New Win2k8 R2 OpenVPN Server fails - Tap 32

luis84

Hello Everyone,

I have set up a few OpenVPN servers before but never in Windows.

I followed the guide carefully, but when I launch I get:

"Tue Nov 15 18:29:49 2011 OpenVPN 2.0.9 Win32-MinGW [SSL] [LZO] built on Oct 1 2006
Tue Nov 15 18:29:50 2011 Diffie-Hellman initialized with 1024 bit key
Tue Nov 15 18:29:51 2011 TLS-Auth MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Tue Nov 15 18:29:51 2011 CreateFile failed on TAP device: \\.\Global\{9811F0FA-7237-4438-866A-37704B45A117}.tap
Tue Nov 15 18:29:51 2011 All TAP-Win32 adapters on this system are currently in use.
Tue Nov 15 18:29:51 2011 Exiting"

I have tried the addtap.bat - as admin.

I am running OpenVPN GUI as admin and have installed as admin.

Nothing seems to help.

I am in Win 2008 Server R2.

Any suggestions?

janjust

upgrade to openvpn 2.2.1 ; 2.0.9 is not really supported any more (and won't work on Win2008)

luis84

Thank you. Updated, generated certs, etc.

I can now connect and get a 10.x.x.x IP but none of my traffic is routed through the new server. With my other VPN's when it connects and gets a 10.x.x.x IP the client computers IP is not reveal on whatsmyip.

Right now if I run to whatsmyip -- it shows my local IP and not the IP of the OpenVPN server.

Any ideas what could be wrong?

Here is OpenVPN log...

"Tue Nov 15 22:41:43 2011 OpenVPN 2.2.1 Win32-MSVC++ [SSL] [LZO2] built on Jul 1 2011
Tue Nov 15 22:41:43 2011 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Tue Nov 15 22:41:43 2011 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Tue Nov 15 22:41:43 2011 LZO compression initialized
Tue Nov 15 22:41:43 2011 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Tue Nov 15 22:41:43 2011 Socket Buffers: R=[8192->8192] S=[8192->8192]
Tue Nov 15 22:41:43 2011 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Nov 15 22:41:43 2011 Local Options hash (VER=V4): '41690919'
Tue Nov 15 22:41:43 2011 Expected Remote Options hash (VER=V4): '530fdded'
Tue Nov 15 22:41:43 2011 UDPv4 link local: [undef]
Tue Nov 15 22:41:43 2011 UDPv4 link remote: 66.150.121.102:1194
Tue Nov 15 22:41:43 2011 TLS: Initial packet from 66.150.121.102:1194, sid=6cfafe25 b43119e9
Tue Nov 15 22:41:44 2011 VERIFY OK: depth=1, /C=US/ST=VA/L=Richmond/O=OpenVPN/OU=changeme/CN=server/name=changeme/emailAddress=luisvarca@gmail.com
Tue Nov 15 22:41:44 2011 VERIFY OK: depth=0, /C=US/ST=VA/L=Richmond/O=OpenVPN/OU=changeme/CN=server/name=changeme/emailAddress=luisvarca@gmail.com
Tue Nov 15 22:41:45 2011 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Nov 15 22:41:45 2011 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Nov 15 22:41:45 2011 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Nov 15 22:41:45 2011 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Nov 15 22:41:45 2011 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Tue Nov 15 22:41:45 2011 [server] Peer Connection Initiated with 66.150.121.102:1194
Tue Nov 15 22:41:47 2011 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Tue Nov 15 22:41:47 2011 PUSH: Received control message: 'PUSH_REPLY,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Tue Nov 15 22:41:47 2011 OPTIONS IMPORT: timers and/or timeouts modified
Tue Nov 15 22:41:47 2011 OPTIONS IMPORT: --ifconfig/up options modified
Tue Nov 15 22:41:47 2011 OPTIONS IMPORT: route options modified
Tue Nov 15 22:41:47 2011 ROUTE default_gateway=192.168.0.1
Tue Nov 15 22:41:47 2011 TAP-WIN32 device [Local Area Connection 2] opened: \\.\Global\{B1F94117-2F87-4EDB-960C-1D022C001559}.tap
Tue Nov 15 22:41:47 2011 TAP-Win32 Driver Version 9.8
Tue Nov 15 22:41:47 2011 TAP-Win32 MTU=1500
Tue Nov 15 22:41:47 2011 Notified TAP-Win32 driver to set a DHCP IP/netmask of 10.8.0.6/255.255.255.252 on interface {B1F94117-2F87-4EDB-960C-1D022C001559} [DHCP-serv: 10.8.0.5, lease-time: 31536000]
Tue Nov 15 22:41:47 2011 Successful ARP Flush on interface [14] {B1F94117-2F87-4EDB-960C-1D022C001559}
Tue Nov 15 22:41:52 2011 TEST ROUTES: 1/1 succeeded len=1 ret=1 a=0 u/d=up
Tue Nov 15 22:41:52 2011 C:\WINDOWS\system32\route.exe ADD 10.8.0.1 MASK 255.255.255.255 10.8.0.5
Tue Nov 15 22:41:52 2011 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Tue Nov 15 22:41:52 2011 Route addition via IPAPI succeeded [adaptive]
Tue Nov 15 22:41:52 2011 Initialization Sequence Completed
"

luis84

Update, I made some changes to the client config, to this:

"remote (server) (port)
proto udp
ca ca.crt
cert client.crt
key client.key
client
dev tun
resolv-retry infinite
nobind
persist-key
persist-tun
;http-proxy-retry # retry on connection failures
;http-proxy [proxy server] [proxy port #]
verb 4
mute 5
route-method exe
route-delay 2
redirect-gateway def1
comp-lzo adaptive
explicit-exit-notify 2
"

It now connects, my open RDP connection works fine once it connects but no webpages will load - not even by IP bypassing DNS.

IS this a server config issue?

Mimiko

You must enable forwarding in Win 2008.

luis84

Can you please clarify? Forwarding with the firewall or? I am a bit confused. Sorry I am new to Windows setups with OpenVPN

Mimiko

Read this thread: https://forums.openvpn.net/topic9220.html

luis84

Thank you. I enabled forwarding on Local Area Conn 3 (TAP) and on Xen Network Adapter.

Still no luck. I enabled it, re-launched OpenVPN.

My RDP session stays open and works so I know there is connectivity - in fact it's fast as heck over the VPN. But no net traffic is being handled.

Seems like the issue is in the net traffic.

Server log shows all normal except some ipv6 errors but that is normal.

Client log shows:

"Wed Nov 16 16:06:00 2011 us=693000 Current Parameter Settings:
Wed Nov 16 16:06:00 2011 us=693000 config = 'client.ovpn'
Wed Nov 16 16:06:00 2011 us=693000 mode = 0
Wed Nov 16 16:06:00 2011 us=693000 show_ciphers = DISABLED
Wed Nov 16 16:06:00 2011 us=693000 show_digests = DISABLED
Wed Nov 16 16:06:00 2011 us=693000 NOTE: --mute triggered...
Wed Nov 16 16:06:00 2011 us=693000 218 variation(s) on previous 5 message(s) suppressed by --mute
Wed Nov 16 16:06:00 2011 us=693000 OpenVPN 2.2.1 Win32-MSVC++ [SSL] [LZO2] built on Jul 1 2011
Wed Nov 16 16:06:00 2011 us=693000 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Wed Nov 16 16:06:00 2011 us=693000 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Wed Nov 16 16:06:00 2011 us=864000 LZO compression initialized
Wed Nov 16 16:06:00 2011 us=864000 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Wed Nov 16 16:06:00 2011 us=864000 Socket Buffers: R=[8192->8192] S=[8192->8192]
Wed Nov 16 16:06:00 2011 us=864000 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Wed Nov 16 16:06:00 2011 us=864000 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Wed Nov 16 16:06:00 2011 us=864000 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Wed Nov 16 16:06:00 2011 us=864000 Local Options hash (VER=V4): '41690919'
Wed Nov 16 16:06:00 2011 us=864000 Expected Remote Options hash (VER=V4): '530fdded'
Wed Nov 16 16:06:00 2011 us=864000 UDPv4 link local: [undef]
Wed Nov 16 16:06:00 2011 us=864000 UDPv4 link remote: 66.150.121.102:80
Wed Nov 16 16:06:00 2011 us=958000 TLS: Initial packet from 66.150.121.102:80, sid=82425ea3 8913d3b4
Wed Nov 16 16:06:01 2011 us=457000 VERIFY OK: depth=1, /C=US/ST=VA/L=Richmond/O=OpenVPN/OU=changeme/CN=server/name=changeme/emailAddress=luisvarca@gmail.com
Wed Nov 16 16:06:01 2011 us=457000 VERIFY OK: depth=0, /C=US/ST=VA/L=Richmond/O=OpenVPN/OU=changeme/CN=server/name=changeme/emailAddress=luisvarca@gmail.com
Wed Nov 16 16:06:02 2011 us=424000 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Nov 16 16:06:02 2011 us=424000 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Nov 16 16:06:02 2011 us=424000 NOTE: --mute triggered...
Wed Nov 16 16:06:02 2011 us=424000 3 variation(s) on previous 5 message(s) suppressed by --mute
Wed Nov 16 16:06:02 2011 us=424000 [server] Peer Connection Initiated with 66.150.121.102:80
Wed Nov 16 16:06:04 2011 us=655000 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Wed Nov 16 16:06:04 2011 us=733000 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Wed Nov 16 16:06:04 2011 us=733000 OPTIONS IMPORT: timers and/or timeouts modified
Wed Nov 16 16:06:04 2011 us=733000 OPTIONS IMPORT: --ifconfig/up options modified
Wed Nov 16 16:06:04 2011 us=733000 OPTIONS IMPORT: route options modified
Wed Nov 16 16:06:04 2011 us=749000 ROUTE default_gateway=192.168.0.1
Wed Nov 16 16:06:04 2011 us=780000 TAP-WIN32 device [Local Area Connection 2] opened: \\.\Global\{B1F94117-2F87-4EDB-960C-1D022C001559}.tap
Wed Nov 16 16:06:04 2011 us=780000 TAP-Win32 Driver Version 9.8
Wed Nov 16 16:06:04 2011 us=780000 TAP-Win32 MTU=1500
Wed Nov 16 16:06:04 2011 us=780000 Notified TAP-Win32 driver to set a DHCP IP/netmask of 10.8.0.6/255.255.255.252 on interface {B1F94117-2F87-4EDB-960C-1D022C001559} [DHCP-serv: 10.8.0.5, lease-time: 31536000]
Wed Nov 16 16:06:04 2011 us=780000 Successful ARP Flush on interface [14] {B1F94117-2F87-4EDB-960C-1D022C001559}
Wed Nov 16 16:06:06 2011 us=496000 TEST ROUTES: 2/2 succeeded len=1 ret=1 a=0 u/d=up
Wed Nov 16 16:06:06 2011 us=496000 C:\WINDOWS\system32\route.exe ADD 66.150.121.102 MASK 255.255.255.255 192.168.0.1
OK!
Wed Nov 16 16:06:06 2011 us=512000 C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.8.0.5
OK!
Wed Nov 16 16:06:06 2011 us=527000 C:\WINDOWS\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.8.0.5
OK!
Wed Nov 16 16:06:06 2011 us=558000 C:\WINDOWS\system32\route.exe ADD 10.8.0.1 MASK 255.255.255.255 10.8.0.5
OK!
Wed Nov 16 16:06:06 2011 us=574000 Initialization Sequence Completed
"

Any ideas? THanks again for all the help

Mimiko

But no net traffic is being handled.

What traffic? I see that you redirect all trafic thru tunnel. It's not working internet, or access to servers LAN?

luis84

Right i am ending all traffic to VPN YEt when vpn is connected nothing on the internet works IE No internet browser and ping www.google.com fails.

But my RDP connection to the server (openvn) works fine ......
any ideas

Mimiko

If you access the internet thru the OpenVPN server then you must NAT client's packets. You can use Internet Sharing in windows 2008, but I will not recommend that, better use a 3rd party software.

luis84

Any suggestions, I am not sure what NAT means exactly with the clients packets. I assume I need to do something on the server to ensure that the packets coming in from client are able to use internet resource. ICS in windows is never fun.

What could I do?

luis84

Any other suggestions? Sorry to be a bother. Still no luck getting my VPN to router net traffic.

On my Win server 2k8 I enabled ICS, but that didn't seem to make a difference.

Any ideas about maybe bridging connections? When i tried that it failed.

Any hints would be greatly appreciated.

Mimiko

How did you configure ICS? You can even manage to use RRAS if you will search the forum.