TAP-Windows Adapter Version 9 not in firewall configuration?

truwebpro

EDIT: I just realized I should have posted this under 'server administration', but too late now, and don't want to repeat-post. Can a moderator move this for me? End EDIT

Thanks in advance to anyone reading this. I know how much all forums love newcomers with questions. I almost NEVER post ?s in forums, but I have become desperate...

I cannot connect my Windows 7x64 client to my OpenVPN server unless I turn off the client firewall. So I already know that the problem is that the TAP-Windows Adapter Version 9 needs to be whitelisted in the firewall. The problem is...it is not there. Doesn't show up at all in the firewall's configuration settings, and can't be added as a custom rule (because it is not an .exe file). Whitelisting both the openvpn.exe and openvpn-gui.exe binaries didn't help. I must find a way to clear the TAP/TUN adapter, but can't find any way to force the Win 7 firewall to make it available in the advanced firewall configurations settings, even though the latest Open VPN x64 GUI is properly installed and the TAP-Windows Adapter Version 9 DOES show up as a Local Area Network Connection! It's maddening.

I can't believe I am the only person who has experienced this, but days of research only leads me to Q/A's informing me I need to allow the TAP/TUN adapter through the firewall. Yes, I know...but HOW?

All replies greatly appreciated.

truwebpro

Thank you for the reply, and especially for moving my post.

As to the config files, I understand the reason for the rules, but didn't want to waste anyone's time looking at the config files because my configuration works - if I turn off Windows firewall. My goal is simply to connect my client Win 7 machine to my dedicated OpenVPN server without having to turn the client's firewall off. So all I need to know is if someone can tell me how to turn off the firewall on TAP-Windows Adapter Version 9 in Windows 7 x64, because it doesn't appear in the advanced firewall settings and you can't create a custom rule for an adapter, only programs.

Has anyone else had this problem?

truwebpro

debbie10t wroteThis is for Openvpn support not windows firewall.

Debbie, why so harsh? This problem is specific to my installation of OpenVPN. It seems totally appropriate to ask other OpenVPN users if they have experienced the same problem and can contribute to its resolution, as I dearly need the help. Isn't this the idea behind a users' forum?

Let me try again, and format my request as close to your rules as possible...

I have installed OpenVPN on a dedicated CENTOS 5.10 i686 server with the following configuration:

###
;local a.b.c.d
proto udp
dev tun
ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/easy-rsa/2.0/keys/server.key
dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3
###

I am attempting to connect to it from a client PC running Windows 7 x64 using the OpenVPN GUI client 2.3.2-I003-x86_64, running 'as administrator' with the following config:

###
client
dev tun
proto udp
remote 142.#.#.# 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client1.crt
key client1.key
remote-cert-tls server
comp-lzo
verb 3
###

PROBLEM: TLS negotiation error if client's Windows 7 firewall in ON. Client connection log follows:

###
Mon Nov 04 10:39:33 2013 OpenVPN 2.3.2 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [eurephia] [IPv6] built on Aug 22 2013
Mon Nov 04 10:39:33 2013 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Mon Nov 04 10:39:33 2013 Need hold release from management interface, waiting...
Mon Nov 04 10:39:33 2013 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Mon Nov 04 10:39:33 2013 MANAGEMENT: CMD 'state on'
Mon Nov 04 10:39:33 2013 MANAGEMENT: CMD 'log all on'
Mon Nov 04 10:39:33 2013 MANAGEMENT: CMD 'hold off'
Mon Nov 04 10:39:33 2013 MANAGEMENT: CMD 'hold release'
Mon Nov 04 10:39:34 2013 Socket Buffers: R=[8192->8192] S=[8192->8192]
Mon Nov 04 10:39:34 2013 UDPv4 link local: [undef]
Mon Nov 04 10:39:34 2013 UDPv4 link remote: [AF_INET]142.#.#.#:1194
Mon Nov 04 10:39:34 2013 MANAGEMENT: >STATE:1383561574,WAIT,,,
Mon Nov 04 10:40:34 2013 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Mon Nov 04 10:40:34 2013 TLS Error: TLS handshake failed
Mon Nov 04 10:40:34 2013 SIGUSR1[soft,tls-error] received, process restarting
Mon Nov 04 10:40:34 2013 MANAGEMENT: >STATE:1383561634,RECONNECTING,tls-error,,
Mon Nov 04 10:40:34 2013 Restart pause, 2 second(s)
###

GOAL: Client connects correctly (no TLS error) if Windows 7 firewall is turned OFF. Would like to be able to connect without the necessity of completely deactivating firewall.

Many, many hours of research and effort have been made in attempting to resolve this issue. All replies and suggestions greatly appreciated.

truwebpro

I found the solution. Although no one made any good faith effort to try and help me here, I post it in the hope that some other poor Windows 7 user may be saved the hours of misery I endured trying to weed their way through Microsoft's convoluted mess of a firewall control panel.

The following article is very helpful in setting up Windows 7 firewall to work with OpenVPN:

http://social.technet.microsoft.com/Forums/windows/en-US/b9cd4de4-274e-45b4-95e3-94ac13127b37/openvpn-tap-and-windows-firewall?forum=w7itpronetworking

Or, Debbie, you may delete this entire thread with my blessing, if you prefer, since it was so entirely inappropriate.

truwebpro

Just a few additional thoughts...

debbie10t wroteI did as you asked and politely asked you to follow the rules.

For which I politely thanked you in return.

debbie10t wroteFine, I shall not waste my time, besides my crystal ball is on the blink.

No one thought you had one. I was trying to be considerate of others' time because I had already spent many hours (never needing to be 'spoonfed') and had narrowed the problem down to the firewall. I already addressed my reasoning for raising the firewall compatibility issue in this forum, and still believe it is valid.

debbie10t wroteI have now tried your config using Client Windows 7 64bit with Windows Firewall and I have no problem.

Perhaps you created your keys incorrectly.

That's interesting. Sincere thanks for giving it a try. But as I initially said, I am also able to connect if I turn off the firewall, so that eliminates the keys as a potential issue, does it not? I certainly wish I knew the difference between your firewall settings and my own...or perhaps it's something else in the way the firewall is interacting with my overall network configuration.

debbie10t wroteYou must allow openvpn.exe access not the TAP adapter.

Well I didn't come up with that on my own. The first searches I did for help brought me to this page right here in the OpenVPN FAQ:
http://openvpn.net/index.php/open-source/faq/79-client/255-qconnection-initiated-with-xxxxq-but-i-cannot-ping-the-server-through-the-vpn.html

As you can see, it specifically says, 'On Windows XP, the firewall can be accessed by Control Panel -> Security Center -> Windows Firewall -> Advanced. In the Network Connection Settings control, uncheck the box corresponding to the TAP-Win32 adapter.'

I am using Windows 7, of course, but this was the most relevant advice I could find on the issue. Perhaps it is so outdated everything has changed...for example, the new version 9 adapter may not ever show up in Windows firewall settings. That's the type of information I was hoping to learn here.

debbie10t wrote...this may serve you as a timely reminder of what you can achieve if you work with us not against us.

Again, this comment is a bit over the top for the situation. For goodness sake, this is just a Q/A forum, not a courtroom. What possible interest could I have had in working against anyone? I needed help and was asking for it in what I believed to be the most considerate manner possible. You're entitled to your opinion if you see it another way. But again, in any case, sincere thanks for your attention.