Open VPN GUI connects to server but not working

houmie

Hi all,

I can connect to my OpenVPN server via my OpenVPN.ovpn config on two iPhones and TunnelBlick (Macbook Pro). But when it comes to a windows laptop the same config doesn't seem to work properly with OpenVPN GUI. After some time it seems to connect and it turns green, but the forbidden websites remain inaccessible. (I'm in Iran and some web pages are filtered, hence I need VPN)

Log:

Sun Nov 20 17:55:28 2016 OpenVPN 2.3.13 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Nov  3 2016
Sun Nov 20 17:55:28 2016 Windows version 6.1 (Windows 7) 64bit
Sun Nov 20 17:55:28 2016 library versions: OpenSSL 1.0.1u  22 Sep 2016, LZO 2.09
Enter Management Password:
Sun Nov 20 17:55:29 2016 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Sun Nov 20 17:55:29 2016 UDPv4 link local (bound): [undef]
Sun Nov 20 17:55:29 2016 UDPv4 link remote: [AF_INET]x.0.x.10:3194
Sun Nov 20 17:55:29 2016 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Sun Nov 20 17:55:30 2016 WARNING: INSECURE cipher with block size less than 128 bit (64 bit).  This allows attacks like SWEET32.  Mitigate by using a --cipher with a larger block size (e.g. AES-256-CBC).
Sun Nov 20 17:55:30 2016 WARNING: INSECURE cipher with block size less than 128 bit (64 bit).  This allows attacks like SWEET32.  Mitigate by using a --cipher with a larger block size (e.g. AES-256-CBC).
Sun Nov 20 17:55:30 2016 [x.diskstation.me] Peer Connection Initiated with [AF_INET]x.0.x.10:3194
Sun Nov 20 17:55:32 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Sun Nov 20 17:55:32 2016 open_tun, tt->ipv6=0
Sun Nov 20 17:55:32 2016 TAP-WIN32 device [Local Area Connection 3] opened: \\.\Global\x.tap
Sun Nov 20 17:55:32 2016 Notified TAP-Windows driver to set a DHCP IP/netmask of xx.8.0.x/255.255.255.252 on interface x [DHCP-serv: x.8.0.x, lease-time: 31536000]
Sun Nov 20 17:55:32 2016 Successful ARP Flush on interface [31] x
Sun Nov 20 17:56:07 2016 Warning: route gateway is not reachable on any active network adapters: 10.8.0.5
Sun Nov 20 17:56:07 2016 env_block: add PATH=C:\Windows\System32;C:\Windows;C:\Windows\System32\Wbem
Sun Nov 20 17:56:07 2016 Warning: route gateway is not reachable on any active network adapters: 10.8.0.5
Sun Nov 20 17:56:07 2016 env_block: add PATH=C:\Windows\System32;C:\Windows;C:\Windows\System32\Wbem
Sun Nov 20 17:56:07 2016 Warning: route gateway is not reachable on any active network adapters: 10.8.0.5
Sun Nov 20 17:56:07 2016 env_block: add PATH=C:\Windows\System32;C:\Windows;C:\Windows\System32\Wbem
Sun Nov 20 17:56:07 2016 Warning: route gateway is not reachable on any active network adapters: 10.8.0.5
Sun Nov 20 17:56:07 2016 env_block: add PATH=C:\Windows\System32;C:\Windows;C:\Windows\System32\Wbem
SYSTEM ROUTING TABLE
0.0.0.0 0.0.0.0 192.168.1.1 p=0 i=14 t=4 pr=3 a=6651 h=0 m=281/0/0/0/0
0.0.0.0 128.0.0.0 10.8.0.5 p=0 i=14 t=4 pr=3 a=0 h=0 m=26/0/0/0/0
10.8.0.0 255.255.255.0 10.8.0.5 p=0 i=14 t=4 pr=3 a=0 h=0 m=26/0/0/0/0
10.8.0.1 255.255.255.255 10.8.0.5 p=0 i=14 t=4 pr=3 a=0 h=0 m=26/0/0/0/0
127.0.0.0 255.0.0.0 127.0.0.1 p=0 i=1 t=3 pr=3 a=6694 h=0 m=306/0/0/0/0
127.0.0.1 255.255.255.255 127.0.0.1 p=0 i=1 t=3 pr=3 a=6694 h=0 m=306/0/0/0/0
127.255.255.255 255.255.255.255 127.0.0.1 p=0 i=1 t=3 pr=3 a=6694 h=0 m=306/0/0/0/0
128.0.0.0 128.0.0.0 10.8.0.5 p=0 i=14 t=4 pr=3 a=0 h=0 m=26/0/0/0/0
141.0.147.10 255.255.255.255 192.168.1.1 p=0 i=14 t=4 pr=3 a=0 h=0 m=25/0/0/0/0
169.254.0.0 255.255.0.0 169.254.11.61 p=0 i=31 t=3 pr=3 a=3615 h=0 m=276/0/0/0/0
169.254.11.61 255.255.255.255 169.254.11.61 p=0 i=31 t=3 pr=3 a=3615 h=0 m=276/0/0/0/0
169.254.255.255 255.255.255.255 169.254.11.61 p=0 i=31 t=3 pr=3 a=3615 h=0 m=276/0/0/0/0
192.168.1.0 255.255.255.0 192.168.1.199 p=0 i=14 t=3 pr=3 a=6646 h=0 m=281/0/0/0/0
192.168.1.199 255.255.255.255 192.168.1.199 p=0 i=14 t=3 pr=3 a=6646 h=0 m=281/0/0/0/0
192.168.1.255 255.255.255.255 192.168.1.199 p=0 i=14 t=3 pr=3 a=6646 h=0 m=281/0/0/0/0
224.0.0.0 240.0.0.0 127.0.0.1 p=0 i=1 t=3 pr=3 a=6694 h=0 m=306/0/0/0/0
224.0.0.0 240.0.0.0 192.168.1.199 p=0 i=14 t=3 pr=3 a=6651 h=0 m=281/0/0/0/0
224.0.0.0 240.0.0.0 169.254.11.61 p=0 i=31 t=3 pr=3 a=3780 h=0 m=276/0/0/0/0
255.255.255.255 255.255.255.255 127.0.0.1 p=0 i=1 t=3 pr=3 a=6694 h=0 m=306/0/0/0/0
255.255.255.255 255.255.255.255 192.168.1.199 p=0 i=14 t=3 pr=3 a=6651 h=0 m=281/0/0/0/0
255.255.255.255 255.255.255.255 169.254.11.61 p=0 i=31 t=3 pr=3 a=3780 h=0 m=276/0/0/0/0
SYSTEM ADAPTER LIST
TAP-Windows Adapter V9
  Index = 31
  GUID = x
  IP = x.x.11.61/255.255.0.0 
  MAC = x
  GATEWAY = 0.0.0.0/255.255.255.255 
  DHCP SERV =  
  DHCP LEASE OBTAINED = Sun Nov 20 17:56:07 2016
  DHCP LEASE EXPIRES  = Sun Nov 20 17:56:07 2016
  DNS SERV =  
TAP Adapter V9 for Private Tunnel
  Index = 15
  GUID = x
  IP = 0.0.0.0/0.0.0.0 
  MAC = x
  GATEWAY = 0.0.0.0/255.255.255.255 
  DHCP SERV =  
  DHCP LEASE OBTAINED = Sun Nov 20 17:56:07 2016
  DHCP LEASE EXPIRES  = Sun Nov 20 17:56:07 2016
  DNS SERV =  
Realtek RTL8723BE Wireless LAN 802.11n PCI-E NIC
  Index = 14
  GUID = x
  IP = 192.168.1.199/255.255.255.0 
  MAC = x
  GATEWAY = 192.168.1.1/255.255.255.255 
  DNS SERV = 208.67.222.222/255.255.255.255 208.67.220.220/255.255.255.255 
Bluetooth Device (Personal Area Network)
  Index = 13
  GUID = x
  IP = 0.0.0.0/0.0.0.0 
  MAC = x
  GATEWAY = 0.0.0.0/255.255.255.255 
  DHCP SERV =  
  DHCP LEASE OBTAINED = Sun Nov 20 17:56:07 2016
  DHCP LEASE EXPIRES  = Sun Nov 20 17:56:07 2016
  DNS SERV =  
Realtek PCIe GBE Family Controller
  Index = 11
  GUID = x
  IP = 0.0.0.0/0.0.0.0 
  MAC = x
  GATEWAY = 0.0.0.0/255.255.255.255 
  DHCP SERV =  
  DHCP LEASE OBTAINED = Sun Nov 20 17:56:07 2016
  DHCP LEASE EXPIRES  = Sun Nov 20 17:56:07 2016
  DNS SERV =  
Sun Nov 20 17:56:07 2016 Initialization Sequence Completed With Errors ( see http://openvpn.net/faq.html#dhcpclientserv )

The config:

dev tun
tls-client
remote x.diskstation.me 3194
redirect-gateway def1
pull
proto udp
script-security 2
comp-lzo
reneg-sec 0
<ca>
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
</ca>
auth-user-pass cred.txt

TinCanTech

Please see:
HOWTO: Request Help !

houmie

Thank you for your reply.

The client is OpenVPN GUI 2.3.13 on Windows.
VPN Server is on my Synology NAS server with the version 1.3.4-2750.
I have already anonymised the public IPs, have I missed anything?

TinCanTech

houmie wrotehave I missed anything?

Your server config file is important ..

However:

houmie wrotewindows laptop the same config doesn't seem to work

houmie wroteSun Nov 20 17:55:32 2016 TAP-WIN32 device [Local Area Connection 3] opened: \\.\Global\x.tap
Sun Nov 20 17:55:32 2016 Notified TAP-Windows driver to set a DHCP IP/netmask of xx.8.0.x/255.255.255.252 on interface x [DHCP-serv: x.8.0.x, lease-time: 31536000]
Sun Nov 20 17:55:32 2016 Successful ARP Flush on interface [31] x
Sun Nov 20 17:56:07 2016 Warning: route gateway is not reachable on any active network adapters: 10.8.0.5

You must start the Windows DHCP-Client Service

FYI:

server 10.8.0.0 255.255.255.0  #  This is a private IP address which
                               #  can *not* be used to hack your network

Ref:
https://forums.openvpn.net/viewtopic.php?f=30&t=22603

houmie

Thank you, that was very helpful. I ended up wiping Win7 and replacing it with win 10, as the firewall and dhcp service were corrupted.

houmie

However while win 10 now connects properly with my VPN server, it doesn't work so well like my Macbook pro with Tunnelblick.
Tunnelblick on Mac and OpenVPN GUI on Win10 share the exact same OpenVPN config file.

Yet I can access facebook via Tunnelblick, but I can't access facebook on windows10 via OpenVPN GUI. Somehow the entire traffic isn't yet over the VPN, hence facebook remains blocked. It just says facebook site can't be reached.

I'm unsure if I should provide the server settings because it looks more like a client issue to me.

For convenience here is the config file:

remote x.diskstation.me 3194
redirect-gateway def1
pull
proto udp
script-security 2
comp-lzo
reneg-sec 0
<ca>
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
</ca>
auth-user-pass cred.txt

FYI I have set the DNS to OpenDNS already.

Many Thanks for advice,

houmie

I forgot to attach the log file:

The log file of OpenVPN GUI:

Fri Nov 25 12:27:24 2016 OpenVPN 2.3.13 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Nov  3 2016
Fri Nov 25 12:27:24 2016 Windows version 6.2 (Windows 8 or greater) 64bit
Fri Nov 25 12:27:24 2016 library versions: OpenSSL 1.0.1u  22 Sep 2016, LZO 2.09
Fri Nov 25 12:27:24 2016 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Fri Nov 25 12:27:25 2016 UDPv4 link local (bound): [undef]
Fri Nov 25 12:27:25 2016 UDPv4 link remote: [AF_INET]x:3194
Fri Nov 25 12:27:25 2016 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Fri Nov 25 12:27:26 2016 WARNING: INSECURE cipher with block size less than 128 bit (64 bit).  This allows attacks like SWEET32.  Mitigate by using a --cipher with a larger block size (e.g. AES-256-CBC).
Fri Nov 25 12:27:26 2016 WARNING: INSECURE cipher with block size less than 128 bit (64 bit).  This allows attacks like SWEET32.  Mitigate by using a --cipher with a larger block size (e.g. AES-256-CBC).
Fri Nov 25 12:27:26 2016 [x.y.me] Peer Connection Initiated with [AF_INET]x:3194
Fri Nov 25 12:27:28 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Fri Nov 25 12:27:28 2016 open_tun, tt->ipv6=0
Fri Nov 25 12:27:28 2016 TAP-WIN32 device [Ethernet 2] opened: \\.\Global\{xxx}.tap
Fri Nov 25 12:27:28 2016 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.6/255.255.255.252 on interface {xxx} [DHCP-serv: 10.8.0.5, lease-time: 31536000]
Fri Nov 25 12:27:28 2016 Successful ARP Flush on interface [30] {x}
Fri Nov 25 12:27:33 2016 Initialization Sequence Completed
Fri Nov 25 12:36:42 2016 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #16797 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Fri Nov 25 12:36:42 2016 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #16798 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Fri Nov 25 12:36:42 2016 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #16800 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
...
Fri Nov 25 15:27:07 2016 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #91598 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Fri Nov 25 15:52:09 2016 write UDPv4: No buffer space available (WSAENOBUFS) (code=10055)