[i]A real typical day - the VPN disconnected after 14, 16, 2, 20, 16, 2, 2, 1, and 4 minutes. I gave up. [/i] My VPN disconnects frequently, sometimes after a couple minutes, sometimes longer. Using the IPVanish windows client, the log always shows “inactivity timeout” as the reason. To regain a VPN connection I right-click TAP Windows Adapter V9 and “Disable” then “Enable”. I can then connect the VPN again. BUT....THE VPN WORKS GREAT IF - I uncheck the Kaspersky Anti-Virus NDIS 6 Filter in the TAP Windows Adapter V9 (below pic). The VPN never disconnects. However, [b]I’m trying to find a way to stay connected with the NDIS filter turned on[/b], so our Kaspersky Internet Security 2015 is active. [url=https://postimg.org/image/5vuep8c8n/][img]https://s31.postimg.org/5vuep8c8n/TAP_NDIS.jpg[/img][/url] WHAT I HAVE TRIED - Which still causes frequent disconnects [list=1][*]IPVanish uses port 443 (HTTPS) for UDP – I turned off monitoring this port in KIS. No difference. [*]Tried using TCP instead of UDP, no difference. [*]Tried using servers in different cities, no difference. [*]“Respond Ping Request from WAN” was OFF on the ASUS router, turned this ON. No difference. [*]Manually installed TAP Adapter 9.21.2 instead of using IPVanish OpenVPN install prompt. [*]Updated to IPVansih 2.1.0 Windows Client released April 2016. [*]Clean install of TAP and IPV softwares [*] Worked extensively with IPV support for 2 weeks, and a little with KIS support[/list] SYSTEM DETAILS: Windows 7 (64), Kaspersky Internet Security 2015 TAP Windows 9.21.2, IPVanish Windows Client 2.1.0 Asus AC66U router IPVANISH LOG EXAMPLE (When is disconnects): [i]2016-05-24 17:18:47,336 Status changed to Connected 2016-05-24 17:20:04,164 Tue May 24 17:20:04 2016 [sjc-a04.ipvanish.com] Inactivity timeout (--ping-restart), restarting 2016-05-24 17:20:04,221 Status changed to Disconnected[/i]

So the absolute bottom line is: [list]If you do [u]not[/u] use the Kaspersky NDIS6 Filter driver bound to the Windows TAP Device the VPN works flawlessly ?[/list] Please provide exact details of these two drivers you are actually using.

Thanks so much for the help. That is correct, I uncheck (turn OFF) the NDIS 6 Filter in the Tap Adapter properties and the VPN works perfectly. Also, when this NDIS 6 is turned OFF, the [url=https://s32.postimg.org/u268q5w79/IPVanish.jpg/]map in the IPV application[/url] that shows the VPN's IP server location starts working. When the NDIS 6 filter is ON and VPN connected, the IPV application can't find this IP location, the map just displays [url=https://s32.postimg.org/ey7kkcqph/index.jpg/]"Looking up IP address"[/url]. Here's what the log says when this happens: [code]2016-05-24 16:46:38,942 Error while downloading IP information - try 1: System.Net.Http.HttpRequestException: An error occurred while sending the request. ----> System.Net.WebException: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel. ----> System.Security.Authentication.AuthenticationException: The remote certificate is invalid according to the validation procedure.[/code]The IPV app makes 25 attempts (try's) to find this IP, then stops trying. TAP Windows V9 (File version 9.21.2 Built by: WinDDK) [url=https://postimg.org/image/b2g1ggci9/][img]https://s32.postimg.org/b2g1ggci9/TAP.jpg[/img][/url] Kaspersky Antivirus NDIS 6 Filter (File version 8.0.0.105) [url=https://postimg.org/image/nah3qp2hd/][img]https://s32.postimg.org/nah3qp2hd/NDIS.jpg[/img][/url] The idea of disabling the KIS NDIS filter was something I read in another forum, a couple year old thread. It was the only approach I found that worked other than disabling the entire Kaspersky app. The below is from old [url=http://support.kaspersky.com/us/8596/]Kaspersky support pages about NDIS:[/url] [i][color=#FF0000][b]Warning[/b][/color] It is not recommended to use Kaspersky Anti-Virus NDIS Filter by disabling the option in Local Area Connection. That would make NDIS Filter to switch into a specific mode which could destabilize the entire operating system (e.g. cause a BSOD). [/i]

Please note: I do not intent to sound confrontational, unfortunately, it is [i]unavoidable[/i] at times .. [quote="AZmedia"]I disagree. OpenVPN has recognized and accepted Bug/Defect tickets between the Tap Adapter and Kaspersky NDIS Filter in other operating systems, ticket #592 regarding Windows 10 is just one example[/quote]I Disagree .. This ticket [url]https://community.openvpn.net/openvpn/ticket/592[/url] was opened as an [i]unknown problem[/i] related to installing TAP adaptor. It was later discovered that Kaspersky was [b]also[/b] interfering .. [quote="bananolu"]Seems to be Kaspersky NDIS 6 intermediate driver which interfere with TAP-windows. Uninstalling antivirus made Tap adapter appear in local network connections at once.[/quote] [quote="samuli"]I suggest contacting Kaspersky support, summarizing the problem and providing them with a link to this bug report. [b]There is nothing we can really do at the OpenVPN end[/b]. Replying to myself to clarify this a bit. The problem with antivirus software is that they add low-level hooks into the operating system. OpenVPN and tap-windows operate above those hooks and have no way to affect or modify the protective measures the antivirus has in place. If we could circumvent antivirus software, so could a virus. That said, I notified Kaspersky of this issue. I will let you guys know what their response is.[/quote]There is also a detailed reply post forwarded from Kaspersky themselves on that ticket .. The rest of that ticket returns to the initial problem of installing the TAP Adaptor .. Also, from Kaspersky: [url]http://support.kaspersky.com/us/8596[/url] [quote="Kaspersky support pages about NDIS: "What is Kaspersky Anti-Virus NDIS Filter in Kaspersky Anti-Virus version 6.0.4.x"][quote][b]Information[/b] Kaspersky Anti-Virus NDIS Filter is [b]not[/b] installed when installing Kaspersky Anti-Virus 6.0 [u]for Windows Servers[/u][/quote][/quote]No doubt because it will [u]not[/u] work with Windows servers and Kaspersky do not want to lose those business clients who run servers. If Kaspersky do not trust their own software enough that they even choose [u]not[/u] to install it with a Windows server then what do you expect if you install it on a user pc .. Sorry, but in my opinion that is Kaspersky [i]chickening out[/i] of the problem and [u]not[/u] resolving it. Clearly the Kaspersky NDIS Filter (which is [u]not[/u] an NDIS Device driver but a software filter) is [u]also[/u], or at least can be, incompatible with openvpn TAP NDIS driver. The openvpn TAP NDIS Driver is Free Open Source Software which means Kaspersky have full access to it and should be able to easily correct the problems in their own closed source software. There is nothing Openvpn developers can do to or with Kaspersky software. That said: You could set --[b]verb 4[/b] in your client config and then post your complete client log, including the disconnects .. perhaps (though very unlikely) there may be something which gives a hint as to the problem .. Finally: As I said before .. You pay for Kaspersky so make [b]them[/b] work for your money. Otherwise, vote with your wallet and take your Anti-virus business to another vendor ..

Frequent Disconnects "Inactivity Timeout" - Kaspersky NDIS Filter?

AZmedia

A real typical day - the VPN disconnected after 14, 16, 2, 20, 16, 2, 2, 1, and 4 minutes. I gave up.

My VPN disconnects frequently, sometimes after a couple minutes, sometimes longer. Using the IPVanish windows client, the log always shows “inactivity timeout” as the reason. To regain a VPN connection I right-click TAP Windows Adapter V9 and “Disable” then “Enable”. I can then connect the VPN again.

BUT....THE VPN WORKS GREAT IF - I uncheck the Kaspersky Anti-Virus NDIS 6 Filter in the TAP Windows Adapter V9 (below pic). The VPN never disconnects. However, I’m trying to find a way to stay connected with the NDIS filter turned on, so our Kaspersky Internet Security 2015 is active.

WHAT I HAVE TRIED - Which still causes frequent disconnects

IPVanish uses port 443 (HTTPS) for UDP – I turned off monitoring this port in KIS. No difference.
Tried using TCP instead of UDP, no difference.
Tried using servers in different cities, no difference.
“Respond Ping Request from WAN” was OFF on the ASUS router, turned this ON. No difference.
Manually installed TAP Adapter 9.21.2 instead of using IPVanish OpenVPN install prompt.
Updated to IPVansih 2.1.0 Windows Client released April 2016.
Clean install of TAP and IPV softwares
Worked extensively with IPV support for 2 weeks, and a little with KIS support

SYSTEM DETAILS:
Windows 7 (64), Kaspersky Internet Security 2015
TAP Windows 9.21.2, IPVanish Windows Client 2.1.0
Asus AC66U router

IPVANISH LOG EXAMPLE (When is disconnects):
2016-05-24 17:18:47,336 Status changed to Connected
2016-05-24 17:20:04,164 Tue May 24 17:20:04 2016 [sjc-a04.ipvanish.com] Inactivity timeout (--ping-restart), restarting
2016-05-24 17:20:04,221 Status changed to Disconnected

TinCanTech

Are you using the FREE service or do you pay for IPVanish ?

AZmedia

I pay for IPVanish, annual subsrcription last November. I gave up after the first 3 weeks but didn't cancel. I came back last month after IPV released a new client app with built in kill switch and other features. I still get the frequent disconnects. This forum is probably my last hope after 30+ hours of work and research.

When installing their IPV client app it prompts you to install the TAP driver. I've tried that process and also downloaded TAP from OpenVPN site and installed latest version, then install IPVanish.

TinCanTech

So the absolute bottom line is:

If you do not use the Kaspersky NDIS6 Filter driver bound to the Windows TAP Device the VPN works flawlessly ?

Please provide exact details of these two drivers you are actually using.

AZmedia

Thanks so much for the help. That is correct, I uncheck (turn OFF) the NDIS 6 Filter in the Tap Adapter properties and the VPN works perfectly.

Also, when this NDIS 6 is turned OFF, the map in the IPV application that shows the VPN's IP server location starts working. When the NDIS 6 filter is ON and VPN connected, the IPV application can't find this IP location, the map just displays "Looking up IP address". Here's what the log says when this happens:

2016-05-24 16:46:38,942 Error while downloading IP information - try 1: System.Net.Http.HttpRequestException: An error occurred while sending the request. ----> System.Net.WebException: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel. ----> System.Security.Authentication.AuthenticationException: The remote certificate is invalid according to the validation procedure.

The IPV app makes 25 attempts (try's) to find this IP, then stops trying.

TAP Windows V9 (File version 9.21.2 Built by: WinDDK)

Kaspersky Antivirus NDIS 6 Filter (File version 8.0.0.105)

The idea of disabling the KIS NDIS filter was something I read in another forum, a couple year old thread. It was the only approach I found that worked other than disabling the entire Kaspersky app. The below is from old Kaspersky support pages about NDIS:
Warning It is not recommended to use Kaspersky Anti-Virus NDIS Filter by disabling the option in Local Area Connection. That would make NDIS Filter to switch into a specific mode which could destabilize the entire operating system (e.g. cause a BSOD).

TinCanTech

Sorry, this forum only provides support for Openvpn .. I simply need to see the version of Windows TAP NDIS-6 Device Driver vs the Kaspersky NDIS-6 Filter driver.

If you pay for KIS then they are probably your best channel for a resolution. It is their driver which does not work and they are making money .. this forum is run by volunteers.

AZmedia

I disagree. OpenVPN has recognized and accepted Bug/Defect tickets between the Tap Adapter and Kaspersky NDIS Filter in other operating systems, ticket #592 regarding Windows 10 is just one example. So the Kaspersky products work fine, its the Tap Adapter compatibility that is at issue. Most don't want to turn OFF their internet security (Kaspersky) to run OpenVPN.

The reason I provided such detailed explanation and pics was in the hope this thread might the source for the slew of Windows 7 users to finally get answers. It apparently is not.

TinCanTech

Please note: I do not intent to sound confrontational, unfortunately, it is unavoidable at times ..

AZmedia wroteI disagree. OpenVPN has recognized and accepted Bug/Defect tickets between the Tap Adapter and Kaspersky NDIS Filter in other operating systems, ticket #592 regarding Windows 10 is just one example

I Disagree ..

This ticket https://community.openvpn.net/openvpn/ticket/592 was opened as an unknown problem related to installing TAP adaptor. It was later discovered that Kaspersky was also interfering ..

bananolu wroteSeems to be Kaspersky NDIS 6 intermediate driver which interfere with TAP-windows. Uninstalling antivirus made Tap adapter appear in local network connections at once.

samuli wroteI suggest contacting Kaspersky support, summarizing the problem and providing them with a link to this bug report. There is nothing we can really do at the OpenVPN end.

Replying to myself to clarify this a bit. The problem with antivirus software is that they add low-level hooks into the operating system. OpenVPN and tap-windows operate above those hooks and have no way to affect or modify the protective measures the antivirus has in place. If we could circumvent antivirus software, so could a virus.

That said, I notified Kaspersky of this issue. I will let you guys know what their response is.

There is also a detailed reply post forwarded from Kaspersky themselves on that ticket ..

The rest of that ticket returns to the initial problem of installing the TAP Adaptor ..

Also, from Kaspersky:
http://support.kaspersky.com/us/8596
[quote="Kaspersky support pages about NDIS: "What is Kaspersky Anti-Virus NDIS Filter in Kaspersky Anti-Virus version 6.0.4.x"]

Information Kaspersky Anti-Virus NDIS Filter is not installed when installing Kaspersky Anti-Virus 6.0 for Windows Servers

[/quote]No doubt because it will not work with Windows servers and Kaspersky do not want to lose those business clients who run servers. If Kaspersky do not trust their own software enough that they even choose not to install it with a Windows server then what do you expect if you install it on a user pc .. Sorry, but in my opinion that is Kaspersky chickening out of the problem and not resolving it.

Clearly the Kaspersky NDIS Filter (which is not an NDIS Device driver but a software filter) is also, or at least can be, incompatible with openvpn TAP NDIS driver.

The openvpn TAP NDIS Driver is Free Open Source Software which means Kaspersky have full access to it and should be able to easily correct the problems in their own closed source software. There is nothing Openvpn developers can do to or with Kaspersky software.

That said: You could set --verb 4 in your client config and then post your complete client log, including the disconnects .. perhaps (though very unlikely) there may be something which gives a hint as to the problem ..

Finally: As I said before .. You pay for Kaspersky so make them work for your money. Otherwise, vote with your wallet and take your Anti-virus business to another vendor ..

AZmedia

Two guys walk into a bar......

Thanks for the incredible insight and patience. I'm rolling up on 60 yrsold and some of this stuff just gets overwhelming.

Kaspersky closed my support ticket using KIS-2015 awhile back. So I moved to their latest product today and discovered KIS-2016 does not use or install "NDIS 6" filters in network adapters. I removed these key pieces of software using Revo Uninstallers (clean uninstalls) and then installed them in order - TAP, then IPVanish. I then connected to the VPN and installed KIS 2016.

With KIS-2015 the NDIS 6 filter was in every adapter properties - LAN, WAN, TAP, Wireless. With KIS-2016 the filter is just gone (see pic below). The bad news is the VPN still disconnects after a few minutes and no way uncheck this NDIS filter to keep the VPN connected. I started a new support ticket with Kaspersky.

TinCanTech

AZmedia wroteWith KIS-2016 the filter is just gone

Perhaps there is an install time option ?

TinCanTech wroteYou could set --verb 4 in your client config and then post your complete client log, including the disconnects .. perhaps (though very unlikely) there may be something which gives a hint as to the problem

You can try that if you like ..

I suspect that Kaspersky is blocking openvpn keepalive packets .. your server and client logs would help support that.

AZmedia

After 4 more hours today I learned a few new things.

I read others have had these "inactivity timeouts" with using wireless internet connection, but not when the device is wired. I have 3 active network connections. I am connecting the laptop to internet via wireless connection. I also have a wired LAN connection from laptop to a NAS (no internet connection) - the "interface metric" for this LAN was raised to 110 which insures the wireless adapter tries for internet access before the wired connection. The 3rd is the VPN when connected.

One person in older thread stated "the computer with the failing connection was not having ALL it’s network traffic handled over the VPN. Consequently it would fail to set an endpoint and as a result, eventually time out between the VPN server and device.....while VPN should automatically route all traffic, it’s possible that with wireless connections this is not happening be default and thus requires you to force it to route all traffic."

Kaspersky requested I repeat what I've already tired (scanning and port settings).

TinCanTech

AZmedia wrotethe computer with the failing connection was not having ALL it’s network traffic handled over the VPN. Consequently it would fail to set an endpoint and as a result, eventually time out between the VPN server and device

This is not correct. Regardless of redirecting default gateway, openvpn will set the VPN end point. If the VPN end point is not set then something else has gone wrong.

AZmedia wrotewhile VPN should automatically route all traffic, it’s possible that with wireless connections this is not happening be default and thus requires you to force it to route all traffic

Again .. there is no difference between a wired vs wireless connection to openvpn when using --redirect-gateway. So something else is at fault ..

AZmedia wroteOne person in older thread stated

Please post a link to the thread.

I will add, it is possible that the wireless connection is interfering with openvpn --keepalives, however, I am running a server and some clients on wireless and have no such issues.

AZmedia

I'm working on how to make logs from OpenVPN, contacting IPVanissh for help. Their client logs don't seem to have the detail neededd.

Here's the thread quoted above. Their issue was to many connections, was solved. Roxy comments on inactivity timeout are at bottom.
http://www.drmaciver.com/2012/05/openvpn-repeatedly-losing-connections-with-inactivity-timeout/

Here's a thread about wireless device OpenVPN connectionss dropping. Discuss pings, lease time, shows logs, etc. Resolution on page2 was to enable the VPN to 'route all traffic'.
https://www.techpowerup.com/forums/threads/solved-open-vpn-connection-dropping-outside-network-activity-on-only-one-of-three-devices.196262/

TinCanTech

IMHO Your first link is absolutely pointless .. the thread contains no openvpn details what-so-ever.
Every single reply is from a kiss-ass, with the exception of one link to server fault
and that only lists one possible reason for the first thread.
I would give that find 1 out of 10 for at least finding a solution ..

IMHO Your second link is written by somebody who has never read the openvpn manual.
Again, there are no detailed openvpn configs and the thread does not even have a log at --verb 4,
which is our official base line for diagnostic purposes ..
Also, not only are the conclusions incorrect but the OP does not understand basic networking terminology.
I would give that 0 out of 10.

Finally, why would you waste your time reading those threads when you know your problem is Kaspersky ?

Pro tip: use google site: operator like so .. Into google search field enter (example):

site:forums.openvpn.net inactivity timeout

This will list only results from this forum, which is a step up from all the wannabe tech-support (ahem) sites out there posting rubbish.

Link: https://support.google.com/websearch/answer/2466433

AZmedia

TinCan I think we found it.

I have a error in the IPVanish log that says - Warning: route gateway is ambiguous: 192.168.1.1 (2 matches). Notice the 2 matches statement.

The explanation around the net is: "The user had both a cabled connection and a wifi connection to the same network and such had the same default gateways on 2 different networks. Once one of the connections got disconnected the VPN-connection worked as expected."

I connect wirelessly to an Asus AC66U router for internet. I connect via ethernet cable to another Asus AC66U that only serves as a connection to our NAS (no internet). I believe both routers use their OEM 192.168.1.1 IP address. The only problem is that I need both the wireless connection and wired LAN connection at the same time. I will have to read more to figure out a fix. Any insight would helpful.

TinCanTech

Good grief ! :roll: This is why we ask for Configs and logs if you want help ..

This is the warning message which openvpn will generate:

src/openvpn/tun.c wrote
tun.c: msg (M_WARN, "NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.");

This is the message we give users on the Forum:

TinCanTech wroteAlso,
NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
:arrow: Never use 192.168.0.0/24 or 192.168.1.0/24 (or other common subnets) for your OpenVPN Server LAN :!:

You are advised to change your server LAN to a more unique RFC1918 compliant subnet. f.e 192.168.143.0/24

What you need to do is change both your subnets .. and make them unique to each other ie. Not the same !