Hello. In the last days I have analyst a problem with my existing, self administrate OpenVPN solution for more peoples in a company. And the situation is so strange, that I will inform the community about it. Situation: With a new Windows 7 laptop OpenVPN works with the same configuration as with XP in the home office. After round about 10 minutes the IP traffic to the destination network will not work, the GUI is green. With XP in the same time all work fine. The same laptop work in the company with a different ISP the complete day without any problems. Configuration: A normal configuration with the complete routing via the tunnel (redirect-gateway) Tests and first view on the problem: I do really a lot of test, nothing helps. Change settings on Windows, client and server side. Always after a broken connection the routing will be wrong. Without the tunnel I have only one default gate (0.0.0.0/0 route to router), when the tunnel works the system has a default gateway the VPN tunnel (0.0.0.0/0 route to TAP device, VPN-Server-IP/32 to router), with the broken route both are active! 0.0.0.0/0 route to router with a metric smaller than 0.0.0.0/0 route to TAP device. That can not work. So far I create a manual host route the tunnel the host is stable reachable. Workaround: Thanks to the tool WireShark – I fount only on DHCP request at the moment where the tunnel go down. With a static IP all works fine. So I change on my router the lease time of the DHCP from a half our to one day. The tunnel looks like good (I found no problem in the moment, the solution is active only one day and it not tested in the detail). Background: From my view Windows 7 has a bug / feature: With a new DHCP lease the network will be reloaded. So the original routing will be active again. OpenVPN has so no option the work correctly with this routing. Reproduce: With a active tunnel I run in an administrative command box “ipconfig /renew” and the problem is there. In the home office and in the company. But only on Windows 7, not on XP. @ Community: It is juicy? Can you reproduce the situation? (So in different environment) Are you think it is a bug from Windows 7 (my option) or a missing new function with support from OpenVPN? Became we a statement from a OpenVPN developer about it? Is this a problem? And is the deploying of the situation here correctly to fix it? Or who need what? Is this the right way? I'm new here. Comment from me: I had only configure the lease time small, because I test a lot of different systems and so I prefer a cleaning of the DHCP. But that is not the discussion: What make different ISP with the lease time? I have never check the lease time from a ISP before – the route do what a route must do. And from my view a DHCP renewal can not have an affect to the routing. As I'm Microsoft “know” is it is a new feature, also in the view of Ipv6. Can and will do the OpenVPN developer something again? For me I have a solution and I know the problem. And for all other I hope this novel is not to long and to strange. Thanks to all of the OpenVPN community – it is a create tool and a good job of all. Regards The Silent Techie

hmmm I think I can reproduce it on my win7 box... use OpenVPN 2.1.4 and try adding [code]register-dns[/code] to the client config file. Another thing to try it to UNcheck the setting "Register this connection's addresses in DNS" in the DNS tab of the Advanced TCP/IP settings . Don't you just *love* windows ;-) ?

I tried both ideas from janjust - no, it will not be a solution on my system. And for me normal DNS has no function with routing or with reloading of network, but I open for each idea. @Alemak: Can you use static IP? That will also work. By the way: SP1 for W7 made no different. An other very bad workaround is to delete the wrong routing manual. So I test it very fast and must not always enter all data. It is also only for testing, not a workaround for production environment. At last: No comment from a developer. Is this the wrong place?

Please do not smite me for this possible bad workaround for Alemak. :oops: The script will check every 10 seconds the count of default gateways and delete on error the wrong. (So I hope) [code]@echo off set GWcount= set MaxGWcount=2 set defGW=192.168.0.1 set sleepexe=%~dp0sleep.exe set sleeptime=10 :loop for /f %%a in ('route print ^|find /c " 0.0.0.0"') do set GWcount=%%a if "%GWcount%" geq "%MaxGWcount%" route delete 0.0.0.0 %defGW% %sleepexe% %sleeptime% goto loop :end set GWcount= set MaxGWcount= set defGW= set sleepexe= set sleeptime=[/code] Howto: Search only sleep.exe in the internet, copy it in the same folder as this script (something.bat or GWreset.cmd), modify "set defGW=192.168.0.1" with your default gateway and run this under administrator rights. If necessary I will search for a solution to to find out in the script the default gateway. But this is difficult with different LAN configuration and so .... And the script is without guaranty and without official support. (A opensource draft - alpha - proof of concept) ;)

hmmm I can [i]sometimes[/i] reproduce this behaviour. When I do see it, I also see in the Event Log: [quote]Event ID: 50015 OpCode: NackReceived Nack is received in the adapter 22 [/quote] (where 22 is the adapter ID of the tap-win32 adapter). Do you see this as well? I cannot find any info on this on the internet, except a few others who have had similar problems with their home routers....

With "ipconfig /renew" and with active tunnel no NACK in the system event log. I checked also the DHCP packages on LAN and on the VPN network card - no NACK. To make the same situation: I test in the meantime without firewall, virus defence, ... - a empty system. The same result have I with my production system (with patches and so on). The problem can reproduce with 2.1.4 and with 2.2 beta 5. Configuration dev tun with full routed network.

[quote="TheSilentTechie"]Please do not smite me for this possible bad workaround for Alemak. :oops: The script will check every 10 seconds the count of default gateways and delete on error the wrong. (So I hope) And the script is without guaranty and without official support. (A opensource draft - alpha - proof of concept) ;)[/quote] Thank you very much, the script works (I spent some time in order to figure out the address of the default gateway, but at the end I made it work). Unluckily I cannot use a static IP, so I have to use this solution... Ok, it may not be the best solution ever, but at least it works :-) I also tried the one proposed by janjust, but it didn't work either (I don't know if it's because I don't use version 2.1.4, but 2.2.beta5). Anyway, I don't have any nack as TheSilentTechie, and to me the problem arose every time the lease time expired (about 4-5 minutes before the time listed in the details of the network connection - i.e. about every hour for my network) Bye Alemack

this is more of an answer to a private message by SilentTechie, but I cannot figure out how to reply to a private message: [quote]The question is for me, what we will do now? For me it is no problem, but I think it is a general bug somewhere. The problem from Alemack is fixed - ok, with a bad solution, but it more than nothing. I miss a commend from a developer and also some comments from other users. So for me is the question about the skill of this situation. Is this forum the correct place? Or do you think I should contact Samuli Seppäne alias mattock? Have you more contact to the developer or are you a member of the developer team?[/quote] I think we need to investigate this further - there seems to be some weird interaction between Windows 7 (Vista?) and the tap-win32/tap-win64 adapter supplied by OpenVPN. This problem seems to be hard to reproduce for the developers , so it will be even harder to fix.

A new bad solution, but I think not so dirty as the last one. Change the option of the active network card under the properties of Internet Protocol Version 4 (TCP/IPv4). On advanced you can uncheck "Automatic Metric" and define a value with a high number than the OpenVPN metric. In my case 100 was good, because OpenVPN came with 30. You can check the change with "route print" add look at the column "metric". About a general solution I will Google a little bit more to find out what Microsoft has changed. But the first search has no goal. And it's look like that I must test it also with Vista. Or can someone tell me that with Vista has the same bug? @Alemack: Which solution preferred you?

[quote="TheSilentTechie"]A new bad solution, but I think not so dirty as the last one. Change the option of the active network card under the properties of Internet Protocol Version 4 (TCP/IPv4). On advanced you can uncheck "Automatic Metric" and define a value with a high number than the OpenVPN metric. In my case 100 was good, because OpenVPN came with 30. You can check the change with "route print" add look at the column "metric".[/quote] I will try also this solution and I will let you know the outcome :-) [quote="TheSilentTechie"] About a general solution I will Google a little bit more to find out what Microsoft has changed. But the first search has no goal. And it's look like that I must test it also with Vista. Or can someone tell me that with Vista has the same bug?[/quote] I have the problem on Vista :-) Bye Alemack

Windows 7 x64, routing, DHCP and a unstable VPN

pmw

Anything new of this problem? I have 100% same problem.

Disabling UAC, resintalling etc etc didn't work.

I have no clue what I can do for this.

TheSilentTechie

From my side I have no really news that you can use.
I check the situation new, because I don’t use W7 anymore fore that. Xubuntu, OpenVPN and Remmina (RDP client with SSL) do the job as well. Also I have changed the DHCP lease time and so I have workarounds for workaround for me.
To the facts: I have rebuild the situation and have different effects. With an “ipconfig /renew” on two systems the routing table will be changed back. So a second default gateway entry exist after that. From the metric on one system has the network card a higher priority, on the second a lower. The system with the higher priority should have the listed problem, but no - it works ????
What have I changed? Not really something on OpenVPN. But I’ll be honest - the VPN Server was changed. For one year I had a virtual W2k3 Server (32-bit) on ESX 4.0. In the view of paranoia on a possible hacking of ESX in the DMZ we have installed the VPN Server new. Now it is a physical server with the same configuration (OS, actual OpenVPN software). I can not imagine that ESX make this bug - but all is possible. Perhaps Microsoft has fixed the bug with a security patch?
@PMW: Will the workaround with the metric change not work?
@Jan: Have you news? You found out that it can be a timing problem (or is my reminding on the irc chat wrong?).

pmw

TheSilentTechie wrote @PMW: Will the workaround with the metric change not work?

Unfortunately no. This is strange thing cause it's only in new Windowses(2008,Vista,7).
And because these operating systems are todays extremely common, it really seems that I need to leave openvpn. This bug --- or whatever it is --- has teased me more than 6 months, and it's still not working!

TheSilentTechie

Windows 2008! As client or only as server?
Can you post the routing table with the open tunnel? I can not believe that is exactly the same problem. In my case the tunnel works - but only to the next DHCP request.
Perhaps we should check the compleate configuration, but I'm more a system administrator - no OpenVPN specialist.

[edit]
You have a different problem - I found your toppic
https://forums.openvpn.net/topic9346.html

So we can stop your problem here. Or saw I something wrong?

pmw

Sorry, you are right.
My problem actually wasn't same as was seen in this topic.

Anyway, thanks for advice!

Too fast fingers and lack of reading..

salzino

alemack wroteI have the very same problem, but unluckily I can't use the proposed workaround because I cannot change the lease time of the router (I don't have access to its configuration).

Any other possible solution?

You can try by deactivating the firewall for a while... This worked fine for me.. I hope this helps

« Previous Page