Serious problem with OpenVPN 2.3.3-I002-x86_64 install

cbr954rr

I recently upgraded from a slightly older version of OpenVPN to the newest 2.3.3-I002 x86 64 bit for my Windows 7 Pro machine. The install went smoothly and all was working as it should.

After doing some reading on the Heartbleed issue and learning how using a TLS-Auth key would help to add extra security to my setup, I attempted to generate a TLS-Auth key and this is where my problems started.

Here is what I have attempted with no apparent success.

First I opened a command prompt with Admin Rights within C:\Program Files\OpenVPN\easy-rsa and then tried to generate the key using openvpn --genkey --secret ta.key

This caused the cmd.exe process to consume 50% CPU cycles and it stayed like this for over 5 minutes with no apparent results. The underscore in the command prompt just kept flashing on and off. So figuring there was a glitch, I tried to kill the cmd.exe process and I was not able to. Only way to get the process to stop was to reboot.

Now is where the serious problem with the OpenVPN install comes in. I can not run the OpenVPN-GUI. If I attempt to run it, an explorer.exe process starts and hogs 50% + of the CPU cycles and the program never starts. If I try to kill the explorer.exe process, I am not able to just like when I tried to generate the TLS-Auth key and could not kill the cmd.exe process.

The only way to stop the process is to reboot. But now, I can not run the OpenVPN-GUI.

So, I attempted to do a System Restore back to a point before I attempted to create the TLS-Auth key, but the restore fails with a message about a file not being able to be accessed possilby due to AV software and gives error code 0x80070005. I have never had an issue doing a restore while my ESET AV was active so this is a first for me.

So, I decided to try to reinstall the samve version of OpenVPN on top of the existing. This did not work either as when I double click the install file, I get yet another explorer.exe process taking up 50% + CPU cycles and nothing ever happens. Again, the only way to kill the process is to reboot. For a test, I tried running a completely different installer program for something else just to see if that installer would run, and it ran fine. So it seems linked just to OpenVPN stuff that is having an issue.

So, I thought I would just uninstall the current version and then reinstall. Well, the uninstaller starts up and displayse something like Start REMOVE and just hangs there again taking up 50% + CPU cycles.

I have noticed that each time I try to generate the key or try to run OpenVPN-GUI, a process called openvpn.exe appears taking up no CPU cycles but I can't terminate it. I am not sure if the openvpn.exe process shows up when trying to install or uninstall the software, but the openvpn.exe process does not appear after a normal boot, only when attempting to do something with OpenVPN.

So, my question is, what have I done wrong to create this mess and how can I fix it? Is there some config file that is somehow corrupt that I don't know about? I would attempt to uninstall from Safe Mode, but I would rather save that as a last resort only because doing things in Safe Mode does not give you the same safety features as doing them from a normal boot.

Thanks to any and all that can help get me back to a normal running OpenVPN on my laptop.

- Dan

cbr954rr

After spending some time googling my problem and not really finding anything related, I decided to go directly to the OpenVPN-GUI program, right clicked on it and selected Run as Administrator. The program fired up normally. I tested and was able to establish a VPN connection just fine. So, I right clicked the icon in the system tray and exited the program and then went to the shortcut on the desktop and tried double clicking it. Program fired up just fine.

And before any one suggests that I did not have admin rights to run the program, my account is an admin account and I have the actual OpenVPN-GUI program set to Run this program as an administrator under the Privilege Level under Properties - Compatibility and the shortcut is set the same way.

Why it would not run yesterday when I tried it is beyond me. Nothing really changed that I can think of. I merely rebooted the laptop and once logged in, I put it to sleep until today when I started to work on the issue again.

So, this leads me to this question: How do I correctly generate a TLS-Auth key?

I thought it was merely a case of opening a dos prompt in the easy-rsa folder in admin mode, and typing

openvpn --genkey --secret ta.key

but this is what has caused my initial issues with the dos prompt hanging the system at 50% with nothing seeming to happen for over 5 minutes.

Any insight as to what I am doing wrong is greatly appreciated.

Thanks.

-Dan

cbr954rr

debbie10t wrotePerhaps your download was corrupted ?

I have been testing v233 since day of release and have not had any problems like you describe ...

Have you tried to generate a TLS Auth Key since getting things to work ?

Thanks for chiming in debbie10t. At this point I have not attempted to generate a key.

If the correct procedure is merely opening an elevated dos prompt in the C:\Program Files\OpenVPN\easy-rsa folder and typing

openvpn --genkey --secret ta.key

then I was thinking of either experimenting with another machine first or trying it in a virtual machine. This way if there are problems I wont have to worry about trying to fix issues on the machine I use on a daily basis. I can always scratch and redo the virtual machine if need be.

Thanks again for helping out.

- Dan

cbr954rr

So, I attempted to generate the TLS-Auth key using a freshly installed Windows 8.1 Pro on a spare drive I had lying around. I downloaded OpenVPN 2.3.3-I002-x86_64 and easy-rsa 2.2.2 to the desktop and installed the OpenVPN.

Funny thing here is when OpenVPN finished installing and I looked in the OpenVPN folder, there was a folder labeled easy-rsa already there with all the files that would normally be expected to be there for generating the keys. I thought this was a bit weird as it is stated on the OpenVPN website that easy-rsa is no longer included with the current installer.

Anyway, I fired up OpenVPN-GUI with admin rights to make sure it worked correctly then, without doing any of the normal setup stuff like init-config, vars, clean-all, build-ca, etc., I opened an elevated command prompt in the C:\Program Files\OpenVPN\easy-rsa folder and typed

openvpn --genkey --secret ta.key

and almost instantly the ta.key file showed up in the easy-rsa folder.

I opened the file to have a quick look and noticed

#
# 2048 bit OpenVPN static key
#

at the top of the file.

Is it normal for this key to be 2048 bit and will I have an issue attempting to use this key being that the server and client keys I generated are only 1024 bit?

With this question answered, I think I will be ready to try and implement the TLS-Auth key into my setup and see how things go.

Thanks.

- Dan