Automatic Version Update

[scrfix]

The Issue: Every time there is a new version of OpenVPN released, my clients OpenVPN client states oh look you are connected perfectly but then when they try to reach resources on the VPN they cannot. I have to manually log into their computer every time and download and install the newest version of the software. This is a pain.

The Request: I would LOVE to see an automatic update appear on this software.

Note: If it already does this somehow (Windows computers) then please let me know because it is a pain to log in to everyone's computers every single time there is an update to the openvpn client and reinstall the software.

Thanks,

Wayne

[Douglas]

The Issue: Every time there is a new version of OpenVPN released, my clients OpenVPN client states oh look you are connected perfectly but then when they try to reach resources on the VPN they cannot. I have to manually log into their computer every time and download and install the newest version of the software. This is a pain.

The Request: I would LOVE to see an automatic update appear on this software.

Note: If it already does this somehow (Windows computers) then please let me know because it is a pain to log in to everyone's computers every single time there is an update to the openvpn client and reinstall the software.

Thanks,

Wayne

I just want to make sure I am following you. You are saying each time a new client is released by the openvpn project, your client devices just stop working?

[scrfix]

That's correct.

The client states it is connected. It shows no problems however you cannot ping or get to network resources over the VPN.

I install the update and then everything works perfectly until the next update. This has happened over the last three updates ever since the installation.

Wayne

[Douglas]

That's correct.

The client states it is connected. It shows no problems however you cannot ping or get to network resources over the VPN.

I install the update and then everything works perfectly until the next update. This has happened over the last three updates ever since the installation.

Wayne

Hi Wayne

Is the server updated too for each update?

[scrfix]

At first I thought yes because I was updating the firmware on the QNAP NAS and I kept losing connection even though it reported everything was fine however this has happened three times on the last three updates and the last time around I didn't update the firmware on the QNAP and they still couldn't get to the machine over the VPN so now I would have to say no. The only correlation I can find is every time there is a new version of the openvpn software out there.

I finally wrote out step by step with picture instructions for one client to update it herself however it would be easier if there was just an auto update feature you could turn on or off in the settings.

Wayne

[cron2]

I can see and understand the wish to have an auto-updating client - it's not unsolvable, but someone needs to do it, and that someone needs to develop on windows...

But to clarify a misconception: every version of the OpenVPN client should interoperate with every version of the Server (like, 2.2 client works with git master server, or 2.3.6 client works with a 2.1 server). If an update stops the client from working for you, this is something local to your setup.

(What I do on my corporate server is to check from --client-connect that the client version is "recent enough", and if it is not, send a mail that an update is needed. But the connection still works fine)

gert

[scrfix]

I can see and understand the wish to have an auto-updating client - it's not unsolvable, but someone needs to do it, and that someone needs to develop on windows...

I completely understand. This is why it is on the wishlist.

But to clarify a misconception: every version of the OpenVPN client should interoperate with every version of the Server (like, 2.2 client works with git master server, or 2.3.6 client works with a 2.1 server). If an update stops the client from working for you, this is something local to your setup.

I am not sure what it could be.
I use a QNAP on one end that has an interface that is filled in.
I use the Windows 64 bit VPN client on the other end.
It works perfectly when I set it up initially however sometime later the VPN drops however says it is connected but you cannot reach any resources on the other end or ping the VPN. I can stop, start, spit, fart, throw a fit, troubleshoot until I am blue in the face, restart and it makes no difference until I install the latest version then everything magically works again. I don't change any settings, I don't reload anything. I just install the latest version of the software. Do we have log files that give us what is happening available to us?

(What I do on my corporate server is to check from --client-connect that the client version is "recent enough", and if it is not, send a mail that an update is needed. But the connection still works fine)

How exactly are you accomplishing this? Is this a setting I missed in the software? Are you using batch for this? Is this done through the configuration file? Can you provide an example?

I am going to try going to install the 32 bit version of the software and remove the 64 bit version. My thoughts here (not sure if this makes a difference) is that perhaps the QNAP has a 32 bit version of the software and it is causing problems with the 64 bit version staying connected. Since there doesn't appear to be a way I can find out what version the openvpn software the qnap is running nor is there anything that states whether it is 64 or 32 bit I am going to try it.

[scrfix]

Okay software version updates don't appear to be it. The VPN just went down again.
This does not negate my request on the wishlist for an auto-update feature.

Here is what is happening however.
Client has VPN Access (64 bit) Windows connecting into QNAP NAS (unsure of Version of bit installed as it is pre-installed and there is nothing that I can find in command line or otherwise to provide this information)
Client is connected to VPN when software is installed.
Client's Internet is a Verizon Mobile Device that they turn off when they are not using it.
VPN is running when they turn it off. (This might be the culprit)
VPN states it is connected when they turn it back on but disconnecting and reconnecting the VPN do not make a connection. Rebooting the computer does not make a connection.
Hopefully that information helps us resolve what is happening and what I can try to help prevent this from happening.

Here are the log files
Tue Jan 06 09:32:13 2015 ERROR: Windows route add command failed [adaptive]: returned error code 1
Tue Jan 06 09:32:13 2015 ROUTE: route addition failed using CreateIpForwardEntry: Access is denied. [status=5 if_index=23]
Tue Jan 06 09:32:13 2015 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Tue Jan 06 09:32:13 2015 ERROR: Windows route add command failed [adaptive]: returned error code 1
Tue Jan 06 09:32:13 2015 ROUTE: route addition failed using CreateIpForwardEntry: Access is denied. [status=5 if_index=23]
Tue Jan 06 09:32:13 2015 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Tue Jan 06 09:32:13 2015 ERROR: Windows route add command failed [adaptive]: returned error code 1
Tue Jan 06 09:32:13 2015 ROUTE: route addition failed using CreateIpForwardEntry: Access is denied. [status=5 if_index=23]
Tue Jan 06 09:32:13 2015 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Tue Jan 06 09:32:13 2015 ERROR: Windows route add command failed [adaptive]: returned error code 1
Tue Jan 06 09:32:13 2015 Initialization Sequence Completed

[scrfix]

Update: I installed the 32 bit version and same results. Everything is working however something will happen and the VPN will stop working. I am having the client test this by telling her to do the same thing she has been doing. We will see if the 32 bit version suffers from the same fate. If it does which I suspect it will then I will have her disconnect from the VPN first before disconnecting from her Internet. (which will not be an easy task as she is not an avid computer user and will forget sometimes to disconnect from the VPN before she disconnects her Internet connection).

Question: Is there command line access to the OpenVPN client? I have a batch file I wrote for her to transfer files to my server from her computer and that is what we utilize the VPN for. (She doesn't know how to use FTP and long story otherwise). If I could have it make a temporary connection to the VPN from the command line, transfer the files and the disconnect the connection (If this is indeed the problem) then that would remove her from having to disconnect it altogether.

[scrfix]

Issue: OpenVPN client on a Windows Vista or above PC states it is connected but you cannot reach the folders or directories on the VPN server.

Problem: The issue is that access is being denied to write to the routing table. OpenVPN requires that the process be ran as administrator in order to write to these tables. The problem here is that OpenVPN actually makes this connection anyway and tells you that it is connected. THIS IS A PROBLEM! What should happen is that OpenVPN should detect that the access was denied as given in the log files and report back to try to run the program as administrator to resolve the issue instead of telling you that the connection is made and everything is hunky dory. The result of this not happening is the issue above. The VPN connection is made but you cannot utilize it.

Local Access Resolution: Right click on the OpenVPN GUI shortcut and run the program as administrator.

Customer Access Resolution Option 1: If you require the program to be on at all times then stop the program from running on start up which is in msconfig under the startup Item openvpn-gui. Create a BAT file using the RUNAS command line remembering administrator username and password and place that on startup.

BATCH CODE

Code: Select all

@echo off
:: Set configuration variables here
:: If you use a configuration file set this variable to its name
set _config=openvpn.ovpn

:: Did you install the 32 bit (x86) or 64?
set _pf32=%programfiles(x86)%
set _pf64=%programfiles%
set _bin=OpenVPN\bin\openvpn-gui.exe

:: Set the administrator username
set _admin=administrator

:: end setting configuration variables

:: Note: Change the _pf32 or _pf64 depending on what you installed
:: Note: Change the %computername% to a domain IF you are on a domain.

RUNAS /user:%computername%\%_admin% /savecred "%_pf32%\%_bin% %_config%"

Run it once and put in the administrator password. Then put this in the startup folder. However you MAY get something about your system doesn't allow blank passwords. If that comes up then either set a password for the administrator or there is a second option however the client will then have to push the YES button every time they turn their computer on to run the program with administrative rights.

Customer Access Resolution Option 2:
Step 1: Open MSCONFIG and uncheck the startup item openvpn-gui
Step 2: Find the openvpn-gui.exe file located in Program Files Directory/OpenVPN/bin. (Possibly Program Files x86 if you installed a 32 bit version on a 64 bit computer) When you find it, right click on it and go to properties. Click on the compatibility tab and Check the box Run this program as administrator then click OK.
Step 3: Find a shortcut to the OPEN VPN program (even if you have to create one), right click on it and go to properties. In the target there should be the pathway. It will looks something like "C:\Program Files\OpenVPN\bin\openvpn-gui.exe". Add the following line after the quotes "--connect openvpn.ovpn" where your configuration file (presuming you are using one) is named openvpn.ovpn so it will now look like "C:\Program Files\OpenVPN\bin\openvpn-gui.exe" "--connect openvpn.ovpn".

Note: This above will automatically open a connection and then ask for a username and password unless you use the auth-user-pass login.conf option. You then must create the login.conf file in the config directory and put the username and password into the login.conf file if you want it to be automatic. Use that option at your own risk.

[Traffic]

Or .. you could just use the Openvpn Wndows Service ?

Configuring OpenVPN to run automatically on system startup

The adminstrator password is still required .. if the service is operated by a normal user after boot.

[scrfix]

Or .. you could just use the Openvpn Wndows Service ?

Configuring OpenVPN to run automatically on system startup

The adminstrator password is still required .. if the service is operated by a normal user after boot.

I saw the option for that as well in the docs however I was not sure how that worked or if it had to run as administrator or anything else. I had not played around with it and frankly was just quite ticked that OpenVPN would even tell you that it was connected and everything is wonderful when its not and it needs administrative rights to right to the routing tables. If that was the case and this is a known fact then then Run as administrator check box should be automatically checked when you install the software. I have been pulling my hair out for months as to why this wasn't working properly (Was it my server? Is it the configuration file? Is the client disconnecting from the Internet and terminating the connection prematurely? Is it a problem with the clients computer? Is there some software that is preventing this from happening? Am I just a dumbass and didn't install this properly since this was my first installation and configuration? My server says connected, the vpn says connected but resources on the server are being denied. Uninstall, reinstall everything works. A week later, client says nope not working.... ahhhhhhhhhhhhhhhh... repeat process with hours of troubleshooting in between every couple of weeks for months and months and months.)

Sorry, just ranting now. Thanks for the tip on the installing as a service.

I probably should have gone further into that people that get the blank password error can allow blank passwords if they have a Windows Professional version. They can go into secpol.msc from the run dialogue box and allow blank passwords as well so that the runas will work (If their administrator account doesn't already have a password): http://www.pctips3000.com/how-to-enable ... e-network/

If it still doesn't work they can also activate the administrator account by opening up an administrative command prompt and typing net user administrator /active:yes if it is still not working
http://www.howtogeek.com/howto/windows- ... ows-vista/
They can then login to the administrator account and set a password and then use that when they run the bat file.

However then it will probably show up in their login screen for the client so they probably want to hide it after they activate it.

Hide User Accounts in windows Vista and Windows 7
In the Run Dialogue Box (Windows Key+R) type regedit
Once in regedit go to HKEY_LOCAL_MACHINE\Software\Microsoft\WindowsNT\CurrentVersion\Winlogon
In the left panel, right click on Winlogon and click New and click Key.
Type SpecialAccounts and press Enter
In the left panel, right click on SpecialAccounts and click New and click Key.
Type UserList and press Enter.
In right panel of UserList, right click on a empty area and click New then click DWORD (32bit) Value.
Type in the name of the user account that you want to hide and press Enter.eg: Everyday Account.
In the right panel, right click on the user account name and click Modify.

To hide the user account – Type 0 and click OK. (number zero not the letter)
Whenever you want to use the account just unhide the it by typing 1 instead of zero.

===============================================

If you don't have a professional version of Windows then you won't have secpol.msc so you can either use option 2 OR
read the instructions above about activating the administrator's account and then setting the password and then hiding the administrator's account from the login screen.

Wayne

[Traffic]

was just quite ticked that OpenVPN would even tell you that it was connected and everything is wonderful when its not

OpenVPN was connected ..

and it needs administrative rights to right to the routing tables

Your client log made it clear .. Access is Denied.

The right to "write" to the routing table is governed by your operating system not OpenVPN ..
and .. you can over-ride it if you choose.

As for this:

Automatic Version Update

hopefully, never gonna happen .. plus that would not have solved your issue anywayz ..

[scrfix]

Why wouldn't the option for automatic update be a good thing?

My whole point is IF there was a problem (Any Problem) then OpenVPN SHOULDN'T have connected. It should have told me there was an error and prevented the connection. What good is a VPN if you cannot access the resources on the other side? It's not any good, it's crap! This entire fiasco could have been prevented if the installation was changed to automatically select the "Run as Administrator" when you open up the program to begin with.

Beginner VPN users like myself are not going to automatically know that you cannot write to routing tables without administrative rights. Hell, some of the beginners don't even know what routing tables are. We are not born with this knowledge nor could I find this stated anywhere that you must run OpenVPN as administrator. The access denied logs did not say HEY, THE ROUTING TABLES HAVE ACCESS DENIED TO THEM. PLEASE RUN OPENVPN AS ADMINISTRATOR. They were cryptic at best on the customer's machine and pulled no decent results in Google.
route addition failed using CreateIpForwardEntry: Access is denied. [status=5 if_index=23]
Tue Jan 06 09:32:13 2015 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Windows route add command failed [adaptive]: returned error code 1

Even if they weren't cryptic, how many times do you look at the log files on so many things only to find out that the issue was something else that was causing the problem. In fact, in this case the result was route addition failed because access denied. It does not tell you WHY it was denied. Was it because McAfee or Norton was blocking access. Was it because UAC was turned up to Max? Was it because the sky was purple and the stars were not aligned with the venus that night?
Returned error Code 1 is useless to the end user. How about access is denied try running with administrative rights or something a little better and easier to understand?

I wasn't even aware that OpenVPN added a route EVERY time you connect nor should I have to be. This issue can be taken care of from a programming perspective and should not have to troubleshot by the end user trying to interpret what might be wrong out of the 1000 things that could possibly be wrong. The programmers better understand what is going on then the beginner end user ever will or should have to. When I program, I make damn sure that little things like that are taken care of so that the end user doesn't have to fight to use my software properly. I don't put it on the end user to have my knowledge to be able to fix issues when they arise.

In fact, it was only when I set it up trying to repeat what the customer was doing on a machine at my location that I finally was able to repeat it and my log files were different than at that location but holy B... I copied and pasted the error I received into Google and found a lonely forum post somewhere where someone else mentions in a sentence buried oh hey you have to have administrative rights to write to the routing tables. I thought.... hmmmmmm let me try that and it worked... oh lord have mercy... yeah! It would have been nice if the "Run as Administrator" checkbox which is 1 line of code to make it checked (depending on the language used) was already checked during the installation and sometimes is an option that can be completed from the packaging software that is being used depending on what is being used to package up the software for installation.

I was pulling at straws because I had no hair left when I originally posted. The only thing that correlated at the time was every time there was a new version out the customer lost connection. It was simply coincidence that they contacted me after a release of a new version. I would install the new version and bam everything worked until the next release. As it turns out, they weren't using it that often or weren't shutting their computer down. As soon as they rebooted the computer BAM didn't work anymore because the Run As Administrator wasn't checked. I realize that wouldn't have solved the issue but I don't understand why that would be a bad idea to have that as an option. I would still like to have the option of at minimal update software from the actual software and not have to go to google, search for the page, download the software, etc etc etc etc.

Should I change the wishlist request to "automatically check Run as Administrator" so the program actually works as intended?

[Traffic]

You should take this experience as a lesson:

• When using software you are not familiar with take the time to read the documentation !

Installing OpenVPN

Windows Notes

• OpenVPN for Windows can be installed from the self-installing exe file on the OpenVPN download page. Remember that OpenVPN will only run on Windows XP or later. Also note that OpenVPN must be installed and run by a user who has administrative privileges (this restriction is imposed by Windows, not OpenVPN). The restriction can be sidestepped by running OpenVPN in the background as a service, in which case even non-admin users will be able to access the VPN, once it is installed.

Why wouldn't the option for automatic update be a good thing?

I expect the sort of thing you are looking for is something like the way Java updates itself ?

Administering my network, I want to make the decision when, and indeed if, I install updates.

And the fact still remains, you learned a great deal (not just about OpenVPN) from this experience.
Things you would still be blissfully unaware of had this not happened .. they say "ignorance is bliss" ..

For me personally, I disagree with practically every point you raise. In fact the only reason I offered you this advice:

you could just use the Openvpn Wndows Service ?

is because you found the real cause for your complaint and it seemed more suitable as a solution than the convoluted method you schemed up.

Finally, bear in mind:

• OpenVPN is free open source software .. it is not a market ready finished product.
• Nobody gets paid to write or support it .. and so, as a user, you must be prepared to support yourself.

.. Or pay for a product which more closely suits your requirements.

My apologies .. but I have nothing left to say .. rant on if you must.

[scrfix]

You made great points and I agree. I was just ticked and ranting like I stated before. I have to look into treating this as a service because for some reason putting the shortcut into the startup folder where it should oh I don't know, startup when the computer boots doesn't seem to work. The customer never gets the pop-up and openvpn doesn't open.

My server works with OpenVPN or PPTP so I am kind of stuck with it. I don't really have another solution except for PPTP for this particular scenario and I need this to be as automated as possible so OpenVPN it is.

As far as the update I would like to see an option for it. Even a link in the software where I can go and check for updates. It doesn't have to be automatic. Just enough so that it saves us from having to go to the website, check to see if there is a new version. Like Malwarebytes. Malwarebytes comes up and says Hey! There is a new version, click here to install.

[scrfix]

The setting it as a service appears to work pretty flawlessly. The client doesn't even have to verify UAC prompts. Thanks for mentioning it.

[scrfix]

However, ranting and raging aside my point still stands too. Whether it is free or not is not an excuse for inadequate programming. If you are going to put it out there make sure it works. The fact that they know that it needs administrative rights just proves the point even more.

1. When you install, the program automatically puts itself into the startupreg for msconfig. It does this without marking the executable to run the program with administrative rights. Right there is the issue. It simply needs to mark itself to run with administrative rights. The end users of the program should not have to stop to figure this out. They should be able to presume that the settings upon installation are setup properly to run and stay running after reboot.

2. I love the fact that it creates itself as a service. This was awesome. I didn't have to run an commands but then the service isn't started by default.

So what we have here is an inadequate installation process. It puts a registry entry for pointing to an executable that they KNOW needs administrative rights to run but then doesn't select the proper administrative box for it to run properly therefore causing confusion, unnecessary delay, massive amounts of research and troubleshooting. That registry entry should never be there if they aren't going to select the run as administrator checkbox when setting up the installation.

There are a number of ways around this even if it was as simple as in the READ ME that says "Hey, you need to right click on the executable and check the box run the program as administrator" not just in the documentation online that may or may not be found by the end user. Then open the read me by default after the installation.

This can be setup as a scheduled task that is set to run with the highest privileges upon boot (Although this is more difficult if the client is on a home edition OS that doesn't have command line access to the task schedule command).

No matter how we look at this scenario, this could have been prevented if the software was programmed properly. The installation process is flawed which is what caused this to begin with. This should work properly out of the box and it doesn't. I program plenty of programs that are free for my clients and they work without failure so just because it is free doesn't give it the right to be setup inadequately for users in my opinion.

[scrfix]

For anyone else reading this that is running into the same issue.

This has been a long hard road figuring this out however ignore what was stated above. I cannot go back and EDIT unfortunately.

1. Go into MSCONFIG (Windows Key+R and type msconfig, press Enter) and uncheck the openvpn-gui startup item.
2. Go into your services (Windows Key+R and type services.msc, press Enter) and find OpenVPN.
a) Double click on it. Start the service and set it for Automatic.
3. Create a VPN configuration file. (My server automatically produced one so I cannot tell you exactly how to set this up so other than telling you it is a .ovpn extension).
a) Place the configuration file into the config directory for OpenVPN (Located for 64 bit software in "C:\Program Files\OpenVPN\config" OR for 32 bit software "C:\Program Files(x86)\OpenVPN\config")
4. Place the ca.crt file in the same directory. (I also received this from my server so I cannot assist with how to create one)

If you want the program to be fully automated then you will need to add the following to the end of your configuration in the .ovpn file: auth-user-pass login.conf and then create a login.conf with the username on the first line and the password on the second line and save it in the same config directory.

This will automatically start, connect and run your open vpn connection to your server.