Tunnelblick MacOS ok / OpenVPN GUI nok -> Same config

Seb28

Hi there from France,

I have a strange issue (I think) :

- From Tunnelblick on MacOS I can connect to my VPN server, ping my server and remote lan addresses, and route all network traffic from the client throught the server
- When using exactly the same config with OpenVPN GUI on Windows 7 or Windows Server 2012, I can connect to the serveur
but can't ping it, can't ping remote local adresses and can't surf on the web neither...

- My server configuration (/etc/openvpn/server.conf) :
mode server
proto tcp
port 443
dev tun
tls-server

ca ca.crt
cert server.crt
key server.key
dh dh2048.pem
tls-auth ta.key 1
key-direction 0
cipher AES-256-CBC

server 10.8.0.0 255.255.255.0
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
push "route 192.168.162.0 255.255.255.0"
push "route 192.100.1.0 255.255.255.0"
keepalive 10 120
keepalive 10 120

user nobody
group nogroup
chroot /etc/openvpn/jail
persist-key
persist-tun
comp-lzo

verb 3
mute 20
status openvpn-status.log
log-append /var/log/openvpn.log

- My client configuration (client.ovpn|conf)
dev tun
proto tcp-client
remote XX.XX.XX.XX 443
resolv-retry infinite
cipher AES-256-CBC
ca ca.crt
cert client.crt
key client.key
tls-auth ta.key 1
key-direction 1
dh dh2048.pem
tls-client
ifconfig 10.8.0.2 10.8.0.1
redirect-gateway def1
route-gateway 10.8.0.1
route 192.168.162.0 255.255.255.0
route 192.100.1.0 255.255.255.0
# Securite
nobind
persist-key
persist-tun
comp-lzo
verb 3

Does anyone have an idea about that ?

Thanks a lot 🙂

The Johan

Are you running openvpn gui as admin?

Seb28

Thx for you answser.

Yes I'm (logged as admin on Windows, and even tried right-click run as administrator too)

Seb28

Hi there,

I still have my issue. Anyone ?
Do you need additionnal informations ?

Thx in advance.

Seb28

Here the log of openvpn gui on windows serveur 2012 :

Thu Jan 12 13:44:56 2017 disabling NCP mode (--ncp-disable) because not in P2MP client or server mode
Thu Jan 12 13:44:56 2017 OpenVPN 2.4.0 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Dec 27 2016
Thu Jan 12 13:44:56 2017 Windows version 6.2 (Windows 8 or greater) 64bit
Thu Jan 12 13:44:56 2017 library versions: OpenSSL 1.0.2i 22 Sep 2016, LZO 2.09
Enter Management Password:
Thu Jan 12 13:44:56 2017 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Thu Jan 12 13:44:56 2017 Need hold release from management interface, waiting...
Thu Jan 12 13:44:57 2017 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Thu Jan 12 13:44:57 2017 MANAGEMENT: CMD 'state on'
Thu Jan 12 13:44:57 2017 MANAGEMENT: CMD 'log all on'
Thu Jan 12 13:44:57 2017 MANAGEMENT: CMD 'hold off'
Thu Jan 12 13:44:57 2017 MANAGEMENT: CMD 'hold release'
Thu Jan 12 13:44:57 2017 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Thu Jan 12 13:44:57 2017 MANAGEMENT: CMD 'password [...]'
Thu Jan 12 13:44:57 2017 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Thu Jan 12 13:44:57 2017 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Jan 12 13:44:57 2017 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Jan 12 13:44:57 2017 interactive service msg_channel=0
Thu Jan 12 13:44:57 2017 ROUTE_GATEWAY 192.168.1.1/255.255.255.0 I=12 HWADDR=08:00:27:02:50:75
Thu Jan 12 13:44:57 2017 open_tun
Thu Jan 12 13:44:57 2017 TAP-WIN32 device [Ethernet 2] opened: \\.\Global\{0EB5614D-AE8E-4C5A-87B0-E987533ABF48}.tap
Thu Jan 12 13:44:57 2017 TAP-Windows Driver Version 9.21
Thu Jan 12 13:44:57 2017 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.2/255.255.255.252 on interface {0EB5614D-AE8E-4C5A-87B0-E987533ABF48} [DHCP-serv: 10.8.0.1, lease-time: 31536000]
Thu Jan 12 13:44:57 2017 Successful ARP Flush on interface [15] {0EB5614D-AE8E-4C5A-87B0-E987533ABF48}
Thu Jan 12 13:44:57 2017 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Thu Jan 12 13:44:57 2017 MANAGEMENT: >STATE:1484225097,ASSIGN_IP,,10.8.0.2,,,,
Thu Jan 12 13:44:57 2017 TCP/UDP: Preserving recently used remote address: [AF_INET]XX.XX.XX.XX:443
Thu Jan 12 13:44:57 2017 Socket Buffers: R=[65536->65536] S=[65536->65536]
Thu Jan 12 13:44:57 2017 Attempting to establish TCP connection with [AF_INET]XX.XX.XX.XX:443 [nonblock]
Thu Jan 12 13:44:57 2017 MANAGEMENT: >STATE:1484225097,TCP_CONNECT,,,,,,
Thu Jan 12 13:44:58 2017 TCP connection established with [AF_INET]XX.XX.XX.XX:443
Thu Jan 12 13:44:58 2017 TCP_CLIENT link local: (not bound)
Thu Jan 12 13:44:58 2017 TCP_CLIENT link remote: [AF_INET]XX.XX.XX.XX:443
Thu Jan 12 13:44:58 2017 MANAGEMENT: >STATE:1484225098,WAIT,,,,,,
Thu Jan 12 13:44:58 2017 MANAGEMENT: >STATE:1484225098,AUTH,,,,,,
Thu Jan 12 13:44:58 2017 TLS: Initial packet from [AF_INET]XX.XX.XX.XX:443, sid=bd7b4157 b1f6125c
Thu Jan 12 13:44:58 2017 VERIFY OK: depth=1, C=FR, ST=FR, L=LOCATION, O=ORGANISATION, OU=ORGANISATION, CN=ORGANISATION CA, name=EasyRSA, emailAddress=user@mail.fr
Thu Jan 12 13:44:58 2017 VERIFY OK: depth=0, C=FR, ST=FR, L=LOCATION, O=ORGANISATION, OU=ORGANISATION, CN=server, name=EasyRSA, emailAddress=user@mail.fr
Thu Jan 12 13:44:59 2017 WARNING: 'ifconfig' is present in local config but missing in remote config, local='ifconfig 10.8.0.2 10.8.0.1'
Thu Jan 12 13:44:59 2017 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Thu Jan 12 13:44:59 2017 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Jan 12 13:44:59 2017 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Thu Jan 12 13:44:59 2017 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Jan 12 13:44:59 2017 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Thu Jan 12 13:44:59 2017 [server] Peer Connection Initiated with [AF_INET]XX.XX.XX.XX:443
Thu Jan 12 13:45:05 2017 TEST ROUTES: 3/3 succeeded len=2 ret=1 a=0 u/d=up
Thu Jan 12 13:45:05 2017 C:\Windows\system32\route.exe ADD XX.XX.XX.XX MASK 255.255.255.255 192.168.1.1
Thu Jan 12 13:45:05 2017 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=10 and dwForwardType=4
Thu Jan 12 13:45:05 2017 Route addition via IPAPI succeeded [adaptive]
Thu Jan 12 13:45:05 2017 C:\Windows\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.8.0.1
Thu Jan 12 13:45:05 2017 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Thu Jan 12 13:45:05 2017 Route addition via IPAPI succeeded [adaptive]
Thu Jan 12 13:45:05 2017 C:\Windows\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.8.0.1
Thu Jan 12 13:45:05 2017 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Thu Jan 12 13:45:05 2017 Route addition via IPAPI succeeded [adaptive]
Thu Jan 12 13:45:05 2017 MANAGEMENT: >STATE:1484225105,ADD_ROUTES,,,,,,
Thu Jan 12 13:45:05 2017 C:\Windows\system32\route.exe ADD 192.168.162.0 MASK 255.255.255.0 10.8.0.1
Thu Jan 12 13:45:05 2017 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Thu Jan 12 13:45:05 2017 Route addition via IPAPI succeeded [adaptive]
Thu Jan 12 13:45:05 2017 C:\Windows\system32\route.exe ADD 192.100.1.0 MASK 255.255.255.0 10.8.0.1
Thu Jan 12 13:45:05 2017 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Thu Jan 12 13:45:05 2017 Route addition via IPAPI succeeded [adaptive]
Thu Jan 12 13:45:05 2017 Initialization Sequence Completed
Thu Jan 12 13:45:05 2017 MANAGEMENT: >STATE:1484225105,CONNECTED,SUCCESS,10.8.0.2,XX.XX.XX.XX,443,192.168.1.36,49177

TiTex

remove these lines from client config , and make sure that "DHCP Client" service is running

key-direction 1
dh dh2048.pem
ifconfig 10.8.0.2 10.8.0.1
redirect-gateway def1
route-gateway 10.8.0.1
route 192.168.162.0 255.255.255.0
route 192.100.1.0 255.255.255.0

and these from server config

key-direction 0
keepalive 10 120 #second line , it seems like you have the same parameter twice

replace tls-auth ta.key 1 with tls-auth ta.key 0 in server config

also , are you sure that you configured correctly the environment for "chroot" ?

Seb28

Thx for your quick answer,

by removing the indicated line I've got this error in the log :

Options error : on Windows, --ifconfig is required when --dev tun is used

And when i disable the dev tun option I've got :

Options error : You must define TUN/TAP device (--dev)

TiTex

try this config

client
dev tun
proto tcp-client
remote XX.XX.XX.XX 443
resolv-retry infinite
cipher AES-256-CBC
ca ca.crt
cert client.crt
key client.key
tls-auth ta.key 1
# Securite
nobind
persist-key
persist-tun
comp-lzo
verb 3

Seb28

Thx again,

I tried the config, same result, I can connect to the server, but can't ping remote local addresses nor surf the web.
Following the log of openvpn client

Thu Jan 12 14:29:10 2017 OpenVPN 2.4.0 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Dec 27 2016
Thu Jan 12 14:29:10 2017 Windows version 6.2 (Windows 8 or greater) 64bit
Thu Jan 12 14:29:10 2017 library versions: OpenSSL 1.0.2i 22 Sep 2016, LZO 2.09
Enter Management Password:
Thu Jan 12 14:29:10 2017 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Thu Jan 12 14:29:10 2017 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Thu Jan 12 14:29:10 2017 TCP/UDP: Preserving recently used remote address: [AF_INET]XX.XX.XXX.XX:443
Thu Jan 12 14:29:10 2017 Attempting to establish TCP connection with [AF_INET]XX.XX.XXX.XX:443 [nonblock]
Thu Jan 12 14:29:11 2017 TCP connection established with [AF_INET]XX.XX.XXX.XX:443
Thu Jan 12 14:29:11 2017 TCP_CLIENT link local: (not bound)
Thu Jan 12 14:29:11 2017 TCP_CLIENT link remote: [AF_INET]XX.XX.XXX.XX:443
Thu Jan 12 14:29:12 2017 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1559', remote='link-mtu 1560'
Thu Jan 12 14:29:12 2017 WARNING: 'comp-lzo' is present in remote config but missing in local config, remote='comp-lzo'
Thu Jan 12 14:29:12 2017 [server] Peer Connection Initiated with [AF_INET]XX.XX.XXX.XX:443
Thu Jan 12 14:29:13 2017 open_tun
Thu Jan 12 14:29:13 2017 TAP-WIN32 device [Ethernet 2] opened: \\.\Global\{0EB5614D-AE8E-4C5A-87B0-E987533ABF48}.tap
Thu Jan 12 14:29:13 2017 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.6/255.255.255.252 on interface {0EB5614D-AE8E-4C5A-87B0-E987533ABF48} [DHCP-serv: 10.8.0.5, lease-time: 31536000]
Thu Jan 12 14:29:13 2017 Successful ARP Flush on interface [15] {0EB5614D-AE8E-4C5A-87B0-E987533ABF48}
Thu Jan 12 14:29:13 2017 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Thu Jan 12 14:29:18 2017 Initialization Sequence Completed

TiTex

first take care of these warning

Thu Jan 12 14:29:12 2017 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1559', remote='link-mtu 1560'
Thu Jan 12 14:29:12 2017 WARNING: 'comp-lzo' is present in remote config but missing in local config, remote='comp-lzo'

then check your server if it's doing ip routing + NAT

Seb28

Thx man for your answer, fix tun-mtu on both side and add comp-lzo on client conf seems to save the day !

With my kink regards ! 🙂