WinXP client not getting IP address from WinXp server.

Gordon1M

I have used openvpn successfully for several years with a Windows XP SP3 server and Windows XP SP3 client on my laptop. In the last few months, I have also successfully used an Android client on my tablet.

I haven't used openvpn on the laptop for some weeks and now I am finding that it won't connect properly. The Android client still works satisfactorily.

The XP server (192.168.17.101) is running OpenVPN 2.0.9 Win32-MinGW.
The XP client (192.168.17.219) is running OpenVPN 2.2.2 Win32-MSVC++
(the client was running 2.0.9 when I first noticed the problem).
If 2.0.9 and 2.2.2 are incompatible that may be the problem.

When I manually connect the client, through the Win GUI, the icon goes green after a second or so and a pop-up balloon tells me that an IP address has been assigned to the connection (192.168.17.240, with the server configuration below). However, if I run ipconfig /all (see below), the TAP-Win32 adapter IP address is shown as a link-local address of 169.254.165.165. This testing is currently all within my LAN.

When the client connects, the log shows many attempts of "Waiting for TUN/TAP interface to come up ... ", but the result is always "down". I am showing the client log file below. A couple of things I am noticing in the client log is that the TAP-Win32 adapter doesn't have a Gateway address and its DHCP server address is 255.255.255.255. This seems odd to me.

I am also don't understand the line (in the client log):

Wed Apr 11 21:15:42 2012 Notified TAP-Win32 driver to set a DHCP IP/netmask of 192.168.17.240/255.255.255.0 on interface {8B60DD33-811A-4E44-B7AC-4272DD2BC0A6} [DHCP-serv: 192.168.17.0, lease-time: 31536000]

Why 192.168.17.0 ?

I have found references to similar problems, but none of the suggested solutions have helped me.
Turning off Windows firewall on both client and server doesn't help. Fixing Winsock doesn't help.

Any help would be much appreciated.

Gordon

The server config file is:

port 443
proto tcp
dev tap
ca C:\\OpenVPN\\easy-rsa\\keys\\ca.crt
cert C:\\OpenVPN\\easy-rsa\\keys\\server.crt
key C:\\OpenVPN\\easy-rsa\\keys\\server.key
dh C:\\OpenVPN\\easy-rsa\\keys\\dh1024.pem
ifconfig-pool-persist ipp.txt
server-bridge 192.168.17.101 255.255.255.0 192.168.17.240 192.168.17.250
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3

The client config file is:

client
dev tap
proto tcp
remote myserver.com 443
resolv-retry infinite
nobind
persist-key
persist-tun
ca "E:\\Program files\\OpenVPN\\easy-rsa\\keys\\ca.crt"
cert "E:\\Program Files\\OpenVPN\\easy-rsa\\keys\\client1.crt"
key "E:\\Program files\\OpenVPN\\easy-rsa\\keys\\client1.key"
comp-lzo
verb 3

ipconfig /all results:

Windows IP Configuration

Host Name . . . . . . . . . . . . : eeepc701
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Unknown
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Local Area Connection 6:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : TAP-Win32 Adapter V9
Physical Address. . . . . . . . . : 00-FF-8B-60-DD-33
Dhcp Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Autoconfiguration IP Address. . . : 169.254.165.165
Subnet Mask . . . . . . . . . . . : 255.255.0.0
Default Gateway . . . . . . . . . :
DNS Servers . . . . . . . . . . . : 192.168.17.1

Ethernet adapter Wireless Network Connection:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Atheros AR5007EG Wireless Network Adapter
Physical Address. . . . . . . . . : 00-15-AF-6B-20-D6
Dhcp Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IP Address. . . . . . . . . . . . : 192.168.17.219
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.17.1
DHCP Server . . . . . . . . . . . : 192.168.17.1
DNS Servers . . . . . . . . . . . : 192.168.17.1
Lease Obtained. . . . . . . . . . : April 11, 2012 8:21:20 PM
Lease Expires . . . . . . . . . . : April 12, 2012 8:21:20 PM

Ethernet adapter Local Area Connection 2:

Media State . . . . . . . . . . . : Media disconnected
Description . . . . . . . . . . . : Atheros L2 Fast Ethernet 10/100 Base-T Controller
Physical Address. . . . . . . . . : 00-1E-8C-72-AE-E9

Client log file:
Wed Apr 11 21:15:37 2012 OpenVPN 2.2.2 Win32-MSVC++ [SSL] [LZO2] [PKCS11] built on Dec 15 2011
Wed Apr 11 21:15:37 2012 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Wed Apr 11 21:15:37 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Wed Apr 11 21:15:38 2012 LZO compression initialized
Wed Apr 11 21:15:38 2012 Control Channel MTU parms [ L:1576 D:140 EF:40 EB:0 ET:0 EL:0 ]
Wed Apr 11 21:15:38 2012 Socket Buffers: R=[8192->8192] S=[8192->8192]
Wed Apr 11 21:15:38 2012 Data Channel MTU parms [ L:1576 D:1450 EF:44 EB:135 ET:32 EL:0 AF:3/1 ]
Wed Apr 11 21:15:38 2012 Local Options hash (VER=V4): '31fdf004'
Wed Apr 11 21:15:38 2012 Expected Remote Options hash (VER=V4): '3e6d1056'
Wed Apr 11 21:15:38 2012 Attempting to establish TCP connection with [External IP address]:443
Wed Apr 11 21:15:38 2012 TCP connection established with [External IP address]:443
Wed Apr 11 21:15:38 2012 TCPv4_CLIENT link local: [undef]
Wed Apr 11 21:15:38 2012 TCPv4_CLIENT link remote: [External IP address]:443
Wed Apr 11 21:15:38 2012 TLS: Initial packet from [External IP address]:443, sid=6fdbb1ec 550acdc6
Wed Apr 11 21:15:38 2012 VERIFY OK: depth=1, /C=CA/ST=ON/L=Kanata/O=Basement/OU=Delta/CN=Delta/emailAddress=personal info deleted
Wed Apr 11 21:15:38 2012 VERIFY OK: depth=0, /C=CA/ST=ON/O=Basement/OU=Delta/CN=server/emailAddress= personal info deleted
Wed Apr 11 21:15:39 2012 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Apr 11 21:15:39 2012 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Apr 11 21:15:39 2012 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Apr 11 21:15:39 2012 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Apr 11 21:15:39 2012 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Wed Apr 11 21:15:39 2012 [server] Peer Connection Initiated with [External IP address]:443
Wed Apr 11 21:15:42 2012 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Wed Apr 11 21:15:42 2012 PUSH: Received control message: 'PUSH_REPLY,dhcp-option DNS 192.168.17.1,dhcp-option WINS 192.168.17.1,route-gateway 192.168.17.101,ping 10,ping-restart 120,ifconfig 192.168.17.240 255.255.255.0'
Wed Apr 11 21:15:42 2012 OPTIONS IMPORT: timers and/or timeouts modified
Wed Apr 11 21:15:42 2012 OPTIONS IMPORT: --ifconfig/up options modified
Wed Apr 11 21:15:42 2012 OPTIONS IMPORT: route-related options modified
Wed Apr 11 21:15:42 2012 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Wed Apr 11 21:15:42 2012 WARNING: potential TUN/TAP adapter subnet conflict between local LAN [192.168.17.0/255.255.255.0] and remote VPN [192.168.17.0/255.255.255.0]
Wed Apr 11 21:15:42 2012 TAP-WIN32 device [Local Area Connection 6] opened: \\.\Global\{8B60DD33-811A-4E44-B7AC-4272DD2BC0A6}.tap
Wed Apr 11 21:15:42 2012 TAP-Win32 Driver Version 9.9
Wed Apr 11 21:15:42 2012 TAP-Win32 MTU=1500
Wed Apr 11 21:15:42 2012 Notified TAP-Win32 driver to set a DHCP IP/netmask of 192.168.17.240/255.255.255.0 on interface {8B60DD33-811A-4E44-B7AC-4272DD2BC0A6} [DHCP-serv: 192.168.17.0, lease-time: 31536000]
Wed Apr 11 21:15:42 2012 Successful ARP Flush on interface [2] {8B60DD33-811A-4E44-B7AC-4272DD2BC0A6}
Wed Apr 11 21:15:48 2012 TEST ROUTES: 0/0 succeeded len=-1 ret=0 a=0 u/d=down
Wed Apr 11 21:15:48 2012 Route: Waiting for TUN/TAP interface to come up...
Wed Apr 11 21:15:52 2012 TEST ROUTES: 0/0 succeeded len=-1 ret=0 a=0 u/d=down

Many more identical entries deleted for brevity.

Wed Apr 11 21:16:14 2012 TEST ROUTES: 0/0 succeeded len=-1 ret=0 a=0 u/d=down
Wed Apr 11 21:16:14 2012 Route: Waiting for TUN/TAP interface to come up...
Wed Apr 11 21:16:15 2012 TEST ROUTES: 0/0 succeeded len=-1 ret=0 a=0 u/d=down
Wed Apr 11 21:16:15 2012 Route: Waiting for TUN/TAP interface to come up...
Wed Apr 11 21:16:16 2012 TEST ROUTES: 0/0 succeeded len=-1 ret=0 a=0 u/d=down
Wed Apr 11 21:16:16 2012 Route: Waiting for TUN/TAP interface to come up...
Wed Apr 11 21:16:17 2012 TEST ROUTES: 0/0 succeeded len=-1 ret=0 a=0 u/d=down
SYSTEM ROUTING TABLE
0.0.0.0 0.0.0.0 192.168.17.1 p=0 i=65540 t=4 pr=3 a=3294 h=0 m=25/-1/-1/-1/-1
127.0.0.0 255.0.0.0 127.0.0.1 p=0 i=1 t=3 pr=2 a=3319 h=0 m=1/-1/-1/-1/-1
192.168.17.0 255.255.255.0 192.168.17.219 p=0 i=65540 t=3 pr=2 a=3296 h=0 m=25/-1/-1/-1/-1
192.168.17.219 255.255.255.255 127.0.0.1 p=0 i=1 t=3 pr=2 a=3296 h=0 m=25/-1/-1/-1/-1
192.168.17.255 255.255.255.255 192.168.17.219 p=0 i=65540 t=3 pr=2 a=3296 h=0 m=25/-1/-1/-1/-1
224.0.0.0 240.0.0.0 192.168.17.219 p=0 i=65540 t=3 pr=2 a=3296 h=0 m=25/-1/-1/-1/-1
255.255.255.255 255.255.255.255 192.168.17.219 p=0 i=65540 t=3 pr=2 a=3319 h=0 m=1/-1/-1/-1/-1
255.255.255.255 255.255.255.255 192.168.17.219 p=0 i=65541 t=3 pr=2 a=3319 h=0 m=1/-1/-1/-1/-1
255.255.255.255 255.255.255.255 192.168.17.219 p=0 i=2 t=3 pr=2 a=3319 h=0 m=1/-1/-1/-1/-1
SYSTEM ADAPTER LIST
TAP-Win32 Adapter V9
Index = 2
GUID = {8B60DD33-811A-4E44-B7AC-4272DD2BC0A6}
IP = 0.0.0.0/0.0.0.0
MAC = 00:ff:8b:60:dd:33
GATEWAY =
DHCP SERV = 255.255.255.255
DHCP LEASE OBTAINED = Wed Apr 11 21:01:03 2012
DHCP LEASE EXPIRES = Thu May 28 08:38:44 1970
DNS SERV = 192.168.17.1
Atheros AR5007EG Wireless Network Adapter
Index = 65540
GUID = {0B4786C6-4FFD-4E60-85F8-74A7FD071EA0}
IP = 192.168.17.219/255.255.255.0
MAC = 00:15:af:6b:20:d6
GATEWAY = 192.168.17.1/0.0.0.0
DHCP SERV = 192.168.17.1
DHCP LEASE OBTAINED = Wed Apr 11 20:21:20 2012
DHCP LEASE EXPIRES = Wed Dec 31 19:00:00 1969
DNS SERV = 192.168.17.1
Atheros L2 Fast Ethernet 10/100 Base-T Controller
Index = 65541
GUID = {B45527F8-87D9-49E0-98D3-99C89AF3B4A1}
IP = 0.0.0.0/0.0.0.0
MAC = 00:1e:8c:72:ae:e9
GATEWAY =
DHCP SERV = 192.168.0.1
DHCP LEASE OBTAINED = Sat Mar 17 11:37:03 2012
DHCP LEASE EXPIRES = Wed Dec 31 19:00:00 1969
DNS SERV =
Wed Apr 11 21:16:17 2012 Initialization Sequence Completed With Errors ( see http://openvpn.net/faq.html#dhcpclientserv )

janjust

you've got a networking conflict on your XP client vs the OpenVPN server range:

Wed Apr 11 21:15:42 2012 WARNING: potential TUN/TAP adapter subnet conflict between local LAN [192.168.17.0/255.255.255.0] and remote VPN [192.168.17.0/255.255.255.0]

Thank you for the rapid reply ... sorry to take up so much of your time.

So it seems that it won't harm leaving the push statements in and they could be useful.

ipconfig /all shows, as expected, that my DNS server is on the main router 192.168.17.1. I use a second router, acting as a bridge on the same network, and the DHCP server is disabled on this. The second router is what wireless clients connect to. Wireless is off on the primary router. As noted before, I get the same 255.255.255.128 subnet mask regardless of whether I use wirelsss or Ethernet.

I have a separate, but related question. I note that there are a couple of web-sites that are offering your book as a free download (I am not sure whether this is really "free", as I haven't investigated too much. I don't know whether this is authorized by the publisher/you or not. I have been debating whether to buy your book and I have no intention of depriving you of any income that you may derive from it. This issue may not be appropriate to discuss on this forum. If not, I may e-mail you at the address shown on the book page.

Thank you
Gordon

Gordon1M

Found it!

I powered down the routers and turned them back on again and the subnet mask now shows as 255.255.255.0 (for both wireless and Ethernet). The router where the DHCP server resides is running DD-WRT. Maybe it hangs on to netmasks for some reason.

Gordon