Windows Firewall issue with OpenVPN

stevens92

Final Goal:
Able to connect to OpenVPN server and able to access internet with Windows Firewall enabled with proper rules.

Server specification:
Windows Server R2 2012, RRAS NOT installed.
The server is running in VM with bridge mode, which has a public IP on it. There is no other firewall beside Windows Firewall on server side.
I have already follow this: https://forums.openvpn.net/topic7806.html with my IP forwarding.

Config file:
Server:

local a.b.c.d

port 17283
proto udp
dev tun
server 10.8.0.0 255.255.255.0

ca ca.crt
cert Server.crt
key Server.key  # This file should be kept secret
dh dh2048.pem

push "redirect-gateway def1"

push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"

#the following commands are optional
keepalive 10 120
comp-lzo
persist-key
persist-tun
verb 3

Client:

client
dev tun
proto udp
remote a.b.c.d 17283

resolv-retry infinite

nobind

persist-key
persist-tun

ca ca.crt
cert clients.crt
key clients.key

remote-cert-tls server

comp-lzo

verb 3

Windows Firewall Specification (Server):
1. Removed all predefined rules
2. Add and allow UDP port 17283 for incoming connections
Basically, beside port 17283 is reachable, everything else just dropping package.
Default incoming connection is block, default outgoing connection is allow. Using public profile

Observations:
1. With above firewall rules: The client is able to connect to server, but no internet access. <- This is the goal, need to make client able to access internet with firewall enabled.
2. If completely disable the firewall or allow incoming connection by default and WITHOUT restarting VPN service, the client still have no internet access.
3. If completely disable the firewall or allow incoming connection by default and RESTARTED VPN service, then the client have internet access.
4. If enable the firewall again with above rule and WITHOUT restarting VPN service, the client still have internet access.
5. If enable the firewall again with above rule and RESTARTED VPN service, then the client have no internet access again.

Any thoughts for this problem? Thanks for helping.

Traffic

stevens92 wroteServer specification:
Windows Server R2 2012

stevens92 wroteWindows Firewall Specification (Server):
1. Removed all predefined rules

stevens92 wroteAny thoughts

Removing all windows firewall rules was a bad idea ..

This forum is for OpenVPN support .. not windows firewall.

stevens92

Thank for approving it and replaying it.

Removing predefined rules isn't the cause of this issue, and my server been running lots of apps just fine without them.
Also tested on a Windows 10 VM with public IP WITHOUT removing the predefined rules. Problem persist.

After investigating with log,
Found out some dropped entries with:
SRC IP: 10.8.0.1, DST IP: 8.8.8.8, ACTION: DROPPED

To solve above issue, I disabled firewall of TAP adapter. (Firewall only enabled for external adapter)

Traffic wrote This forum is for OpenVPN support .. not windows firewall.

I don't think this is about windows firewall support. Not asking you to config firewall for me, not asking you to check my firewall log for me, not asking you to test it for me. And been using WF for years years, only OpenVPN had issues like this.

Therefore I call it lack of documentation on OpenVPN TAP adapter. Documentation only tells to open the listening UDP or TCP port.

nikolaiortiz

Hi, I see this post is fortgotten but I think is a important one.

I got the same problem.

1. I'm install OPENVPN and follow the configuration example of:
https://community.openvpn.net/openvpn/wiki/Easy_Windows_Guide
Everything went fine.
After some days Windows10 send an update and everything stop working.
2. I follow some of the advice here:
On server I defined a Gateway in my connection and also added the following lines to the server configuration:

 ; Fix for problem with client side Windows 7 firewall
; (Goes in Server config file)
push "route-metric 512"
push "route 0.0.0.0 0.0.0.0"

Also turn off the firewall connection
3. After those steps I can make ping to the server form client and vice versa.
But I cant see the shared files of my server.
4. In the client siede. the connection it's show as a public connection and I can´t change it to private.
In the Server side the connection it´s shows as private.
5. Even with the firewall full off i can see the shared files, even when I'm able to do ping.

Any thoughts or help?

thanks a lot.

* EDIT: I test and I can see the files of the client with my Server, But I can't see the files of the server with my client.

TinCanTech

nikolaiortiz wrote I see this post is fortgotten but I think is a important one

Reviving dead threads is not a good start.

Please see this thread for the details we require to be able to help you.
HOWTO: Request Help ! {2}

nikolaiortiz wrote But I cant see the shared files of my server

Windows file and print sharing does not work by default over a VPN.

We have some help here:
https://community.openvpn.net/openvpn/wiki/WindowsBrowsing

Please start a new thread if you still need help.
If you want to reference other threads in your new topic go ahead.