Openvpn server & MS Multiplexor Network Driver

frml

Hi All,

I have to install a VPN solution onto a Windows 2012R2 server of an association and think of course to deploy openvpn (not my favorite OS).

Unfortunately I have issue to make the solution work and think this is due to the use of Microsoft Multiplexor Network Driver with group both physical two NIC to get one virtual network adapter of 2GB.

The tunnel using tun mode and udp work well (no setup issue, no connexions issue), but when the tunnel is Up and that all client network trafic go through the VPN (using push "redirect-gateway def1 bypass-dhcp" & push "dhcp-option DNS 192.168.1.254") nothing is routed out of the Tap adaptor to the local Virtual Multiplexor NIC of my openvpn server :/ I know that the use of 192.168.1.0/24 network is a pain in the ...., but I'll work on it in further time, starting 1st to secure RDP session with this VPN setup.

I've search for a similar issue and only found this topic of 2015 which end with 'get ride of your Multiplexor Network Driver' ... which is not a solution I can choose.
Here is the link to this thread : https://forums.openvpn.net/viewtopic.php?f=24&t=19794&p=56522&hilit=multiplexor#p56522

My final question : does somebody heard of issue from Tap to Multiplexor adapter or issue with openvpn routing trafic ?

Thank in advance

frml

Here are configurations & routing tables

###########################################################################
###########################################################################
## Server configuration & routing table
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh2048.pem
server 10.8.0.0 255.255.255.0
;topology subnet
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 192.168.1.254"
keepalive 10 120
tls-auth ta.key 0 # This file is secret
cipher AES-256-CBC
max-clients 30
persist-key
persist-tun
status openvpn-status.log
verb 5
explicit-exit-notify 1

IPv4 Table de routage
===========================================================================
Itinéraires actifs :
Destination réseau Masque réseau Adr. passerelle Adr. interface Métrique
0.0.0.0 0.0.0.0 192.168.1.1 192.168.1.254 261
10.8.0.0 255.255.255.0 10.8.0.2 192.168.1.254 6
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
192.168.1.0 255.255.255.0 On-link 192.168.1.254 261
192.168.1.254 255.255.255.255 On-link 192.168.1.254 261
192.168.1.255 255.255.255.255 On-link 192.168.1.254 261
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 192.168.1.254 261
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 192.168.1.254 261
===========================================================================
Itinéraires persistants :
Adresse réseau Masque réseau Adresse passerelle Métrique
0.0.0.0 0.0.0.0 192.168.1.1 Par défaut
===========================================================================

############################################################################
############################################################################
## CLIENT configuration & routing table
client
dev tun
proto udp
remote xxxxxxxxxxx 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert PRIVATECLIENT.crt
key PRIVATECLIENT.key
remote-cert-tls server
tls-auth ta.key 1
cipher AES-256-CBC
verb 3
route 192.168.1.0 255.255.255.0 ; Does work with or without this route option

#########
IPv4 Table de routage (Client)
===========================================================================
Itinéraires actifs :
Destination réseau Masque réseau Adr. passerelle Adr. interface Métrique
0.0.0.0 0.0.0.0 10.101.190.254 10.101.190.22 276
0.0.0.0 128.0.0.0 10.8.0.5 10.8.0.6 20
10.8.0.1 255.255.255.255 10.8.0.5 10.8.0.6 20
10.8.0.4 255.255.255.252 On-link 10.8.0.6 276
10.8.0.6 255.255.255.255 On-link 10.8.0.6 276
10.8.0.7 255.255.255.255 On-link 10.8.0.6 276
LOCALNETWORK 255.255.252.0 On-link LOCALIPADDRESS 276
LOCALIPADDRESS 255.255.255.255 On-link LOCALIPADDRESS 276
LOCALBROADCAST 255.255.255.255 On-link LOCALIPADDRESS 276
LOCALDEFAULTGW 255.255.255.255 LOCALDEFAULTGW LOCALIPADDRESS 20
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
128.0.0.0 128.0.0.0 10.8.0.5 10.8.0.6 20
192.168.1.0 255.255.255.0 10.8.0.5 10.8.0.6 20
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link LOCALIPADDRESS 276
224.0.0.0 240.0.0.0 On-link 10.8.0.6 276
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link LOCALIPADDRESS 276
255.255.255.255 255.255.255.255 On-link 10.8.0.6 276

===========================================================================
Itinéraires persistants :
Adresse réseau Masque réseau Adresse passerelle Métrique
0.0.0.0 0.0.0.0 LOCALDEFAULTGW Par défaut
===========================================================================

frml

Here is Status of my client vpn activity on server side :

Thu Sep 20 11:39:45 2018 X.X.X.X:61573 [PRIVATECLIENT] Peer Connection Initiated with [AF_INET]X.X.X.X:61573
Thu Sep 20 11:39:45 2018 PRIVATECLIENT/X.X.X.X:61573 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled)
Thu Sep 20 11:39:45 2018 PRIVATECLIENT/X.X.X.X:61573 MULTI: Learn: 10.8.0.6 -> PRIVATECLIENT/X.X.X.X:61573
Thu Sep 20 11:39:45 2018 PRIVATECLIENT/X.X.X.X:61573 MULTI: primary virtual IP for PRIVATECLIENT/X.X.X.X:61573: 10.8.0.6
Thu Sep 20 11:39:46 2018 PRIVATECLIENT/X.X.X.X:61573 PUSH: Received control message: 'PUSH_REQUEST'
Thu Sep 20 11:39:46 2018 PRIVATECLIENT/X.X.X.X:61573 SENT CONTROL [PRIVATECLIENT]: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 192.168.1.254,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5,peer-id 0,cipher AES-256-GCM' (status=1)
Thu Sep 20 11:39:46 2018 PRIVATECLIENT/X.X.X.X:61573 Data Channel: using negotiated cipher 'AES-256-GCM'
Thu Sep 20 11:39:46 2018 PRIVATECLIENT/X.X.X.X:61573 Data Channel MTU parms [ L:1549 D:1450 EF:49 EB:406 ET:0 EL:3 ]
Thu Sep 20 11:39:46 2018 PRIVATECLIENT/X.X.X.X:61573 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Thu Sep 20 11:39:46 2018 PRIVATECLIENT/X.X.X.X:61573 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key

With WireShark on my Tap adapter on the client side (eg 10.8.0.6) I do see ICMP request (from ping 192.168.1.254 on a cmd windows), but nothing icmp-reply ! In fact I don't see any IP packet from my server (eg 10.8.0.5),the only packet 'seen' back from the tunnel is an ethernet MAC response for 10.8.0.5

TinCanTech

frml wrote In fact I don't see any IP packet from my server (eg 10.8.0.5),

That IP is not your server IP and it is not usable by design.

frml

TinCanTech wrote That IP is not your server IP and it is not usable by design.

Yep, it is 10.8.0.2, should read: no IP packet from the other side of the VPN tunnel

Another thing, that I've not seen before in server log (verb 5):
Thu Sep 20 14:45:30 2018 us=87176 C:\Windows\system32\route.exe ADD 10.8.0.0 MASK 255.255.255.0 10.8.0.2
Thu Sep 20 14:45:30 2018 us=90178 Warning: route gateway is not reachable on any active network adapters: 10.8.0.2 :cry:
Thu Sep 20 14:45:30 2018 us=90178 Route addition via IPAPI failed [adaptive]
Thu Sep 20 14:45:30 2018 us=90178 Route addition fallback to route.exe

Which make me look again to rooting table on server => nothing for 10.8.0.0/24 ?
Which make me look for Tap Ip address on server :
Etehernet adapter OpenVPN (TAP-Windows Adapter V9)
DNS suffix . . . :
IPv4 Adress . . . : 169.254.117.43 :roll:
Subnet Mask . . . . . . . . . : 255.255.0.0
Default Gateway. . . . . . . . . :

Well, here I amback to my question does openvpn and Tap adaptor works with Multiplexor Network Driver => it seems to be no with default installation !

I have force My TAP adpter manualy to 10.8.0.2,work now fine :lol:

More questions come to me : Why launch of the server is not able to setup correctly TAP ip address ?

TinCanTech

TinCanTech wrote
frml wrote In fact I don't see any IP packet from my server (eg 10.8.0.5),
That IP is not your server IP and it is not usable by design.

frml wrote Yep, it is 10.8.0.2

That is also not the IP of your server and again is not ping-able by design. You are using topology net30.

frml wrote SENT CONTROL [PRIVATECLIENT]: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 192.168.1.254,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5,peer-id 0,cipher AES-256-GCM' (status=1)

frml wrote I have force My TAP adpter manualy to 10.8.0.2,work now fine

No it does not. See above ..

frml wrote Why launch of the server is not able to setup correctly TAP ip address ?

Make sure you have started the Windows DHCP Client service.

Please see:
HOWTO: Request Help !