OpenVPN Connect client and ZeroTier

sysadmin_guy

I have been using both ZeroTier and the OpenVPN Connect client for some time now for different reasons on Windows 10. ZeroTier is used for remote clients to backup data, while OpenVPN requires login credentials to access internal networks. Both networks are totally separate.

I updated the OpenVPN Connect client from 3.2.3 to 3.3.1. After doing this the client hangs upon attempted connection to the OpenVPN server.

Using Wireshark, I determined that this is due to traffic from the OpenVPN client being routed through the ZeroTier gateway rather than through my laptop wireless interface.

If I disable the ZeroTier service on my laptop, OpenVPN works again. If I revert back to the original version of the client I was using (3.2.3), no OpenVPN traffic goes through the ZeroTier adapter and everything works.

So far I cannot find a way to force OpenVPN Connect to ignore the ZeroTier adapter entirely (such as by playing with interface metrics). If anyone has seen something like this before I'd appreciate some ideas.

openvpn_inc

Hello sysadmin_guy,

It would be helpful to know what the routing table looks like when ZeroTier is enabled. Possibly you can bypass the issue by adding a route to your routing table for the IP of your OpenVPN server that points to your Internet gateway.

Kind regards,
Johan

sysadmin_guy

Thanks for the reply Johan. Here are some screenshots:

ZeroTier service disabled:

Routing table as OpenVPN is connecting, and will succeed:

ZeroTier service enabled:

Routing table as OpenVPN is connecting, and will fail:

I understand your suggestion of manually adding a route to our OpenVPN servers, however maintenance would be an issue. This needs to reliably work for some non-technical users who are always on the road.

openvpn_inc

Hello sysadmin_guy,

The problem is clear now, it is a matter of two default routes being present, and Connect is picking the wrong one. I looked in our code and found a patch for this in OpenVPN3 core release 3.6.4 which is on the way. This library goes into OpenVPN Connect v3.3.2 release for Windows which is expected next week. Hopefully with that release the issue will then be resolved for you.

For now the workaround with setting a route to the specific OpenVPN server will work.

Kind regards,
Johan

sysadmin_guy

Thank you for taking a look at this Johan. I will give 3.3.2 a test once it is available!

openvpn_inc

Hello,

Version 3.3.2 has been out for a little while. Any luck with this particular issue?

Kind regards,
Johan

sysadmin_guy

Yes I have verified that v3.3.2 now works as expected. Thank you!