Try to auto connect and route all traffic through tunnel

starshine

I am new to OpenVPN

I managed to set it up so it auto starts at boot-up in Win8, logs on without interaction.

But the traffic doesn't go through the tunnel. It did initially, but something went wrong. Looking at the log, it's full of errors. Any advice appreciated! I have spent hours on trying to get this setup working.

Connection config (I know it's a hacked cut&paste so any suggestions of improvement are appreciated)

client
dev tun
proto udp
remote-random
remote 89.248.174.xx xxx
resolv-retry 5
nobind
fast-io
push "redirect-gateway def1"
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
persist-key
persist-tun
ca globalca.crt
push "redirect-gateway def1"
auth-user-pass auth.txt
comp-lzo
route-delay 5 30
script-security 3 system
mute-replay-warnings
verb 3

Log says the following (but Open VPN claims successful connect!)

Sun Jun 15 03:19:24 2014 OpenVPN 2.3.2 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [eurephia] [IPv6] built on Aug 22 2013
Enter Management Password:
Sun Jun 15 03:19:26 2014 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Sun Jun 15 03:19:26 2014 Need hold release from management interface, waiting...
Sun Jun 15 03:19:26 2014 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Sun Jun 15 03:19:26 2014 MANAGEMENT: CMD 'state on'
Sun Jun 15 03:19:26 2014 MANAGEMENT: CMD 'log all on'
Sun Jun 15 03:19:27 2014 MANAGEMENT: CMD 'hold off'
Sun Jun 15 03:19:27 2014 MANAGEMENT: CMD 'hold release'
Sun Jun 15 03:19:27 2014 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Sun Jun 15 03:19:27 2014 NOTE: --fast-io is disabled since we are running on Windows
Sun Jun 15 03:19:30 2014 Socket Buffers: R=[65536->65536] S=[65536->65536]
Sun Jun 15 03:19:30 2014 UDPv4 link local: [undef]
Sun Jun 15 03:19:30 2014 UDPv4 link remote: [AF_INET]89.248.жжж.чч:443
Sun Jun 15 03:19:30 2014 MANAGEMENT: >STATE:1402798770,WAIT,,,
Sun Jun 15 03:19:30 2014 MANAGEMENT: >STATE:1402798770,AUTH,,,
Sun Jun 15 03:19:30 2014 TLS: Initial packet from [AF_INET]89.248.жжж.чч:443, sid=2afd722e ec3e6165
Sun Jun 15 03:19:30 2014 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Sun Jun 15 03:19:32 2014 VERIFY OK: depth=1, C=US, ST=FL, L=Orlando, O=MyVPN, OU=VPN, CN=TG-OVPN-CA, name=MyVPN, emailAddress=sysadmin@torguard.net
Sun Jun 15 03:19:32 2014 VERIFY OK: depth=0, C=US, ST=FL, L=Orlando, O=MyVPN, OU=VPN, CN=TG-OVPN-CA, name=MyVPN, emailAddress=sysadmin@MyVPN.net
Sun Jun 15 03:19:33 2014 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sun Jun 15 03:19:33 2014 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Jun 15 03:19:33 2014 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sun Jun 15 03:19:33 2014 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Jun 15 03:19:33 2014 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Sun Jun 15 03:19:33 2014 [TG-OVPN-CA] Peer Connection Initiated with [AF_INET]89.248.174.41:443
Sun Jun 15 03:19:34 2014 MANAGEMENT: >STATE:1402798774,GET_CONFIG,,,
Sun Jun 15 03:19:35 2014 SENT CONTROL [TG-OVPN-CA]: 'PUSH_REQUEST' (status=1)
Sun Jun 15 03:19:35 2014 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 10.9.0.1,topology net30,ping 5,ping-restart 30,ifconfig 10.9.0.14 10.9.0.13'
Sun Jun 15 03:19:35 2014 OPTIONS IMPORT: timers and/or timeouts modified
Sun Jun 15 03:19:35 2014 OPTIONS IMPORT: --ifconfig/up options modified
Sun Jun 15 03:19:35 2014 OPTIONS IMPORT: route options modified
Sun Jun 15 03:19:35 2014 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Sun Jun 15 03:19:35 2014 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Sun Jun 15 03:19:35 2014 MANAGEMENT: >STATE:1402798775,ASSIGN_IP,,10.9.0.14,
Sun Jun 15 03:19:35 2014 open_tun, tt->ipv6=0
Sun Jun 15 03:19:35 2014 TAP-WIN32 device [Local Area Connection] opened: \\.\Global\{98DEF9A6-5522-4F88-8595-A78EFA324D75}.tap
Sun Jun 15 03:19:35 2014 TAP-Windows Driver Version 9.9
Sun Jun 15 03:19:35 2014 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.9.0.14/255.255.255.252 on interface {98DEF9A6-5522-4F88-8595-A78EFA324D75} [DHCP-serv: 10.9.0.13, lease-time: 31536000]
Sun Jun 15 03:19:35 2014 NOTE: FlushIpNetTable failed on interface [27] {98DEF9A6-5522-4F88-8595-A78EFA324D75} (status=5) : Access is denied.
Sun Jun 15 03:19:40 2014 TEST ROUTES: 2/2 succeeded len=1 ret=1 a=0 u/d=up
Sun Jun 15 03:19:40 2014 C:\WINDOWS\system32\route.exe ADD 89.248.174.41 MASK 255.255.255.255 192.168.0.2
Sun Jun 15 03:19:40 2014 ROUTE: route addition failed using CreateIpForwardEntry: Access is denied. [status=5 if_index=2]
Sun Jun 15 03:19:40 2014 Route addition via IPAPI failed [adaptive]
Sun Jun 15 03:19:40 2014 Route addition fallback to route.exe
Sun Jun 15 03:19:40 2014 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Sun Jun 15 03:19:41 2014 ERROR: Windows route add command failed [adaptive]: returned error code 1
Sun Jun 15 03:19:41 2014 C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.9.0.13
Sun Jun 15 03:19:41 2014 ROUTE: route addition failed using CreateIpForwardEntry: Access is denied. [status=5 if_index=27]
Sun Jun 15 03:19:41 2014 Route addition via IPAPI failed [adaptive]
Sun Jun 15 03:19:41 2014 Route addition fallback to route.exe
Sun Jun 15 03:19:41 2014 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Sun Jun 15 03:19:41 2014 ERROR: Windows route add command failed [adaptive]: returned error code 1
Sun Jun 15 03:19:41 2014 C:\WINDOWS\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.9.0.13
Sun Jun 15 03:19:41 2014 ROUTE: route addition failed using CreateIpForwardEntry: Access is denied. [status=5 if_index=27]
Sun Jun 15 03:19:41 2014 Route addition via IPAPI failed [adaptive]
Sun Jun 15 03:19:41 2014 Route addition fallback to route.exe
Sun Jun 15 03:19:41 2014 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Sun Jun 15 03:19:41 2014 ERROR: Windows route add command failed [adaptive]: returned error code 1
Sun Jun 15 03:19:41 2014 MANAGEMENT: >STATE:1402798781,ADD_ROUTES,,,
Sun Jun 15 03:19:41 2014 C:\WINDOWS\system32\route.exe ADD 10.9.0.1 MASK 255.255.255.255 10.9.0.13
Sun Jun 15 03:19:41 2014 ROUTE: route addition failed using CreateIpForwardEntry: Access is denied. [status=5 if_index=27]
Sun Jun 15 03:19:41 2014 Route addition via IPAPI failed [adaptive]
Sun Jun 15 03:19:41 2014 Route addition fallback to route.exe
Sun Jun 15 03:19:41 2014 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Sun Jun 15 03:19:41 2014 ERROR: Windows route add command failed [adaptive]: returned error code 1
Sun Jun 15 03:19:41 2014 Initialization Sequence Completed
Sun Jun 15 03:19:41 2014 MANAGEMENT: >STATE:1402798781,CONNECTED,SUCCESS,10.9.0.14,89.248.174.41

starshine

Hi thanks for the advice! Unfortunately that didn't solve it and I feel I'm just walking in cirlces. :cry:

As of this minute, I am running this as an administrator. In fact I am running this as a service, from the startup folder and from the Registry "Run" section.
And right now it's still not even starting! When I manually start, it gives the error below.

[Not sure why this got moved to server] I'm doing it as a client, against my VPN.
I have the very basic objective of automatically connecting at boot-up, and route all traffic through the tunnel.

Should be very basic stuff, for the most n00b type of users. I've spent hours on it, and if it wasn't for my faith in Open Source, I would have given up a long time ago.

The key to success seems to be an unholy mix of registry hacks, Startup folder entries, connection strings and file property settings that all need to be manually set "just so" for this to work.

I had it for a brief second, then I lost it and now it's just no error messages, no success and confusing dialogues.

If I ever manage to get this working, I'll certainly write a guide for others, but in the meantime, my feedback is to add a few checkboxes to the client, to achieve this basic objective. It's pretty standard for VPN, isn't it? I have no idea why it's so hard. I can achieve the same thing with the VPNs bespoke client, or cisco on my work laptop.

I'm nearing the end of the line with this - I seem to be going in circles breaking one thing while fixing another. If anyone has any tip before I throw in the towel, I'd really appreciate it. Wasting a silly amount of time in the process.

I have no idea where I'm going wrong in this, but either it's not starting, it starts, claims to connect but doesn't route the trafic. Or it won't connect to the service seemingly by random.

starshine

And now it suddenly working!
I assume it must be working through the Windows Service, because I can't see the little icon for OpenVPN in the notification area.

I'll document everything I did later to avoid others wasting as much time as I did, on this.