Windows Server 2003 + VirtualBox + OpenVPN = No RDP

alphamail

Hi guys I have a issue that is driving me up the wall.

I have a VPS Server hosting Windows Server 2003
On this I installed openVPN with StrongVPN Configs

I can Remote Desktop into the machine successfully (without openVPN running)

When I connect to openVPN to StrongVPN it automatically disconnects Remote Desktop and I'm unable to reach the VPS again until I reboot it.

Any ideas or suggestions on what to do to enable openVPN to run on the Host machine, and have Remote Desktop Access to it?

Thank you.

Editted: Added Config and Log

CONFIG


remote 207.204.236.28 4672
proto udp
ca ca.crt
cert ovpn281.crt
key ovpn281.key
tls-auth ta.key 1
client
dev tun
resolv-retry infinite
nobind
persist-key
persist-tun
;http-proxy-retry # retry on connection failures
;http-proxy [proxy server] [proxy port #]
verb 4
mute 5
tun-mtu 1500
route-method exe
route-delay 2
redirect-gateway def1
explicit-exit-notify 2
fragment  1390
mssfix 1390

LOG (I always run a bat file that restarts the server after 4 mins right before I start openVPN so the server will reboot on it's own when I lose RDP connection)

Tue Jul 26 23:47:48 2011 us=406000 Current Parameter Settings:
Tue Jul 26 23:47:48 2011 us=406000   config = 'ovpn281.ovpn'
Tue Jul 26 23:47:48 2011 us=406000   mode = 0
Tue Jul 26 23:47:48 2011 us=406000   show_ciphers = DISABLED
Tue Jul 26 23:47:48 2011 us=406000   show_digests = DISABLED
Tue Jul 26 23:47:48 2011 us=406000 NOTE: --mute triggered...
Tue Jul 26 23:47:48 2011 us=406000 218 variation(s) on previous 5 message(s) suppressed by --mute
Tue Jul 26 23:47:48 2011 us=406000 OpenVPN 2.2.1 Win32-MSVC++ [SSL] [LZO2] built on Jul  1 2011
Tue Jul 26 23:47:48 2011 us=406000 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Tue Jul 26 23:47:48 2011 us=406000 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Tue Jul 26 23:47:48 2011 us=750000 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
Tue Jul 26 23:47:48 2011 us=750000 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jul 26 23:47:48 2011 us=750000 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jul 26 23:47:48 2011 us=750000 Control Channel MTU parms [ L:1545 D:166 EF:66 EB:0 ET:0 EL:0 ]
Tue Jul 26 23:47:48 2011 us=750000 Socket Buffers: R=[8192->8192] S=[8192->8192]
Tue Jul 26 23:47:48 2011 us=750000 Data Channel MTU parms [ L:1545 D:1390 EF:45 EB:4 ET:0 EL:0 ]
Tue Jul 26 23:47:48 2011 us=750000 Fragmentation MTU parms [ L:1545 D:1390 EF:45 EB:4 ET:0 EL:0 ]
Tue Jul 26 23:47:48 2011 us=750000 Local Options String: 'V4,dev-type tun,link-mtu 1545,tun-mtu 1500,proto UDPv4,mtu-dynamic,keydir 1,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-client'
Tue Jul 26 23:47:48 2011 us=750000 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1545,tun-mtu 1500,proto UDPv4,mtu-dynamic,keydir 0,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-server'
Tue Jul 26 23:47:48 2011 us=750000 Local Options hash (VER=V4): '885414e3'
Tue Jul 26 23:47:48 2011 us=750000 Expected Remote Options hash (VER=V4): '8bcc3b84'
Tue Jul 26 23:47:48 2011 us=750000 UDPv4 link local: [undef]
Tue Jul 26 23:47:48 2011 us=750000 UDPv4 link remote: 207.204.236.28:4672
Tue Jul 26 23:47:48 2011 us=906000 TLS: Initial packet from 207.204.236.28:4672, sid=b679975d 58760d61
Tue Jul 26 23:47:49 2011 us=656000 VERIFY OK: depth=1, /C=US/ST=NA/L=San-Francisco/O=reliablehosting.com/CN=ovpn281/emailAddress=techies@reliablehosting.com
Tue Jul 26 23:47:49 2011 us=656000 VERIFY OK: depth=0, /C=US/ST=NA/O=reliablehosting.com/CN=ovpn281/emailAddress=techies@reliablehosting.com
Tue Jul 26 23:47:51 2011 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Jul 26 23:47:51 2011 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Jul 26 23:47:51 2011 NOTE: --mute triggered...
Tue Jul 26 23:47:51 2011 us=15000 3 variation(s) on previous 5 message(s) suppressed by --mute
Tue Jul 26 23:47:51 2011 us=15000 [ovpn281] Peer Connection Initiated with 207.204.236.28:4672
Tue Jul 26 23:47:53 2011 us=390000 SENT CONTROL [ovpn281]: 'PUSH_REQUEST' (status=1)
Tue Jul 26 23:47:53 2011 us=531000 PUSH: Received control message: 'PUSH_REPLY,route-delay 2,route-metric 1,dhcp-option DNS 216.131.94.5,dhcp-option DNS 216.131.95.20,route 10.8.8.201,topology net30,ping 10,ping-restart 60,ifconfig 10.8.8.206 10.8.8.205'
Tue Jul 26 23:47:53 2011 us=546000 OPTIONS IMPORT: timers and/or timeouts modified
Tue Jul 26 23:47:53 2011 us=546000 OPTIONS IMPORT: --ifconfig/up options modified
Tue Jul 26 23:47:53 2011 us=546000 OPTIONS IMPORT: route options modified
Tue Jul 26 23:47:53 2011 us=546000 NOTE: --mute triggered...
Tue Jul 26 23:47:53 2011 us=593000 2 variation(s) on previous 5 message(s) suppressed by --mute
Tue Jul 26 23:47:53 2011 us=593000 ROUTE default_gateway=85.17.24.190
Tue Jul 26 23:47:53 2011 us=609000 TAP-WIN32 device [Local Area Connection 4] opened: \\.\Global\{D9DFAEC0-A634-4C12-8019-8D760417E3D6}.tap
Tue Jul 26 23:47:53 2011 us=609000 TAP-Win32 Driver Version 9.8 
Tue Jul 26 23:47:53 2011 us=609000 TAP-Win32 MTU=1500
Tue Jul 26 23:47:53 2011 us=625000 Notified TAP-Win32 driver to set a DHCP IP/netmask of 10.8.8.206/255.255.255.252 on interface {D9DFAEC0-A634-4C12-8019-8D760417E3D6} [DHCP-serv: 10.8.8.205, lease-time: 31536000]
Tue Jul 26 23:47:53 2011 us=625000 DHCP option string: 0608d883 5e05d883 5f14
Tue Jul 26 23:47:53 2011 us=625000 Successful ARP Flush on interface [131075] {D9DFAEC0-A634-4C12-8019-8D760417E3D6}
Tue Jul 26 23:47:55 2011 us=828000 TEST ROUTES: 0/0 succeeded len=1 ret=0 a=0 u/d=down
Tue Jul 26 23:47:55 2011 us=828000 Route: Waiting for TUN/TAP interface to come up...
Tue Jul 26 23:47:58 2011 us=15000 TEST ROUTES: 0/0 succeeded len=1 ret=0 a=0 u/d=down
Tue Jul 26 23:47:58 2011 us=15000 Route: Waiting for TUN/TAP interface to come up...
Tue Jul 26 23:47:59 2011 us=31000 TEST ROUTES: 2/2 succeeded len=1 ret=1 a=0 u/d=up
Tue Jul 26 23:47:59 2011 us=31000 C:\WINDOWS\system32\route.exe ADD 207.204.236.28 MASK 255.255.255.255 85.17.24.190
Tue Jul 26 23:47:59 2011 us=187000 C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.8.8.205
Tue Jul 26 23:47:59 2011 us=312000 C:\WINDOWS\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.8.8.205
Tue Jul 26 23:47:59 2011 us=453000 C:\WINDOWS\system32\route.exe ADD 10.8.8.201 MASK 255.255.255.255 10.8.8.205 METRIC 1
Tue Jul 26 23:47:59 2011 us=562000 Initialization Sequence Completed
Tue Jul 26 23:50:39 2011 us=843000 SIGTERM received, sending exit notification to peer
Tue Jul 26 23:50:41 2011 us=109000 TCP/UDP: Closing socket
Tue Jul 26 23:50:41 2011 us=109000 C:\WINDOWS\system32\route.exe DELETE 10.8.8.201 MASK 255.255.255.255 10.8.8.205
Tue Jul 26 23:50:41 2011 us=203000 ERROR: Windows route delete command failed: returned error code -1073741502
Tue Jul 26 23:50:41 2011 us=203000 C:\WINDOWS\system32\route.exe DELETE 207.204.236.28 MASK 255.255.255.255 85.17.24.190
Tue Jul 26 23:50:41 2011 us=265000 ERROR: Windows route delete command failed: returned error code -1073741502
Tue Jul 26 23:50:41 2011 us=265000 C:\WINDOWS\system32\route.exe DELETE 0.0.0.0 MASK 128.0.0.0 10.8.8.205
Tue Jul 26 23:50:41 2011 us=312000 ERROR: Windows route delete command failed: returned error code -1073741502
Tue Jul 26 23:50:41 2011 us=312000 C:\WINDOWS\system32\route.exe DELETE 128.0.0.0 MASK 128.0.0.0 10.8.8.205
Tue Jul 26 23:50:41 2011 us=375000 ERROR: Windows route delete command failed: returned error code -1073741502
Tue Jul 26 23:50:41 2011 us=375000 Closing TUN/TAP interface
Tue Jul 26 23:50:41 2011 us=390000 SIGTERM[soft,exit-with-notification] received, process exiting

I notice that I lose connection when I see in the openVPN log this part

Tue Jul 26 23:47:59 2011 us=31000 C:\WINDOWS\system32\route.exe ADD 207.204.236.28 MASK 255.255.255.255 85.17.24.190
Tue Jul 26 23:47:59 2011 us=187000 C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.8.8.205

Not sure this has anything to do with it, however this is the last thing I see before I lose connection to remote desktop and can not contact the server again, until reboot.

Mimiko

Hi.

Seems a routing problem. Does the system W2k3 ping after starting OpenVPN?
Post your OpenVPN server's config, results of "ipconfig /all" and "route print" before starting OpenVPN.

alphamail

no i lose all connection to the server altogether can not ping the server once openVPN is connected.

Windows IP COnfiguration
	Host Name.......................: KS02
	Primary Dns Suffix .............:
	Node Type ......................: Unknown
	Ip Routing Enabled .............: No
	WINS Proxy Enabled .............: No

Ethernet adapter Local Area Connection 2:
	Connection-specific DNS Suffix .: 
	Description .......................: Intel(R) PRO/1000 T Server Adapter
	Physical Addres .................: 08-00-27-B3-C1-99
	Dhcp Enabled ....................: No
	IP Address ........................: 85.17.24.151
	Subnet Address .................: 255.255.255.192
	Default Gateway ................: 85.17.24.190
	DNS Servers ......................: 85.17.96.69
					         62.212.65.123

Ethernet adapter Local Area Connection 4:
	Media State ....................: Media disconnected
	Description ....................: TAP-Win32 Adapter V9
	Physical Address ...............: 00-FF-D9-DF-AE-C0

Mimiko

You have "redirect-gateway def1" in you config to route all traffic thru the tunnel. I assume that this client connects to 207.204.236.28 to make a VPN connection, but you manage this server from different ip.

Tue Jul 26 23:47:59 2011 us=31000 C:\WINDOWS\system32\route.exe ADD 207.204.236.28 MASK 255.255.255.255 85.17.24.190

OpenVPN adds this route to not lose connection to OpenVPN server 207.204.236.28 when redirecting all traffic trhu the tunnel with the

Tue Jul 26 23:47:59 2011 us=187000 C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.8.8.205

If you want to not use the connection with management server, add this line to OpenVPN config:

route public_IP_of_your_computer 255.255.255.255 85.17.24.190

and in log must appear an identical line as

Tue Jul 26 23:47:59 2011 us=31000 C:\WINDOWS\system32\route.exe ADD 207.204.236.28 MASK 255.255.255.255 85.17.24.190

only after ADD will be the public ip of the computer from wich you connect remotely.

I hope it will work.

alphamail

so i'm gathering that using the following command in the config file 'SHOULD' potential resolve this issue?

route 85.17.24.151 255.255.255.255 85.17.24.190

Mimiko

No. You must replace the public IP of your computer, not the server's.

85.17.24.151 is server's public ip to which you loose connection.

alphamail

Thank you, got it working finally. +++REP my friend

Do you know of anyway to exclude RDP altogether from the VPN connection, because I was thinking if I ever change IPs I'd be locked out of the server until I can reboot it again, and manually change the IP in the config file again.

Mimiko

Glad can help you.

But you must restate your achieves. Why would you like to route all traffice from your server to some other server? Your server will be inaccecible to everyone except you.

alphamail

well I edited my previous reply to state just that while you were replying.

The reason being is the server is located in the netherlands, at times I need a US IP, to work on other projects. Having RDP completely excluded would be the most optimal solution without having to add in a IP address to be 'whitelisted' so to continue working on the server.

Mimiko

Windows 2003 firewall and routing is not as flexible as linux's iprouting. You can't route RDP port with windows routing.

If you plan to change your IP, then install OpenVPn on your computer and make a routing to the server thru the tunnel. You will have always full access to your server despite changing your IP or server's IP.