Windows 7 x64, routing, DHCP and a unstable VPN

TheSilentTechie

Hello.

In the last days I have analyst a
problem with my existing, self administrate OpenVPN solution for more peoples in a company. And the situation is so strange, that I will inform the community about it.

Situation:
With a new Windows 7 laptop OpenVPN works with the same configuration as with XP in the home office. After round about 10 minutes the IP traffic to the destination network will not work, the GUI is green. With XP in the same time all work fine.
The same laptop work in the company with a different ISP the complete day without any problems.

Configuration:
A normal configuration with the complete routing via the tunnel (redirect-gateway)

Tests and first view on the problem:
I do really a lot of test, nothing helps. Change settings on Windows, client and server side. Always after a broken connection the routing will be wrong. Without the tunnel I have only one default gate (0.0.0.0/0 route to router), when the tunnel works the system has a default gateway the VPN tunnel (0.0.0.0/0 route to TAP device, VPN-Server-IP/32 to router), with the broken route both are active! 0.0.0.0/0 route to router with a metric smaller than 0.0.0.0/0 route to TAP device. That can not work. So far I create a manual host route the tunnel the host is stable reachable.

Workaround:
Thanks to the tool WireShark – I fount only on DHCP request at the moment where the tunnel go down. With a static IP all works fine. So I change on my router the lease time of the DHCP from a half our to one day. The tunnel looks like good (I found no problem in the moment, the solution is active only one day and it not tested in the detail).

Background:
From my view Windows 7 has a bug / feature: With a new DHCP lease the network will be reloaded. So the original routing will be active again. OpenVPN has so no option the work correctly with this routing.

Reproduce:
With a active tunnel I run in an administrative command box “ipconfig /renew” and the problem is there. In the home office and in the company. But only on Windows 7, not on XP.

@ Community:
It is juicy?
Can you reproduce the situation? (So in different environment)
Are you think it is a bug from Windows 7 (my option) or a missing new function with support from OpenVPN?
Became we a statement from a OpenVPN developer about it?
Is this a problem?
And is the deploying of the situation here correctly to fix it? Or who need what? Is this the right way? I'm new here.

Comment from me:
I had only configure the lease time small, because I test a lot of different systems and so I prefer a cleaning of the DHCP. But that is not the discussion: What make different ISP with the lease time? I have never check the lease time from a ISP before – the route do what a route must do. And from my view a DHCP renewal can not have an affect to the routing. As I'm Microsoft “know” is it is a new feature, also in the view of Ipv6. Can and will do the OpenVPN developer something again?
For me I have a solution and I know the problem. And for all other I hope this novel is not to long and to strange.

Thanks to all of the OpenVPN community – it is a create tool and a good job of all.

Regards
The Silent Techie

alemack

I have the very same problem, but unluckily I can't use the proposed workaround because I cannot change the lease time of the router (I don't have access to its configuration).

Any other possible solution?

janjust

hmmm I think I can reproduce it on my win7 box...
use OpenVPN 2.1.4 and try adding

register-dns

to the client config file.

Another thing to try it to UNcheck the setting "Register this connection's addresses in DNS" in the DNS tab of the Advanced TCP/IP settings .

Don't you just *love* windows ;-) ?

TheSilentTechie

I tried both ideas from janjust - no, it will not be a solution on my system. And for me normal DNS has no function with routing or with reloading of network, but I open for each idea.

@Alemak:
Can you use static IP? That will also work.

By the way: SP1 for W7 made no different.

An other very bad workaround is to delete the wrong routing manual. So I test it very fast and must not always enter all data. It is also only for testing, not a workaround for production environment.

At last:
No comment from a developer. Is this the wrong place?

TheSilentTechie

Please do not smite me for this possible bad workaround for Alemak. :oops:
The script will check every 10 seconds the count of default gateways and delete on error the wrong. (So I hope)

@echo off
set GWcount=
set MaxGWcount=2
set defGW=192.168.0.1
set sleepexe=%~dp0sleep.exe
set sleeptime=10

:loop
for /f %%a in ('route print ^|find /c " 0.0.0.0"') do set GWcount=%%a
if "%GWcount%" geq "%MaxGWcount%" route delete 0.0.0.0 %defGW%
%sleepexe% %sleeptime%
goto loop

:end
set GWcount=
set MaxGWcount=
set defGW=
set sleepexe=
set sleeptime=

Howto:
Search only sleep.exe in the internet, copy it in the same folder as this script (something.bat or GWreset.cmd),
modify "set defGW=192.168.0.1" with your default gateway
and run this under administrator rights.

If necessary I will search for a solution to to find out in the script the default gateway. But this is difficult with different LAN configuration and so ....

And the script is without guaranty and without official support. (A opensource draft - alpha - proof of concept) 😉

janjust

hmmm I can sometimes reproduce this behaviour. When I do see it, I also see in the Event Log:

Event ID: 50015
OpCode: NackReceived
Nack is received in the adapter 22

(where 22 is the adapter ID of the tap-win32 adapter). Do you see this as well? I cannot find any info on this on the internet, except a few others who have had similar problems with their home routers....

TheSilentTechie

With "ipconfig /renew" and with active tunnel no NACK in the system event log.

I checked also the DHCP packages on LAN and on the VPN network card - no NACK.

To make the same situation: I test in the meantime without firewall, virus defence, ... - a empty system. The same result have I with my production system (with patches and so on).
The problem can reproduce with 2.1.4 and with 2.2 beta 5. Configuration dev tun with full routed network.

alemack

TheSilentTechie wrotePlease do not smite me for this possible bad workaround for Alemak. :oops:
The script will check every 10 seconds the count of default gateways and delete on error the wrong. (So I hope)

And the script is without guaranty and without official support. (A opensource draft - alpha - proof of concept) 😉

Thank you very much, the script works (I spent some time in order to figure out the address of the default gateway, but at the end I made it work). Unluckily I cannot use a static IP, so I have to use this solution...
Ok, it may not be the best solution ever, but at least it works :-)

I also tried the one proposed by janjust, but it didn't work either (I don't know if it's because I don't use version 2.1.4, but 2.2.beta5).

Anyway, I don't have any nack as TheSilentTechie, and to me the problem arose every time the lease time expired (about 4-5 minutes before the time listed in the details of the network connection - i.e. about every hour for my network)

Bye
Alemack

janjust

this is more of an answer to a private message by SilentTechie, but I cannot figure out how to reply to a private message:

The question is for me, what we will do now? For me it is no problem, but I think it is a general bug somewhere. The problem from Alemack is fixed - ok, with a bad solution, but it more than nothing.

I miss a commend from a developer and also some comments from other users. So for me is the question about the skill of this situation. Is this forum the correct place? Or do you think I should contact Samuli Seppäne alias mattock? Have you more contact to the developer or are you a member of the developer team?

I think we need to investigate this further - there seems to be some weird interaction between Windows 7 (Vista?) and the tap-win32/tap-win64 adapter supplied by OpenVPN. This problem seems to be hard to reproduce for the developers , so it will be even harder to fix.

TheSilentTechie

A new bad solution, but I think not so dirty as the last one.

Change the option of the active network card under the properties of Internet Protocol Version 4 (TCP/IPv4). On advanced you can uncheck "Automatic Metric" and define a value with a high number than the OpenVPN metric. In my case 100 was good, because OpenVPN came with 30.
You can check the change with "route print" add look at the column "metric".

About a general solution I will Google a little bit more to find out what Microsoft has changed. But the first search has no goal. And it's look like that I must test it also with Vista. Or can someone tell me that with Vista has the same bug?

@Alemack:
Which solution preferred you?

alemack

TheSilentTechie wroteA new bad solution, but I think not so dirty as the last one.

Change the option of the active network card under the properties of Internet Protocol Version 4 (TCP/IPv4). On advanced you can uncheck "Automatic Metric" and define a value with a high number than the OpenVPN metric. In my case 100 was good, because OpenVPN came with 30.
You can check the change with "route print" add look at the column "metric".

I will try also this solution and I will let you know the outcome :-)

TheSilentTechie wrote About a general solution I will Google a little bit more to find out what Microsoft has changed. But the first search has no goal. And it's look like that I must test it also with Vista. Or can someone tell me that with Vista has the same bug?

I have the problem on Vista :-)

Bye
Alemack

alemack

I used the solution proposed for a couple of days and, so far, I haven't had any problem: thank you very much.

Bye
Alemack

whyhello

well in short i am having the same problem on win 7 ultimate 64 bit for a month now, and i have read miles of forums posts and 'work around's and nothing works.

my openvpn server runs on deb lenny 5 OS remote server , been up and running for more then 1 year , open vpn server config files

server 10.8.0.0 255.255.255.0
# YOUR LOCAL SERVER IP HERE:
local remote .ip
dev tun
proto udp
comp-lzo

# THESE 2 LINES ARE HELPFUL FOR THOSE WITH MOBILE (G3 / G3.5) BROADBAND:
tun-mtu 1500
tun-mtu-extra 32

# ROUTE THE CLIENT'S INTERNET ACCESS THROUGH THIS SERVER:
push "redirect-gateway def1 bypass-dns"

keepalive 10 60

dh /etc/openvpn/easy-rsa/keys/dh1024.pem
ca /etc/openvpn/easy-rsa/keys/ca.crt

# ENSURE THE DOMAIN NAME/FILENAME IS CORRECT:
cert /etc/openvpn/easy-rsa/keys/vpn.myserver.com.crt
key /etc/openvpn/easy-rsa/keys/vpn.myserver.com.key

# LEAVE THE FOLLOWING LINE COMMENTED FOR NOW:
# crl-verify /etc/openvpn/easy-rsa/keys/crl.pem

user openvpn
group openvpn

persist-key
persist-tun

local p.c win 7 64 bit , client vpn files

client
dev tun
proto udp

# THE IP OF THE REMOTE OPENVPN SERVER:
remote remote ip
# THE CSR FILE:
pkcs12 [csr].p12

comp-lzo

route-method exe
route-delay 2



verb 5

redirect-gateway def1

the same config works out of the box on xp but win 7 it does not, am using openvpn 2.1.4, which installed correctly with the tap drivers, my vpn gets connected perfectly fine, i can ping the vpn server, hell i can even ssh to it , or znc running oin it does not break on local p.c , or my ftp ,, it the out side network which does not work i cannot get on any site or do anything else. from what i can make it windows 7 marks the connect as public with no Internet i have turned off windows firewall but no cigar plus the default gateway, there no gate way to the vpn windows won't let it use the active connection as the gateway , now here is the bugger all my ip acts as my gate way it's 3g a dial up data card so the gate way is on - link.

i have tired and given up on windows 7 forums , works for ome when running as admin does not work for some as [including me.]

hoping some opnvpn tech gurus can help me out 😃

TheSilentTechie

As I you understand whyhello he became a green openvpn gui, but the routing never works correctly. So it is not exactly the same problem, but it is also juicy.

@whyhello:
1. have you the same problem with a normal broadband Internet connection?
2. became you a succeeded message of the routing commands in the vpn log?
3. can you post the routing table (netstat -rn)?
4. so far you can use an other broadband connection, can you uninstall the 3g-software? From my first remote view a software can prevent a modification a the routing command.

TheSilentTechie

Janjust have create a bug ticket on a similar issues (https://community.openvpn.net/openvpn/ticket/97)
and we are in contact on the devel irc to arrange different tests. So we hope all to find a global solution.

whyhello

ok i worked it out, yeah this happens on all connections, the problem from xp to win 7 [ never used vista] is 2 fold, 1st win 7 does not let you use the default gateway , i.e no gate way is assigned to openvpn as it is a virtual adapter with no ip of it's own. 2nd it marks it as public network with no Internet . there 2 or 3 things you can do then , disable UAC totally or run openvpn as admin [also in vista sp2 mode] and you have to disable windows firewall , no way a user can use it , the routes just won't work you might get the green light but no networking .
and also found helpful config for openvpn windows 7 public network

# Dummy default gateway to work around Windows 'unidentified network'/'unknown network'
route-metric 512
route 0.0.0.0 0.0.0.0

put this in your openvpn client config , and a window will pop up asking you to name the network. obviously you should know your networking and default metric from ISP, this has to be higher then isp's metric.

in my case i disabled UAC , turned off windows firewall , installed openvpn again , cleaned firewall registry entries and bang wham a working connection 😃

janjust

in order to successfully use openvpn on Windows 7 (and Vista) you must run openvpn with enough privileges to add/delete/alter network routes. Unfortunately this requires 'admin privs' on Win 7 home edition ; on Windows 7 Professional and higher you can also make the current user a member of 'Network Admins'. If you do this there's no need to use elevated privileges

Disabling UAC gives you pretty much the same behaviour as WinXP so I'm not surprised that that works.

TheSilentTechie

The solution from whyhello is ok - it is work. But I can not understand it - from my view "redirect-gateway" must do the same. So I have one idea. Can you try the old config without the "def1" option. Perhaps something with the interface counter is wrong? Or you have an hide and bad character in the config file?

@janjust: Or do you think i'm wrong?

I test also this configuration for "my first problem" - all the same.

@janjust: Do you think on this problem also on the devel meeting tomorrow. Very thanks in advance.

janjust

we've discussed this problem in the devel meeting and will continue looking.
In the meantime, can someone try out the following:

Add a registry key

HKML\SYSTEM\CurrentControlSet\services\TCPIP6\Parameters\DisabledComponents:DWORD32 = 1

and reboot the box ; this wil disable all M$ tunnel interfaces (but the tap-win32 i/f will remain intact). I'm curious if this makes a difference for other people, as it "solved" the issue on my Win 7 64bit laptop.

TheSilentTechie

no, nothing changed. But I never had a DHCP NACK problem. My problem is a reset of the routing table on a DHCP Request.

DHCP Wirshark sniff on the TUN/TAP device, IP are from the tunnel (inside endpoint):
     15 21:01:03.054003 10.51.251.6           10.51.251.5           DHCP     DHCP Request  - Transaction ID 0x5938ca57
     16 21:01:03.054099 10.51.251.5           10.51.251.6           DHCP     DHCP ACK      - Transaction ID 0x5938ca57
     86 21:01:16.661696 10.51.251.6           255.255.255.255       DHCP     DHCP Inform   - Transaction ID 0x9a8b85f4
     88 21:01:19.664169 10.51.251.6           255.255.255.255       DHCP     DHCP Inform   - Transaction ID 0x9a8b85f4

Perhaps we should show not only on the client side. You test with a linux server? I have a W2k3 server als OpenVPN server.