Hi all. I'm using client version 2.4.6 on a Windows 10 Pro machine. When connected, the VPN seems to disrupt the Windows NLA service such that Outlook/Office 365 no longer authenticates. I can't even sign in to any Office apps to check account status. Of course, Outlook/email no longer authenticates. OWA and the Office portal works fine - that's just https in a browser. What is it about the VPN client that disrupts NLA? Thanks.

Same issue here. Any solution to this?

The method for determining the presence of an Internet connection these services use involves checking for a route. When OpenVPN program creates a VPN tunnel, the routing in the Microsoft operating system is changed for security associated with the VPN tunnel. The two Microsoft services above are unable to recognize the new VPN route and the existence of a way to get to the Internet, so a message comes back claiming there is no Internet access or no network connection. This is a failure on the part of Microsoft and the NLA and NCSI services. Here is a long post with many people in a similar situation: [url]https://answers.microsoft.com/en-us/msoffice/forum/msoffice_other-mso_win10-mso_o365b/office-365-cloud-features-do-not-work-when-using-a/b6002038-744a-4d94-a6db-89d4338e99d4[/url] A dangerous way around this is offered partway through the post above and provided here for transparency: [url]https://www.macwheeler.com/windows-10-office-365-cannot-connect-over-openvpn-fixed/[/url] I use the word 'dangerous' because it involves creating a leak in your system to accommodate the Microsoft flaw. Recognising that this is a flaw in the way the NLA & NCSI services have been programmed does not help much. Microsoft appear disinterested in resolving this problem and are obviously aware. Do the OpenVPN team have any plans to resolve this through coding a fix without opening up the link? Do you feel it's possible to "Mimic" the NLA & NCSI service server. My understanding is that these services simply ping a fixed IP to validate the internet connection, so possibly OpenVPN could intercept this and respond positively as needed.

[quote=Donchik post_id=85727 time=1560695263 user_id=47276] The method for determining the presence of an Internet connection these services use involves checking for a route. When OpenVPN program creates a VPN tunnel, the routing in the Microsoft operating system is changed for security associated with the VPN tunnel. The two Microsoft services above are unable to recognize the new VPN route and the existence of a way to get to the Internet, so a message comes back claiming there is no Internet access or no network connection. This is a failure on the part of Microsoft and the NLA and NCSI services.[/quote] This is what Microsoft claim the problem is caused by: [quote="M$"]The problem here is that NCSI depends on the default gateway to decide if it should “probe” the network connection to decide if it has an internet connection. The way that NCSI probes the network is it attempts to connect to www,msftncsi,com and retrieve a file called ncsi.txt. If it can retrieve that file, it marks the connection as having internet access. When the VPN adapter connection connects, and NCSI detects that a connection was made on an adapter interface. NCSI will attempt to probe the connection, but since there is no default gateway on the VPN adapter it attempts to send the probe packets out the adapter with a default gateway and that fails since the VPN connection is active. [/quote][b] Source: [i]Office 2013 reports no internet connectivity with VPN connection [/i]https://blogs.technet.microsoft.com/the_microsoft_excel_support_team_blog/2014/03/24/office-2013-reports-no-internet-connectivity-with-vpn-connection/ Note[/b]: [i]Third-party VPN client stops Internet connectivity in Windows 7 SP1 or Windows Server 2008 R2 SP1[/i] https://support.microsoft.com/en-us/help/2964643/third-party-vpn-client-stops-internet-connectivity-in-windows-7-sp1-or Maybe they just fixed Win10 [i]later on[/i] ..

Hi TinCanTech, Many thanks for the update. Can you confirm if a Windows 10 hotfix exists? I like many are still locked out of Office and MS Account when OpenVPN is up and running. If not, do we have any OpenVPN fixes in the pipeline? Cheers Donchik

[quote=Donchik post_id=85747 time=1560787427 user_id=47276] Can you confirm if a Windows 10 hotfix exists? [/quote]I cannot. [quote=Donchik post_id=85747 time=1560787427 user_id=47276] do we have any OpenVPN fixes in the pipeline? [/quote]No. You could try adding something like: [code]allow-pull-fqdn route www.msftncsi.com net_gateway[/code]to your client config .. but that is only a guess and I do not use M$O so do not have a way to test or verify the result.

When you are connected to the VPN, all your traffic goes through the VPN default gateway. By adding this configuration, you are basically instructing the OpenVPN to add a static route for the hostname through your default gateway. Basically, all requests done to 'www.msftncsi.com' will bypass the VPN tunnel, which can be considered as a leak. I was hoping for OpenVPN to be looking for a resolution from Microsoft. I doubt they'd listen to me, but would hope OpenVPN as a team would have more "Clout" with them

Microshaft know exactly how OpenVPN works, they have even cloned it on github FYI: M$ own github, they paid $7BN for it So, they have chosen to do things this way deliberately ...

im getting same problem with openvpn 2.4.9 windows 10 and pfsense. anyone found a sollution without setting manual gateway on all of our machines.

Hi, I'm having the same issue with OpenVPN 2.4.9 on Windows 10, and I cannot fix it even adding a default gateway manually. Our VPN is already configured to use the local default gateway for all destinations, except for destinations in the company LAN which will use instead the VPN gateway. The "route print" command confirms this. But the default gateway in the TAP network interface is still empty after connecting. I tried anyway setting the default gateway to the local default gateway in the TAP network interface, but this is not enough, NLA still breaks. Any clues? Thanks.

Openvpn breaks NLA and NCSI services for Windows / Office 365

itsangiep

TinCanTech wrote
denwood wrote Adding
push "route 0.0.0.0 0.0.0.0"

Is a sure fire way to screw you up.

This thread is utter nonsense.

Instead of using this forum to air your complaints about MS, may try being useful and helpful and offer practical solutions!

TinCanTech

https://forums.openvpn.net/viewtopic.php?f=1&t=27321#p85733

There are no "practical solutions" because Microsoft are breaking the rules.

On the one hand, Microshaft claim that Windblows does not do policy based routing.
On the other hand, they explain EXACTLY how Windblows does do policy based routing, when THEY want it to.

THAT is what breaks Windblows Orifice when you use a VPN.

And we are not here to solve your problems with the utter shit software you choose to pay for.

Go ask those who you PAY for the answer.

And then listen to their lies as they squirm and whine like Golum,
to steal your data, all the while pretending to be innocent. GOLUM.. GOLUM

Microsoft ONLY answer to The One Ring. MONEY .. (aka POWER)

TinCanTech

On a lighter note:

This is very much a case of Pirates of the Caribbean ..

You can always trust a dishonest man, to be dishonest .. read: man = Windblows

TinCanTech

If you don't understand why I don't trust M$ then look up

how and why Open-Office came to be .. aka LibreOffice.

This Forum is for Free-Open-Source-Software OpenVPN support.

This Forum is not here for free support of dishonest and shit software that you cannot live without.

If you have any further problems with Microshaft Orifice then go ask the Man you PAY for an answer.

You can also PAY me for assistance: Leave a suitable comment below.

This thread is dead.

(This is what the internet looks like without corporate bullshit all over it, back from the '90s)

TinCanTech

Here is the corporate bullshit:
https://forums.openvpn.net/viewtopic.php?f=30&t=22603

You may prefer this:
https://openvpn.net/community/

:peuke:

« Previous Page