OpenVPN GUI issue

nieldejonghe

Hello,

I'm working on a windows 10 Image with MDT and I have an issue with my OpenVPN GUI installation.

I've tried both the 2.4.4 and 2.4.6 and both aks for a Management password, see logs:

Thu Aug 30 15:35:20 2018 OpenVPN 2.4.4 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Sep 26 2017
Thu Aug 30 15:35:20 2018 Windows version 6.2 (Windows 8 or greater) 64bit
Thu Aug 30 15:35:20 2018 library versions: OpenSSL 1.0.2l  25 May 2017, LZO 2.10
Enter Management Password:

when I tried the older version on the site (2.3.18 old stable) It works fine. I'd rather be using the newer versions tho but I can't find how to solve this issue.

It also seems to work when logged in with a user with admin rights (Domain admin / Local admin) but not with normal AD users (So maybe its a permission issue ?)

Any help would be greatly appreciated

Below is my config (generated from the firewall we use)

client
pull
nobind
dev tun
remote <ip> <port>
proto tcp-client
cipher AES-128-CBC
comp-lzo adaptive
remote-cert-eku "TLS Web Server Authentication"
<ca>

-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----
</ca>

<cert>

-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----

</cert>

<key>

-----BEGIN RSA PRIVATE KEY-----
-----END RSA PRIVATE KEY-----
</key>

Kind Regards

TinCanTech

nieldejonghe wrote I've tried both the 2.4.4 and 2.4.6 and both aks for a Management password, see logs:

Thu Aug 30 15:35:20 2018 OpenVPN 2.4.4 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Sep 26 2017
Thu Aug 30 15:35:20 2018 Windows version 6.2 (Windows 8 or greater) 64bit
Thu Aug 30 15:35:20 2018 library versions: OpenSSL 1.0.2l  25 May 2017, LZO 2.10
Enter Management Password:

This usually means that openvpn has already been started ..

https://community.openvpn.net/openvpn/wiki/OpenVPN-GUI-New#gui-moreinfo

nieldejonghe

hey TinCanTech, thnx for the info but I don't see any open openvpn.exe in my task manager :/

nieldejonghe

Seems like when i open Taskmanager as ADMIN I can see an OpenVPN Daemon running and when I close that it works ... Issue here is i don't want to need admin powers to get OpenVPN working ?

TinCanTech

You are starting openvpn in another way .. probably the OpenvpnService or Openvpn Legacy Service.

Do not use those services, only use the Openvpn Interactive Service.

And then you do not require Administrator rights.

https://community.openvpn.net/openvpn/wiki/OpenVPN-GUI-New

nieldejonghe

TinCanTech,

I just download the exe from the website, install it with admin permissions, and than when I open it (as a normal domain user) as shown on the link you shared me it gives me issues ? :/

i've tried removing the TAP adapter since we use TUN but that didn't help, also tried adding the OpenVPN Administrator group and adding the domainuser in that group but the problem still persists ...

TinCanTech

nieldejonghe wrote I just download the exe from the website, install it with admin permissions, and than when I open it (as a normal domain user) as shown on the link you shared me it gives me issues ? :/

Log files please.

nieldejonghe wrote i've tried removing the TAP adapter since we use TUN but that didn't help

The TAP adapter is used in TUN mode .. don't remove it or openvpn will not work.

nieldejonghe

Hello TinCanTech,

unfortunatly even with adding "verb 4" in my client config like so:

client
verb 4
pull
nobind
dev tun
remote <dns> 4430 
proto tcp-client
cipher AES-128-CBC
comp-lzo adaptive
remote-cert-eku "TLS Web Server Authentication"

I have only this little log info:

Mon Sep 03 15:52:18 2018 OpenVPN 2.4.6 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Apr 26 2018
Mon Sep 03 15:52:18 2018 Windows version 6.2 (Windows 8 or greater) 64bit
Mon Sep 03 15:52:18 2018 library versions: OpenSSL 1.1.0h  27 Mar 2018, LZO 2.10
Enter Management Password:

Also when I check my services I see this:

OpenVPNServiceLegacy = STOPPED
OpenVPNServiceInteractive = ACTIVE
OpenVPNService = STOPPED

In the backgroundprocesses I see this:

OpenVPN Daemon
OpenVPN Service

This is the script I use to install OpenVPN with during my MDT task sequence

xcopy "%~DP0*.*" C:\Windows\Temp\OpenVPN /E /I /Y
certutil -addstore "TrustedPublisher" C:\Windows\Temp\OpenVPN\openvpn.cer 
C:\Windows\Temp\OpenVPN\openvpn-install-2.4.6-I602.exe /S /SELECT_SHORTCUTS=1 /SELECT_OPENVPN=1 /SELECT_SERVICE=1 /SELECT_TAP=1 /SELECT_OPENVPNGUI=1 /SELECT_ASSOCIATIONS=1 /SELECT_PATH=1 
rmdir C:\Windows\Temp\OpenVPN /S /Q
exit

Things i've tried:

I'm running a decrapifier script https://community.spiceworks.com/scripts/show/4378-windows-10-decrapifier-1803
that removes some bloatware in windows 10 so I thought that could be the issue

I've created a group "openvpn administrators" and put the domain user in there

Removed tap interface (obv didn't work ...)

When I run it with an account that has local admin or domain admin priviliges it works

I'm out of things to try and any help would be greatly appreciated.

Kind Regards

TinCanTech

nieldejonghe wrote In the backgroundprocesses I see this:

OpenVPN Daemon
OpenVPN Service

Then you have not stopped / disabled the old services.

which is why you still see this:

nieldejonghe wrote I have only this little log info:

Mon Sep 03 15:52:18 2018 OpenVPN 2.4.6 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Apr 26 2018
Mon Sep 03 15:52:18 2018 Windows version 6.2 (Windows 8 or greater) 64bit
Mon Sep 03 15:52:18 2018 library versions: OpenSSL 1.1.0h  27 Mar 2018, LZO 2.10
Enter Management Password:

If you want to contact me privately : tincanteksup <at> gmail

nieldejonghe

Hey TinCanTech,

I've contacted you via mail.

Kind Regards,