Connection problems with Windows 10 anniversary update

temuco

Hello,

We are using OpenVPN successfully for a couple of years. Also within Windows 10 without any problems and very stable.

Now, we have updated some Windows 10 computers to the newest version of windows (redstone, anniversary update 1607).

After the update each of the computers has connection problems while connected via OpenVPN client to the OpenVPN server. Every few minutes the network connection is interrupted (RD no longer goes, network shares are no longer available, etc.). OpenVPN doesn’t log any error – even with “verb 5”. The VPN-tunnel will be established all the time.

After 30 to 60 seconds, the connection is restored, until after a few minutes the next cancellation will happen. This “game” is repeated infinitely.

For test purposes I have updated a well working Windows 10 laptop to the newest Windows Version.

Before: everything went well
After: the above mentioned problems happen

The Windows update has changed anything that causing the error.

In addition, I read that in the future Windows will accept only kernel driver signed by Microsoft - but drivers installed before the update will be transferred to the updated system. What shall I do, when I have to install a new OpenVPN TAP-Device within the new Windows 10?

In any case I will be happy to get a solution for my connection problems. Because as it is now it's impossible to work from outside with my mobile device.

Thank you very much in advance!

TinCanTech

Is this OpenVPN-Access.Server or OpenVPN-Community.Edition ?

temuco

Sorry. I did not know that there are different products. How do I recognize that? I think I have the Community Edition. I always download the package from this page:

https://openvpn.net/index.php/download/community-downloads.html

TinCanTech

temuco wroteHow do I recognize that?

Make sure you know what you are installing ..

temuco wroteI always download the package from this page

That is community edition.

temuco wroteFor test purposes I have updated a well working Windows 10 laptop to the newest Windows Version.

Before: everything went well
After: the above mentioned problems happen

Please see the Forum rules (top of this page)

Although I highly doubt it has anything what-so-ever to do with openvpn, perhaps your configs or logs will help a little.

temuco wroteWhat shall I do, when I have to install a new OpenVPN TAP-Device within the new Windows 10?

The OpenVPN developer team are highly active and do take the issue with Microsoft driver requirements very seriously. At the current time, the development version, known as 2.4 (or 2.3_git-master), has most, if not all, of the Microsoft Windows 10 issues resolved, or at least addressed with work in the pipeline to resolve any outstanding issues.

You can download and compile this yourself and possibly provide us with feedback regarding your success or failures.

See: Building using the generic build system

If that is too daunting then these pre-built Test versions are also made available:
http://build.openvpn.net/downloads/snapshots/

I am currently using http://build.openvpn.net/downloads/snapshots/openvpn-install-master-20160726154912-dea8917a03-x86_64.exe on Windows 10 with no problems. Although mine is not W10 Anniversary Update, so feedback of your experience would be most welcome

Enjoy 😃

temuco

Here first the configuration files:

Server configuration:

cd "C:/Program Files/OpenVPN/config/"

dev tap
dev-node OpenVPN

remote-cert-tls client
 
port 1194
proto udp

tun-mtu 1500
fragment 1300
mssfix

mode server
tls-server	
ifconfig-pool 192.168.1.180 192.168.1.199 255.255.255.0
push "route 192.168.1.0 255.255.255.0 192.168.1.205"

client-to-client

connect-freq 1 sec
keepalive 10 120
persist-key
persist-tun

ifconfig-pool-persist ipp.txt

ca certs/ca.crt
cert certs/openvpn.crt
key private/openvpn.key

dh dh2048.pem

comp-lzo yes

verb 3

Client configuration:

cd "C:/Program Files/OpenVPN/config/"

remote myservice.mydomain.tld

dev tap

remote-cert-tls server

tls-client
pull

rport 1194
lport 1194
proto udp

tun-mtu 1500
fragment 1300
mssfix

pkcs12 certs/myclient.p12

comp-lzo yes

verb 3

When I have a little more time, I'll post the log files.

fsociety

Hi,

I hope I'm not hijacking this topic but, this night I had a windows update (i'm in the windows insider program) and my openvpn client stopped being able to connect to our openvpn server, so maybe it's a bit related.

I'm using the openvpn community edition.

Since this night windows update it now throws this error:

Sat Aug 13 07:12:29 2016 NETSH: C:\WINDOWS\system32\netsh.exe interface ip set address VPN-OBS static 10.8.0.10 255.255.255.252
Sat Aug 13 07:12:30 2016 NETSH: C:\WINDOWS\system32\netsh.exe interface ip delete dns VPN-OBS all
Sat Aug 13 07:12:31 2016 NETSH: C:\WINDOWS\system32\netsh.exe interface ip set dns VPN-OBS static 192.168.50.15
Sat Aug 13 07:12:45 2016 NETSH: C:\WINDOWS\system32\netsh.exe interface ip delete wins VPN-OBS all
Sat Aug 13 07:12:45 2016 ERROR: netsh command failed: returned error code 1
Sat Aug 13 07:12:50 2016 NETSH: C:\WINDOWS\system32\netsh.exe interface ip delete wins VPN-OBS all
Sat Aug 13 07:12:50 2016 ERROR: netsh command failed: returned error code 1
Sat Aug 13 07:12:54 2016 MANAGEMENT: Client disconnected
Sat Aug 13 07:12:54 2016 NETSH: command failed
Sat Aug 13 07:12:54 2016 Exiting due to fatal error

I tried the faulty command in an admin elevated command prompt window

C:\WINDOWS\system32>C:\WINDOWS\system32\netsh.exe interface ip delete wins VPN-OBS all
The parameter is incorrect.

It seems the "all" parameter is broken in this windows update ?
If I try with a specific ip:

C:\WINDOWS\system32>C:\WINDOWS\system32\netsh.exe interface ip delete wins "VPN-OBS" 10.1.1.1
Element not found.

Windows version:

C:\WINDOWS\system32>ver
Microsoft Windows [Version 10.0.14901]

Okay while writing this post I'm realizing that it's probably not an openvpn issue but I still send it, maybe it can be of use...

Is there a config option to prevent the client to try to remove wins servers on the interface ?
Thanks a lot for you help.

Sébastien

fsociety

Okay I found a workaround in the meantime for the netsh issue. Using:
ip-win32 ipapi
routes-method ipapi in the client config to avoid calling the bogus netsh, and reported the issue to the windows insiders feedback hub.

Crowley

I can confirm problems with the new version of Windows 10. I use OpenVPN to connect to two remote VPN servers with two physical adapters bound to specific TAP adapters, and have set up metric options for Windows to prefer specific one. The new Win10 version seems to randomly change the network adapter order, and the wrong TAP adapter gets used.

I've disabled automatic metric from PowerShell, but this does not seem to help. Restarting OpenVPN does usually fix this.

Another problem,

Sometimes my personal IP leaks through even though OpenVPN is connected, it just gets bypassed. I can fix this by using "plugin fix-dns-leak-64.dll"

If I use --block-outside-dns I lose internet connection.

TinCanTech

Crowley wroteI can fix this by using "plugin fix-dns-leak-64.dll"

For the benefit of anybody else:
https://www.reddit.com/r/VPN/comments/3n3kab/openvpn_plugin_to_fix_windows_dns_leaks_for/

temuco

I have installed Windows 8.1 in a virtual machine on my workstation (Hyper-V). On the virtual PC I have the client OpenVPN installed to use my remote machines. Not pretty, but what oll I do otherwise? Can we expect a solution? And when?

Thank you so much!

nfisher

Hi there.
I have the absolutely same effect with Win10 1607 update.
I use 'dev tap' option.
After the update connection establishes ok, nothing criminal in logs, but nothing is accessible on the other side.

I've tried to update to the latest OpenVPN snapshot (20160824) and update to tap-windows-9.21.2 - no effect.

nfisher

So what guys?
Almost 2 weeks passed and the problem persists.
More logs needed? Or the problem is localized and need more time?
Any conversation with MS? Any answer?

sunny boy

I suggest all of you try this out:

Go to Windows 10 settings
Go to Network & Internet
Go to VPN
Then, slide all options under VPN to OFF status
Lastly, restart your windows before start using the openvpn.

nfisher

sunny boy wroteI suggest all of you try this out:

Go to Windows 10 settings
Go to Network & Internet
Go to VPN
Then, slide all options under VPN to OFF status
Lastly, restart your windows before start using the openvpn.

wtf?

LoLoBear

Hello,

Same problem here with Windows 1607 update.
Had to switch back to 1511.

Symptoms :
Using OpenVPN 2.3.12-I601-x86_64 or latest nightly, client can connect without errors but cannot ping other side boxes.
Only the other side box hosting the openvpn server can be pinged and accessed normally.
# Client
client
dev tap
comp-lzo yes
proto udp
remote XXX.XXX.XXX.XXX
resolv-retry infinite
cipher AES-256-CBC

# Cles
ca ca.crt
cert XXX.crt
key XXX.key
tls-auth ta.key 1

# Securite
nobind
auth-nocache
script-security 2
persist-key
persist-tun
comp-lzo
verb 3 Server version is 2.1.3 mode server
script-security 2
proto udp
port 1194
dev tap0

ca ca.crt
cert XXX.crt
key XXX.key
dh dh1024.pem
tls-auth ta.key 0
cipher AES-256-CBC

server-bridge 192.168.64.250 255.255.255.0 192.168.64.100 192.168.64.129
up "/etc/openvpn/scripts/up.sh br0"
down "/etc/openvpn/scripts/down.sh br0"
local 192.168.64.250

keepalive 10 120
push "route 192.168.64.0 255.255.255.0"
push "dhcp-option DNS 192.168.64.250"

user nobody
group nogroup
chroot /etc/openvpn/jail
persist-key
persist-tun
comp-lzo

verb 3
mute 20
status openvpn-status.log
log-append /var/log/openvpn.log Hoping it may help to solve the issue.

TinCanTech

LoLoBear wroteServer version is 2.1.3

2.1.3 is dated: 08-May-2013 .. you need to get up to date.

nfisher

TinCanTech wrote2.1.3 is dated: 08-May-2013 .. you need to get up to date.

No matter the server version.
The thread is about client on Win10 (v.1607).

Does anyone have any thoughts? The trouble is almost 3 months old. 🙁

TinCanTech

nfisher wroteNo matter the server version

If you care about security keep your server up to date.

Heartbleed comes to mind ..

If you are having trouble with Windows 10 start a detailed thread in the OpenVPN-Configuration Forum.

Include:
Server Config --verb 4
Server log
Client Config --verb 4
Client log

samb

Hello!

I have this problem too!

Had a OpenVPN server running on Windows 10 since a year w/o any problem.
Got the update to 1607 yesterday. Status says connected on both clients and server. But nothing seems to be sent. Ping are not received.

I cut some logs.

Server: http://pastebin.com/NK4zUsG6
Client: http://pastebin.com/pX9NCy8u

Any thoughts?...

Have uninstalled booth the OpenVPN and Adapters and re-installed.

Last resort: Revert update 1607...

//Sam

TinCanTech

@Sam, please post your server and client config files.