Windows clients cannot connect (OSX/Android works)

rabbitor

Dear forum users,
Thank you for taking the time to look through this. For years now I am running an OpenVPN access server and until now I only had Android and Mac OSX users, everything works flawlessly on those operating systems. Thus I never checked if the server works with Windows clients. Now I need to. On every tested Windows client (Windows 7 x64) I receive the same following error, then it disconnects:

ERROR: There is a clash between the --ifconfig local address and the internal DHCP server address -- both are set to 192.168.9.166 -- please use the --ip-win32 dynamic option to choose a different free address from the --ifconfig subnet for the internal DHCP server

The address 192.168.9.166 is the address I assigned for this user in the webgui, however: Changing it to be dynamically assigned by the access server leads to the same error. Trying to find out more about this error message lead me nowhere, all I think I know is that the server pushes an invalid configuration to Windows clients, except that it doesn't look invalid to me:

PUSH: Received control message: 'PUSH_REPLY,explicit-exit-notify,topology subnet,route-delay 5 30,dhcp-pre-release,dhcp-renew,dhcp-release,route-metric 101,ping 12,ping-restart 50,auth-token SESS_ID,comp-lzo yes,redirect-private def1,redirect-private bypass-dhcp,redirect-private autolocal,redirect-private bypass-dns,route-gateway 192.168.9.161,route 192.168.9.144 255.255.255.248,route 192.168.6.0 255.255.255.0,route 192.168.8.0 255.255.255.0,dhcp-option NBT 1,block-ipv6,ifconfig 192.168.9.166 255.255.255.248'

As you can see the server is set up to use Routing/NAT, not bridging. I actually set it to bridging for tests and that worked just fine. The next step was installing a fresh copy of the OpenVPN AS on a freshly installed Debian 7 x64 machine - the problem persists even then. Now I am using this fresh copy for further testing. Maybe it is important to note that I installed Debian myself, I do not use any of the preconfigured appliances available for download.

Since this post is already very long, I have left out other information that I think will not be necessary, I hope that is okay. Perhaps you can give me a hint about what i can do to change the "internal DHCP server address" since that is what the client complains about. Thank you.

One last important note: For testing purposes I put the client and the server onto the same subnet, 192.168.8.0/24, this obviously doesn't make much sense, but it's only for testing. The real-world scenario where clients connect via internet leads to the same error. Here is the complete client logfile - this basically looks the same across multiple tested machines:

Sat Mar 14 19:19:16 2015 OpenVPN 2.3.6 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Mar  4 2015
Sat Mar 14 19:19:16 2015 library versions: OpenSSL 1.0.1l 15 Jan 2015, LZO 2.08
Enter Management Password:
Sat Mar 14 19:19:16 2015 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Sat Mar 14 19:19:16 2015 Need hold release from management interface, waiting...
Sat Mar 14 19:19:16 2015 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Sat Mar 14 19:19:16 2015 MANAGEMENT: CMD 'state on'
Sat Mar 14 19:19:16 2015 MANAGEMENT: CMD 'log all on'
Sat Mar 14 19:19:16 2015 MANAGEMENT: CMD 'hold off'
Sat Mar 14 19:19:16 2015 MANAGEMENT: CMD 'hold release'
Sat Mar 14 19:19:18 2015 MANAGEMENT: CMD 'username "Auth" "pav"'
Sat Mar 14 19:19:18 2015 MANAGEMENT: CMD 'password [...]'
Sat Mar 14 19:19:19 2015 Control Channel Authentication: tls-auth using INLINE static key file
Sat Mar 14 19:19:19 2015 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Mar 14 19:19:19 2015 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Mar 14 19:19:19 2015 Socket Buffers: R=[8192->100000] S=[8192->100000]
Sat Mar 14 19:19:19 2015 UDPv4 link local: [undef]
Sat Mar 14 19:19:19 2015 UDPv4 link remote: [AF_INET]192.168.8.7:1194
Sat Mar 14 19:19:19 2015 MANAGEMENT: >STATE:1426357159,WAIT,,,
Sat Mar 14 19:19:19 2015 MANAGEMENT: >STATE:1426357159,AUTH,,,
Sat Mar 14 19:19:19 2015 TLS: Initial packet from [AF_INET]192.168.8.7:1194, sid=e1f838c4 fc08bb94
Sat Mar 14 19:19:19 2015 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Sat Mar 14 19:19:19 2015 VERIFY OK: depth=1, CN=OpenVPN CA
Sat Mar 14 19:19:19 2015 VERIFY OK: nsCertType=SERVER
Sat Mar 14 19:19:19 2015 VERIFY OK: depth=0, CN=OpenVPN Server
Sat Mar 14 19:19:19 2015 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sat Mar 14 19:19:19 2015 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Mar 14 19:19:19 2015 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sat Mar 14 19:19:19 2015 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Mar 14 19:19:19 2015 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Sat Mar 14 19:19:19 2015 [OpenVPN Server] Peer Connection Initiated with [AF_INET]192.168.8.7:1194
Sat Mar 14 19:19:20 2015 MANAGEMENT: >STATE:1426357160,GET_CONFIG,,,
Sat Mar 14 19:19:21 2015 SENT CONTROL [OpenVPN Server]: 'PUSH_REQUEST' (status=1)
Sat Mar 14 19:19:21 2015 PUSH: Received control message: 'PUSH_REPLY,explicit-exit-notify,topology subnet,route-delay 5 30,dhcp-pre-release,dhcp-renew,dhcp-release,route-metric 101,ping 12,ping-restart 50,auth-token SESS_ID,comp-lzo yes,redirect-private def1,redirect-private bypass-dhcp,redirect-private autolocal,redirect-private bypass-dns,route-gateway 192.168.9.161,route 192.168.9.144 255.255.255.248,route 192.168.6.0 255.255.255.0,route 192.168.8.0 255.255.255.0,dhcp-option NBT 1,block-ipv6,ifconfig 192.168.9.166 255.255.255.248'
Sat Mar 14 19:19:21 2015 Option 'explicit-exit-notify' in [PUSH-OPTIONS]:1 is ignored by previous <connection> blocks 
Sat Mar 14 19:19:21 2015 Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:21: block-ipv6 (2.3.6)
Sat Mar 14 19:19:21 2015 OPTIONS IMPORT: timers and/or timeouts modified
Sat Mar 14 19:19:21 2015 OPTIONS IMPORT: explicit notify parm(s) modified
Sat Mar 14 19:19:21 2015 OPTIONS IMPORT: LZO parms modified
Sat Mar 14 19:19:21 2015 OPTIONS IMPORT: --ifconfig/up options modified
Sat Mar 14 19:19:21 2015 OPTIONS IMPORT: route options modified
Sat Mar 14 19:19:21 2015 OPTIONS IMPORT: route-related options modified
Sat Mar 14 19:19:21 2015 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Sat Mar 14 19:19:21 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Sat Mar 14 19:19:21 2015 MANAGEMENT: >STATE:1426357161,ASSIGN_IP,,192.168.9.166,
Sat Mar 14 19:19:21 2015 open_tun, tt->ipv6=0
Sat Mar 14 19:19:21 2015 TAP-WIN32 device [Local Area Connection 2] opened: \\.\Global\{CDB760BF-6631-468D-90D2-B0A5E580D419}.tap
Sat Mar 14 19:19:21 2015 TAP-Windows Driver Version 9.21 
Sat Mar 14 19:19:21 2015 Set TAP-Windows TUN subnet mode network/local/netmask = 192.168.9.160/192.168.9.166/255.255.255.248 [SUCCEEDED]
Sat Mar 14 19:19:21 2015 MANAGEMENT: Client disconnected
Sat Mar 14 19:19:21 2015 ERROR: There is a clash between the --ifconfig local address and the internal DHCP server address -- both are set to 192.168.9.166 -- please use the --ip-win32 dynamic option to choose a different free address from the --ifconfig subnet for the internal DHCP server
Sat Mar 14 19:19:21 2015 Exiting due to fatal error

maikcat

post your configs please,

Michael.

rabbitor

I apologize, right after writing the initial post, I added the following line to the server configuration:

push "ip-win32 dynamic 0 3600"

This immediately solved the problem. I will test the connectivity now to make sure it's actually solved, but now my logfile looks like this:

Tue Mar 17 11:44:54 2015 OpenVPN 2.3.6 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Mar  4 2015
Tue Mar 17 11:44:54 2015 library versions: OpenSSL 1.0.1l 15 Jan 2015, LZO 2.08
Tue Mar 17 11:44:54 2015 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25342
Tue Mar 17 11:44:54 2015 Need hold release from management interface, waiting...
Tue Mar 17 11:44:54 2015 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25342
Tue Mar 17 11:44:54 2015 MANAGEMENT: CMD 'state on'
Tue Mar 17 11:44:54 2015 MANAGEMENT: CMD 'log all on'
Tue Mar 17 11:44:54 2015 MANAGEMENT: CMD 'hold off'
Tue Mar 17 11:44:54 2015 MANAGEMENT: CMD 'hold release'
Tue Mar 17 11:44:57 2015 MANAGEMENT: CMD 'username "Auth" "pav"'
Tue Mar 17 11:44:57 2015 MANAGEMENT: CMD 'password [...]'
Tue Mar 17 11:44:57 2015 Control Channel Authentication: tls-auth using INLINE static key file
Tue Mar 17 11:44:57 2015 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Mar 17 11:44:57 2015 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Mar 17 11:44:57 2015 Socket Buffers: R=[8192->100000] S=[8192->100000]
Tue Mar 17 11:44:57 2015 UDPv4 link local: [undef]
Tue Mar 17 11:44:57 2015 UDPv4 link remote: [AF_INET]192.168.8.7:1194
Tue Mar 17 11:44:57 2015 MANAGEMENT: >STATE:1426589097,WAIT,,,
Tue Mar 17 11:44:57 2015 MANAGEMENT: >STATE:1426589097,AUTH,,,
Tue Mar 17 11:44:57 2015 TLS: Initial packet from [AF_INET]192.168.8.7:1194, sid=b6418f9d 1074edc4
Tue Mar 17 11:44:57 2015 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Tue Mar 17 11:44:57 2015 VERIFY OK: depth=1, CN=OpenVPN CA
Tue Mar 17 11:44:57 2015 VERIFY OK: nsCertType=SERVER
Tue Mar 17 11:44:57 2015 VERIFY OK: depth=0, CN=OpenVPN Server
Tue Mar 17 11:44:57 2015 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Mar 17 11:44:57 2015 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Mar 17 11:44:57 2015 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Mar 17 11:44:57 2015 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Mar 17 11:44:57 2015 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Tue Mar 17 11:44:57 2015 [OpenVPN Server] Peer Connection Initiated with [AF_INET]192.168.8.7:1194
Tue Mar 17 11:44:58 2015 MANAGEMENT: >STATE:1426589098,GET_CONFIG,,,
Tue Mar 17 11:44:59 2015 SENT CONTROL [OpenVPN Server]: 'PUSH_REQUEST' (status=1)
Tue Mar 17 11:44:59 2015 PUSH: Received control message: 'PUSH_REPLY,explicit-exit-notify,topology subnet,route-delay 5 30,dhcp-pre-release,dhcp-renew,dhcp-release,route-metric 101,ip-win32 dynamic 0 3600,ping 12,ping-restart 50,auth-token SESS_ID,comp-lzo yes,redirect-private def1,redirect-private bypass-dhcp,redirect-private autolocal,redirect-private bypass-dns,route-gateway 192.168.9.161,route 192.168.9.144 255.255.255.248,block-ipv6,ifconfig 192.168.9.166 255.255.255.248'
Tue Mar 17 11:44:59 2015 Option 'explicit-exit-notify' in [PUSH-OPTIONS]:1 is ignored by previous <connection> blocks 
Tue Mar 17 11:44:59 2015 Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:19: block-ipv6 (2.3.6)
Tue Mar 17 11:44:59 2015 OPTIONS IMPORT: timers and/or timeouts modified
Tue Mar 17 11:44:59 2015 OPTIONS IMPORT: explicit notify parm(s) modified
Tue Mar 17 11:44:59 2015 OPTIONS IMPORT: LZO parms modified
Tue Mar 17 11:44:59 2015 OPTIONS IMPORT: --ifconfig/up options modified
Tue Mar 17 11:44:59 2015 OPTIONS IMPORT: route options modified
Tue Mar 17 11:44:59 2015 OPTIONS IMPORT: route-related options modified
Tue Mar 17 11:44:59 2015 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Tue Mar 17 11:44:59 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Tue Mar 17 11:44:59 2015 MANAGEMENT: >STATE:1426589099,ASSIGN_IP,,192.168.9.166,
Tue Mar 17 11:44:59 2015 open_tun, tt->ipv6=0
Tue Mar 17 11:44:59 2015 TAP-WIN32 device [Local Area Connection 2] opened: \\.\Global\{CDB760BF-6631-468D-90D2-B0A5E580D419}.tap
Tue Mar 17 11:44:59 2015 TAP-Windows Driver Version 9.21 
Tue Mar 17 11:44:59 2015 Set TAP-Windows TUN subnet mode network/local/netmask = 192.168.9.160/192.168.9.166/255.255.255.248 [SUCCEEDED]
Tue Mar 17 11:44:59 2015 Notified TAP-Windows driver to set a DHCP IP/netmask of 192.168.9.166/255.255.255.248 on interface {CDB760BF-6631-468D-90D2-B0A5E580D419} [DHCP-serv: 192.168.9.160, lease-time: 3600]
Tue Mar 17 11:44:59 2015 Successful ARP Flush on interface [15] {CDB760BF-6631-468D-90D2-B0A5E580D419}
Tue Mar 17 11:44:59 2015 TAP: DHCP address released
Tue Mar 17 11:44:59 2015 TAP: DHCP address renewal succeeded
Tue Mar 17 11:45:04 2015 TEST ROUTES: 2/2 succeeded len=1 ret=1 a=0 u/d=up
Tue Mar 17 11:45:04 2015 C:\Windows\system32\route.exe ADD 192.168.8.7 MASK 255.255.255.255 192.168.8.1 IF 11
Tue Mar 17 11:45:04 2015 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=10 and dwForwardType=4
Tue Mar 17 11:45:04 2015 Route addition via IPAPI succeeded [adaptive]
Tue Mar 17 11:45:04 2015 C:\Windows\system32\route.exe ADD 192.168.8.1 MASK 255.255.255.255 192.168.8.1 IF 11
Tue Mar 17 11:45:04 2015 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=10 and dwForwardType=4
Tue Mar 17 11:45:04 2015 Route addition via IPAPI succeeded [adaptive]
Tue Mar 17 11:45:04 2015 MANAGEMENT: >STATE:1426589104,ADD_ROUTES,,,
Tue Mar 17 11:45:04 2015 C:\Windows\system32\route.exe ADD 192.168.9.144 MASK 255.255.255.248 192.168.9.161 METRIC 101
Tue Mar 17 11:45:04 2015 Route addition via IPAPI succeeded [adaptive]
Tue Mar 17 11:45:04 2015 Initialization Sequence Completed
Tue Mar 17 11:45:04 2015 MANAGEMENT: >STATE:1426589104,CONNECTED,SUCCESS,192.168.9.166,192.168.8.7

Now the only thing I wonder about is why this does not work out-of-the-box, but well. I can post the client config - but do you know where I find the server configuration file? The file /usr/local/openvpn_as/etc/as.conf is very generic and does not contain any of my custom settings (routes to specific subnets etc.). Or is there no human-readable config file on the server side? And yes, apparently i am running a OpenVPN AS server for years without knowing where this config actually sits. At the expected location /etc/openvpn/openvpn.conf there was nothing.

Here is the client config:

# Automatically generated OpenVPN client config file
# Generated on Tue Mar 17 12:13:28 2015 by redacted
# Note: this config file contains inline private keys
#       and therefore should be kept confidential!
# Note: this configuration is user-locked to the username below
# OVPN_ACCESS_SERVER_USERNAME=redacted
# Define the profile name of this particular configuration file
# OVPN_ACCESS_SERVER_PROFILE=redacted
# OVPN_ACCESS_SERVER_CLI_PREF_ALLOW_WEB_IMPORT=True
# OVPN_ACCESS_SERVER_CLI_PREF_ENABLE_CONNECT=True
# OVPN_ACCESS_SERVER_CLI_PREF_ENABLE_XD_PROXY=True
# OVPN_ACCESS_SERVER_WSHOST=redacted
# OVPN_ACCESS_SERVER_WEB_CA_BUNDLE_START
# -----BEGIN CERTIFICATE-----
# redacted
# -----END CERTIFICATE-----
# OVPN_ACCESS_SERVER_WEB_CA_BUNDLE_STOP
# OVPN_ACCESS_SERVER_IS_OPENVPN_WEB_CA=1
# OVPN_ACCESS_SERVER_ORGANIZATION=redacted
setenv FORWARD_COMPATIBLE 1
client
server-poll-timeout 4
nobind
remote redacted 1194 udp
remote redacted 1194 udp
remote redacted 443 tcp
remote redacted 1194 udp
remote redacted 1194 udp
remote redacted 1194 udp
remote redacted 1194 udp
remote redacted 1194 udp
dev tun
dev-type tun
ns-cert-type server
setenv opt tls-version-min 1.0 or-highest
reneg-sec 604800
sndbuf 100000
rcvbuf 100000
auth-user-pass
# NOTE: LZO commands are pushed by the Access Server at connect time.
# NOTE: The below line doesn't disable LZO.
comp-lzo no
verb 3
setenv PUSH_PEER_INFO

<ca>
-----BEGIN CERTIFICATE-----
redacted
-----END CERTIFICATE-----
</ca>

<cert>
-----BEGIN CERTIFICATE-----
redacted
-----END CERTIFICATE-----
</cert>

<key>
-----BEGIN PRIVATE KEY-----
redacted
-----END PRIVATE KEY-----
</key>

key-direction 1
<tls-auth>
#
# 2048 bit OpenVPN static key (Server Agent)
#
-----BEGIN OpenVPN Static key V1-----
redacted
-----END OpenVPN Static key V1-----
</tls-auth>

## -----BEGIN RSA SIGNATURE-----
redacted
## -----END RSA SIGNATURE-----
## -----BEGIN CERTIFICATE-----
redacted
## -----END CERTIFICATE-----
## -----BEGIN CERTIFICATE-----
redacted
## -----END CERTIFICATE-----