OpenVPN Support Forum

Hi there

I have OpenVPN server on a Raspberry Pi. It allows my mobile phone to connect without any problem.

I created keys etc for my Windows 10 laptop with OpenVPN Connect. I am using the same ovpn file as used on the phone.

I find that when connects it reports:
ovpnagent: request error

The log shows that the auto-generated script that configures the tap net adapter shows this:
"gateway" : "UNSPEC",

POST np://[\\.\pipe\agent_ovpnconnect]/tun-setup : 400 Bad Request
ip_exception: error parsing tunnel_addresses[0].gateway IP address 'UNSPEC' : An invalid argument was supplied.
[Jun 25, 2021, 21:11:01] TUN Error: ovpnagent: request error


Is there something missing from my client or server config files?
Let me know if you need me to post any other info.

Thank you in advance.

Hello plumbersmate,

In order to investigate this further, please contact us at https://openvpn.net/support and send logs of your connection attempts that show this problem. Also please let us know the exact version of OpenVPN Connect being used.

However there is just one thing I want to point out and that is that with OpenVPN generally you do not specify a gateway for the TAP adapter. Instead you set up routes that redirect traffic to the IP address of the VPN server's internal gateway address, reachable through the client's TAP adapter.

However such an error message deserves investigation and as such we'd like to see more, but we'd rather do that over a secure channel.

Kind regards,
Johan

Thank you for your offer of looking into this problem.

The version of OpenVPN I am using is: Note this line in the log, which I think maybe significant: My log is: My client ovpn file:

I got branched off to the commercial OpenVPN site. Then was told that's not for me as I am using the Community openvpn.

So, is there someone here who can help?

plumbersmate wrote: ↑

Fri Jun 25, 2021 8:16 pm

Windows 10 laptop with OpenVPN Connect

plumbersmate wrote: ↑

Thu Aug 19, 2021 5:00 pm

I got branched off to the commercial OpenVPN site. Then was told that's not for me as I am using the Community openvpn.

According to your post you are using the Corporate version of Openvpn-Connect

I am still trying to resolve this problem.
Would really appreciate any help as I have spent hours trying to resolve this, I just cannot find out why it is not working.
I am now using Windows OpenVPN version 3.3.3

Hi Mate,

You are using the proprietary ("corporate") OpenVPN Connect client. It's fully compatible with any OpenVPN server including community openvpn.

Did you open a ticket as Johan asked? Please share the last 3 digits of the ticket number here so we can be sure to see it.

Thanks and regards, rob0

Dear Rob
I did open a ticket as requested, the ticket ending is 151
I was told:
"The issue you are describing appears to be related to the OpenVPN open source community version. I am sorry for the inconvenience, but unfortunately, I cannot help you here.
This support ticket system is for customers of our OpenVPN Access Server and OpenVPN Cloud products only, the commercial solutions based on OpenVPN."

I seem to be going around in circles.

plumbersmate wrote: ↑

Sun Dec 19, 2021 8:35 pm

I was told:
"The issue you are describing appears to be related to the OpenVPN open source community version. I am sorry for the inconvenience, but unfortunately, I cannot help you here.
This support ticket system is for customers of our OpenVPN Access Server and OpenVPN Cloud products only, the commercial solutions based on OpenVPN."

If that is the best they can do then ...

How is this Community Related ?

Signed up to leave a comment which will save others from troubleshooting this problem in future. Please see my solution for this issue in the last paragraph.

In general, the OpenVPN community forum troubleshooting experience is immensely frustrating with the sheer amount of times you search an issue online and the first result is a thread from this forum where either there's no answer in X years, or more frequently, TinCanTech shutting down a question for any number of reasons - often citing relevance.

You moderators know you can move threads in phpBB right? Instead, this thread is the first search engine result for anyone experiencing gateway=UNSPEC problems on the OpenVPN Connect Windows client. Alike MANY other top-result troubleshooting threads on this cursed forum the last reply is **frequently** a "get lost" remark due to somebody posting a thread in the wrong section (or whichever excuse we would like to pick to avoid acknowledging the problem). Don't bother moving the thread to a more relevant section, just let it become the FIRST RESULT INDEXED for when people search for this problem so they can hit a dead end immediately. Even the creator of this thread was asking for help multiple times as there's no decent documentation for this kind of hiccup unless you are already an expert in this field. The number of threads on the OpenVPN forum here that end up unanswered, dismissed and *the first search engine result for any specific problem* is way too damn high. Frankly it's an embarrassing and unacceptable state to have the forum in so frequently

-------------

@plumbersmate I'm sorry this comment is likely too late to help you now but I'm leaving my experience with this error and the solution I came up with because this is way better than this dead unanswered thread being the top result when people go looking for help. This should be a permitted bump because it makes this first google result potentially useful to somebody now.

Onto discussing the actual problem - Identically as @plumbersmate, all our OpenVPN clients both mobile and PC have zero issues, but the OpenVPN Connect client for Windows throws the exact same error you experienced.

I am configuring OpenVPN Connect 3.7.7.2979 with an existing OpenVPN 2.6.3 Community server for one of our business clients. In our case, our OpenVPN server (community) is pushing `redirect-gateway def1` to all clients - Despite OpenVPN Connect being the superior and pretty client with a nice UI for users **This is not enough** - In fact you could even label this as an OpenVPN Connect bug as it should be seeing `def1` and filling the gateway JSON field itself based on that push. Alas, it does not.

What is happening here is that OpenVPN Connect is building a JSON array of server information for it to pipe into the OpenVPN process it runs for tunnel configuration to occur post-connection. Even with your OpenVPN 2.6.3 server pushing `redirect-gateway def1` this is **not enough** for OpenVPN Connect to take the hint and it fills in the "gateway" json field with the string "UNSPEC". As a result, and per your logs you can see the pipe failing as it gets upset trying to interpret "gateway": "UNSPEC" which obviously doesn't fly with a "400 Bad Request" error thrown locally.

It gets worse - If one reads the man page for OpenVPN you'll see that you can push `route-gateway dhcp` or `route-gateway gateway` as well (Even just as a contingency) but OpenVPN Connect errors when you use `dhcp` too taking the string literally which is a bit of a facepalm. Yet another incompatibility / misnomer in its behaviour.

Finally, I found that setting `push route-gateway 10.55.0.1` (Use your own OpenVPN server's gateway IP, not this example IP) is enough to rectify this problem for OpenVPN Connect clients, this sets the "gateway" JSON to that IP, and it parses correctly internally for further configuration. I hope somebody finds this information helpful if they run into this problem in future, OpenVPN Connect explicitly expects a gateway IP to be set or it will fill it in with "UNSPEC" then promptly get upset when it tries to use that.

Best of luck!