Need help configuring OpenVPN server

you need to use NAT/PAT with suitable ACLS to only allow OpenVPN traffic to reach the OpenVPN server

I would always use OpenVPN in routed rather than bridged mode

I have the pinholes created and can reach the vpn server from the outside. Here is the error I receive when I try to connect.

Sat Oct 08 21:24:03 2011 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Sat Oct 08 21:24:03 2011 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Sat Oct 08 21:24:03 2011 LZO compression initialized
Sat Oct 08 21:24:03 2011 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Sat Oct 08 21:24:03 2011 Socket Buffers: R=[8192->8192] S=[8192->8192]
Sat Oct 08 21:24:03 2011 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Sat Oct 08 21:24:03 2011 Local Options hash (VER=V4): '41690919'
Sat Oct 08 21:24:03 2011 Expected Remote Options hash (VER=V4): '530fdded'
Sat Oct 08 21:24:03 2011 UDPv4 link local: [undef]
Sat Oct 08 21:24:03 2011 UDPv4 link remote: xxx.xxx.xxx.xxx:1194
Sat Oct 08 21:24:03 2011 TLS: Initial packet from xxx.xxx.xxx.xxx:1194, sid=8cf3a863 6a99b963
Sat Oct 08 21:24:03 2011 VERIFY ERROR: depth=0, error=unable to get local issuer certificate: /C=US/ST=CA/L=Fresno/O=FPU/CN=server/emailAddress=john@mydomain.local
Sat Oct 08 21:24:03 2011 TLS_ERROR: BIO read tls_read_plaintext error: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed
Sat Oct 08 21:24:03 2011 TLS Error: TLS object -> incoming plaintext read error
Sat Oct 08 21:24:03 2011 TLS Error: TLS handshake failed
Sat Oct 08 21:24:03 2011 TCP/UDP: Closing socket
Sat Oct 08 21:24:03 2011 SIGUSR1[soft,tls-error] received, process restarting
Sat Oct 08 21:24:03 2011 Restart pause, 2 second(s)
Sat Oct 08 21:24:05 2011 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Sat Oct 08 21:24:05 2011 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Sat Oct 08 21:24:05 2011 LZO compression initialized
Sat Oct 08 21:24:05 2011 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Sat Oct 08 21:24:05 2011 Socket Buffers: R=[8192->8192] S=[8192->8192]
Sat Oct 08 21:24:05 2011 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Sat Oct 08 21:24:05 2011 Local Options hash (VER=V4): '41690919'
Sat Oct 08 21:24:05 2011 Expected Remote Options hash (VER=V4): '530fdded'
Sat Oct 08 21:24:05 2011 UDPv4 link local: [undef]
Sat Oct 08 21:24:05 2011 UDPv4 link remote: xxx.xxx.xxx.xxx:1194
Sat Oct 08 21:24:05 2011 TCP/UDP: Closing socket
Sat Oct 08 21:24:05 2011 SIGTERM[hard,] received, process exiting

I am trying to configure OpenVPN to allows users to authenticate with their AD credentials.

Does the time match on both machines? Including timezones?

Yes

The message you receive pretty much looks like your server CA certificate is not properly generated, or does not fit to the certifcate used for the client.

I switched gears and am attempting to use a radius plugin to authenticate our vpn users. The request is reaching the windows radius server. I am receiving an "access denied" error. It is telling me that there are no matching policies. The only policy I have created is one that says all users who are a member of the domain users group are granted access. The user I am authenticating with is a member of that group. There are no other policies. Here is what I am seeing in the event log.

User josh.cole was denied access.
 Fully-Qualified-User-Name = <undetermined>
 NAS-IP-Address = 172.16.0.71
 NAS-Identifier = OpenVpn
 Called-Station-Identifier = <not present>
 Calling-Station-Identifier = xxx.xxx.xxx.xxx
 Client-Friendly-Name = 172.16.0.71
 Client-IP-Address = 172.16.0.71
 NAS-Port-Type = Virtual
 NAS-Port = 1
 Proxy-Policy-Name = <none>
 Authentication-Provider = <undetermined>
 Authentication-Server = <undetermined>
 Policy-Name = <undetermined>
 Authentication-Type = <undetermined>
 EAP-Type = <undetermined>
 Reason-Code = 49
 Reason = The connection attempt did not match any connection request policy.

I was able to get it working.

I didn't receive any feedback that helped me resolve the problem. I eventually found the solution for myself and made sure to post it here.