168.89.64
Wed Apr 08 15:43:32 2015 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Wed Apr 08 15:43:32 2015 Initialization Sequence Completed
Wed Apr 08 15:43:32 2015 MANAGEMENT: >STATE:1428522212,CONNECTED,SUCCESS,192.168.89.95,192.168.0.14

3

Did you tick the option: Require Client Certificate

on the openvpn server instance ?

4

Did you tick the option: Require Client Certificate

on the openvpn server instance ?

5

yes i did, under openvpn server tab