Connection problems with Windows 10 anniversary update

[temuco]

Hello,

We are using OpenVPN successfully for a couple of years. Also within Windows 10 without any problems and very stable.

Now, we have updated some Windows 10 computers to the newest version of windows (redstone, anniversary update 1607).

After the update each of the computers has connection problems while connected via OpenVPN client to the OpenVPN server. Every few minutes the network connection is interrupted (RD no longer goes, network shares are no longer available, etc.). OpenVPN doesn’t log any error – even with “verb 5”. The VPN-tunnel will be established all the time.

After 30 to 60 seconds, the connection is restored, until after a few minutes the next cancellation will happen. This “game” is repeated infinitely.

For test purposes I have updated a well working Windows 10 laptop to the newest Windows Version.

Before: everything went well
After: the above mentioned problems happen

The Windows update has changed anything that causing the error.

In addition, I read that in the future Windows will accept only kernel driver signed by Microsoft - but drivers installed before the update will be transferred to the updated system. What shall I do, when I have to install a new OpenVPN TAP-Device within the new Windows 10?

In any case I will be happy to get a solution for my connection problems. Because as it is now it's impossible to work from outside with my mobile device.

Thank you very much in advance!

[TinCanTech]

Is this OpenVPN-Access.Server or OpenVPN-Community.Edition ?

[temuco]

Sorry. I did not know that there are different products. How do I recognize that? I think I have the Community Edition. I always download the package from this page:

https://openvpn.net/index.php/download/ ... loads.html

[TinCanTech]

How do I recognize that?

Make sure you know what you are installing ..

I always download the package from this page

That is community edition.

For test purposes I have updated a well working Windows 10 laptop to the newest Windows Version.

Before: everything went well
After: the above mentioned problems happen

Please see the Forum rules (top of this page)

Although I highly doubt it has anything what-so-ever to do with openvpn, perhaps your configs or logs will help a little.

What shall I do, when I have to install a new OpenVPN TAP-Device within the new Windows 10?

The OpenVPN developer team are highly active and do take the issue with Microsoft driver requirements very seriously. At the current time, the development version, known as 2.4 (or 2.3_git-master), has most, if not all, of the Microsoft Windows 10 issues resolved, or at least addressed with work in the pipeline to resolve any outstanding issues.


You can download and compile this yourself and possibly provide us with feedback regarding your success or failures.

See: Building using the generic build system

If that is too daunting then these pre-built Test versions are also made available:
http://build.openvpn.net/downloads/snapshots/

I am currently using http://build.openvpn.net/downloads/snap ... x86_64.exe on Windows 10 with no problems. Although mine is not W10 Anniversary Update, so feedback of your experience would be most welcome

Enjoy

[temuco]

Here first the configuration files:

Server configuration:

Code: Select all

cd "C:/Program Files/OpenVPN/config/"

dev tap
dev-node OpenVPN

remote-cert-tls client
 
port 1194
proto udp

tun-mtu 1500
fragment 1300
mssfix

mode server
tls-server	
ifconfig-pool 192.168.1.180 192.168.1.199 255.255.255.0
push "route 192.168.1.0 255.255.255.0 192.168.1.205"

client-to-client

connect-freq 1 sec
keepalive 10 120
persist-key
persist-tun

ifconfig-pool-persist ipp.txt

ca certs/ca.crt
cert certs/openvpn.crt
key private/openvpn.key

dh dh2048.pem

comp-lzo yes

verb 3

Client configuration:

Code: Select all

cd "C:/Program Files/OpenVPN/config/"

remote myservice.mydomain.tld

dev tap

remote-cert-tls server

tls-client
pull

rport 1194
lport 1194
proto udp

tun-mtu 1500
fragment 1300
mssfix

pkcs12 certs/myclient.p12

comp-lzo yes

verb 3

When I have a little more time, I'll post the log files.

[fsociety]

Hi,

I hope I'm not hijacking this topic but, this night I had a windows update (i'm in the windows insider program) and my openvpn client stopped being able to connect to our openvpn server, so maybe it's a bit related.

I'm using the openvpn community edition.

Since this night windows update it now throws this error:

Code: Select all

Sat Aug 13 07:12:29 2016 NETSH: C:\WINDOWS\system32\netsh.exe interface ip set address VPN-OBS static 10.8.0.10 255.255.255.252
Sat Aug 13 07:12:30 2016 NETSH: C:\WINDOWS\system32\netsh.exe interface ip delete dns VPN-OBS all
Sat Aug 13 07:12:31 2016 NETSH: C:\WINDOWS\system32\netsh.exe interface ip set dns VPN-OBS static 192.168.50.15
Sat Aug 13 07:12:45 2016 NETSH: C:\WINDOWS\system32\netsh.exe interface ip delete wins VPN-OBS all
Sat Aug 13 07:12:45 2016 ERROR: netsh command failed: returned error code 1
Sat Aug 13 07:12:50 2016 NETSH: C:\WINDOWS\system32\netsh.exe interface ip delete wins VPN-OBS all
Sat Aug 13 07:12:50 2016 ERROR: netsh command failed: returned error code 1
Sat Aug 13 07:12:54 2016 MANAGEMENT: Client disconnected
Sat Aug 13 07:12:54 2016 NETSH: command failed
Sat Aug 13 07:12:54 2016 Exiting due to fatal error

I tried the faulty command in an admin elevated command prompt window

Code: Select all

C:\WINDOWS\system32>C:\WINDOWS\system32\netsh.exe interface ip delete wins VPN-OBS all
The parameter is incorrect.

It seems the "all" parameter is broken in this windows update ?
If I try with a specific ip:

Code: Select all

C:\WINDOWS\system32>C:\WINDOWS\system32\netsh.exe interface ip delete wins "VPN-OBS" 10.1.1.1
Element not found.

Windows version:

Code: Select all

C:\WINDOWS\system32>ver
Microsoft Windows [Version 10.0.14901]

Okay while writing this post I'm realizing that it's probably not an openvpn issue but I still send it, maybe it can be of use...

Is there a config option to prevent the client to try to remove wins servers on the interface ?
Thanks a lot for you help.

Sébastien

[fsociety]

Okay I found a workaround in the meantime for the netsh issue. Using:

View OriginalClient config

1

ip-win32 ipapi

2

1

ip-win32 ipapi

in the client config to avoid calling the bogus netsh, and reported the issue to the windows insiders feedback hub.

[Crowley]

I can confirm problems with the new version of Windows 10. I use OpenVPN to connect to two remote VPN servers with two physical adapters bound to specific TAP adapters, and have set up metric options for Windows to prefer specific one. The new Win10 version seems to randomly change the network adapter order, and the wrong TAP adapter gets used.

I've disabled automatic metric from PowerShell, but this does not seem to help. Restarting OpenVPN does usually fix this.

Another problem,

Sometimes my personal IP leaks through even though OpenVPN is connected, it just gets bypassed. I can fix this by using "plugin fix-dns-leak-64.dll"

If I use --block-outside-dns I lose internet connection.

[TinCanTech]

I can fix this by using "plugin fix-dns-leak-64.dll"

For the benefit of anybody else:
https://www.reddit.com/r/VPN/comments/3 ... leaks_for/

[temuco]

I have installed Windows 8.1 in a virtual machine on my workstation (Hyper-V). On the virtual PC I have the client OpenVPN installed to use my remote machines. Not pretty, but what oll I do otherwise? Can we expect a solution? And when?

Thank you so much!

[nfisher]

Hi there.
I have the absolutely same effect with Win10 1607 update.
I use 'dev tap' option.
After the update connection establishes ok, nothing criminal in logs, but nothing is accessible on the other side.

I've tried to update to the latest OpenVPN snapshot (20160824) and update to tap-windows-9.21.2 - no effect.

[nfisher]

So what guys?
Almost 2 weeks passed and the problem persists.
More logs needed? Or the problem is localized and need more time?
Any conversation with MS? Any answer?

[sunny boy]

I suggest all of you try this out:

Go to Windows 10 settings
Go to Network & Internet
Go to VPN
Then, slide all options under VPN to OFF status
Lastly, restart your windows before start using the openvpn.

[nfisher]

I suggest all of you try this out:

Go to Windows 10 settings
Go to Network & Internet
Go to VPN
Then, slide all options under VPN to OFF status
Lastly, restart your windows before start using the openvpn.

wtf?

[LoLoBear]

Hello,

Same problem here with Windows 1607 update.
Had to switch back to 1511.

Symptoms :
Using OpenVPN 2.3.12-I601-x86_64 or latest nightly, client can connect without errors but cannot ping other side boxes.
Only the other side box hosting the openvpn server can be pinged and accessed normally.

View OriginalClient config

1

# Client

2

3

client

4

5

dev tap

6

7

comp-lzo yes

8

9

proto udp

10

11

remote XXX.XXX.XXX.XXX

12

13

resolv-retry infinite

14

15

cipher AES-256-CBC

16

17

18

19

# Cles

20

21

ca ca.crt

22

23

cert XXX.crt

24

25

key XXX.key

26

27

tls-auth ta.key 1

28

29

30

31

# Securite

32

33

nobind

34

35

auth-nocache

36

37

script-security 2

38

39

persist-key

40

41

persist-tun

42

43

comp-lzo

44

1

client

2

dev tap

3

comp-lzo yes

4

proto udp

5

remote XXX.XXX.XXX.XXX

6

resolv-retry infinite

7

cipher AES-256-CBC

8

ca ca.crt

9

cert XXX.crt

10

key XXX.key

11

tls-auth ta.key 1

12

nobind

13

auth-nocache

14

script-security 2

15

persist-key

16

persist-tun

17

comp-lzo

Server version is 2.1.3

View OriginalServer config

1

mode server

2

3

script-security 2

4

5

proto udp

6

7

port 1194

8

9

dev tap0

10

11

12

13

ca ca.crt

14

15

cert XXX.crt

16

17

key XXX.key

18

19

dh dh1024.pem

20

21

tls-auth ta.key 0

22

23

cipher AES-256-CBC

24

25

26

27

server-bridge 192.168.64.250 255.255.255.0 192.168.64.100 192.168.64.129

28

29

up "/etc/openvpn/scripts/up.sh br0"

30

31

down "/etc/openvpn/scripts/down.sh br0"

32

33

local 192.168.64.250

34

35

36

37

keepalive 10 120

38

39

push "route 192.168.64.0 255.255.255.0"

40

41

push "dhcp-option DNS 192.168.64.250"

42

43

44

45

user nobody

46

47

group nogroup

48

49

chroot /etc/openvpn/jail

50

51

persist-key

52

53

persist-tun

54

55

comp-lzo

56

57

58

59

verb 3

60

61

mute 20

62

63

status openvpn-status.log

64

1

mode server

2

script-security 2

3

proto udp

4

port 1194

5

dev tap0

6

ca ca.crt

7

cert XXX.crt

8

key XXX.key

9

dh dh1024.pem

10

tls-auth ta.key 0

11

cipher AES-256-CBC

12

server-bridge 192.168.64.250 255.255.255.0 192.168.64.100 192.168.64.129

13

up "/etc/openvpn/scripts/up.sh br0"

14

down "/etc/openvpn/scripts/down.sh br0"

15

local 192.168.64.250

16

keepalive 10 120

17

push "route 192.168.64.0 255.255.255.0"

18

push "dhcp-option DNS 192.168.64.250"

19

user nobody

20

group nogroup

21

chroot /etc/openvpn/jail

22

persist-key

23

persist-tun

24

comp-lzo

25

verb 3

26

mute 20

27

status openvpn-status.log

Hoping it may help to solve the issue.

[TinCanTech]

Server version is 2.1.3

2.1.3 is dated: 08-May-2013 .. you need to get up to date.

[nfisher]

2.1.3 is dated: 08-May-2013 .. you need to get up to date.

No matter the server version.
The thread is about client on Win10 (v.1607).

Does anyone have any thoughts? The trouble is almost 3 months old.

[TinCanTech]

No matter the server version

If you care about security keep your server up to date.

Heartbleed comes to mind ..

If you are having trouble with Windows 10 start a detailed thread in the OpenVPN-Configuration Forum.

• Include:
• Server Config --verb 4
• Server log
• Client Config --verb 4
• Client log

[samb]

Hello!

I have this problem too!

Had a OpenVPN server running on Windows 10 since a year w/o any problem.
Got the update to 1607 yesterday. Status says connected on both clients and server. But nothing seems to be sent. Ping are not received.

I cut some logs.

Server: http://pastebin.com/NK4zUsG6
Client: http://pastebin.com/pX9NCy8u

Any thoughts?...

Have uninstalled booth the OpenVPN and Adapters and re-installed.

Last resort: Revert update 1607...

//Sam

[TinCanTech]

@Sam, please post your server and client config files.