OpenVPN Full uninstallation from Win7 (and Linux, as well)

RogerT

Hi,

How can I have a full OpenVPN uninstallation on Win7?
Surprinsingly, I found nothing in OpenVPN documentation and in the forum about that?
And what about a full OpenVPN uninstallation on Linux (Debian or whatever)? I don't have the problem ther but it would be good to know too about that.

DETAILS
My OpenVPN setup on Win7 64 was fine.
But I forgot the password required by the OpenVPN GUI to operate.
So I decided to uninstall OpenVPN (openvpn-install-2.3.10-I602-x86_64.exe) and reinstall it (openvpn-install-2.4.6-I602.exe).
The GUI did not ask me to setup a password but instead asked me the password (obviously thep previous one).
So, I uninstalled OpenVPN again and did some simple manual cleaning operations in my Windows registry. But it didn't work.
Some software on the net propose a "full OpenVPN removal" but I can't install such a .exe on my machine for safety reasons.

Thanks
Best regards

TinCanTech

Who's server do you connect to ?

RogerT

I'm connecting to my homebox which provides VPN facilities (FreeBox Revolution)

TinCanTech

If you are running your own server then there is a fairly steep learning curve.

I suggest you start here:
https://openvpn.net/index.php/open-source/documentation/howto.html

As for your other point:

RogerT wrote But I forgot the password required by the OpenVPN GUI to operate.

The password is either in the certificate or the server .. either way uninstalling and reinstalling openvpn will have no effect on that.

RogerT

I've read the HowTo OpenVPN page, which is very rich and clear (I remember that I found subtle and useful explanations for my first OpenVPN setups).
I currrently manage this OpenVPN server and all Linux clients with no problems. I know most of the beginners traps about OpenVPN.
My only and new problem is about this GUI PWD problem with a Win7 machine.

To be 100% sure that I was clear in my first message :
I'm NOT talking about the user PWD (and user ID) defined within the OpenVPN server that may be used to produce some of the connection files (ca.crt client.crt client.crt client.ovpn).
I'm talking about the PWD that protects Windows OpenVPN GUI (accessible from system tray). I remember I setup manually that specific PWD , which I lost.

In the GUI, today, I've just tried the user ID and PWD (regarding OpenVPN server). It doesn't work.

Do you know where is this OpenVPN GUI password is stored ?
And, of course, how to "reinstall OpenVPN with no password/reset this GUI PWD" ?

Is there some "simple" brute force tool I can try to find that OpenVPN GUI PWD ?

Thanks

TinCanTech

RogerT wrote Do you know where is this OpenVPN GUI password is stored ?

I believe it is in the Windows Registry : HKCU\Software\OpenVPN-GUI .. somewhere.

If you find it you can help by improving this:
https://community.openvpn.net/openvpn/wiki/OpenVPN-GUI-New

RogerT

1/ I've "fixed" the ID/PWD required by OpenVPN GUI in Windows as I usually do it with Linux machines (as root):
Now, ID and PWD are no more asked by OpenVPN GUI:
For that, in xxx.ovpn file, I've replaced :
auth-user-pass
with
auth-user-pass "D:\\path-to-config-file\\login.txt"
Be careful: \ in the Windows path must be replaced by \\

* Possible conclusion : ID and PWD required by OpenVPN GUI ARE _OpenVPN user_ ID and PWD but are not sent to the OpenVPN server.

2/ As the log file says :
"WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this", I added the following directive in xxx.ovpn file (just before the auth-user-pass directive) :
auth-nocache

* Anyway, it was jus a warning.

3/ As the log file says :
"There is a problem in your selection of --ifconfig endpoints [local=192.168.27.65, remote=212.27.38.253]. The local and remote VPN endpoints must exist within the same 255.255.255.252 subnet. This is a limitation of --dev tun when used with the TAP-WIN32 driver. Try 'openvpn --show-valid-subnets' option for more info."
I remember this problem when dealing with a Windows7 machine...

Let's search a solution about this "TAP-WIN32 driver" limitation...

C:\Windows\system32>"C:\Program Files\OpenVPN\bin\openvpn" --show-valid-subnets
On Windows, point-to-point IP support (i.e. --dev tun)
is emulated by the TAP-Windows driver. The major limitation
imposed by this approach is that the --ifconfig local and
remote endpoints must be part of the same 255.255.255.252
subnet. The following list shows examples of endpoint
pairs which satisfy this requirement. Only the final
component of the IP address pairs is at issue.

As an example, the following option would be correct:
--ifconfig 10.7.0.5 10.7.0.6 (on host A)
--ifconfig 10.7.0.6 10.7.0.5 (on host B)
because [5,6] is part of the below list.

[ 1, 2] [ 5, 6] [ 9, 10] [ 13, 14] [ 17, 18]
[ 21, 22] [ 25, 26] [ 29, 30] [ 33, 34] [ 37, 38]
[ 41, 42] [ 45, 46] [ 49, 50] [ 53, 54] [ 57, 58]
[ 61, 62] [ 65, 66] [ 69, 70] [ 73, 74] [ 77, 78]
[ 81, 82] [ 85, 86] [ 89, 90] [ 93, 94] [ 97, 98]
[101,102] [105,106] [109,110] [113,114] [117,118]
[121,122] [125,126] [129,130] [133,134] [137,138]
[141,142] [145,146] [149,150] [153,154] [157,158]
[161,162] [165,166] [169,170] [173,174] [177,178]
[181,182] [185,186] [189,190] [193,194] [197,198]
[201,202] [205,206] [209,210] [213,214] [217,218]
[221,222] [225,226] [229,230] [233,234] [237,238]
[241,242] [245,246] [249,250] [253,254]

It suggests the akward turnaround to select the IP address for the Windows client so it fulfills that rule compared to server IP (?).
Unfortunately, the available range from the OpenVPN server is [65:93] for the "final component of the IP address" (the firmware locks that...).

Can you pls. lend a hand to fix that Windows issue that so many Windows users have obviously encountered?
(I read that an OpenVPN bridged router instead of a routed one in the present case is supposed to make things easier. Not yet tested.
Anyway, I'm more and more motivated to run my own OpenVPN server without any of such limitations decided by an internet operator...!).

The following information suggests that the installation of a TUN/TAP kernel driver is done, but says nothing about additional requirements:

https://openvpn.net/index.php/open-source/documentation/install.html?start=1
(...)
TUN/TAP Driver Configuration:
(...)
* Windows XP/2003/Vista/7:

OpenVPN on Windows needs a TUN/TAP kernel driver to work. OpenVPN installers
include this driver, so installing it separately is not usually required.
The driver source code is available here:

https://github.com/OpenVPN/tap-windows

Thanks

TinCanTech

Please see:
HOWTO: Request Help ! {2}

RogerT

After some research and readings, I came to modify my .ovpn file as follows:

#type config_openvpn_routed_user1.ovpn
client
remote <IP Publique FREEBOX> <PORT VPN>
proto tcp-client      # or proto udp
nobind
dev-type tun

pull
dev tun0
#----------MODIF----------------------------------------
topology subnet
ifconfig 192.168.27.65 255.255.255.224
pull-filter ignore "ifconfig"
route-gateway 192.168.27.94
#----------/MODIF---------------------------------------
redirect-gateway
etc...

Via the OpenVPN GUI, the VPN connection was up immediatly, with just one Warning :
WARNING: using --pull/--client and --ifconfig together is probably not what you want

I made some additional tests:
"disconnect", "connect" many times : OK, stable.
I encountered only one problem with "reconnect" (via GUI menu or via the status windows) : "reconnect" doesn't not "disconnect" first.
The server-side turnaround is to deconnect the user. Therefore, the connection is quickly done.
The client-side "default" turnaround is only to wait that reconnection fails (35 times in about 4 mn in my case). It's not cool because the user is not connected to the VPN during that process (no more ping to of from other VPN machines).

Do you know the directives to use in the .opvn file that could test if there is an existing VPN connection, then disconnecting before reconnecting cleanly?

This 2017 article, about bridged and routed OpenVPN connections via a FreeBox Revolution, helped me (in french):
https://forum.freenews.fr/index.php?topic=117463.0