Windows XP "route addition failed" u: non-admin, openvpn svc

saliya

Hi people,

My OpenVPN server authenticates users using a combination of certificate + LDAP user/pass,
and pushes routes to them with the 'push "route n.n.n.n n.n.n.n"' syntax.

But my Windows XP SP3 clients refuse to accept the routes.
Googling shows that this is because the OpenVPN GUI is not run with sufficient privileges; so I have two questions:

* Why is 'run OpenVPN as a service' insufficient to do this?
* What (if anything) are people using to get this working?

I would like to let an unprivileged user in front of the keyboard connect to my server and accept the routes.
Is this possible? How are people using OpenVPN in a corporate environment?

Cheers,

SW

maikcat

hi there,

generally i dont have issues like this in win xp..

can you please post configs?

also ,

is your xp part of domain with limited rights?

Michael.

janjust

when openvpn is run as a service it is run using a SYSTEM account - this account needs to have the right privileges.
when running openvpn as a "regular" user it is sufficient to have "Network Administrator" privileges.

either way, when you're starting a VPN and you want to change the routing tables you must have some level of elevated privileges - this applies to all operating systems.

saliya

maikcat wrotehi there,

generally i dont have issues like this in win xp..

can you please post configs?

Hi Michael,

thanks for your answer.

The client configs are simple:

client
dev tun
proto tcp
remote hostname.domain hostport
nobind
persist-key
persist-tun
ca cachain.pem
cert cert.pem
key key.pem
comp-lzo
verb 3
keepalive 10 60
auth-user-pass

also ,

is your xp part of domain with limited rights?

Michael.

Yes indeed. In terms of 'the user at the keyboard is not an administrator nor a network administrator'.

Cheers,

SW

saliya

janjust wrotewhen openvpn is run as a service it is run using a SYSTEM account - this account needs to have the right privileges.
when running openvpn as a "regular" user it is sufficient to have "Network Administrator" privileges.

either way, when you're starting a VPN and you want to change the routing tables you must have some level of elevated privileges - this applies to all operating systems.

Hi,

I had thought that installing OpenVPN as a service and configuring autostart would give it these privileges.
I will try it again with stored user/pass as it might be this which is holding things up.

Cheers,

SW