mullvad.net : I just can't make it work

dropme

Hello,

First, please allow me to thank the developpers for offering this free software. 🙂

But I have a problem. I've installed OpenVPN on windows XP, I've tried 2 different VPN server : everything connect fine, but the traffic goes through my normal connection instead of the VPN.
Clipboard01.png - On the left, the TAP-windows connection
- in the middle OpenVPN
- on the right the local connection to the my ISP router.

The lock is green, it says "initialization completed", but the TAP-Windows connection is never used, and it's my real IP when I browse the web.

I've tried everything : administrator or not, reinstall, changing VPN servers, DHCP (it doesn't work, for some reason), manual IP, with or without firewall...

I give you one of my log :

Sun Aug 10 09:18:49 2014 OpenVPN 2.3.4 i686-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Jun 5 2014
Sun Aug 10 09:18:49 2014 library versions: OpenSSL 1.0.1h 5 Jun 2014, LZO 2.05
Enter Management Password:
Sun Aug 10 09:18:49 2014 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Sun Aug 10 09:18:49 2014 Need hold release from management interface, waiting...
Sun Aug 10 09:18:50 2014 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Sun Aug 10 09:18:50 2014 MANAGEMENT: CMD 'state on'
Sun Aug 10 09:18:50 2014 MANAGEMENT: CMD 'log all on'
Sun Aug 10 09:18:50 2014 MANAGEMENT: CMD 'hold off'
Sun Aug 10 09:18:50 2014 MANAGEMENT: CMD 'hold release'
Sun Aug 10 09:18:50 2014 Socket Buffers: R=[8192->8192] S=[8192->8192]
Sun Aug 10 09:18:50 2014 MANAGEMENT: >STATE:1407622730,RESOLVE,,,
Sun Aug 10 09:18:50 2014 UDPv4 link local: [undef]
Sun Aug 10 09:18:50 2014 UDPv4 link remote: [AF_INET]162.210.197.232:1194
Sun Aug 10 09:18:50 2014 MANAGEMENT: >STATE:1407622730,WAIT,,,
Sun Aug 10 09:18:50 2014 MANAGEMENT: >STATE:1407622730,AUTH,,,
Sun Aug 10 09:18:50 2014 TLS: Initial packet from [AF_INET]162.210.197.232:1194, sid=cb9ba808 9efb8904
Sun Aug 10 09:18:51 2014 CRL: CRL crl.pem is from a different issuer than the issuer of certificate C=NA, ST=None, L=None, O=Mullvad, CN=Mullvad CA, emailAddress=info@mullvad.net
Sun Aug 10 09:18:51 2014 VERIFY OK: depth=2, C=NA, ST=None, L=None, O=Mullvad, CN=Mullvad CA, emailAddress=info@mullvad.net
Sun Aug 10 09:18:51 2014 CRL: CRL crl.pem is from a different issuer than the issuer of certificate C=NA, ST=None, L=None, O=Mullvad, CN=master.mullvad.net, emailAddress=info@mullvad.net
Sun Aug 10 09:18:51 2014 VERIFY OK: depth=1, C=NA, ST=None, L=None, O=Mullvad, CN=master.mullvad.net, emailAddress=info@mullvad.net
Sun Aug 10 09:18:51 2014 Validating certificate key usage
Sun Aug 10 09:18:51 2014 ++ Certificate has key usage 00a0, expects 00a0
Sun Aug 10 09:18:51 2014 VERIFY KU OK
Sun Aug 10 09:18:51 2014 Validating certificate extended key usage
Sun Aug 10 09:18:51 2014 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Sun Aug 10 09:18:51 2014 VERIFY EKU OK
Sun Aug 10 09:18:51 2014 CRL CHECK OK: C=NA, ST=None, L=None, O=Mullvad, CN=se3.mullvad.net, emailAddress=info@mullvad.net
Sun Aug 10 09:18:51 2014 VERIFY OK: depth=0, C=NA, ST=None, L=None, O=Mullvad, CN=se3.mullvad.net, emailAddress=info@mullvad.net
Sun Aug 10 09:18:52 2014 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sun Aug 10 09:18:52 2014 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Aug 10 09:18:52 2014 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sun Aug 10 09:18:52 2014 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Aug 10 09:18:52 2014 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Sun Aug 10 09:18:52 2014 [se3.mullvad.net] Peer Connection Initiated with [AF_INET]193.138.219.226:1194
Sun Aug 10 09:18:53 2014 MANAGEMENT: >STATE:1407622733,GET_CONFIG,,,
Sun Aug 10 09:18:54 2014 SENT CONTROL [se3.mullvad.net]: 'PUSH_REQUEST' (status=1)
Sun Aug 10 09:18:54 2014 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 10.8.0.1,route 10.8.0.1,topology net30,ifconfig 10.8.x.xx 10.8.x.xx'
Sun Aug 10 09:18:54 2014 OPTIONS IMPORT: --ifconfig/up options modified
Sun Aug 10 09:18:54 2014 OPTIONS IMPORT: route options modified
Sun Aug 10 09:18:54 2014 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Sun Aug 10 09:18:54 2014 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Sun Aug 10 09:18:54 2014 MANAGEMENT: >STATE:1407622734,ASSIGN_IP,,10.8.1.22,
Sun Aug 10 09:18:54 2014 ******** NOTE: Please manually set the IP/netmask of 'tapvpn' to 10.8.1.22/255.255.255.252 (if it is not already set)
Sun Aug 10 09:18:54 2014 open_tun, tt->ipv6=0
Sun Aug 10 09:18:54 2014 TAP-WIN32 device [tapvpn] opened: \\.\Global\{23C39624-D33D-4AC1-B94B-526702A4D64C}.tap
Sun Aug 10 09:18:54 2014 TAP-Windows Driver Version 9.9
Sun Aug 10 09:18:54 2014 Successful ARP Flush on interface [196610] {23C39624-D33D-4AC1-B94B-526702A4D64C}
Sun Aug 10 09:19:00 2014 TEST ROUTES: 0/0 succeeded len=1 ret=0 a=0 u/d=down
Sun Aug 10 09:19:00 2014 Route: Waiting for TUN/TAP interface to come up...
Sun Aug 10 09:19:04 2014 TEST ROUTES: 0/0 succeeded len=1 ret=0 a=0 u/d=down
Sun Aug 10 09:19:04 2014 Route: Waiting for TUN/TAP interface to come up...
Sun Aug 10 09:19:05 2014 TEST ROUTES: 0/0 succeeded len=1 ret=0 a=0 u/d=down
Sun Aug 10 09:19:05 2014 Route: Waiting for TUN/TAP interface to come up...
Sun Aug 10 09:19:06 2014 TEST ROUTES: 0/0 succeeded len=1 ret=0 a=0 u/d=down
Sun Aug 10 09:19:06 2014 Route: Waiting for TUN/TAP interface to come up...
Sun Aug 10 09:19:07 2014 TEST ROUTES: 0/0 succeeded len=1 ret=0 a=0 u/d=down
Sun Aug 10 09:19:07 2014 Route: Waiting for TUN/TAP interface to come up...
Sun Aug 10 09:19:08 2014 TEST ROUTES: 0/0 succeeded len=1 ret=0 a=0 u/d=down
Sun Aug 10 09:19:08 2014 Route: Waiting for TUN/TAP interface to come up...
Sun Aug 10 09:19:09 2014 TEST ROUTES: 2/2 succeeded len=1 ret=1 a=0 u/d=up
Sun Aug 10 09:19:09 2014 C:\WINDOWS\system32\route.exe ADD 193.138.219.226 MASK 255.255.255.255 192.168.1.1
Sun Aug 10 09:19:09 2014 Route addition via IPAPI succeeded [adaptive]
Sun Aug 10 09:19:09 2014 C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.8.1.21
Sun Aug 10 09:19:09 2014 Route addition via IPAPI succeeded [adaptive]
Sun Aug 10 09:19:09 2014 C:\WINDOWS\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.8.1.21
Sun Aug 10 09:19:09 2014 Route addition via IPAPI succeeded [adaptive]
Sun Aug 10 09:19:09 2014 MANAGEMENT: >STATE:1407622749,ADD_ROUTES,,,
Sun Aug 10 09:19:09 2014 C:\WINDOWS\system32\route.exe ADD 10.8.0.1 MASK 255.255.255.255 10.8.1.21
Sun Aug 10 09:19:09 2014 Route addition via IPAPI succeeded [adaptive]
Sun Aug 10 09:19:09 2014 Initialization Sequence Completed
Sun Aug 10 09:19:09 2014 MANAGEMENT: >STATE:1407622749,CONNECTED,SUCCESS,10.8.1.22,162.210.197.232

And here's the client config

# Notice to Mullvad customers:
#
# For those of you behind very restrictive firewalls,
# you can use our tunnels on tcp port 443, as well as
# on udp port 53.
client

dev tun

proto udp
#proto udp
#proto tcp

remote openvpn.mullvad.net 1194
#remote openvpn.mullvad.net 443
#remote openvpn.mullvad.net 53
#remote se.mullvad.net # Servers in Sweden
#remote nl.mullvad.net # Servers in the Netherlands

# Keep trying indefinitely to resolve the
# host name of the OpenVPN server. Very useful
# on machines which are not permanently connected
# to the internet such as laptops.
resolv-retry infinite

# Most clients don't need to bind to
# a specific local port number.
nobind

# Try to preserve some state across restarts.
persist-key
persist-tun

# Enable compression on the VPN link.
# Don't enable this unless it is also
# enabled in the server config file.
comp-lzo

# Set log file verbosity.
verb 3

remote-cert-tls server

ping-restart 60

# Daemonize
service mullvadopenvpn

ping 10

ca ca.crt
cert mullvad.crt
key mullvad.key

crl-verify crl.pem

ip-win32 manual
redirect-gateway def1

I've added ip-win32 manual because DHCP doesn't work ("sequence completed with errors") and "redirect-gateway def1", for testing.

I'd really like some help. Thanks.

maikcat

server config?

Michael.

dropme

Hello,

There's no server config as far as I can tell. I use OpenVPN as a client only.
For mullvad the config files are the .opvn file (cf above), the certs files and the private key.
Same with others servers like VPNbook.

maikcat

you might try to contact mullvad for troubleshooting and support.

besides that what a

tracert 8.8.8.8

shows?

Michael.

dropme

Yes, but it's not a server-problem since it doesn't work with vpnbook either.

(I'm only testing free servers for the moment, I may try a real server when I'm sure it works).

Tracert 8.8.8.8

1 * * <1 ms 192.168.1.1
2 25 ms 25 ms 25 ms xx.xx.xx.xx.rev.sfr.net [xx.xx.xx.xx] --> (My I.P)
3 25 ms 25 ms 26 ms 181.113.24.109.rev.sfr.net [109.24.113.181]
4 26 ms 26 ms 25 ms 61.103.20.93.rev.sfr.net [93.20.103.61]
5 25 ms 26 ms 26 ms 146.212.96.84.rev.sfr.net [84.96.212.146]
6 26 ms 26 ms 26 ms 154.212.96.84.rev.sfr.net [84.96.212.154]
7 39 ms 38 ms 39 ms 72.14.217.1
8 * 53 ms 42 ms 72.14.238.228
9 43 ms 40 ms 39 ms 209.85.245.81
10 44 ms 45 ms 44 ms 209.85.249.16
11 49 ms 48 ms 49 ms google-public-dns-a.google.com [8.8.8.8]

maikcat

post the output of:

ipconfig
netstat -nr

After vpn is up...

Michael.

dropme

Thanks for taking the time to help me.

Ip Config /All

        Host Name . . . . . . . . . . :           	COMPUTER
        Primary DNS Suffix . . . . . . :
        Node Type . . . . . . . . . . :           Unknown
        IP Routing Enabled . . . . . . . . :   	No
        WINS Proxy Enabled . . . . . . . .  	No

Ethernet Adapter Local Area Connection:

        Connection-specific DNS Suffix  . :
        Description . . . . . . . . . . . :         	Realtek
        Physical Address. . . . . . . . . :     	XX-XX-XX-XX-XX-XX 
        DHCP Enabled. . . . . . . . . . . :    	No
        IP Address. . . . . . . . . . . . :        	192.168.1.18
        Subnet Mask . . . . . . . . . . . :      	255.255.255.0
        Default Gateway . . . . . . . . . :     	192.168.1.1
        DNS Servers . . . . . . . . . .  :       	109.0.66.10
                                                        109.0.66.20
        NetBIOS over Tcpip. . . . . . . . :    	Disabled

Ethernet adapter TAP-Windows Adapter V9:

        Connection-specific DNS Suffix  . :
        Description . . . . . . . . . . . :      	TAP-Windows Adapter V9 #4
        Physical Address. . . . . . . . . :  	00-FF-XX-XX-XX-XX  
        DHCP Enabled. . . . . . . . . . . :  	No
        IP Address. . . . . . . . . . . . :      	10.8.0.198
        Subnet Mask . . . . . . . . . . . :    	255.255.255.0
        Default Gateway . . . . . . . . . :
        NetBIOS over Tcpip. . . . . . . . : 	Disabled

Netstat -nr

Route Table
===========================================================================
Interface List
0x1 ........................... MS TCP Loopback interface
0x2 ...XX XX XX XX XX XX ...... Realtek
0x10004 ...00 ff XX XX XX XX ...... TAP-Windows Adapter V9 #4
===========================================================================
===========================================================================

Active routes : 
Network Destination         Netmask            Gateway            Interface        Metric
0.0.0.0                     0.0.0.0        192.168.1.1          192.168.1.18        20
10.8.0.196              255.255.255.252        10.8.0.198        10.8.0.198        30
10.8.0.198              255.255.255.255          127.0.0.1         127.0.0.1        30
10.255.255.255       255.255.255.255        10.8.0.198        10.8.0.198             30
108.59.13.40          255.255.255.255       192.168.1.1    192.168.1.18             1
127.0.0.0                 255.0.0.0          127.0.0.1          127.0.0.1             1
192.168.1.0               255.255.255.0     192.168.1.18     192.168.1.18          20
192.168.1.18          255.255.255.255          127.0.0.1          127.0.0.1       20
192.168.1.255        255.255.255.255       192.168.1.18     192.168.1.18           20
224.0.0.0                 240.0.0.0         10.8.0.198        10.8.0.198              30
224.0.0.0                 240.0.0.0      192.168.1.18     192.168.1.18              20
255.255.255.255    255.255.255.255         10.8.0.198        10.8.0.198            1
255.255.255.255    255.255.255.255       192.168.1.18     192.168.1.18               1

Default Gateway :       192.168.1.1
===========================================================================
Persistents Routes :
  None

Note : sorry for the line spacing. 🙁
I "censored" the mac addresses but that's the right ones, I've checked.

note 2 : there's a DHCP menu in my router box, but I've disabled it. You can only enter IP starting with 192.168.; same for the menu "static address".

maikcat

something is not right....

in your logs

Sun Aug 10 09:19:09 2014 C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.8.1.21
Sun Aug 10 09:19:09 2014 Route addition via IPAPI succeeded [adaptive]
Sun Aug 10 09:19:09 2014 C:\WINDOWS\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.8.1.21
Sun Aug 10 09:19:09 2014 Route addition via IPAPI succeeded [adaptive]
Sun Aug 10 09:19:09 2014 MANAGEMENT: >STATE:1407622749,ADD_ROUTES,,,
Sun Aug 10 09:19:09 2014 C:\WINDOWS\system32\route.exe ADD 10.8.0.1 MASK 255.255.255.255 10.8.1.21

but in your netstat -nr output shows nothing of the above additions.... :?

Michael.

dropme

If you're talking about the 10.8.1.21 changed into 10.8.0.198, it's because this logs were taken at 2 different days, and this IP change everytime I restart.

For the rest, I have no idea. 🙁

What can I do now ?

maikcat

if you are running openvpn with admin rights and in your logs shows up messages
line the ones i posted but in netstat -nr still not showing the additional routes
you can only try adding them by hand....

and of course try to communicate mullvad and ask for support...

Michael.

dropme

Ok, there's some news.

For security reasons, I use a non-administrator account but of course I launch openvpngui with admin privileges, with the command "run as".

Yesterday, I've tried to run openvpn from my full admin account and... it works.
Without the openvpn service by the way.

So, I'm gonna try to explore in this direction and find a way to make it work in user account. Maybe running openvpngui as admin is not enough, maybe you need to launch openvpn.exe with the command run as, as well.

I'll keep you informed.

Thanks for your help. 🙂

dropme

It's solved!

It was much simpler than I expected.

I loggued in my user account, runned OpenVPN with administrator privileges but without openvpn service. And that's all.

Thanks again. Bye.