openvpn-as(2.11.0) ,Use community client,error

doit2010

I'm not satisfied with the client(V3,V2.7.1.111),So I use the latest community client(OpenVPN-2.5.7-I602-amd64). it works seems normal,but have same red warning.

1,NOTE: Release of DHCP-assigned IP address lease on TAP-Windows adapter failed: The system cannot find the specified file
2,WARNING: Failed to renew DHCP IP address lease on TAP-Windows adapter: The system cannot find the specified file
3,ROUTE: route addition failed using service: Object already exists

my server system is RHEL8.6,my client system is win10.

the profile.ovpn is

# Automatically generated OpenVPN client config file
# Generated on Thu Jul 7 11:29:52 2022 by localhost.localdomain
# Note: this config file contains inline private keys
# and therefore should be kept confidential!
# Certificate serial: 3, certificate common name: openvpn
# Expires 2032-07-04 11:29:52
# Note: this configuration is user-locked to the username below
# OVPN_ACCESS_SERVER_USERNAME=openvpn
# Define the profile name of this particular configuration file
# OVPN_ACCESS_SERVER_PROFILE=openvpn@192.168.245.132

# Default Cipher
cipher AES-256-CBC
# OVPN_ACCESS_SERVER_CLI_PREF_ALLOW_WEB_IMPORT=True
# OVPN_ACCESS_SERVER_CLI_PREF_BASIC_CLIENT=False
# OVPN_ACCESS_SERVER_CLI_PREF_ENABLE_CONNECT=False
# OVPN_ACCESS_SERVER_CLI_PREF_ENABLE_XD_PROXY=True
# OVPN_ACCESS_SERVER_WSHOST=192.168.245.132:443
# OVPN_ACCESS_SERVER_WEB_CA_BUNDLE_START
# -----BEGIN CERTIFICATE-----
# MII*******
# -----END CERTIFICATE-----
# OVPN_ACCESS_SERVER_WEB_CA_BUNDLE_STOP
# OVPN_ACCESS_SERVER_IS_OPENVPN_WEB_CA=1
client
server-poll-timeout 4
nobind
remote 192.168.245.132 1194 udp
remote 192.168.245.132 1194 udp
remote 192.168.245.132 443 tcp
remote 192.168.245.132 1194 udp
remote 192.168.245.132 1194 udp
remote 192.168.245.132 1194 udp
remote 192.168.245.132 1194 udp
remote 192.168.245.132 1194 udp
dev tun
dev-type tun
remote-cert-tls server
tls-version-min 1.2
reneg-sec 604800
auth-user-pass
verb 3
push-peer-info

<ca>
-----BEGIN CERTIFICATE-----
MII*******
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
MI*******
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
MIIEv*********
-----END PRIVATE KEY-----
</key>
<tls-crypt>
#
# 2048 bit OpenVPN static key (Server Agent)
#
-----BEGIN OpenVPN Static key V1-----
278****
******
9b*****
-----END OpenVPN Static key V1-----
</tls-crypt>
## -----BEGIN RSA SIGNATURE-----
## DIGEST:sha256
## AI********=
## -----END RSA SIGNATURE-----
## -----BEGIN CERTIFICATE-----
## MII********
## O90=
## -----END CERTIFICATE-----
## -----BEGIN CERTIFICATE-----
## MII******
## -----END CERTIFICATE-----

openvpn_inc

Hello doit2020,

The only item here that I can say anything sensible about is this one:
> 3,ROUTE: route addition failed using service: Object already exists

This line means you're trying to implement a route on the client side that already exists. For example, if you're trying to add the 192.168.1.0/24 route on the client side, but the routing table on the client side already has that route, it will mention that this already exists. That's the error message you're seeing here. So it's best to check the routes you're adding on the client side.

Kind regards,
Johan

doit2010

openvpn_inc wrote Hello doit2020,

The only item here that I can say anything sensible about is this one:
> 3,ROUTE: route addition failed using service: Object already exists

This line means you're trying to implement a route on the client side that already exists. For example, if you're trying to add the 192.168.1.0/24 route on the client side, but the routing table on the client side already has that route, it will mention that this already exists. That's the error message you're seeing here. So it's best to check the routes you're adding on the client side.

Kind regards,
Johan

but i use clientV3 AND V2， it have no error

openvpn_inc

Hello doit2010,

OpenVPN Connect v2 and v3 use OpenVPN3 library. Its logging is different from OpenVPN2 that is used in OpenVPN2 GUI.

That error message comes up in OpenVPN2 when a route is being added that already exists. So I'd still suggest looking at the routes you're adding and if they already exist on the client side.

Kind regards,
Johan

doit2010

openvpn_inc wrote Hello doit2010,

OpenVPN Connect v2 and v3 use OpenVPN3 library. Its logging is different from OpenVPN2 that is used in OpenVPN2 GUI.

That error message comes up in OpenVPN2 when a route is being added that already exists. So I'd still suggest looking at the routes you're adding and if they already exist on the client side.

Kind regards,
Johan

Can you help guide how to solve these two problem codes ？
1,NOTE: Release of DHCP-assigned IP address lease on TAP-Windows adapter failed: The system cannot find the specified file
2,WARNING: Failed to renew DHCP IP address lease on TAP-Windows adapter: The system cannot find the specified file

openvpn_inc

Hello,

Since this is about OpenVPN2 GUI client I'll have to redirect this to the community section.

Kind regards,
Johan

TinCanTech

Please post the complete (sanitized) client log at --verb 4

doit2010

TinCanTech wrote Please post the complete (sanitized) client log at --verb 4

I have tested many open-as(>=2.8.8) versions. Even the default settings are the same as long as the community client is used.

2022-10-08 15:35:17 DEPRECATED OPTION: --cipher set to 'AES-256-CBC' but missing in --data-ciphers (AES-256-GCM:AES-128-GCM). Future OpenVPN version will ignore --cipher for cipher negotiations. Add 'AES-256-CBC' to --data-ciphers or change --cipher 'AES-256-CBC' to --data-ciphers-fallback 'AES-256-CBC' to silence this warning.
2022-10-08 15:35:17 OpenVPN 2.5.7 Windows-MSVC [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on May 27 2022
2022-10-08 15:35:17 Windows version 10.0 (Windows 10 or greater) 64bit
2022-10-08 15:35:17 library versions: OpenSSL 1.1.1o 3 May 2022, LZO 2.10
2022-10-08 15:35:17 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
2022-10-08 15:35:17 Need hold release from management interface, waiting...
2022-10-08 15:35:18 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
2022-10-08 15:35:18 MANAGEMENT: CMD 'state on'
2022-10-08 15:35:18 MANAGEMENT: CMD 'log all on'
2022-10-08 15:35:18 MANAGEMENT: CMD 'echo all on'
2022-10-08 15:35:18 MANAGEMENT: CMD 'bytecount 5'
2022-10-08 15:35:18 MANAGEMENT: CMD 'hold off'
2022-10-08 15:35:18 MANAGEMENT: CMD 'hold release'
2022-10-08 15:35:19 MANAGEMENT: CMD 'username "Auth" "shilh"'
2022-10-08 15:35:19 MANAGEMENT: CMD 'password [...]'
2022-10-08 15:35:19 Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
2022-10-08 15:35:19 Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
2022-10-08 15:35:19 Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
2022-10-08 15:35:19 Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
2022-10-08 15:35:19 TCP/UDP: Preserving recently used remote address: [AF_INET]192.168.245.132:1194
2022-10-08 15:35:19 Socket Buffers: R=[131072->131072] S=[131072->131072]
2022-10-08 15:35:19 UDP link local: (not bound)
2022-10-08 15:35:19 UDP link remote: [AF_INET]192.168.245.132:1194
2022-10-08 15:35:19 MANAGEMENT: >STATE:1665214519,WAIT,,,,,,
2022-10-08 15:35:19 MANAGEMENT: >STATE:1665214519,AUTH,,,,,,
2022-10-08 15:35:19 TLS: Initial packet from [AF_INET]192.168.245.132:1194, sid=03d09c25 d941d9be
2022-10-08 15:35:19 VERIFY OK: depth=1, CN=OpenVPN CA
2022-10-08 15:35:19 VERIFY KU OK
2022-10-08 15:35:19 Validating certificate extended key usage
2022-10-08 15:35:19 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
2022-10-08 15:35:19 VERIFY EKU OK
2022-10-08 15:35:19 VERIFY OK: depth=0, CN=OpenVPN Server
2022-10-08 15:35:19 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, peer certificate: 2048 bit RSA, signature: RSA-SHA256
2022-10-08 15:35:19 [OpenVPN Server] Peer Connection Initiated with [AF_INET]192.168.245.132:1194
2022-10-08 15:35:20 MANAGEMENT: >STATE:1665214520,GET_CONFIG,,,,,,
2022-10-08 15:35:20 SENT CONTROL [OpenVPN Server]: 'PUSH_REQUEST' (status=1)
2022-10-08 15:35:20 PUSH: Received control message: 'PUSH_REPLY,explicit-exit-notify,topology subnet,route-delay 5 30,dhcp-pre-release,dhcp-renew,dhcp-release,route-metric 101,ping 12,ping-restart 50,redirect-gateway def1,redirect-gateway bypass-dhcp,redirect-gateway autolocal,route-gateway 172.27.232.1,dhcp-option DNS 192.168.245.2,register-dns,block-ipv6,ifconfig 172.27.232.3 255.255.248.0,peer-id 0,auth-tokenSESS_ID,cipher AES-256-GCM'
2022-10-08 15:35:20 Obsolete option --dhcp-release detected. This is now on by default
2022-10-08 15:35:20 WARNING: You have specified redirect-gateway and redirect-private at the same time (or the same option multiple times). This is not well supported and may lead to unexpected results
2022-10-08 15:35:20 WARNING: You have specified redirect-gateway and redirect-private at the same time (or the same option multiple times). This is not well supported and may lead to unexpected results
2022-10-08 15:35:20 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
2022-10-08 15:35:20 OPTIONS IMPORT: timers and/or timeouts modified
2022-10-08 15:35:20 OPTIONS IMPORT: explicit notify parm(s) modified
2022-10-08 15:35:20 OPTIONS IMPORT: --ifconfig/up options modified
2022-10-08 15:35:20 OPTIONS IMPORT: route options modified
2022-10-08 15:35:20 OPTIONS IMPORT: route-related options modified
2022-10-08 15:35:20 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
2022-10-08 15:35:20 OPTIONS IMPORT: peer-id set
2022-10-08 15:35:20 OPTIONS IMPORT: adjusting link_mtu to 1624
2022-10-08 15:35:20 OPTIONS IMPORT: data channel crypto options modified
2022-10-08 15:35:20 Data Channel: using negotiated cipher 'AES-256-GCM'
2022-10-08 15:35:20 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2022-10-08 15:35:20 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2022-10-08 15:35:20 interactive service msg_channel=504
2022-10-08 15:35:20 open_tun
2022-10-08 15:35:20 tap-windows6 device [OpenVPN TAP-Windows6] opened
2022-10-08 15:35:20 TAP-Windows Driver Version 9.24
2022-10-08 15:35:20 Set TAP-Windows TUN subnet mode network/local/netmask = 172.27.232.0/172.27.232.3/255.255.248.0 [SUCCEEDED]
2022-10-08 15:35:20 Notified TAP-Windows driver to set a DHCP IP/netmask of 172.27.232.3/255.255.248.0 on interface {086AB4A5-A7CE-4CDC-A454-745D2B6D7362} [DHCP-serv: 172.27.232.0, lease-time: 31536000]
2022-10-08 15:35:20 Successful ARP Flush on interface [11] {086AB4A5-A7CE-4CDC-A454-745D2B6D7362}
2022-10-08 15:35:20 NOTE: Release of DHCP-assigned IP address lease on TAP-Windows adapter failed: The system cannot find the specified file。 (code=2)
2022-10-08 15:35:20 WARNING: Failed to renew DHCP IP address lease on TAP-Windows adapter: The system cannot find the specified file。 (code=2)
2022-10-08 15:35:20 MANAGEMENT: >STATE:1665214520,ASSIGN_IP,,172.27.232.3,,,,
2022-10-08 15:35:20 IPv4 MTU set to 1500 on interface 11 using service
2022-10-08 15:35:25 TEST ROUTES: 1/1 succeeded len=0 ret=1 a=0 u/d=up
2022-10-08 15:35:25 C:\Windows\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 172.27.232.1
2022-10-08 15:35:25 Route addition via service succeeded
2022-10-08 15:35:25 C:\Windows\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 172.27.232.1
2022-10-08 15:35:25 Route addition via service succeeded
2022-10-08 15:35:25 Initialization Sequence Completed
2022-10-08 15:35:25 Register_dns request sent to the service
2022-10-08 15:35:25 MANAGEMENT: >STATE:1665214525,CONNECTED,SUCCESS,172.27.232.3,192.168.245.132,1194,,

doit2010

TinCanTech wrote Please post the complete (sanitized) client log at --verb 4

I have tested many open as versions(>=2.8.8). Even the default settings are the same as long as the community client(>=2.5.5) is used
# This is the community client log
2022-10-08 15:35:17 DEPRECATED OPTION: --cipher set to 'AES-256-CBC' but missing in --data-ciphers (AES-256-GCM:AES-128-GCM). Future OpenVPN version will ignore --cipher for cipher negotiations. Add 'AES-256-CBC' to --data-ciphers or change --cipher 'AES-256-CBC' to --data-ciphers-fallback 'AES-256-CBC' to silence this warning.
2022-10-08 15:35:17 OpenVPN 2.5.7 Windows-MSVC [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on May 27 2022
2022-10-08 15:35:17 Windows version 10.0 (Windows 10 or greater) 64bit
2022-10-08 15:35:17 library versions: OpenSSL 1.1.1o 3 May 2022, LZO 2.10
2022-10-08 15:35:17 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
2022-10-08 15:35:17 Need hold release from management interface, waiting...
2022-10-08 15:35:18 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
2022-10-08 15:35:18 MANAGEMENT: CMD 'state on'
2022-10-08 15:35:18 MANAGEMENT: CMD 'log all on'
2022-10-08 15:35:18 MANAGEMENT: CMD 'echo all on'
2022-10-08 15:35:18 MANAGEMENT: CMD 'bytecount 5'
2022-10-08 15:35:18 MANAGEMENT: CMD 'hold off'
2022-10-08 15:35:18 MANAGEMENT: CMD 'hold release'
2022-10-08 15:35:19 MANAGEMENT: CMD 'username "Auth" "shilh"'
2022-10-08 15:35:19 MANAGEMENT: CMD 'password [...]'
2022-10-08 15:35:19 Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
2022-10-08 15:35:19 Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
2022-10-08 15:35:19 Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
2022-10-08 15:35:19 Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
2022-10-08 15:35:19 TCP/UDP: Preserving recently used remote address: [AF_INET]192.168.245.132:1194
2022-10-08 15:35:19 Socket Buffers: R=[131072->131072] S=[131072->131072]
2022-10-08 15:35:19 UDP link local: (not bound)
2022-10-08 15:35:19 UDP link remote: [AF_INET]192.168.245.132:1194
2022-10-08 15:35:19 MANAGEMENT: >STATE:1665214519,WAIT,,,,,,
2022-10-08 15:35:19 MANAGEMENT: >STATE:1665214519,AUTH,,,,,,
2022-10-08 15:35:19 TLS: Initial packet from [AF_INET]192.168.245.132:1194, sid=03d09c25 d941d9be
2022-10-08 15:35:19 VERIFY OK: depth=1, CN=OpenVPN CA
2022-10-08 15:35:19 VERIFY KU OK
2022-10-08 15:35:19 Validating certificate extended key usage
2022-10-08 15:35:19 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
2022-10-08 15:35:19 VERIFY EKU OK
2022-10-08 15:35:19 VERIFY OK: depth=0, CN=OpenVPN Server
2022-10-08 15:35:19 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, peer certificate: 2048 bit RSA, signature: RSA-SHA256
2022-10-08 15:35:19 [OpenVPN Server] Peer Connection Initiated with [AF_INET]192.168.245.132:1194
2022-10-08 15:35:20 MANAGEMENT: >STATE:1665214520,GET_CONFIG,,,,,,
2022-10-08 15:35:20 SENT CONTROL [OpenVPN Server]: 'PUSH_REQUEST' (status=1)
2022-10-08 15:35:20 PUSH: Received control message: 'PUSH_REPLY,explicit-exit-notify,topology subnet,route-delay 5 30,dhcp-pre-release,dhcp-renew,dhcp-release,route-metric 101,ping 12,ping-restart 50,redirect-gateway def1,redirect-gateway bypass-dhcp,redirect-gateway autolocal,route-gateway 172.27.232.1,dhcp-option DNS 192.168.245.2,register-dns,block-ipv6,ifconfig 172.27.232.3 255.255.248.0,peer-id 0,auth-tokenSESS_ID,cipher AES-256-GCM'
2022-10-08 15:35:20 Obsolete option --dhcp-release detected. This is now on by default
2022-10-08 15:35:20 WARNING: You have specified redirect-gateway and redirect-private at the same time (or the same option multiple times). This is not well supported and may lead to unexpected results
2022-10-08 15:35:20 WARNING: You have specified redirect-gateway and redirect-private at the same time (or the same option multiple times). This is not well supported and may lead to unexpected results
2022-10-08 15:35:20 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
2022-10-08 15:35:20 OPTIONS IMPORT: timers and/or timeouts modified
2022-10-08 15:35:20 OPTIONS IMPORT: explicit notify parm(s) modified
2022-10-08 15:35:20 OPTIONS IMPORT: --ifconfig/up options modified
2022-10-08 15:35:20 OPTIONS IMPORT: route options modified
2022-10-08 15:35:20 OPTIONS IMPORT: route-related options modified
2022-10-08 15:35:20 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
2022-10-08 15:35:20 OPTIONS IMPORT: peer-id set
2022-10-08 15:35:20 OPTIONS IMPORT: adjusting link_mtu to 1624
2022-10-08 15:35:20 OPTIONS IMPORT: data channel crypto options modified
2022-10-08 15:35:20 Data Channel: using negotiated cipher 'AES-256-GCM'
2022-10-08 15:35:20 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2022-10-08 15:35:20 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2022-10-08 15:35:20 interactive service msg_channel=504
2022-10-08 15:35:20 open_tun
2022-10-08 15:35:20 tap-windows6 device [OpenVPN TAP-Windows6] opened
2022-10-08 15:35:20 TAP-Windows Driver Version 9.24
2022-10-08 15:35:20 Set TAP-Windows TUN subnet mode network/local/netmask = 172.27.232.0/172.27.232.3/255.255.248.0 [SUCCEEDED]
2022-10-08 15:35:20 Notified TAP-Windows driver to set a DHCP IP/netmask of 172.27.232.3/255.255.248.0 on interface {086AB4A5-A7CE-4CDC-A454-745D2B6D7362} [DHCP-serv: 172.27.232.0, lease-time: 31536000]
2022-10-08 15:35:20 Successful ARP Flush on interface [11] {086AB4A5-A7CE-4CDC-A454-745D2B6D7362}
2022-10-08 15:35:20 NOTE: Release of DHCP-assigned IP address lease on TAP-Windows adapter failed: The system cannot find the specified file。 (code=2)
2022-10-08 15:35:20 WARNING: Failed to renew DHCP IP address lease on TAP-Windows adapter: The system cannot find the specified file。 (code=2)
2022-10-08 15:35:20 MANAGEMENT: >STATE:1665214520,ASSIGN_IP,,172.27.232.3,,,,
2022-10-08 15:35:20 IPv4 MTU set to 1500 on interface 11 using service
2022-10-08 15:35:25 TEST ROUTES: 1/1 succeeded len=0 ret=1 a=0 u/d=up
2022-10-08 15:35:25 C:\Windows\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 172.27.232.1
2022-10-08 15:35:25 Route addition via service succeeded
2022-10-08 15:35:25 C:\Windows\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 172.27.232.1
2022-10-08 15:35:25 Route addition via service succeeded
2022-10-08 15:35:25 Initialization Sequence Completed
2022-10-08 15:35:25 Register_dns request sent to the service
2022-10-08 15:35:25 MANAGEMENT: >STATE:1665214525,CONNECTED,SUCCESS,172.27.232.3,192.168.245.132,1194,,