Routing issues on Windows 7 Professional

pascalh

Hi all

Thanks for OpenVPN. I'm using it on a few machines to get remote access to my home network and it works great, a lot better than PPTP.

One of my laptops runs Windows 7 Professional. This machine has problems with OpenVPN. Immediately after establishing the connection to the server, the routing gets screwed up. Details are below. First here is a list of suggestions I have tried that did not work:

- Run OpenVPN GUI with admin privs
- Run OpenVPN GUI in Vista compatibility mode
- Use route-method exe in config
- Disable Windows firewall

I had the same problem on another laptop running Windows 7 Home Premium. On that machine, I was able to solve the issue by running OpenVPN GUI as an administrator, but that does not work on Windows 7 Pro.

Before connecting, route -4 shows:

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      145.18.24.1     145.18.26.30     25
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
      145.18.24.0    255.255.248.0         On-link      145.18.26.30    281
     145.18.26.30  255.255.255.255         On-link      145.18.26.30    281
    145.18.31.255  255.255.255.255         On-link      145.18.26.30    281
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link      145.18.26.30    281
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link      145.18.26.30    281
===========================================================================
Persistent Routes:
  None

The first line, with gateway 145.18.26.1, routes public traffic over the wireless adapter, which is bound to 145.18.26.30. After OpenVPN establishes a connection, the routes look like this:

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0        128.0.0.0       10.76.12.5       10.76.12.6     31
       10.76.12.1  255.255.255.255       10.76.12.5       10.76.12.6     31
       10.76.12.4  255.255.255.252         On-link        10.76.12.6    286
       10.76.12.6  255.255.255.255         On-link        10.76.12.6    286
       10.76.12.7  255.255.255.255         On-link        10.76.12.6    286
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
        128.0.0.0        128.0.0.0       10.76.12.5       10.76.12.6     31
      169.254.0.0      255.255.0.0         On-link        10.76.12.6     30
  169.254.255.255  255.255.255.255         On-link        10.76.12.6    286
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link        10.76.12.6    286
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link        10.76.12.6    286
===========================================================================
Persistent Routes:
  None

As you can see, there are no longer any routes for the wireless adapter. Correspondingly, there is no internet connectivity.

The log from OpenVPN is as follows (some information redacted):

Thu Mar 01 15:08:25 2012 OpenVPN 2.1.1 i686-pc-mingw32 [SSL] [LZO2] [PKCS11] built on Dec 11 2009
Thu Mar 01 15:08:28 2012 IMPORTANT: OpenVPN's default port number is now 1194, based on an official port number assignment by IANA.  OpenVPN 2.0-beta16 and earlier used 5000 as the default port.
Thu Mar 01 15:08:28 2012 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Thu Mar 01 15:08:28 2012 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Thu Mar 01 15:08:30 2012 Control Channel MTU parms [ L:1541 D:138 EF:38 EB:0 ET:0 EL:0 ]
Thu Mar 01 15:08:30 2012 Data Channel MTU parms [ L:1541 D:1450 EF:41 EB:4 ET:0 EL:0 ]
Thu Mar 01 15:08:30 2012 Local Options hash (VER=V4): '3514370b'
Thu Mar 01 15:08:30 2012 Expected Remote Options hash (VER=V4): '239669a8'
Thu Mar 01 15:08:30 2012 Socket Buffers: R=[8192->8192] S=[8192->8192]
Thu Mar 01 15:08:30 2012 UDPv4 link local (bound): [undef]:1194
Thu Mar 01 15:08:30 2012 UDPv4 link remote: ###HOSTIP###:1194
Thu Mar 01 15:08:30 2012 TLS: Initial packet from ###HOSTIP###:1194, sid=a33e61f7 65084e71
Thu Mar 01 15:08:30 2012 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Thu Mar 01 15:08:30 2012 VERIFY OK: depth=1, ###CERTDETAILS### 
Thu Mar 01 15:08:30 2012 VERIFY OK: depth=0, ###CERTDETAILS### 
Thu Mar 01 15:08:30 2012 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Mar 01 15:08:30 2012 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Mar 01 15:08:30 2012 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Mar 01 15:08:30 2012 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Mar 01 15:08:30 2012 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Thu Mar 01 15:08:30 2012 [***] Peer Connection Initiated with ###HOSTIP###:1194
Thu Mar 01 15:08:33 2012 SENT CONTROL [***]: 'PUSH_REQUEST' (status=1)
Thu Mar 01 15:08:33 2012 PUSH: Received control message: 'PUSH_REPLY,route 10.76.12.1,topology net30,ping 10,ping-restart 60,ifconfig 10.76.12.6 10.76.12.5'
Thu Mar 01 15:08:33 2012 OPTIONS IMPORT: timers and/or timeouts modified
Thu Mar 01 15:08:33 2012 OPTIONS IMPORT: --ifconfig/up options modified
Thu Mar 01 15:08:33 2012 OPTIONS IMPORT: route options modified
Thu Mar 01 15:08:33 2012 ROUTE default_gateway=145.18.24.1
Thu Mar 01 15:08:33 2012 TAP-WIN32 device [Local Area Connection 2] opened: \\.\Global\{3CB0192D-2DA9-4E3E-A9D1-320871503336}.tap
Thu Mar 01 15:08:33 2012 TAP-Win32 Driver Version 9.6 
Thu Mar 01 15:08:33 2012 TAP-Win32 MTU=1500
Thu Mar 01 15:08:33 2012 Notified TAP-Win32 driver to set a DHCP IP/netmask of 10.76.12.6/255.255.255.252 on interface {3CB0192D-2DA9-4E3E-A9D1-320871503336} [DHCP-serv: 10.76.12.5, lease-time: 31536000]
Thu Mar 01 15:08:33 2012 Successful ARP Flush on interface [23] {3CB0192D-2DA9-4E3E-A9D1-320871503336}
Thu Mar 01 15:08:35 2012 TEST ROUTES: 2/2 succeeded len=1 ret=1 a=0 u/d=up
Thu Mar 01 15:08:35 2012 C:\WINDOWS\system32\route.exe ADD ###HOSTIP### MASK 255.255.255.255 145.18.24.1
Thu Mar 01 15:08:35 2012 C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.76.12.5
Thu Mar 01 15:08:35 2012 C:\WINDOWS\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.76.12.5
Thu Mar 01 15:08:36 2012 C:\WINDOWS\system32\route.exe ADD 10.76.12.1 MASK 255.255.255.255 10.76.12.5
Thu Mar 01 15:08:36 2012 Initialization Sequence Completed
Thu Mar 01 15:09:37 2012 [###] Inactivity timeout (--ping-restart), restarting
Thu Mar 01 15:09:37 2012 TCP/UDP: Closing socket
Thu Mar 01 15:09:37 2012 SIGUSR1[soft,ping-restart] received, process restarting
Thu Mar 01 15:09:37 2012 Restart pause, 2 second(s)
Thu Mar 01 15:09:38 2012 IMPORTANT: OpenVPN's default port number is now 1194, based on an official port number assignment by IANA.  OpenVPN 2.0-beta16 and earlier used 5000 as the default port.
Thu Mar 01 15:09:38 2012 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Thu Mar 01 15:09:38 2012 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Thu Mar 01 15:09:39 2012 Re-using SSL/TLS context
Thu Mar 01 15:09:39 2012 Control Channel MTU parms [ L:1541 D:138 EF:38 EB:0 ET:0 EL:0 ]
Thu Mar 01 15:09:41 2012 RESOLVE: Cannot resolve host address: ###HOSTIP###: [NO_DATA] The requested name is valid but does not have an IP address.
Thu Mar 01 15:09:41 2012 Data Channel MTU parms [ L:1541 D:1450 EF:41 EB:4 ET:0 EL:0 ]
Thu Mar 01 15:09:41 2012 Local Options hash (VER=V4): '3514370b'
Thu Mar 01 15:09:41 2012 Expected Remote Options hash (VER=V4): '239669a8'
Thu Mar 01 15:09:43 2012 RESOLVE: Cannot resolve host address: ###HOSTIP###: [NO_DATA] The requested name is valid but does not have an IP address.
Thu Mar 01 15:09:50 2012 RESOLVE: signal received during DNS resolution attempt
Thu Mar 01 15:09:50 2012 TCP/UDP: Closing socket
Thu Mar 01 15:09:50 2012 C:\WINDOWS\system32\route.exe DELETE 10.76.12.1 MASK 255.255.255.255 10.76.12.5
Thu Mar 01 15:09:50 2012 C:\WINDOWS\system32\route.exe DELETE ###HOSTIP### MASK 255.255.255.255 145.18.24.1
Thu Mar 01 15:09:50 2012 C:\WINDOWS\system32\route.exe DELETE 0.0.0.0 MASK 128.0.0.0 10.76.12.5
Thu Mar 01 15:09:51 2012 C:\WINDOWS\system32\route.exe DELETE 128.0.0.0 MASK 128.0.0.0 10.76.12.5
Thu Mar 01 15:09:51 2012 Closing TUN/TAP interface
Thu Mar 01 15:09:51 2012 SIGTERM[hard,init_instance] received, process exiting

You can see OpenVPN successfully establishing a connection and set up the correct routes. Then after about a minute it can no longer ping the remote host because internet connectivity is lost. After disconnecting from OpenVPN, the wireless adapter will re-connect to the wireless network, restoring the routes and internet connectivity.

The OpenVPN config file, with all the hacks in place:

remote ###HOSTIP###
dev tun
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
auth-user-pass
pull
tls-client
ca ###CERTFILE###
script-security 2
route-method exe
route-delay 2
verb 3
redirect-gateway def1

I have read forum posts and other sources that relate this and similar issues to Windows 7 network security model, i.e. the way Windows determines whether you're on a "Home" or "Work" network and what rules to apply, and how this ties into the user security model (UAC, Network Admins, ...), but I don't fully understand this or how the difference between Windows 7 Pro and Home Premium editions should matter.

If someone can help me understand this and if possible solve it, that would be great. If you need more information, please let me know.

Thanks

Pascal

janjust

upgrade to openvpn 2.2.2, as 2.1.1 does not work well on Windows 7
add 'verb 4' to the client config and reconnect; check the sanitized log file to see if DNS settings are pushed - most likely the DNS settings are screwed up when the reconnect attempt hits.

try adding

register-dns

to the client config file

pascalh

Thanks for the response. I'll try upgrading and report back. With regards to DNS, there is no problem with DNS resolution per se - the packets just can't get out due to the broken routing.

pascalh

I have installed OpenVPN 2.2.2 and tried again, but same result. Routing table is destroyed and internet connectivity is lost.

janjust

this is bizarre - after OpenVPN comes up the default routes are gone? the openvpn client log file does not show the deletion of ANY routes! Check whether there's some third-party firewalling software that is not trusting the connection. Does the wlan adapter still have an IP address after the VPN connection has come up?

I use OpenVPN on Win7 64bit Pro without too many problems...

you can also try adding

redirect-gateway def1 bypass-dhcp

to the client config file.

jacksena

Well it can be a cause of bad router settings so you need to update your router settings and restore your system again with updated window 7. For any query take Microsoft Customer Help for best window support.