OpenVPN: Windows 7 x64 client cannot see remote LAN, but XP client can

Question

I'm using OpenVPN 2.1.1 with Windows XP x86 SP3 and Windows 7 x64 clients to an Endian Community 2.4.0 box which includes OpenVPN 2.1-rc15.

Connecting from both works fine, but accessing resources on the green LAN does not work from Windows 7, and works for XP.
So: I can ping the hosts on the pushed networks through the VPN, but with windows7 I only ping the firewall green ip address.

Edit: I have tried the route-method exe / route-delay 2 trick, but that does not solve the issue.

More specifics on the Endian configuration (tried both 2.2 and 2.4, both fail):

red=192.168.100.25;192.168.71.25
green=176.16.41.1
orange=176.16.141.1

It basically runs as an OpenVPN server, serving at red, providing access to green.

On Windows XP, I have the default OpenVPN 2.1.1 install, using OpenVPN GUI (included in the install) and everything is dandy.

On Windows 7 x64, I run the same, but now with OpenVPN GUI as Administrator.
It can only ping the green gateway, but no other machines.

Windows 7 log:

Tue Aug 10 18:50:15 2010 OpenVPN 2.1.1 i686-pc-mingw32 [SSL] [LZO2] [PKCS11] built on Dec 11 2009
Tue Aug 10 18:50:23 2010 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Tue Aug 10 18:50:23 2010 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Tue Aug 10 18:50:24 2010 LZO compression initialized
Tue Aug 10 18:50:24 2010 Control Channel MTU parms [ L:1576 D:140 EF:40 EB:0 ET:0 EL:0 ]
Tue Aug 10 18:50:24 2010 Data Channel MTU parms [ L:1576 D:1450 EF:44 EB:135 ET:32 EL:0 AF:3/1 ]
Tue Aug 10 18:50:24 2010 Local Options hash (VER=V4): '31fdf004'
Tue Aug 10 18:50:24 2010 Expected Remote Options hash (VER=V4): '3e6d1056'
Tue Aug 10 18:50:24 2010 Attempting to establish TCP connection with 192.168.71.25:1194
Tue Aug 10 18:50:24 2010 TCP connection established with 192.168.71.25:1194
Tue Aug 10 18:50:24 2010 Socket Buffers: R=[8192->8192] S=[8192->8192]
Tue Aug 10 18:50:24 2010 TCPv4_CLIENT link local: [undef]
Tue Aug 10 18:50:24 2010 TCPv4_CLIENT link remote: 192.168.71.25:1194
Tue Aug 10 18:50:24 2010 TLS: Initial packet from 192.168.71.25:1194, sid=165d50de 52c0ecba
Tue Aug 10 18:50:24 2010 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Tue Aug 10 18:50:24 2010 VERIFY OK: depth=1, /C=IT/O=efw/CN=efw_CA
Tue Aug 10 18:50:24 2010 VERIFY OK: depth=0, /C=IT/O=efw/CN=127.0.0.1
Tue Aug 10 18:50:24 2010 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Aug 10 18:50:24 2010 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Aug 10 18:50:24 2010 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Aug 10 18:50:24 2010 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Aug 10 18:50:24 2010 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Tue Aug 10 18:50:24 2010 [127.0.0.1] Peer Connection Initiated with 192.168.71.25:1194
Tue Aug 10 18:50:26 2010 SENT CONTROL [127.0.0.1]: 'PUSH_REQUEST' (status=1)
Tue Aug 10 18:50:27 2010 PUSH: Received control message: 'PUSH_REPLY,ifconfig 172.16.41.209 255.255.255.0,dhcp-option DOMAIN pluimers.com,ping-restart 30,ping 8,route-gateway 172.16.41.1,route-gateway 172.16.41.1'
Tue Aug 10 18:50:27 2010 OPTIONS IMPORT: timers and/or timeouts modified
Tue Aug 10 18:50:27 2010 OPTIONS IMPORT: --ifconfig/up options modified
Tue Aug 10 18:50:27 2010 OPTIONS IMPORT: route-related options modified
Tue Aug 10 18:50:27 2010 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Tue Aug 10 18:50:27 2010 TAP-WIN32 device [Local Area Connection 2] opened: \\.\Global\{F3F5E8A1-1797-4FA8-902E-3895A2163148}.tap
Tue Aug 10 18:50:27 2010 TAP-Win32 Driver Version 9.6
Tue Aug 10 18:50:27 2010 TAP-Win32 MTU=1500
Tue Aug 10 18:50:27 2010 Notified TAP-Win32 driver to set a DHCP IP/netmask of 172.16.41.209/255.255.255.0 on interface {F3F5E8A1-1797-4FA8-902E-3895A2163148} [DHCP-serv: 172.16.41.0, lease-time: 31536000]
Tue Aug 10 18:50:27 2010 Successful ARP Flush on interface [34] {F3F5E8A1-1797-4FA8-902E-3895A2163148}
Tue Aug 10 18:50:32 2010 TEST ROUTES: 0/0 succeeded len=-1 ret=1 a=0 u/d=up
Tue Aug 10 18:50:32 2010 Initialization Sequence Completed[/code]

Windows 7 routing table:

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0     192.168.71.1   192.168.71.160     20
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
      169.254.0.0      255.255.0.0         On-link   169.254.100.145    276
  169.254.100.145  255.255.255.255         On-link   169.254.100.145    276
  169.254.255.255  255.255.255.255         On-link   169.254.100.145    276
      172.16.41.0    255.255.255.0         On-link     172.16.41.209    286
    172.16.41.209  255.255.255.255         On-link     172.16.41.209    286
    172.16.41.255  255.255.255.255         On-link     172.16.41.209    286
     192.168.71.0    255.255.255.0         On-link    192.168.71.160    276
   192.168.71.160  255.255.255.255         On-link    192.168.71.160    276
   192.168.71.255  255.255.255.255         On-link    192.168.71.160    276
    192.168.237.0    255.255.255.0         On-link     192.168.237.1    276
    192.168.237.1  255.255.255.255         On-link     192.168.237.1    276
  192.168.237.255  255.255.255.255         On-link     192.168.237.1    276
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link    192.168.71.160    276
        224.0.0.0        240.0.0.0         On-link   169.254.100.145    276
        224.0.0.0        240.0.0.0         On-link     192.168.237.1    276
        224.0.0.0        240.0.0.0         On-link     172.16.41.209    286
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link    192.168.71.160    276
  255.255.255.255  255.255.255.255         On-link   169.254.100.145    276
  255.255.255.255  255.255.255.255         On-link     192.168.237.1    276
  255.255.255.255  255.255.255.255         On-link     172.16.41.209    286
===========================================================================

(you can ignore these routes, as the are from VMware workstation running on the same machine: - 192.168.237.0/24 - 169.254.0.0/16 )

Windows XP log:

Tue Aug 10 19:01:04 2010 OpenVPN 2.1.1 i686-pc-mingw32 [SSL] [LZO2] [PKCS11] built on Dec 11 2009
Tue Aug 10 19:01:06 2010 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Tue Aug 10 19:01:06 2010 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Tue Aug 10 19:01:07 2010 LZO compression initialized
Tue Aug 10 19:01:07 2010 Control Channel MTU parms [ L:1576 D:140 EF:40 EB:0 ET:0 EL:0 ]
Tue Aug 10 19:01:07 2010 Data Channel MTU parms [ L:1576 D:1450 EF:44 EB:135 ET:32 EL:0 AF:3/1 ]
Tue Aug 10 19:01:07 2010 Local Options hash (VER=V4): '31fdf004'
Tue Aug 10 19:01:07 2010 Expected Remote Options hash (VER=V4): '3e6d1056'
Tue Aug 10 19:01:07 2010 Attempting to establish TCP connection with 192.168.71.25:1194
Tue Aug 10 19:01:07 2010 TCP connection established with 192.168.71.25:1194
Tue Aug 10 19:01:07 2010 Socket Buffers: R=[8192->8192] S=[8192->8192]
Tue Aug 10 19:01:07 2010 TCPv4_CLIENT link local: [undef]
Tue Aug 10 19:01:07 2010 TCPv4_CLIENT link remote: 192.168.71.25:1194
Tue Aug 10 19:01:07 2010 TLS: Initial packet from 192.168.71.25:1194, sid=983b94eb 87732d38
Tue Aug 10 19:01:07 2010 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Tue Aug 10 19:01:07 2010 VERIFY OK: depth=1, /C=IT/O=efw/CN=efw_CA
Tue Aug 10 19:01:07 2010 VERIFY OK: depth=0, /C=IT/O=efw/CN=127.0.0.1
Tue Aug 10 19:01:07 2010 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Aug 10 19:01:07 2010 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Aug 10 19:01:07 2010 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Aug 10 19:01:07 2010 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Aug 10 19:01:07 2010 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Tue Aug 10 19:01:07 2010 [127.0.0.1] Peer Connection Initiated with 192.168.71.25:1194
Tue Aug 10 19:01:09 2010 SENT CONTROL [127.0.0.1]: 'PUSH_REQUEST' (status=1)
Tue Aug 10 19:01:10 2010 PUSH: Received control message: 'PUSH_REPLY,ifconfig 172.16.41.201 255.255.255.0,dhcp-option DOMAIN pluimers.com,ping-restart 30,ping 8,route-gateway 172.16.41.1,route-gateway 172.16.41.1'
Tue Aug 10 19:01:10 2010 OPTIONS IMPORT: timers and/or timeouts modified
Tue Aug 10 19:01:10 2010 OPTIONS IMPORT: --ifconfig/up options modified
Tue Aug 10 19:01:10 2010 OPTIONS IMPORT: route-related options modified
Tue Aug 10 19:01:10 2010 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Tue Aug 10 19:01:10 2010 TAP-WIN32 device [Local Area Connection 3] opened: \\.\Global\{C4752F65-93BA-4DED-A1FE-2633F1481ABF}.tap
Tue Aug 10 19:01:10 2010 TAP-Win32 Driver Version 9.6
Tue Aug 10 19:01:10 2010 TAP-Win32 MTU=1500
Tue Aug 10 19:01:10 2010 Notified TAP-Win32 driver to set a DHCP IP/netmask of 172.16.41.201/255.255.255.0 on interface {C4752F65-93BA-4DED-A1FE-2633F1481ABF} [DHCP-serv: 172.16.41.0, lease-time: 31536000]
Tue Aug 10 19:01:10 2010 Successful ARP Flush on interface [2] {C4752F65-93BA-4DED-A1FE-2633F1481ABF}
Tue Aug 10 19:01:15 2010 TEST ROUTES: 0/0 succeeded len=-1 ret=0 a=0 u/d=down
Tue Aug 10 19:01:15 2010 Route: Waiting for TUN/TAP interface to come up...
Tue Aug 10 19:01:18 2010 TEST ROUTES: 0/0 succeeded len=-1 ret=1 a=0 u/d=up
Tue Aug 10 19:01:18 2010 Initialization Sequence Completed

The XP routing table:

===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0    192.168.237.2  192.168.237.128      10
        127.0.0.0        255.0.0.0        127.0.0.1       127.0.0.1       1
      172.16.41.0    255.255.255.0    172.16.41.201   172.16.41.201       30
    172.16.41.201  255.255.255.255        127.0.0.1       127.0.0.1       30
   172.16.255.255  255.255.255.255    172.16.41.201   172.16.41.201       30
    192.168.237.0    255.255.255.0  192.168.237.128  192.168.237.128      10
  192.168.237.128  255.255.255.255        127.0.0.1       127.0.0.1       10
  192.168.237.255  255.255.255.255  192.168.237.128  192.168.237.128      10
        224.0.0.0        240.0.0.0    172.16.41.201   172.16.41.201       30
        224.0.0.0        240.0.0.0  192.168.237.128  192.168.237.128      10
  255.255.255.255  255.255.255.255    172.16.41.201   172.16.41.201       1
  255.255.255.255  255.255.255.255  192.168.237.128  192.168.237.128      1
Default Gateway:     192.168.237.2
===========================================================================

Anyone having an idea what goes wrong?

--jeroen

Are you actually running as administrator, or a user in the administrators group? Do you get the same behavior if you start VPN via the OpenVPN service? — Zoredache, Aug 10, 2010 at 17:43
@Zoredache: I run as a user in the Administrators group, and I have elevated OpenVPN GUI using UAC. I was not aware you could run OpenVPN as a service, will investigate that and get back. Any other tips? — Jeroen Wiert Pluimers, Aug 10, 2010 at 19:15
@Zoredache: right now, running the OpenVPN service will be a tad difficult, as I need to find out how to reconfigure the Endian appliance to allow certificate authentication in stead of username/password. So any tips on doing it through the GUI are much appreciated. — Jeroen Wiert Pluimers, Aug 10, 2010 at 19:35
Well I do have an idea how to fix it. I started writing but gave up on, a GUI client for openvpn that operates similar to Tunnelblick. Instead of the end user starting the VPN the service starts the VPN, but it is started in the hold state. The GUI then uses the managment port via tcp/ip to communicate with the VPN service and provide the password and start the service. Right now since I am using cert-based authentication I just let the service startup automatically. One of these days when I bored enough I might look into that again. — Zoredache, Aug 10, 2010 at 20:19
@Zoredache: Thanks. Any references on how to set up this certificate based authentication using Endian (or OpenVPN, I might be able to extrapolate to the Endian GUI). — Jeroen Wiert Pluimers, Aug 10, 2010 at 21:39

Falcon Momot · Accepted Answer · 2015-10-01 21:13:16Z

Well i faced the same problem. Tried all the stuff like enable file sharing, setting same workgroup, etc. Nothing helped but this:

I noticed that there is a multiple number of network adapters in Device manager. All were hidden so one must click View and enable hidden devices.

All of them were named something like ...4to6 adapter. When I removed all these adapters my file/printer sharing and networking with XP clients starts working after reboot. If there is a huge number of these adapters you have to remove it all. It can be done using appropriate (32 or 64 bit version) tool DEVCON.EXE (which is part of Windows Driver Kit - Download details: Windows Driver Kit Version 7.1.0). More can be found here The DevCon command-line utility functions as an alternative to Device Manager.

I found this solution here: http://ryanvictory.com/posts/automating-6to4-adapter-removal-in-windows/

+1; This is the link to the "6to4 adapter removal" article: ryanvictory.com/posts/… — Jeroen Wiert Pluimers, Jan 22, 2011 at 21:17

Jeroen Wiert Pluimers · Accepted Answer · 2010-12-02 21:36:27Z

0

I solved my problem: it was a testcase error.

Windows XP was connecting to a physical Endian box.
Windows 7 x64 was connecting to a virtual Endian box.

The virtual box is running on VMware ESX/ESXi, using a virtual network switch.
I forgot to enable promiscuous mode for that switch.

Enabling that fixed the issue.

--jeroen

answered Dec 2, 2010 at 21:36

Jeroen Wiert Pluimers

2906 silver badges14 bronze badges

I have exactly the same problem with Windows7 64bit not working but copied exact config from WinXP which worked. On XP I could see network machines and drives, on Windows7 I can't. Logs on connect and route table looks fine under Windows7 - but somehow network machine information is not passing through the TUN device despite routes. I tried manually adding exact routes but still no luck. It seem Microsoft have change how networking name resolution works.
– user62304
Dec 2, 2010 at 12:28
See the answer I just gave. Did that help?
– Jeroen Wiert Pluimers
Dec 2, 2010 at 21:36

Add a comment |

Stack Exchange Network

OpenVPN: Windows 7 x64 client cannot see remote LAN, but XP client can

2 Answers 2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged
windows-xp
routing
openvpn
windows-7
.

Linked

Hot Network Questions

OpenVPN: Windows 7 x64 client cannot see remote LAN, but XP client can

2 Answers 2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged windows-xproutingopenvpnwindows-7.

Linked

Related

Hot Network Questions

Not the answer you're looking for? Browse other questions tagged
windows-xp
routing
openvpn
windows-7
.