OpenVPN not assigning IP during routing

grgxf

Hi
I am having trouble configuring the VPN client on one of my computers because it is not assigning an IP address from the VPN server (client retains its ISP IP). I have browsed the forum and tried some of the route forces as seen in the client below, but this hasn't helped. I would very much appreciate if anyone has any troubleshooting advice- this is beyond my beginner level IT knowledge. Thank you!

Config file:

client
dev tap
proto udp
dev-node NETGEAR-VPN
remote XXXX.mynetgear.com 12974
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
cipher AES-128-CBC
comp-lzo
verb 4
route-gateway 192.168.1.1
block-outside-dns
route 192.168.1.0 255.255.255.0 vpn_gateway

Last part of the log showing warnings:

2020-12-16 16:58:50 us=27751 TCP/UDP: Preserving recently used remote address: [AF_INET]XX.XX.XX.XX:12974
2020-12-16 16:58:50 us=28803 Socket Buffers: R=[65536->65536] S=[65536->65536]
2020-12-16 16:58:50 us=28803 UDP link local: (not bound)
2020-12-16 16:58:50 us=28803 UDP link remote: [AF_INET]XX.XX.XX.XX:12974
2020-12-16 16:58:50 us=28803 MANAGEMENT: >STATE:1608159530,WAIT,,,,,,
2020-12-16 16:58:51 us=603308 MANAGEMENT: >STATE:1608159531,AUTH,,,,,,
2020-12-16 16:58:51 us=604302 TLS: Initial packet from [AF_INET]XX.XX.XX.XX:12974, sid=996dc5a7 65c0703e
2020-12-16 16:58:52 us=14256 VERIFY OK: depth=0, C=TW, ST=TW, O=netgear, OU=netgear, CN=netgear, emailAddress=mail@netgear.com
2020-12-16 16:58:52 us=405917 Control Channel: TLSv1, cipher SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
2020-12-16 16:58:52 us=405917 [netgear] Peer Connection Initiated with [AF_INET]XX.XX.XX.XX:12974
2020-12-16 16:58:53 us=510467 MANAGEMENT: >STATE:1608159533,GET_CONFIG,,,,,,
2020-12-16 16:58:53 us=510467 SENT CONTROL [netgear]: 'PUSH_REQUEST' (status=1)
2020-12-16 16:58:53 us=555302 PUSH: Received control message: 'PUSH_REPLY,route 192.168.1.0 255.255.255.0,route-delay 5,redirect-gateway def1,route-gateway dhcp,ping 10,ping-restart 120'
2020-12-16 16:58:53 us=555302 OPTIONS IMPORT: timers and/or timeouts modified
2020-12-16 16:58:53 us=555302 OPTIONS IMPORT: route options modified
2020-12-16 16:58:53 us=555302 OPTIONS IMPORT: route-related options modified
2020-12-16 16:58:53 us=555302 Using peer cipher 'AES-128-CBC'
2020-12-16 16:58:53 us=555302 Outgoing Data Channel: Cipher 'AES-128-CBC' initialized with 128 bit key
2020-12-16 16:58:53 us=555302 Outgoing Data Channel: Using 160 bit message hash 'SHA1' for HMAC authentication
2020-12-16 16:58:53 us=555302 Incoming Data Channel: Cipher 'AES-128-CBC' initialized with 128 bit key
2020-12-16 16:58:53 us=555302 Incoming Data Channel: Using 160 bit message hash 'SHA1' for HMAC authentication
2020-12-16 16:58:53 us=555302 interactive service msg_channel=820
2020-12-16 16:58:53 us=565324 ROUTE_GATEWAY 192.168.1.1/255.255.255.0 I=11 HWADDR=9e:b6:e8:fd:33:a2
2020-12-16 16:58:53 us=587248 open_tun
2020-12-16 16:58:53 us=595192 tap-windows6 device [NETGEAR-VPN] opened
2020-12-16 16:58:53 us=595192 TAP-Windows Driver Version 9.24 
2020-12-16 16:58:53 us=596221 TAP-Windows MTU=1500
2020-12-16 16:58:53 us=596221 Successful ARP Flush on interface [7] {443E9CDB-83EA-4116-AD8F-37162136AA86}
2020-12-16 16:58:53 us=596221 do_ifconfig, ipv4=0, ipv6=0
2020-12-16 16:58:53 us=596221 MANAGEMENT: >STATE:1608159533,ASSIGN_IP,,,,,,
2020-12-16 16:58:53 us=596221 Blocking outside DNS
2020-12-16 16:58:53 us=596221 Using service to add block dns filters
2020-12-16 16:58:53 us=598184 Blocking outside dns using service succeeded.
2020-12-16 16:58:54 us=9086 Extracted DHCP router address: 192.168.1.1
2020-12-16 16:58:58 us=19532 TEST ROUTES: 0/0 succeeded len=-1 ret=1 a=0 u/d=up
2020-12-16 16:58:58 us=19532 C:\WINDOWS\system32\route.exe ADD XX.XX.XX.XX MASK 255.255.255.255 192.168.1.1
2020-12-16 16:58:58 us=21503 Route addition via service succeeded
2020-12-16 16:58:58 us=21503 C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 192.168.1.1
2020-12-16 16:58:58 us=23497 Route addition via service succeeded
2020-12-16 16:58:58 us=23497 C:\WINDOWS\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 192.168.1.1
2020-12-16 16:58:58 us=26489 Route addition via service succeeded
2020-12-16 16:58:58 us=26489 WARNING: OpenVPN was configured to add an IPv4 route. However, no IPv4 has been configured for NETGEAR-VPN, therefore the route installation may fail or may not work as expected.
2020-12-16 16:58:58 us=26489 MANAGEMENT: >STATE:1608159538,ADD_ROUTES,,,,,,
2020-12-16 16:58:58 us=26489 C:\WINDOWS\system32\route.exe ADD 192.168.1.0 MASK 255.255.255.0 192.168.1.1
2020-12-16 16:58:58 us=31474 Route addition via service succeeded
2020-12-16 16:58:58 us=31474 C:\WINDOWS\system32\route.exe ADD 192.168.1.0 MASK 255.255.255.0 192.168.1.1
2020-12-16 16:58:58 us=35464 ROUTE: route addition failed using service: The object already exists.   [status=5010 if_index=7]
2020-12-16 16:58:58 us=35464 Route addition via service failed
2020-12-16 16:58:58 us=35464 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
2020-12-16 16:58:58 us=35464 Initialization Sequence Completed
2020-12-16 16:58:58 us=35464 MANAGEMENT: >STATE:1608159538,CONNECTED,SUCCESS,,XX.XX.XX.XX,12974,,
2020-12-16 16:58:58 us=36461 Recursive routing detected, drop tun packet to [AF_INET]XX.XX.XX.XX:12974
2020-12-16 16:58:58 us=47432 Recursive routing detected, drop tun packet to [AF_INET]XX.XX.XX.XX:12974
2020-12-16 16:58:58 us=47432 Recursive routing detected, drop tun packet to [AF_INET]XX.XX.XX.XX:12974

TinCanTech

There is a distinct difference between --dev tun and --dev tap.

It is one thing to say that a tomato is a fruit, it is another to say that it is a suspension bridge.

grgxf

Hi TinCan, thanks for looking at my post. I'm afraid I don't know exactly what you mean.
I have dev tap on my 3 other successful configs - in fact, I use that same config file on the other 3 clients.

I did try to switch it to dev tun to see what happens and got this error:

2020-12-20 20:27:10 us=456832 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,cipher AES-128-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
2020-12-20 20:27:10 us=456832 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,cipher AES-128-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
2020-12-20 20:27:10 us=457829 TCP/UDP: Preserving recently used remote address: [AF_INET]24.XXXX:12974
2020-12-20 20:27:10 us=457829 Socket Buffers: R=[65536->65536] S=[65536->65536]
2020-12-20 20:27:10 us=457829 UDP link local: (not bound)
2020-12-20 20:27:10 us=457829 UDP link remote: [AF_INET]24.XXXX:12974
2020-12-20 20:27:10 us=457829 MANAGEMENT: >STATE:1608517630,WAIT,,,,,,
2020-12-20 20:27:10 us=508905 MANAGEMENT: >STATE:1608517630,AUTH,,,,,,
2020-12-20 20:27:10 us=509861 TLS: Initial packet from [AF_INET]24.XXXX:12974, sid=a1d11e57 15887950
2020-12-20 20:27:10 us=766548 VERIFY OK: depth=0, C=TW, ST=TW, O=netgear, OU=netgear, CN=netgear, emailAddress=mail@netgear.com
2020-12-20 20:27:11 us=26874 WARNING: 'dev-type' is used inconsistently, local='dev-type tun', remote='dev-type tap'
2020-12-20 20:27:11 us=26874 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1558', remote='link-mtu 1590'
2020-12-20 20:27:11 us=26874 WARNING: 'tun-mtu' is used inconsistently, local='tun-mtu 1500', remote='tun-mtu 1532'
2020-12-20 20:27:11 us=27855 Control Channel: TLSv1, cipher SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
2020-12-20 20:27:11 us=27855 [netgear] Peer Connection Initiated with [AF_INET]24.XXXX:12974
2020-12-20 20:27:11 us=156517 Key [AF_INET]24.XXXX:12974 [0] not initialized (yet), dropping packet.
2020-12-20 20:27:11 us=683826 Key [AF_INET]24.XXXX:12974 [0] not initialized (yet), dropping packet.
2020-12-20 20:27:11 us=704772 Key [AF_INET]24.XXXX:12974 [0] not initialized (yet), dropping packet.
2020-12-20 20:27:12 us=595550 MANAGEMENT: >STATE:1608517632,GET_CONFIG,,,,,,
2020-12-20 20:27:12 us=595550 SENT CONTROL [netgear]: 'PUSH_REQUEST' (status=1)
2020-12-20 20:27:12 us=641739 PUSH: Received control message: 'PUSH_REPLY,route 192.168.1.0 255.255.255.0,route-delay 5,redirect-gateway def1,route-gateway dhcp,ping 10,ping-restart 120'
2020-12-20 20:27:12 us=641739 OPTIONS IMPORT: timers and/or timeouts modified
2020-12-20 20:27:12 us=641739 OPTIONS IMPORT: route options modified
2020-12-20 20:27:12 us=641739 OPTIONS IMPORT: route-related options modified
2020-12-20 20:27:12 us=641739 Using peer cipher 'AES-128-CBC'
2020-12-20 20:27:12 us=641739 Outgoing Data Channel: Cipher 'AES-128-CBC' initialized with 128 bit key
2020-12-20 20:27:12 us=641739 Outgoing Data Channel: Using 160 bit message hash 'SHA1' for HMAC authentication
2020-12-20 20:27:12 us=641739 Incoming Data Channel: Cipher 'AES-128-CBC' initialized with 128 bit key
2020-12-20 20:27:12 us=641739 Incoming Data Channel: Using 160 bit message hash 'SHA1' for HMAC authentication
2020-12-20 20:27:12 us=642482 interactive service msg_channel=440
2020-12-20 20:27:12 us=648501 ROUTE_GATEWAY 192.168.1.1/255.255.255.0 I=11 HWADDR=9e:b6:e8:fd:33:a2
2020-12-20 20:27:12 us=664454 open_tun
2020-12-20 20:27:12 us=672402 tap-windows6 device [NETGEAR-VPN] opened
2020-12-20 20:27:12 us=672402 TAP-Windows Driver Version 9.24 
2020-12-20 20:27:12 us=672402 TAP-Windows MTU=1500
2020-12-20 20:27:12 us=672402 MANAGEMENT: Client disconnected
2020-12-20 20:27:12 us=672402 ERROR: --dev tun also requires --ifconfig
2020-12-20 20:27:12 us=672402 Exiting due to fatal error

TinCanTech

Looks like you are trying to say that a tomato is a suspension bridge...

grgxf

I'm sorry I have no idea what that means.

TinCanTech

The type of device denoted by --dev or --dev-type is absolute .. they do not mix.

A lot of devices simply do not support --dev-type tap.

I strongly urge you to read some documentation on the subject.

grgxf

Except --dev tun doesn't work, and the NETGEAR automatically installs a TAP driver.

I found this info as well:

You can use TUN if you just use the VPN to connect to the internet.
You need to use TAP if you want to connect to the actual remote network (printers, remote desktops, etc.)

I will be using the VPN to access RDP.

TinCanTech

--dev tun can do all that.

Also, is the Windows DHCP Client Service started ?

man1ck

Wow came here to figure out my issues with connection and man I dont even wanna post my issue with "TinCanTech" being a complete condescending asshole about someone who hasn't read the entirety of the documentation and understands every config option. You sure do know how to blockage beginner user questions in literally the place meant for support... prick

TinCanTech

man1ck wrote I dont even wanna post my issue with "TinCanTech" being a complete condescending asshole

You claim something without supporting your position or point of view.

The documentation is there for you to read and learn. Why bother writing it if you don't read it..

If you will not read it then you have three options:

Pay
Pray
Fail

Now take your bad-mouth and stick it where it belongs..

man1ck

Lol I don't need to support my "position or point of view" it is clearly evident that you're a dick even when trying to help people on here...

I have read through all of the OpenVPN documentation (something you are erroneously claiming I haven't done.. weird that you would know specific details about my daily activities)... and I still am having issues with connection.

My point being, your previous attempts to "help" people are so atrociously dickish that I don't even want to ask for help as a new user.

Maybe check yourself before crafting some "witty" response that you're proud of for some unknown reason.