GUI Works, Service Doesn't Anymore

Dr-D

I have a Windows Server Essentials 2016 machine that has been running OpenVPN perfectly until a few weeks ago when I got a call saying no one could connect anymore. The service no longer connects to the TAP adapter upon startup or when I restart the service. It just always shows that the network cable is unplugged for the TAP adapter now but if I run the GUI then it connects and the TAP adapter shows the cable is plugged in, gives the correct IP address and access again. The problem with that of course is that the system would need to leave a user logged on all the time in order to have OpenVPN working which isn't practical. I've uninstalled and reinstalled using different versions (2.4.8, 2.4.9, 2.4.10 and 2.5.0) but to no avail. It is just this one system doing this and for the life of me I can't find the problem. Has anyone else experienced the service not connecting to the TAP adapter? If so what steps did you take to get it working again if you were able to get it working again? Thank you.

TinCanTech

Dr-D wrote Has anyone else experienced the service not connecting to the TAP adapter?

The service does not connect to the Tap adapter.

https://community.openvpn.net/openvpn/wiki/OpenVPN-GUI-New

Dr-D

That link was of no help as the GUI is working fine, it's the OpenVPN service that won't connect. On all other system if I go into services and stop the OpenVPN service then the TAP adapter says the cable is unplugged, once the service is started then TAP adapter shows that is connected. This one system won't connect with the OpenVPN service, only the GUI. I'm trying to figure out if anyone else had an issue with the OpenVPN service not connecting and if they were able to fix it.

Thanks.

TinCanTech

Are you trying to run Openvpn as a service before the users logon ?

Al@COPE

Hi - I had exactly the same problem, the service failed to connect (but no error log!) although using the GUI worked. We use pfSense with the OpenVPN server option, and use the "Client Export" add-on for output of certificate and config bundles. I've found the service-mode of connecting (which launches with system start-up, irrespective of user login) far better for remote support requirements (we started using service mode because pfSense did not originally support the TAP option and the client at the time wouldn't support dynamic GUI TUN connections without full Windows Admin permissions).

I found that the v.2.5 version of the config files is now using a different syntax for the cipher/encryption settings, having replaced the two lines:

cipher AES-256-CBC
ncp-ciphers AES-256-GCM:AES-128-GCM

with:

data-ciphers AES-256-GCM:AES-128-GCM
data-ciphers-fallback AES-256-CBC

I removed v2.5 and installed 2.4.9, then manually edited the config to match the previous encryption/cipher settings, and now the service connects again.

Discovery method: I had the original config file (data-ciphers version) and tried to launch OpenVPN with right-click on this from Explorer. That then gave an error message in the console which got me pointed towards the solution (sorry, can't recall the exact message text).

I also tested the reverted ("ncp-cipher") config with v.2.5 and its service mode, but it wouldn't connect, hence my reverting the client entirely back to 2.4.9, which works (after installing the separate TAP driver, even though we currently use TUN mode currently).

Alec

woodpd

I have this exact same problem but wish to move forward with v2.5+, do we have a proper solution now?

woodpd

Actually I found the problem (my problem anyway), the OpenVPN service was looking for the server.ovpn in /config-auto whereas I had it in /config which is where the bridging settings were set (as specified in https://openvpn.net/community-resources/ethernet-bridging/). Moving server.ovpn to /config-auto fixed it all