OpenVPN not working on Windows client only

jpknz

I have recently set-up a VPN server on a Raspberry Pi and it works fine on all devices (Mac, iOS) except my windows machine. I've tried various different things to resolve it but don't seem to be making progress. This is an old work laptop so I'm guessing something configured for the work environment is causing an issue. Unfortunately I don't have another windows machine to test that theory on right now.

Any ideas would be appreciated.

ipconfig without connecting to the VPN. Everything works normally as it should.

Ethernet adapter Local Area Connection 2:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :

Wireless LAN adapter Wireless Network Connection 3:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :

Wireless LAN adapter Wireless Network Connection 2:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :

Wireless LAN adapter Wireless Network Connection:

   Connection-specific DNS Suffix  . : lan
   IPv4 Address. . . . . . . . . . . : 192.168.0.220
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 192.168.0.1

Ethernet adapter Local Area Connection:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :

ipconfig when connected to the VPN

Ethernet adapter Local Area Connection 2:

   Connection-specific DNS Suffix  . :
   IPv4 Address. . . . . . . . . . . : 10.8.0.5
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . :

Wireless LAN adapter Wireless Network Connection 3:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :

Wireless LAN adapter Wireless Network Connection 2:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :

Wireless LAN adapter Wireless Network Connection:

   Connection-specific DNS Suffix  . : lan
   IPv4 Address. . . . . . . . . . . : 192.168.0.220
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 192.168.0.1

Ethernet adapter Local Area Connection:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :

I can ping IP addresses when connected to the VPN but if i try to connect to an IP address in a browser I get DNS_PROBE_FINISHED_BAD_CONFIG which is the same as I get when entering an address.
nslookups timeout when connected to the VPN

DNS request timed out.
    timeout was 2 seconds.
Server:  UnKnown
Address:  192.168.0.5

DNS request timed out.
    timeout was 2 seconds.
DNS request timed out.
    timeout was 2 seconds.
DNS request timed out.
    timeout was 2 seconds.
DNS request timed out.
    timeout was 2 seconds.
*** Request to UnKnown timed-out

But work fine when not connected to it. The difference seems to be that the DNS server is unknown even though the IP address is listed right below it.

Server:  pi.hole
Address:  192.168.0.5

Non-authoritative answer:
Name:    google.com
Addresses:  2a00:1450:4009:80f::200e
          216.58.204.14

Connection log below

Mon Aug 13 16:46:51 2018 OpenVPN 2.4.6 i686-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Apr 26 2018
Mon Aug 13 16:46:51 2018 Windows version 6.1 (Windows 7) 32bit
Mon Aug 13 16:46:51 2018 library versions: OpenSSL 1.1.0h  27 Mar 2018, LZO 2.10
Enter Management Password:
Mon Aug 13 16:46:51 2018 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Mon Aug 13 16:46:51 2018 Need hold release from management interface, waiting...
Mon Aug 13 16:46:52 2018 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Mon Aug 13 16:46:52 2018 MANAGEMENT: CMD 'state on'
Mon Aug 13 16:46:52 2018 MANAGEMENT: CMD 'log all on'
Mon Aug 13 16:46:52 2018 MANAGEMENT: CMD 'echo all on'
Mon Aug 13 16:46:52 2018 MANAGEMENT: CMD 'bytecount 5'
Mon Aug 13 16:46:52 2018 MANAGEMENT: CMD 'hold off'
Mon Aug 13 16:46:52 2018 MANAGEMENT: CMD 'hold release'
Mon Aug 13 16:46:52 2018 MANAGEMENT: CMD 'password [...]'
Mon Aug 13 16:46:52 2018 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Mon Aug 13 16:46:52 2018 Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Mon Aug 13 16:46:52 2018 Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Mon Aug 13 16:46:52 2018 Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
Mon Aug 13 16:46:52 2018 Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
Mon Aug 13 16:46:52 2018 MANAGEMENT: >STATE:1534175212,RESOLVE,,,,,,
Mon Aug 13 16:46:52 2018 TCP/UDP: Preserving recently used remote address: [AF_INET]<REMOVEDIP>:1194
Mon Aug 13 16:46:52 2018 Socket Buffers: R=[8192->8192] S=[64512->64512]
Mon Aug 13 16:46:52 2018 UDP link local: (not bound)
Mon Aug 13 16:46:52 2018 UDP link remote: [AF_INET]<REMOVEDIP>:1194
Mon Aug 13 16:46:52 2018 MANAGEMENT: >STATE:1534175212,WAIT,,,,,,
Mon Aug 13 16:46:52 2018 MANAGEMENT: >STATE:1534175212,AUTH,,,,,,
Mon Aug 13 16:46:52 2018 TLS: Initial packet from [AF_INET]<REMOVEDIP>:1194, sid=5641ac13 bc94b719
Mon Aug 13 16:46:52 2018 VERIFY OK: depth=1, CN=ChangeMe
Mon Aug 13 16:46:52 2018 VERIFY KU OK
Mon Aug 13 16:46:52 2018 Validating certificate extended key usage
Mon Aug 13 16:46:52 2018 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Mon Aug 13 16:46:52 2018 VERIFY EKU OK
Mon Aug 13 16:46:52 2018 VERIFY X509NAME OK: CN=server_A6pITwdykFLKh8qh
Mon Aug 13 16:46:52 2018 VERIFY OK: depth=0, CN=server_A6pITwdykFLKh8qh
Mon Aug 13 16:46:52 2018 Control Channel: TLSv1.2, cipher TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384, 4096 bit RSA
Mon Aug 13 16:46:52 2018 [server_A6pITwdykFLKh8qh] Peer Connection Initiated with [AF_INET]94.13.143.111:1194
Mon Aug 13 16:46:53 2018 MANAGEMENT: >STATE:1534175213,GET_CONFIG,,,,,,
Mon Aug 13 16:46:53 2018 SENT CONTROL [server_A6pITwdykFLKh8qh]: 'PUSH_REQUEST' (status=1)
Mon Aug 13 16:46:53 2018 PUSH: Received control message: 'PUSH_REPLY,dhcp-option DNS 192.168.0.5,block-outside-dns,redirect-gateway def1,route-gateway 10.8.0.1,topology subnet,ping 1800,ping-restart 3600,ifconfig 10.8.0.5 255.255.255.0,peer-id 0,cipher AES-256-GCM'
Mon Aug 13 16:46:53 2018 OPTIONS IMPORT: timers and/or timeouts modified
Mon Aug 13 16:46:53 2018 OPTIONS IMPORT: --ifconfig/up options modified
Mon Aug 13 16:46:53 2018 OPTIONS IMPORT: route options modified
Mon Aug 13 16:46:53 2018 OPTIONS IMPORT: route-related options modified
Mon Aug 13 16:46:53 2018 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Mon Aug 13 16:46:53 2018 OPTIONS IMPORT: peer-id set
Mon Aug 13 16:46:53 2018 OPTIONS IMPORT: adjusting link_mtu to 1625
Mon Aug 13 16:46:53 2018 OPTIONS IMPORT: data channel crypto options modified
Mon Aug 13 16:46:53 2018 Data Channel: using negotiated cipher 'AES-256-GCM'
Mon Aug 13 16:46:53 2018 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Mon Aug 13 16:46:53 2018 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Mon Aug 13 16:46:53 2018 interactive service msg_channel=352
Mon Aug 13 16:46:53 2018 ROUTE_GATEWAY 192.168.0.1/255.255.255.0 I=12 HWADDR=d8:fc:93:04:b4:fb
Mon Aug 13 16:46:53 2018 open_tun
Mon Aug 13 16:46:53 2018 TAP-WIN32 device [Local Area Connection 2] opened: \\.\Global\{61757DE8-94EC-4AE7-A25D-CA0333AB1B1A}.tap
Mon Aug 13 16:46:53 2018 TAP-Windows Driver Version 9.21 
Mon Aug 13 16:46:53 2018 Set TAP-Windows TUN subnet mode network/local/netmask = 10.8.0.0/10.8.0.5/255.255.255.0 [SUCCEEDED]
Mon Aug 13 16:46:53 2018 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.5/255.255.255.0 on interface {61757DE8-94EC-4AE7-A25D-CA0333AB1B1A} [DHCP-serv: 10.8.0.254, lease-time: 31536000]
Mon Aug 13 16:46:53 2018 Successful ARP Flush on interface [17] {61757DE8-94EC-4AE7-A25D-CA0333AB1B1A}
Mon Aug 13 16:46:53 2018 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Mon Aug 13 16:46:53 2018 MANAGEMENT: >STATE:1534175213,ASSIGN_IP,,10.8.0.5,,,,
Mon Aug 13 16:46:53 2018 Blocking outside dns using service succeeded.
Mon Aug 13 16:46:58 2018 TEST ROUTES: 1/1 succeeded len=0 ret=1 a=0 u/d=up
Mon Aug 13 16:46:58 2018 C:\WINDOWS\system32\route.exe ADD 94.13.143.111 MASK 255.255.255.255 192.168.0.1
Mon Aug 13 16:46:58 2018 Route addition via service succeeded
Mon Aug 13 16:46:58 2018 C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.8.0.1
Mon Aug 13 16:46:58 2018 Route addition via service succeeded
Mon Aug 13 16:46:58 2018 C:\WINDOWS\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.8.0.1
Mon Aug 13 16:46:58 2018 Route addition via service succeeded
Mon Aug 13 16:46:58 2018 Initialization Sequence Completed
Mon Aug 13 16:46:58 2018 MANAGEMENT: >STATE:1534175218,CONNECTED,SUCCESS,10.8.0.5,94.13.143.111,1194,,

Any help would be appreciated.
Thanks

nathandev

I can ping IP addresses when connected to the VPN but if i try to connect to an IP address in a browser I get DNS_PROBE_FINISHED_BAD_CONFIG which is the same as I get when entering an address.
nslookups timeout when connected to the VPN
DNS request timed out.
timeout was 2 seconds.
Server: UnKnown
Address: 192.168.0.5

You need to renew your Ip address. If this doesn't help, The DNS servers you are using may be overloaded. This is especially likely if this is an intermittent problem.

Google Public DNS operates recursive name servers for public use at the following IP addresses: 8.8.8.8 and 8.8.4.4 for IPv4 service, as well as 2001:4860:4860::8888 and 2001:4860:4860::8844, for IPv6 access. The addresses are mapped to the nearest operational server by anycast routing. I suggest you try those and see if you get better results.

Although in my case I tried this guide https://techloris.com/dns_probe_finished_nxdomain/ but could not determine what the hell was wrong with my connection. About two hours later my internet connection went back to normal finally.

nathandev

Thanks for the formatting. I tried it but it didn't work.

Pippin

This topic is from 2018...