OpenVPN Support Forum

Posted: **Tue Apr 11, 2017 8:10 am**

Hey guys,

i have a strange behaviour of the openvpn service:
I have a server and multiple clients. Everything works fine up to this week. We bought a new laptop, I installed openvpn 2.4.1, issued a new certificate, copied the configuration file and tried to connect. The connection seemed to be fine, the openvpn-gui-window dissapeared as usual but the connection didn't work. AND, from now, I could not connect with any other device to the server. So I restartet the openvpn-daemon (windows server system) and everything works fine again. Until I try to connect with the new Laptop. This connection seems to cause a crash of the openvpn service, so that I have to restart it. I also tried older versions of openvpn for the laptop. Same result... I updated the server openvpn... Same result. I even set up a new vpn server on a different machine, Same same. Has anybody an idea whats going on? All the other computers can connect without any problems. Also the logfile did not help me any further (verb 5), it looks the same as when a normal connection is established...

Client

client
remote XXXX
port 1195
proto udp
dev tap
pkcs12 XXXX.p12
ns-cert-type server
pull
verb 3
mute 50

Server

server 10.10.1.0 255.255.255.0
port 1194
proto udp
dev tap
log-append Server.log
pkcs12 XXXX.p12
dh dh1024.pem
push "route 192.168.1.0 255.255.255.0"
keepalive 20 180
verb 3
mute 50

Thanks for you help !
Chris

Posted: **Tue Apr 11, 2017 10:15 am**

Please see:
HOWTO: Request Help !

Please see:
HOWTO: Request Help ! {2}

Posted: **Wed Apr 12, 2017 11:03 am**

Client Operating System

Code: Select all

Microsoft Windows [Version 10.0.14393]

Client Network Setup

Code: Select all

Windows-IP-Konfiguration

   Hostname  . . . . . . . . . . . . : PC09151-CSL
   Prim„res DNS-Suffix . . . . . . . : 
   Knotentyp . . . . . . . . . . . . : Hybrid
   IP-Routing aktiviert  . . . . . . : Nein
   WINS-Proxy aktiviert  . . . . . . : Nein
   DNS-Suffixsuchliste . . . . . . . : fritz.box

Ethernet-Adapter Ethernet:

   Medienstatus. . . . . . . . . . . : Medium getrennt
   Verbindungsspezifisches DNS-Suffix: 
   Beschreibung. . . . . . . . . . . : Realtek PCIe FE Family Controller
   Physische Adresse . . . . . . . . : D0-BF-9C-8C-F6-17
   DHCP aktiviert. . . . . . . . . . : Ja
   Autokonfiguration aktiviert . . . : Ja

Drahtlos-LAN-Adapter LAN-Verbindung* 2:

   Medienstatus. . . . . . . . . . . : Medium getrennt
   Verbindungsspezifisches DNS-Suffix: 
   Beschreibung. . . . . . . . . . . : Virtueller Microsoft-Adapter fr direktes WiFi #2
   Physische Adresse . . . . . . . . : 36-68-95-40-72-79
   DHCP aktiviert. . . . . . . . . . : Ja
   Autokonfiguration aktiviert . . . : Ja

Ethernet-Adapter Ethernet 2:

   Medienstatus. . . . . . . . . . . : Medium getrennt
   Verbindungsspezifisches DNS-Suffix: 
   Beschreibung. . . . . . . . . . . : TAP-Windows Adapter V9
   Physische Adresse . . . . . . . . : 00-FF-E6-50-E0-A2
   DHCP aktiviert. . . . . . . . . . : Ja
   Autokonfiguration aktiviert . . . : Ja

Drahtlos-LAN-Adapter WiFi:

   Verbindungsspezifisches DNS-Suffix: fritz.box
   Beschreibung. . . . . . . . . . . : Realtek RTL8723BE 802.11 b/g/n Wi-Fi Adapter
   Physische Adresse . . . . . . . . : 34-68-95-40-72-79
   DHCP aktiviert. . . . . . . . . . : Ja
   Autokonfiguration aktiviert . . . : Ja
   Verbindungslokale IPv6-Adresse  . : fe80::d1cb:dc9b:1698:da3f%5(Bevorzugt) 
   IPv4-Adresse  . . . . . . . . . . : 192.168.2.103(Bevorzugt) 
   Subnetzmaske  . . . . . . . . . . : 255.255.255.0
   Lease erhalten. . . . . . . . . . : Freitag, 7. April 2017 09:11:45
   Lease l„uft ab. . . . . . . . . . : Samstag, 22. April 2017 12:13:01
   Standardgateway . . . . . . . . . : 192.168.2.1
   DHCP-Server . . . . . . . . . . . : 192.168.2.1
   DHCPv6-IAID . . . . . . . . . . . : 104097941
   DHCPv6-Client-DUID. . . . . . . . : 00-01-00-01-1D-8D-83-29-D0-BF-9C-8C-F6-17
   DNS-Server  . . . . . . . . . . . : 192.168.2.1
   NetBIOS ber TCP/IP . . . . . . . : Aktiviert

Ethernet-Adapter Bluetooth-Netzwerkverbindung:

   Medienstatus. . . . . . . . . . . : Medium getrennt
   Verbindungsspezifisches DNS-Suffix: 
   Beschreibung. . . . . . . . . . . : Bluetooth-Ger„t (PAN)
   Physische Adresse . . . . . . . . : 34-68-95-40-72-7A
   DHCP aktiviert. . . . . . . . . . : Ja
   Autokonfiguration aktiviert . . . : Ja

Tunneladapter isatap.fritz.box:

   Medienstatus. . . . . . . . . . . : Medium getrennt
   Verbindungsspezifisches DNS-Suffix: fritz.box
   Beschreibung. . . . . . . . . . . : Microsoft ISATAP Adapter
   Physische Adresse . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP aktiviert. . . . . . . . . . : Nein
   Autokonfiguration aktiviert . . . : Ja

Tunneladapter LAN-Verbindung* 1:

   Medienstatus. . . . . . . . . . . : Medium getrennt
   Verbindungsspezifisches DNS-Suffix: 
   Beschreibung. . . . . . . . . . . : Microsoft Teredo Tunneling Adapter
   Physische Adresse . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP aktiviert. . . . . . . . . . : Nein
   Autokonfiguration aktiviert . . . : Ja

Client

client
remote XXXX
port 1195
proto udp
dev tap
pkcs12 XXXX.p12
ns-cert-type server
pull
verb 3
mute 50

Client log @ verb 4

Code: Select all

Wed Apr 12 12:23:25 2017   pkcs11_protected_authentication = DISABLED
Wed Apr 12 12:23:25 2017   pkcs11_private_mode = 00000000
Wed Apr 12 12:23:25 2017   pkcs11_private_mode = 00000000
Wed Apr 12 12:23:25 2017   pkcs11_private_mode = 00000000
Wed Apr 12 12:23:25 2017   pkcs11_private_mode = 00000000
Wed Apr 12 12:23:25 2017   pkcs11_private_mode = 00000000
Wed Apr 12 12:23:25 2017   pkcs11_private_mode = 00000000
Wed Apr 12 12:23:25 2017   pkcs11_private_mode = 00000000
Wed Apr 12 12:23:25 2017   pkcs11_private_mode = 00000000
Wed Apr 12 12:23:25 2017   pkcs11_private_mode = 00000000
Wed Apr 12 12:23:25 2017   pkcs11_private_mode = 00000000
Wed Apr 12 12:23:25 2017   pkcs11_private_mode = 00000000
Wed Apr 12 12:23:25 2017   pkcs11_private_mode = 00000000
Wed Apr 12 12:23:25 2017   pkcs11_private_mode = 00000000
Wed Apr 12 12:23:25 2017   pkcs11_private_mode = 00000000
Wed Apr 12 12:23:25 2017   pkcs11_private_mode = 00000000
Wed Apr 12 12:23:25 2017   pkcs11_private_mode = 00000000
Wed Apr 12 12:23:25 2017   pkcs11_cert_private = DISABLED
Wed Apr 12 12:23:25 2017   pkcs11_cert_private = DISABLED
Wed Apr 12 12:23:25 2017   pkcs11_cert_private = DISABLED
Wed Apr 12 12:23:25 2017   pkcs11_cert_private = DISABLED
Wed Apr 12 12:23:25 2017   pkcs11_cert_private = DISABLED
Wed Apr 12 12:23:25 2017   pkcs11_cert_private = DISABLED
Wed Apr 12 12:23:25 2017   pkcs11_cert_private = DISABLED
Wed Apr 12 12:23:25 2017   pkcs11_cert_private = DISABLED
Wed Apr 12 12:23:25 2017   pkcs11_cert_private = DISABLED
Wed Apr 12 12:23:25 2017   pkcs11_cert_private = DISABLED
Wed Apr 12 12:23:25 2017   pkcs11_cert_private = DISABLED
Wed Apr 12 12:23:25 2017   pkcs11_cert_private = DISABLED
Wed Apr 12 12:23:25 2017   pkcs11_cert_private = DISABLED
Wed Apr 12 12:23:25 2017   pkcs11_cert_private = DISABLED
Wed Apr 12 12:23:25 2017   pkcs11_cert_private = DISABLED
Wed Apr 12 12:23:25 2017   pkcs11_cert_private = DISABLED
Wed Apr 12 12:23:25 2017   pkcs11_pin_cache_period = -1
Wed Apr 12 12:23:25 2017   pkcs11_id = '[UNDEF]'
Wed Apr 12 12:23:25 2017   pkcs11_id_management = DISABLED
Wed Apr 12 12:23:25 2017   server_network = 0.0.0.0
Wed Apr 12 12:23:25 2017   server_netmask = 0.0.0.0
Wed Apr 12 12:23:25 2017   server_network_ipv6 = ::
Wed Apr 12 12:23:25 2017   server_netbits_ipv6 = 0
Wed Apr 12 12:23:25 2017   server_bridge_ip = 0.0.0.0
Wed Apr 12 12:23:25 2017   server_bridge_netmask = 0.0.0.0
Wed Apr 12 12:23:25 2017   server_bridge_pool_start = 0.0.0.0
Wed Apr 12 12:23:25 2017   server_bridge_pool_end = 0.0.0.0
Wed Apr 12 12:23:25 2017   ifconfig_pool_defined = DISABLED
Wed Apr 12 12:23:25 2017   ifconfig_pool_start = 0.0.0.0
Wed Apr 12 12:23:25 2017   ifconfig_pool_end = 0.0.0.0
Wed Apr 12 12:23:25 2017   ifconfig_pool_netmask = 0.0.0.0
Wed Apr 12 12:23:25 2017   ifconfig_pool_persist_filename = '[UNDEF]'
Wed Apr 12 12:23:25 2017   ifconfig_pool_persist_refresh_freq = 600
Wed Apr 12 12:23:25 2017   ifconfig_ipv6_pool_defined = DISABLED
Wed Apr 12 12:23:25 2017   ifconfig_ipv6_pool_base = ::
Wed Apr 12 12:23:25 2017   ifconfig_ipv6_pool_netbits = 0
Wed Apr 12 12:23:25 2017   n_bcast_buf = 256
Wed Apr 12 12:23:25 2017   tcp_queue_limit = 64
Wed Apr 12 12:23:25 2017   real_hash_size = 256
Wed Apr 12 12:23:25 2017   virtual_hash_size = 256
Wed Apr 12 12:23:25 2017   client_connect_script = '[UNDEF]'
Wed Apr 12 12:23:25 2017   learn_address_script = '[UNDEF]'
Wed Apr 12 12:23:25 2017   client_disconnect_script = '[UNDEF]'
Wed Apr 12 12:23:25 2017   client_config_dir = '[UNDEF]'
Wed Apr 12 12:23:25 2017   ccd_exclusive = DISABLED
Wed Apr 12 12:23:25 2017   tmp_dir = 'C:\Users\AHST~1.MIC\AppData\Local\Temp\'
Wed Apr 12 12:23:25 2017   push_ifconfig_defined = DISABLED
Wed Apr 12 12:23:25 2017   push_ifconfig_local = 0.0.0.0
Wed Apr 12 12:23:25 2017   push_ifconfig_remote_netmask = 0.0.0.0
Wed Apr 12 12:23:25 2017   push_ifconfig_ipv6_defined = DISABLED
Wed Apr 12 12:23:25 2017   push_ifconfig_ipv6_local = ::/0
Wed Apr 12 12:23:25 2017   push_ifconfig_ipv6_remote = ::
Wed Apr 12 12:23:25 2017   enable_c2c = DISABLED
Wed Apr 12 12:23:25 2017   duplicate_cn = DISABLED
Wed Apr 12 12:23:25 2017   cf_max = 0
Wed Apr 12 12:23:25 2017   cf_per = 0
Wed Apr 12 12:23:25 2017   max_clients = 1024
Wed Apr 12 12:23:25 2017   max_routes_per_client = 256
Wed Apr 12 12:23:25 2017   auth_user_pass_verify_script = '[UNDEF]'
Wed Apr 12 12:23:25 2017   auth_user_pass_verify_script_via_file = DISABLED
Wed Apr 12 12:23:25 2017   auth_token_generate = DISABLED
Wed Apr 12 12:23:25 2017   auth_token_lifetime = 0
Wed Apr 12 12:23:25 2017   client = ENABLED
Wed Apr 12 12:23:25 2017   pull = ENABLED
Wed Apr 12 12:23:25 2017   auth_user_pass_file = '[UNDEF]'
Wed Apr 12 12:23:25 2017   show_net_up = DISABLED
Wed Apr 12 12:23:25 2017   route_method = 3
Wed Apr 12 12:23:25 2017   block_outside_dns = DISABLED
Wed Apr 12 12:23:25 2017   ip_win32_defined = DISABLED
Wed Apr 12 12:23:25 2017   ip_win32_type = 3
Wed Apr 12 12:23:25 2017   dhcp_masq_offset = 0
Wed Apr 12 12:23:25 2017   dhcp_lease_time = 31536000
Wed Apr 12 12:23:25 2017   tap_sleep = 0
Wed Apr 12 12:23:25 2017   dhcp_options = DISABLED
Wed Apr 12 12:23:25 2017   dhcp_renew = DISABLED
Wed Apr 12 12:23:25 2017   dhcp_pre_release = DISABLED
Wed Apr 12 12:23:25 2017   domain = '[UNDEF]'
Wed Apr 12 12:23:25 2017   netbios_scope = '[UNDEF]'
Wed Apr 12 12:23:25 2017   netbios_node_type = 0
Wed Apr 12 12:23:25 2017   disable_nbt = DISABLED
Wed Apr 12 12:23:25 2017 OpenVPN 2.4.1 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on 

Mar 22 2017
Wed Apr 12 12:23:25 2017 Windows version 6.2 (Windows 8 or greater) 64bit
Wed Apr 12 12:23:25 2017 library versions: OpenSSL 1.0.2k  26 Jan 2017, LZO 2.09
Wed Apr 12 12:23:25 2017 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Wed Apr 12 12:23:25 2017 Need hold release from management interface, waiting...
Wed Apr 12 12:23:25 2017 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Wed Apr 12 12:23:25 2017 MANAGEMENT: CMD 'state on'
Wed Apr 12 12:23:25 2017 MANAGEMENT: CMD 'log all on'
Wed Apr 12 12:23:26 2017 MANAGEMENT: CMD 'echo all on'
Wed Apr 12 12:23:26 2017 MANAGEMENT: CMD 'hold off'
Wed Apr 12 12:23:26 2017 MANAGEMENT: CMD 'hold release'
Wed Apr 12 12:23:26 2017 WARNING: --ns-cert-type is DEPRECATED.  Use --remote-cert-tls instead.
Wed Apr 12 12:23:31 2017 MANAGEMENT: CMD 'password [...]'
Wed Apr 12 12:23:31 2017 WARNING: this configuration may cache passwords in memory -- use the auth-nocache 

option to prevent this
Wed Apr 12 12:23:31 2017 Control Channel MTU parms [ L:1653 D:1212 EF:38 EB:0 ET:0 EL:3 ]
Wed Apr 12 12:23:31 2017 MANAGEMENT: >STATE:1491992611,RESOLVE,,,,,,
Wed Apr 12 12:23:31 2017 Data Channel MTU parms [ L:1653 D:1450 EF:121 EB:411 ET:32 EL:3 ]
Wed Apr 12 12:23:31 2017 Local Options String (VER=V4): 'V4,dev-type tap,link-mtu 1573,tun-mtu 1532,proto 

UDPv4,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Wed Apr 12 12:23:31 2017 Expected Remote Options String (VER=V4): 'V4,dev-type tap,link-mtu 1573,tun-mtu 

1532,proto UDPv4,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Wed Apr 12 12:23:31 2017 TCP/UDP: Preserving recently used remote address: [AF_INET]XXX.XXX.XXX.XXX:1194
Wed Apr 12 12:23:31 2017 Socket Buffers: R=[65536->65536] S=[65536->65536]
Wed Apr 12 12:23:31 2017 UDP link local (bound): [AF_INET][undef]:1194
Wed Apr 12 12:23:31 2017 UDP link remote: [AF_INET]XXX.XXX.XXX.XXX:1194
Wed Apr 12 12:23:31 2017 MANAGEMENT: >STATE:1491992611,WAIT,,,,,,
Wed Apr 12 12:23:37 2017 MANAGEMENT: >STATE:1491992617,AUTH,,,,,,
Wed Apr 12 12:23:37 2017 TLS: Initial packet from [AF_INET]XXX.XXX.XXX.XXX:1194, sid=85e08bd0 f5564800
Wed Apr 12 12:23:42 2017 VERIFY OK: depth=1, C=DE, ST=XXX, L=XXX, O=XXX, OU=XXX., 

CN=XXX, emailAddress=XXX
Wed Apr 12 12:23:42 2017 VERIFY OK: nsCertType=SERVER
Wed Apr 12 12:23:42 2017 VERIFY OK: depth=0, C=DE, ST=XXX, L=XXX, O=XXX, OU=XXX, 

CN=XXX, emailAddress=XXX
Wed Apr 12 12:23:42 2017 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 1024 bit RSA
Wed Apr 12 12:23:42 2017 [Server211] Peer Connection Initiated with [AF_INET]XXX.XXX.XXX.XXX:1194
Wed Apr 12 12:23:43 2017 MANAGEMENT: >STATE:1491992623,GET_CONFIG,,,,,,
Wed Apr 12 12:23:43 2017 SENT CONTROL [Server211]: 'PUSH_REQUEST' (status=1)
Wed Apr 12 12:23:44 2017 PUSH: Received control message: 'PUSH_REPLY,route 192.168.1.0 255.255.255.0,route-

gateway 10.10.1.1,ping 20,ping-restart 180,ifconfig 10.10.1.2 255.255.255.0'
Wed Apr 12 12:23:45 2017 OPTIONS IMPORT: timers and/or timeouts modified
Wed Apr 12 12:23:45 2017 OPTIONS IMPORT: --ifconfig/up options modified
Wed Apr 12 12:23:45 2017 OPTIONS IMPORT: route options modified
Wed Apr 12 12:23:45 2017 OPTIONS IMPORT: route-related options modified
Wed Apr 12 12:23:45 2017 Data Channel MTU parms [ L:1573 D:1450 EF:41 EB:411 ET:32 EL:3 ]
Wed Apr 12 12:23:45 2017 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Apr 12 12:23:45 2017 WARNING: INSECURE cipher with block size less than 128 bit (64 bit).  This allows 

attacks like SWEET32.  Mitigate by using a --cipher with a larger block size (e.g. AES-256-CBC).
Wed Apr 12 12:23:45 2017 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Apr 12 12:23:45 2017 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Apr 12 12:23:45 2017 WARNING: INSECURE cipher with block size less than 128 bit (64 bit).  This allows 

attacks like SWEET32.  Mitigate by using a --cipher with a larger block size (e.g. AES-256-CBC).
Wed Apr 12 12:23:45 2017 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Apr 12 12:23:45 2017 WARNING: cipher with small block size in use, reducing reneg-bytes to 64MB to mitigate 

SWEET32 attacks.
Wed Apr 12 12:23:45 2017 interactive service msg_channel=532
Wed Apr 12 12:23:45 2017 ROUTE_GATEWAY 192.168.2.1/255.255.255.0 I=5 HWADDR=34:68:95:40:72:79
Wed Apr 12 12:23:45 2017 open_tun
Wed Apr 12 12:23:45 2017 TAP-WIN32 device [Ethernet 2] opened: \\.\Global\{E650E0A2-7CF5-48CE-BE7A-

B78AF460B74C}.tap
Wed Apr 12 12:23:45 2017 TAP-Windows Driver Version 9.21 
Wed Apr 12 12:23:45 2017 TAP-Windows MTU=1500
Wed Apr 12 12:23:45 2017 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.10.1.2/255.255.255.0 on 

interface {E650E0A2-7CF5-48CE-BE7A-B78AF460B74C} [DHCP-serv: 10.10.1.0, lease-time: 31536000]
Wed Apr 12 12:23:45 2017 Successful ARP Flush on interface [3] {E650E0A2-7CF5-48CE-BE7A-B78AF460B74C}
Wed Apr 12 12:23:45 2017 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Wed Apr 12 12:23:45 2017 MANAGEMENT: >STATE:1491992625,ASSIGN_IP,,10.10.1.2,,,,
Wed Apr 12 12:23:50 2017 TEST ROUTES: 1/1 succeeded len=1 ret=1 a=0 u/d=up
Wed Apr 12 12:23:50 2017 MANAGEMENT: >STATE:1491992630,ADD_ROUTES,,,,,,
Wed Apr 12 12:23:50 2017 C:\WINDOWS\system32\route.exe ADD 192.168.1.0 MASK 255.255.255.0 10.10.1.1
Wed Apr 12 12:23:50 2017 Route addition via service succeeded
Wed Apr 12 12:23:50 2017 Initialization Sequence Completed
Wed Apr 12 12:23:50 2017 MANAGEMENT: >STATE:1491992630,CONNECTED,SUCCESS,10.10.1.2,XXX.XXX.XXX.XXX,1194,,

Server Operating System

Code: Select all

Microsoft Windows [Version 6.2.9200] (first Server tried)
 Microsoft Windows [Version 6.3.9600] (second Server tried)

Server Network Setup

Code: Select all

Windows-IP-Konfiguration

   Hostname  . . . . . . . . . . . . : Server211
   Prim„res DNS-Suffix . . . . . . . : XXX.local
   Knotentyp . . . . . . . . . . . . : Hybrid
   IP-Routing aktiviert  . . . . . . : Ja
   WINS-Proxy aktiviert  . . . . . . : Nein
   DNS-Suffixsuchliste . . . . . . . : XXX.local

Ethernet-Adapter Ethernet 4:

   Verbindungsspezifisches DNS-Suffix: 
   Beschreibung. . . . . . . . . . . : TAP-Windows Adapter V9
   Physische Adresse . . . . . . . . : 00-FF-79-5E-9C-63
   DHCP aktiviert. . . . . . . . . . : Ja
   Autokonfiguration aktiviert . . . : Ja
   Verbindungslokale IPv6-Adresse  . : fe80::ec19:5ab9:b0a9:4da1%16(Bevorzugt) 
   IPv4-Adresse  . . . . . . . . . . : 10.10.1.1(Bevorzugt) 
   Subnetzmaske  . . . . . . . . . . : 255.255.255.0
   Lease erhalten. . . . . . . . . . : Dienstag, 11. April 2017 08:57:31
   Lease l„uft ab. . . . . . . . . . : Mittwoch, 11. April 2018 08:57:32
   Standardgateway . . . . . . . . . : 
   DHCP-Server . . . . . . . . . . . : 10.10.1.0
   DHCPv6-IAID . . . . . . . . . . . : 587267961
   DHCPv6-Client-DUID. . . . . . . . : 00-01-00-01-1C-0C-99-82-90-1B-0E-30-48-8B
   DNS-Server  . . . . . . . . . . . : fec0:0:0:ffff::1%1
                                       fec0:0:0:ffff::2%1
                                       fec0:0:0:ffff::3%1
   NetBIOS ber TCP/IP . . . . . . . : Aktiviert

Ethernet-Adapter Ethernet 3:

   Verbindungsspezifisches DNS-Suffix: 
   Beschreibung. . . . . . . . . . . : Gruppe: Gruppe #0
   Physische Adresse . . . . . . . . : 90-1B-0E-30-48-8B
   DHCP aktiviert. . . . . . . . . . : Nein
   Autokonfiguration aktiviert . . . : Ja
   Verbindungslokale IPv6-Adresse  . : fe80::f9bb:eea0:8f68:cf2a%15(Bevorzugt) 
   IPv4-Adresse  . . . . . . . . . . : 192.168.1.212(Bevorzugt) 
   Subnetzmaske  . . . . . . . . . . : 255.255.255.0
   Standardgateway . . . . . . . . . : 192.168.1.80
   DHCPv6-IAID . . . . . . . . . . . : 479206158
   DHCPv6-Client-DUID. . . . . . . . : 00-01-00-01-1C-0C-99-82-90-1B-0E-30-48-8B
   DNS-Server  . . . . . . . . . . . : 192.168.1.212
   NetBIOS ber TCP/IP . . . . . . . : Aktiviert

Tunneladapter isatap.{3452FE31-E14F-419B-825A-54CBBEE7D5E4}:

   Medienstatus. . . . . . . . . . . : Medium getrennt
   Verbindungsspezifisches DNS-Suffix: 
   Beschreibung. . . . . . . . . . . : Microsoft-ISATAP-Adapter
   Physische Adresse . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP aktiviert. . . . . . . . . . : Nein
   Autokonfiguration aktiviert . . . : Ja

Tunneladapter isatap.{795E9C63-E206-45A5-9DDF-D87F232010DD}:

   Medienstatus. . . . . . . . . . . : Medium getrennt
   Verbindungsspezifisches DNS-Suffix: 
   Beschreibung. . . . . . . . . . . : Microsoft-ISATAP-Adapter #2
   Physische Adresse . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP aktiviert. . . . . . . . . . : Nein
   Autokonfiguration aktiviert . . . : Ja

Server, identical to both

server 10.10.1.0 255.255.255.0
port 1194
proto udp
dev tap
log-append Server.log
pkcs12 XXXX.p12
dh dh1024.pem
push "route 192.168.1.0 255.255.255.0"
keepalive 20 180
verb 3
mute 50

Server log @ verb 4

Code: Select all

Wed Apr 12 12:17:33 2017   pkcs11_private_mode = 00000000
Wed Apr 12 12:17:33 2017   pkcs11_private_mode = 00000000
Wed Apr 12 12:17:33 2017   pkcs11_private_mode = 00000000
Wed Apr 12 12:17:33 2017   pkcs11_private_mode = 00000000
Wed Apr 12 12:17:33 2017   pkcs11_private_mode = 00000000
Wed Apr 12 12:17:33 2017   pkcs11_private_mode = 00000000
Wed Apr 12 12:17:33 2017   pkcs11_private_mode = 00000000
Wed Apr 12 12:17:33 2017   pkcs11_private_mode = 00000000
Wed Apr 12 12:17:33 2017   pkcs11_private_mode = 00000000
Wed Apr 12 12:17:33 2017   pkcs11_private_mode = 00000000
Wed Apr 12 12:17:33 2017   pkcs11_private_mode = 00000000
Wed Apr 12 12:17:33 2017   pkcs11_private_mode = 00000000
Wed Apr 12 12:17:33 2017   pkcs11_private_mode = 00000000
Wed Apr 12 12:17:33 2017   pkcs11_private_mode = 00000000
Wed Apr 12 12:17:33 2017   pkcs11_cert_private = DISABLED
Wed Apr 12 12:17:33 2017   pkcs11_cert_private = DISABLED
Wed Apr 12 12:17:33 2017   pkcs11_cert_private = DISABLED
Wed Apr 12 12:17:33 2017   pkcs11_cert_private = DISABLED
Wed Apr 12 12:17:33 2017   pkcs11_cert_private = DISABLED
Wed Apr 12 12:17:33 2017   pkcs11_cert_private = DISABLED
Wed Apr 12 12:17:33 2017   pkcs11_cert_private = DISABLED
Wed Apr 12 12:17:33 2017   pkcs11_cert_private = DISABLED
Wed Apr 12 12:17:33 2017   pkcs11_cert_private = DISABLED
Wed Apr 12 12:17:33 2017   pkcs11_cert_private = DISABLED
Wed Apr 12 12:17:33 2017   pkcs11_cert_private = DISABLED
Wed Apr 12 12:17:33 2017   pkcs11_cert_private = DISABLED
Wed Apr 12 12:17:33 2017   pkcs11_cert_private = DISABLED
Wed Apr 12 12:17:33 2017   pkcs11_cert_private = DISABLED
Wed Apr 12 12:17:33 2017   pkcs11_cert_private = DISABLED
Wed Apr 12 12:17:33 2017   pkcs11_cert_private = DISABLED
Wed Apr 12 12:17:33 2017   pkcs11_pin_cache_period = -1
Wed Apr 12 12:17:33 2017   pkcs11_id = '[UNDEF]'
Wed Apr 12 12:17:33 2017   pkcs11_id_management = DISABLED
Wed Apr 12 12:17:33 2017   server_network = 10.10.1.0
Wed Apr 12 12:17:33 2017   server_netmask = 255.255.255.0
Wed Apr 12 12:17:33 2017   server_network_ipv6 = ::
Wed Apr 12 12:17:33 2017   server_netbits_ipv6 = 0
Wed Apr 12 12:17:33 2017   server_bridge_ip = 0.0.0.0
Wed Apr 12 12:17:33 2017   server_bridge_netmask = 0.0.0.0
Wed Apr 12 12:17:33 2017   server_bridge_pool_start = 0.0.0.0
Wed Apr 12 12:17:33 2017   server_bridge_pool_end = 0.0.0.0
Wed Apr 12 12:17:33 2017   push_entry = 'route 192.168.1.0 255.255.255.0'
Wed Apr 12 12:17:33 2017   push_entry = 'route-gateway 10.10.1.1'
Wed Apr 12 12:17:33 2017   push_entry = 'ping 20'
Wed Apr 12 12:17:33 2017   push_entry = 'ping-restart 180'
Wed Apr 12 12:17:33 2017   ifconfig_pool_defined = ENABLED
Wed Apr 12 12:17:33 2017   ifconfig_pool_start = 10.10.1.2
Wed Apr 12 12:17:33 2017   ifconfig_pool_end = 10.10.1.254
Wed Apr 12 12:17:33 2017   ifconfig_pool_netmask = 255.255.255.0
Wed Apr 12 12:17:33 2017   ifconfig_pool_persist_filename = '[UNDEF]'
Wed Apr 12 12:17:33 2017   ifconfig_pool_persist_refresh_freq = 600
Wed Apr 12 12:17:33 2017   ifconfig_ipv6_pool_defined = DISABLED
Wed Apr 12 12:17:33 2017   ifconfig_ipv6_pool_base = ::
Wed Apr 12 12:17:33 2017   ifconfig_ipv6_pool_netbits = 0
Wed Apr 12 12:17:33 2017   n_bcast_buf = 256
Wed Apr 12 12:17:33 2017   tcp_queue_limit = 64
Wed Apr 12 12:17:33 2017   real_hash_size = 256
Wed Apr 12 12:17:33 2017   virtual_hash_size = 256
Wed Apr 12 12:17:33 2017   client_connect_script = '[UNDEF]'
Wed Apr 12 12:17:33 2017   learn_address_script = '[UNDEF]'
Wed Apr 12 12:17:33 2017   client_disconnect_script = '[UNDEF]'
Wed Apr 12 12:17:33 2017   client_config_dir = '[UNDEF]'
Wed Apr 12 12:17:33 2017   ccd_exclusive = DISABLED
Wed Apr 12 12:17:33 2017   tmp_dir = 'C:\Users\ADMINI~1.HOS\AppData\Local\Temp\'
Wed Apr 12 12:17:33 2017   push_ifconfig_defined = DISABLED
Wed Apr 12 12:17:33 2017   push_ifconfig_local = 0.0.0.0
Wed Apr 12 12:17:33 2017   push_ifconfig_remote_netmask = 0.0.0.0
Wed Apr 12 12:17:33 2017   push_ifconfig_ipv6_defined = DISABLED
Wed Apr 12 12:17:33 2017   push_ifconfig_ipv6_local = ::/0
Wed Apr 12 12:17:33 2017   push_ifconfig_ipv6_remote = ::
Wed Apr 12 12:17:33 2017   enable_c2c = DISABLED
Wed Apr 12 12:17:33 2017   duplicate_cn = DISABLED
Wed Apr 12 12:17:33 2017   cf_max = 0
Wed Apr 12 12:17:33 2017   cf_per = 0
Wed Apr 12 12:17:33 2017   max_clients = 1024
Wed Apr 12 12:17:33 2017   max_routes_per_client = 256
Wed Apr 12 12:17:33 2017   auth_user_pass_verify_script = '[UNDEF]'
Wed Apr 12 12:17:33 2017   auth_user_pass_verify_script_via_file = DISABLED
Wed Apr 12 12:17:33 2017   client = DISABLED
Wed Apr 12 12:17:33 2017   pull = DISABLED
Wed Apr 12 12:17:33 2017   auth_user_pass_file = '[UNDEF]'
Wed Apr 12 12:17:33 2017   show_net_up = DISABLED
Wed Apr 12 12:17:33 2017   route_method = 0
Wed Apr 12 12:17:33 2017   block_outside_dns = DISABLED
Wed Apr 12 12:17:33 2017   ip_win32_defined = DISABLED
Wed Apr 12 12:17:33 2017   ip_win32_type = 3
Wed Apr 12 12:17:33 2017   dhcp_masq_offset = 0
Wed Apr 12 12:17:33 2017   dhcp_lease_time = 31536000
Wed Apr 12 12:17:33 2017   tap_sleep = 10
Wed Apr 12 12:17:33 2017   dhcp_options = DISABLED
Wed Apr 12 12:17:33 2017   dhcp_renew = DISABLED
Wed Apr 12 12:17:33 2017   dhcp_pre_release = DISABLED
Wed Apr 12 12:17:33 2017   dhcp_release = DISABLED
Wed Apr 12 12:17:33 2017   domain = '[UNDEF]'
Wed Apr 12 12:17:33 2017   netbios_scope = '[UNDEF]'
Wed Apr 12 12:17:33 2017   netbios_node_type = 0
Wed Apr 12 12:17:33 2017   disable_nbt = DISABLED
Wed Apr 12 12:17:33 2017 OpenVPN 2.3.11 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on May 10 

2016
Wed Apr 12 12:17:33 2017 Windows version 6.2 (Windows 8 or greater) 64bit
Wed Apr 12 12:17:33 2017 library versions: OpenSSL 1.0.1t  3 May 2016, LZO 2.09
Wed Apr 12 12:17:33 2017 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Wed Apr 12 12:17:33 2017 Need hold release from management interface, waiting...
Wed Apr 12 12:17:33 2017 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Wed Apr 12 12:17:33 2017 MANAGEMENT: CMD 'state on'
Wed Apr 12 12:17:33 2017 MANAGEMENT: CMD 'log all on'
Wed Apr 12 12:17:34 2017 MANAGEMENT: CMD 'hold off'
Wed Apr 12 12:17:34 2017 MANAGEMENT: CMD 'hold release'
Wed Apr 12 12:17:34 2017 NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 

192.168.1.x.  Be aware that this might create routing conflicts if you connect to the VPN server from public 

locations such as internet cafes that use the same subnet.
Wed Apr 12 12:17:34 2017 Diffie-Hellman initialized with 1024 bit key
Wed Apr 12 12:17:34 2017 TLS-Auth MTU parms [ L:1573 D:1212 EF:38 EB:0 ET:0 EL:3 ]
Wed Apr 12 12:17:34 2017 Socket Buffers: R=[65536->65536] S=[65536->65536]
Wed Apr 12 12:17:34 2017 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Apr 12 12:17:34 2017 MANAGEMENT: >STATE:1491992254,ASSIGN_IP,,10.10.1.1,
Wed Apr 12 12:17:34 2017 open_tun, tt->ipv6=0
Wed Apr 12 12:17:34 2017 TAP-WIN32 device [Ethernet 4] opened: \\.\Global\{795E9C63-E206-45A5-9DDF-

D87F232010DD}.tap
Wed Apr 12 12:17:34 2017 TAP-Windows Driver Version 9.21 
Wed Apr 12 12:17:34 2017 TAP-Windows MTU=1500
Wed Apr 12 12:17:34 2017 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.10.1.1/255.255.255.0 on 

interface {795E9C63-E206-45A5-9DDF-D87F232010DD} [DHCP-serv: 10.10.1.0, lease-time: 31536000]
Wed Apr 12 12:17:34 2017 Sleeping for 10 seconds...
Wed Apr 12 12:17:44 2017 Successful ARP Flush on interface [16] {795E9C63-E206-45A5-9DDF-D87F232010DD}
Wed Apr 12 12:17:44 2017 Data Channel MTU parms [ L:1573 D:1450 EF:41 EB:12 ET:32 EL:3 ]
Wed Apr 12 12:17:44 2017 UDPv4 link local (bound): [undef]
Wed Apr 12 12:17:44 2017 UDPv4 link remote: [undef]
Wed Apr 12 12:17:44 2017 MULTI: multi_init called, r=256 v=256
Wed Apr 12 12:17:44 2017 IFCONFIG POOL: base=10.10.1.2 size=253, ipv6=0
Wed Apr 12 12:17:44 2017 Initialization Sequence Completed
Wed Apr 12 12:17:44 2017 MANAGEMENT: >STATE:1491992264,CONNECTED,SUCCESS,10.10.1.1,
Wed Apr 12 12:23:20 2017 MULTI: multi_create_instance called
Wed Apr 12 12:23:20 2017 XXX.XXX.XXX.XXX:1194 Re-using SSL/TLS context
Wed Apr 12 12:23:20 2017 XXX.XXX.XXX.XXX:1194 Control Channel MTU parms [ L:1573 D:1212 EF:38 EB:0 ET:0 EL:3 ]
Wed Apr 12 12:23:20 2017 XXX.XXX.XXX.XXX:1194 Data Channel MTU parms [ L:1573 D:1450 EF:41 EB:12 ET:32 EL:3 ]
Wed Apr 12 12:23:20 2017 XXX.XXX.XXX.XXX:1194 Local Options String: 'V4,dev-type tap,link-mtu 1573,tun-mtu 

1532,proto UDPv4,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Wed Apr 12 12:23:20 2017 XXX.XXX.XXX.XXX:1194 Expected Remote Options String: 'V4,dev-type tap,link-mtu 

1573,tun-mtu 1532,proto UDPv4,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Wed Apr 12 12:23:20 2017 XXX.XXX.XXX.XXX:1194 Local Options hash (VER=V4): '0ddbb6e3'
Wed Apr 12 12:23:20 2017 XXX.XXX.XXX.XXX:1194 Expected Remote Options hash (VER=V4): '2c50bd2c'
Wed Apr 12 12:23:20 2017 XXX.XXX.XXX.XXX:1194 TLS: Initial packet from [AF_INET]XXX.XXX.XXX.XXX:1194, 

sid=c4dfd3a4 54c28e28
Wed Apr 12 12:23:30 2017 XXX.XXX.XXX.XXX:1194 VERIFY OK: depth=1, C=DE, ST=XXX, L=XXX, O=XXX, OU=XXX, CN=XXX, 

emailAddress=XXX
Wed Apr 12 12:23:30 2017 XXX.XXX.XXX.XXX:1194 VERIFY OK: depth=0, C=DE, ST=XXX, L=XXX, O=XXX, OU=XXX, CN=XXX, 

emailAddress=XXX
Wed Apr 12 12:23:30 2017 XXX.XXX.XXX.XXX:1194 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Apr 12 12:23:30 2017 XXX.XXX.XXX.XXX:1194 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC 

authentication
Wed Apr 12 12:23:30 2017 XXX.XXX.XXX.XXX:1194 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Apr 12 12:23:30 2017 XXX.XXX.XXX.XXX:1194 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC 

authentication
Wed Apr 12 12:23:30 2017 XXX.XXX.XXX.XXX:1194 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-

SHA384, 1024 bit RSA
Wed Apr 12 12:23:30 2017 XXX.XXX.XXX.XXX:1194 [Laptop] Peer Connection Initiated with 

[AF_INET]XXX.XXX.XXX.XXX:1194
Wed Apr 12 12:23:30 2017 Laptop/XXX.XXX.XXX.XXX:1194 MULTI_sva: pool returned IPv4=10.10.1.2, IPv6=(Not enabled)
Wed Apr 12 12:23:31 2017 Laptop/XXX.XXX.XXX.XXX:1194 PUSH: Received control message: 'PUSH_REQUEST'
Wed Apr 12 12:23:31 2017 Laptop/XXX.XXX.XXX.XXX:1194 send_push_reply(): safe_cap=940
Wed Apr 12 12:23:31 2017 Laptop/XXX.XXX.XXX.XXX:1194 SENT CONTROL [Laptop]: 'PUSH_REPLY,route 192.168.1.0 

255.255.255.0,route-gateway 10.10.1.1,ping 20,ping-restart 180,ifconfig 10.10.1.2 255.255.255.0' (status=1)
Wed Apr 12 12:23:33 2017 Laptop/XXX.XXX.XXX.XXX:1194 MULTI: Learn: 00:ff

Thanks for your help, if anything further missing - just tell me...

Chris[/quote]

Posted: **Wed Apr 12, 2017 12:18 pm**

dpt wrote:if anything further missing - just tell me...

Your complete server log at --verb 4 showing the time at which the problem client connects and what happens after the client has connected.

dpt wrote:the connection didn't work. AND, from now, I could not connect with any other device to the server. So I restartet the openvpn-daemon (windows server system) and everything works fine again. Until I try to connect with the new Laptop

If the server has crashed there should be error messages in the log (above).

Posted: **Wed Apr 12, 2017 3:31 pm**

Your complete server log at --verb 4 showing the time at which the problem client connects and what happens after the client has connected.

Sorry, thats all, no disconnect logged, no crash logged... The openvpn service does not respond anymore. The log above shows the connection of the problem client, but not more...

If the server has crashed there should be error messages in the log (above).

It isn't

. The connection at the client seams to be established (gui is green, ip address is shown in the balloon message) but after that nothing happens anymore. No ping possible, no other client connection possible.

Posted: **Wed Apr 12, 2017 4:38 pm**

dpt wrote:Wed Apr 12 12:23:30 2017 Laptop/XXX.XXX.XXX.XXX:1194 MULTI_sva: pool returned IPv4=10.10.1.2, IPv6=(Not enabled)
Wed Apr 12 12:23:31 2017 Laptop/XXX.XXX.XXX.XXX:1194 PUSH: Received control message: 'PUSH_REQUEST'
Wed Apr 12 12:23:31 2017 Laptop/XXX.XXX.XXX.XXX:1194 send_push_reply(): safe_cap=940
Wed Apr 12 12:23:31 2017 Laptop/XXX.XXX.XXX.XXX:1194 SENT CONTROL [Laptop]: 'PUSH_REPLY,route 192.168.1.0

255.255.255.0,route-gateway 10.10.1.1,ping 20,ping-restart 180,ifconfig 10.10.1.2 255.255.255.0' (status=1)
Wed Apr 12 12:23:33 2017 Laptop/XXX.XXX.XXX.XXX:1194 MULTI: Learn: 00:ff

So this is the end of your server log .. Followed by the server crashes ?

Posted: **Thu Apr 13, 2017 11:35 am**

Right... After that I have to restart the openvpn service

Posted: **Thu Apr 13, 2017 11:48 am**

Try increasing to --verb 7 and see if you get any new information.

Posted: **Fri Jan 24, 2025 9:49 pm**

Hello,
I found this old thread, encoutering the same issue.

But not just once. Multiple times, and a an increasing frequency lately

The issue is exactly as described by the author of the thread : randomly, a client OpenVPN computer trigger the issue with its newly connected tunnel. When pinging the remote OVPN server, It works for only a few seconds, then start lossing all packed permanently or for some prolonged periods of time, with very few periods when a few packed go through.

What's especially problematic is that when the issue arises, the OpenVPN's server side is impacted, for all users (currently connected or later) and must be restarted each time.

I have the feeling the occurence of this particular issue seems to increase with newer releases of OpenVPN, especially since r2.6.x / OpenSSL 3.x / TAPv9 9.2x driver.

Configuration is very straighforward : TAP mode. The issue arises in UDP or TCP, whatever the port. A port NAT rule map the port to the OVPN server. They can be physical server (most of my user case, Windows Server 2016 to 2022) or Hyper-V virtual instances on a basic vSwitch connected to a NIC.

No compression enabled, default parameters.

I don't have a big cohort enough of computers triggering this issue to draw any conclusions, but the user computers are all are quite aged :
- A Lenovo Yoga 730-13iwl with a Core i5-8265u. Was used with Windows 10 Pro then 11 Pro (still in use w/ 24H2), with multiple OVPN Releases. Has always triggered the issue.
- An Asus P1410, Core i3-8130u, Windows 10 Pro 22H2
- A HP Zbook 15 G2 , Core i7-4810HQ, W10 Pro 22H2

Can't remind having a AMD's CPU-based computer triggering the issue so far, but I have very few in use.

Seems to me OpenVPN (or OpenSSL 3.x / TAPv9.x driver) for Windows seems broken, under circumstancies.
At this point, I'm wondering if code optimization / SIMD / AES-SHA hardware acceleration might be broken with older Core Gen CPU.

I'm planning to replace some of the Windows OpenVPN server's instances with appliances running PfSense CE for firewalling and OpenVPN service, hoping it will at least prevent the nasty issue occuring server-side process and impacting the whole service every time.

Posted: **Fri Jan 24, 2025 9:59 pm**

Last piece of information : on these computers, the issue arises whatever the interface used (wifi, wired), the interface driver (tested a lot) or the ISP (fiber, DSL, LTE)

Posted: **Fri Jan 31, 2025 11:34 pm**

I set up an OpenVPN server on a pfSense 2.7.2 CE, hosted on a atom board, and ran a few hours of tests this week with one of the mentioned computer that trigged the issue. the pfSense replaced the OVPN Windows Server on site. Same overall configuration was ported to pfSense.

> Everything seems to work finely, the client does not exhibit the issue observed when used with the Windows OVPN server.

Moreover, the latency seems better (noticeable with a RDS usage), although the max bandwith offered by the E3930 board/PfSense is much lower than the Windows Server's Xeon E-2134 (~150 MBps vs ~500 MBps)

OpenVPN Support Forum

openvpn crashes due to connect from one special machine

openvpn crashes due to connect from one special machine

Re: openvpn crashes due to connect from one special machine

Re: openvpn crashes due to connect from one special machine

Re: openvpn crashes due to connect from one special machine

Re: openvpn crashes due to connect from one special machine

Re: openvpn crashes due to connect from one special machine

Re: openvpn crashes due to connect from one special machine

Re: openvpn crashes due to connect from one special machine

Re: openvpn crashes due to connect from one special machine

Re: openvpn crashes due to connect from one special machine

Re: openvpn crashes due to connect from one special machine