0

Summary: Windows 10 OpenVPN clients have problems dealing with route setup in the case routes are pushed by an OpenVPN server (but finally connect fine). Clients which refurse server routes connect at once.

Details: I have an OpenVPN server from which users connect from Windows 10 machines.

There are two types of client configurations: one where the routes pushed by the server are refused by the client (which adds a few routes on its own) and another where the client receives the server configuration, including routes which force all traffic though the server.

The difference in both configurations are the following lines (which are in the first configuration above)

# refuse routes from server
route-nopull
# add home routes
route 10.10.10.0 255.255.255.0
route 10.10.11.0 255.255.255.0
route 10.10.12.0 255.255.255.0

When connecting from such a client there are no problems, the connection is quickly up without any errors.

In the second case, the connection also goes through (edit: and connectivity is correct and works as expected) but with errors on the way:

Tue Aug 16 18:16:53 2016 OpenVPN 2.3.11 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on May 10 2016
Tue Aug 16 18:16:53 2016 Windows version 6.2 (Windows 8 or greater) 64bit
Tue Aug 16 18:16:53 2016 library versions: OpenSSL 1.0.1t  3 May 2016, LZO 2.09
Enter Management Password:
Tue Aug 16 18:16:53 2016 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25342
Tue Aug 16 18:16:53 2016 Need hold release from management interface, waiting...
Tue Aug 16 18:16:54 2016 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25342
Tue Aug 16 18:16:54 2016 MANAGEMENT: CMD 'state on'
Tue Aug 16 18:16:54 2016 MANAGEMENT: CMD 'log all on'
Tue Aug 16 18:16:54 2016 MANAGEMENT: CMD 'hold off'
Tue Aug 16 18:16:54 2016 MANAGEMENT: CMD 'hold release'
Tue Aug 16 18:16:54 2016 Socket Buffers: R=[65536->65536] S=[65536->65536]
Tue Aug 16 18:16:54 2016 MANAGEMENT: >STATE:1471364214,RESOLVE,,,
Tue Aug 16 18:16:54 2016 UDPv4 link local: [undef]
Tue Aug 16 18:16:54 2016 UDPv4 link remote: [AF_INET]MY_SERVER_IP:1194
Tue Aug 16 18:16:54 2016 MANAGEMENT: >STATE:1471364214,WAIT,,,
Tue Aug 16 18:16:54 2016 MANAGEMENT: >STATE:1471364214,AUTH,,,
Tue Aug 16 18:16:54 2016 TLS: Initial packet from [AF_INET]MY_SERVER_IP:1194, sid=ee4d12d3 37c79813
Tue Aug 16 18:16:54 2016 VERIFY OK: depth=1, C=FR, ST=HOME, L=HOME, O=HOME, OU=HOME, CN=HOME CA, name=server, emailAddress=HOME@HOME
Tue Aug 16 18:16:54 2016 Validating certificate key usage
Tue Aug 16 18:16:54 2016 ++ Certificate has key usage  00a0, expects 00a0
Tue Aug 16 18:16:54 2016 VERIFY KU OK
Tue Aug 16 18:16:54 2016 Validating certificate extended key usage
Tue Aug 16 18:16:54 2016 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Tue Aug 16 18:16:54 2016 VERIFY EKU OK
Tue Aug 16 18:16:54 2016 VERIFY OK: depth=0, C=FR, ST=HOME, L=HOME, O=HOME, OU=HOME, CN=server, name=server, emailAddress=HOME@HOME
Tue Aug 16 18:16:54 2016 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Aug 16 18:16:54 2016 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Aug 16 18:16:54 2016 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Aug 16 18:16:54 2016 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Aug 16 18:16:54 2016 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Tue Aug 16 18:16:54 2016 [server] Peer Connection Initiated with [AF_INET]MY_SERVER_IP:1194
Tue Aug 16 18:16:55 2016 MANAGEMENT: >STATE:1471364215,GET_CONFIG,,,
Tue Aug 16 18:16:56 2016 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Tue Aug 16 18:16:56 2016 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,route 10.10.10.0 255.255.255.0 10.20.1.254,route 10.10.12.0 255.255.255.0 10.20.1.254,route-gateway 10.30.1.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.30.1.4 255.255.255.0'
Tue Aug 16 18:16:56 2016 OPTIONS IMPORT: timers and/or timeouts modified
Tue Aug 16 18:16:56 2016 OPTIONS IMPORT: --ifconfig/up options modified
Tue Aug 16 18:16:56 2016 OPTIONS IMPORT: route options modified
Tue Aug 16 18:16:56 2016 OPTIONS IMPORT: route-related options modified
Tue Aug 16 18:16:56 2016 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Tue Aug 16 18:16:56 2016 ROUTE_GATEWAY 192.168.1.1/255.255.255.0 I=8 HWADDR=44:85:00:ec:ec:2b
Tue Aug 16 18:16:56 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Tue Aug 16 18:16:56 2016 MANAGEMENT: >STATE:1471364216,ASSIGN_IP,,10.30.1.4,
Tue Aug 16 18:16:56 2016 open_tun, tt->ipv6=0
Tue Aug 16 18:16:56 2016 TAP-WIN32 device [Ethernet 2] opened: \\.\Global\{83B07A98-A3E8-4A53-BDA5-44BA2C3ABB1B}.tap
Tue Aug 16 18:16:56 2016 TAP-Windows Driver Version 9.21 
Tue Aug 16 18:16:56 2016 Set TAP-Windows TUN subnet mode network/local/netmask = 10.30.1.0/10.30.1.4/255.255.255.0 [SUCCEEDED]
Tue Aug 16 18:16:56 2016 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.30.1.4/255.255.255.0 on interface {83B07A98-A3E8-4A53-BDA5-44BA2C3ABB1B} [DHCP-serv: 10.30.1.254, lease-time: 31536000]
Tue Aug 16 18:16:56 2016 Successful ARP Flush on interface [10] {83B07A98-A3E8-4A53-BDA5-44BA2C3ABB1B}
Tue Aug 16 18:17:01 2016 TEST ROUTES: 1/3 succeeded len=2 ret=0 a=0 u/d=up
Tue Aug 16 18:17:01 2016 Route: Waiting for TUN/TAP interface to come up...
Tue Aug 16 18:17:06 2016 TEST ROUTES: 1/3 succeeded len=2 ret=0 a=0 u/d=up
Tue Aug 16 18:17:06 2016 Route: Waiting for TUN/TAP interface to come up...
Tue Aug 16 18:17:07 2016 TEST ROUTES: 1/3 succeeded len=2 ret=0 a=0 u/d=up
Tue Aug 16 18:17:07 2016 Route: Waiting for TUN/TAP interface to come up...
Tue Aug 16 18:17:08 2016 TEST ROUTES: 1/3 succeeded len=2 ret=0 a=0 u/d=up
Tue Aug 16 18:17:08 2016 Route: Waiting for TUN/TAP interface to come up...
Tue Aug 16 18:17:09 2016 TEST ROUTES: 1/3 succeeded len=2 ret=0 a=0 u/d=up
Tue Aug 16 18:17:09 2016 Route: Waiting for TUN/TAP interface to come up...
Tue Aug 16 18:17:11 2016 TEST ROUTES: 1/3 succeeded len=2 ret=0 a=0 u/d=up
Tue Aug 16 18:17:11 2016 Route: Waiting for TUN/TAP interface to come up...
Tue Aug 16 18:17:12 2016 TEST ROUTES: 1/3 succeeded len=2 ret=0 a=0 u/d=up
Tue Aug 16 18:17:12 2016 Route: Waiting for TUN/TAP interface to come up...
Tue Aug 16 18:17:13 2016 TEST ROUTES: 1/3 succeeded len=2 ret=0 a=0 u/d=up
Tue Aug 16 18:17:13 2016 Route: Waiting for TUN/TAP interface to come up...
Tue Aug 16 18:17:14 2016 TEST ROUTES: 1/3 succeeded len=2 ret=0 a=0 u/d=up
Tue Aug 16 18:17:14 2016 Route: Waiting for TUN/TAP interface to come up...
Tue Aug 16 18:17:16 2016 TEST ROUTES: 1/3 succeeded len=2 ret=0 a=0 u/d=up
Tue Aug 16 18:17:16 2016 Route: Waiting for TUN/TAP interface to come up...
Tue Aug 16 18:17:17 2016 TEST ROUTES: 1/3 succeeded len=2 ret=0 a=0 u/d=up
Tue Aug 16 18:17:17 2016 Route: Waiting for TUN/TAP interface to come up...
Tue Aug 16 18:17:18 2016 TEST ROUTES: 1/3 succeeded len=2 ret=0 a=0 u/d=up
Tue Aug 16 18:17:18 2016 Route: Waiting for TUN/TAP interface to come up...
Tue Aug 16 18:17:19 2016 TEST ROUTES: 1/3 succeeded len=2 ret=0 a=0 u/d=up
Tue Aug 16 18:17:19 2016 Route: Waiting for TUN/TAP interface to come up...
Tue Aug 16 18:17:21 2016 TEST ROUTES: 1/3 succeeded len=2 ret=0 a=0 u/d=up
Tue Aug 16 18:17:21 2016 Route: Waiting for TUN/TAP interface to come up...
Tue Aug 16 18:17:22 2016 TEST ROUTES: 1/3 succeeded len=2 ret=0 a=0 u/d=up
Tue Aug 16 18:17:22 2016 Route: Waiting for TUN/TAP interface to come up...
Tue Aug 16 18:17:23 2016 TEST ROUTES: 1/3 succeeded len=2 ret=0 a=0 u/d=up
Tue Aug 16 18:17:23 2016 Route: Waiting for TUN/TAP interface to come up...
Tue Aug 16 18:17:24 2016 TEST ROUTES: 1/3 succeeded len=2 ret=0 a=0 u/d=up
Tue Aug 16 18:17:24 2016 Route: Waiting for TUN/TAP interface to come up...
Tue Aug 16 18:17:25 2016 TEST ROUTES: 1/3 succeeded len=2 ret=0 a=0 u/d=up
Tue Aug 16 18:17:25 2016 Route: Waiting for TUN/TAP interface to come up...
Tue Aug 16 18:17:27 2016 TEST ROUTES: 1/3 succeeded len=2 ret=0 a=0 u/d=up
Tue Aug 16 18:17:27 2016 Route: Waiting for TUN/TAP interface to come up...
Tue Aug 16 18:17:28 2016 TEST ROUTES: 1/3 succeeded len=2 ret=0 a=0 u/d=up
Tue Aug 16 18:17:28 2016 Route: Waiting for TUN/TAP interface to come up...
Tue Aug 16 18:17:29 2016 TEST ROUTES: 1/3 succeeded len=2 ret=0 a=0 u/d=up
Tue Aug 16 18:17:29 2016 Route: Waiting for TUN/TAP interface to come up...
Tue Aug 16 18:17:30 2016 TEST ROUTES: 1/3 succeeded len=2 ret=0 a=0 u/d=up
Tue Aug 16 18:17:30 2016 Route: Waiting for TUN/TAP interface to come up...
Tue Aug 16 18:17:31 2016 TEST ROUTES: 1/3 succeeded len=2 ret=0 a=0 u/d=up
Tue Aug 16 18:17:31 2016 C:\Windows\system32\route.exe ADD MY_SERVER_IP MASK 255.255.255.255 192.168.1.1
Tue Aug 16 18:17:31 2016 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=25 and dwForwardType=4
Tue Aug 16 18:17:31 2016 Route addition via IPAPI succeeded [adaptive]
Tue Aug 16 18:17:31 2016 C:\Windows\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.30.1.1
Tue Aug 16 18:17:31 2016 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Tue Aug 16 18:17:31 2016 Route addition via IPAPI succeeded [adaptive]
Tue Aug 16 18:17:31 2016 C:\Windows\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.30.1.1
Tue Aug 16 18:17:31 2016 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Tue Aug 16 18:17:31 2016 Route addition via IPAPI succeeded [adaptive]
Tue Aug 16 18:17:31 2016 MANAGEMENT: >STATE:1471364251,ADD_ROUTES,,,
Tue Aug 16 18:17:31 2016 C:\Windows\system32\route.exe ADD 10.10.10.0 MASK 255.255.255.0 10.20.1.254
Tue Aug 16 18:17:31 2016 Warning: route gateway is not reachable on any active network adapters: 10.20.1.254
Tue Aug 16 18:17:31 2016 Route addition via IPAPI failed [adaptive]
Tue Aug 16 18:17:31 2016 Route addition fallback to route.exe
Tue Aug 16 18:17:31 2016 env_block: add PATH=C:\Windows\System32;C:\Windows;C:\Windows\System32\Wbem
Tue Aug 16 18:17:31 2016 C:\Windows\system32\route.exe ADD 10.10.12.0 MASK 255.255.255.0 10.20.1.254
Tue Aug 16 18:17:31 2016 Warning: route gateway is not reachable on any active network adapters: 10.20.1.254
Tue Aug 16 18:17:31 2016 Route addition via IPAPI failed [adaptive]
Tue Aug 16 18:17:31 2016 Route addition fallback to route.exe
Tue Aug 16 18:17:31 2016 env_block: add PATH=C:\Windows\System32;C:\Windows;C:\Windows\System32\Wbem
SYSTEM ROUTING TABLE
0.0.0.0 0.0.0.0 192.168.1.1 p=0 i=8 t=4 pr=3 a=84556 h=0 m=25/0/0/0/0
0.0.0.0 128.0.0.0 10.30.1.1 p=0 i=10 t=4 pr=3 a=0 h=0 m=20/0/0/0/0
10.10.10.0 255.255.255.0 10.20.1.254 p=0 i=10 t=4 pr=3 a=0 h=0 m=21/0/0/0/0
10.10.12.0 255.255.255.0 10.20.1.254 p=0 i=10 t=4 pr=3 a=0 h=0 m=21/0/0/0/0
10.30.1.0 255.255.255.0 10.30.1.4 p=0 i=10 t=3 pr=2 a=34 h=0 m=276/0/0/0/0
10.30.1.4 255.255.255.255 10.30.1.4 p=0 i=10 t=3 pr=2 a=34 h=0 m=276/0/0/0/0
10.30.1.255 255.255.255.255 10.30.1.4 p=0 i=10 t=3 pr=2 a=34 h=0 m=276/0/0/0/0
MY_SERVER_IP 255.255.255.255 192.168.1.1 p=0 i=8 t=4 pr=3 a=0 h=0 m=25/0/0/0/0
127.0.0.0 255.0.0.0 127.0.0.1 p=0 i=1 t=3 pr=2 a=84568 h=0 m=306/0/0/0/0
127.0.0.1 255.255.255.255 127.0.0.1 p=0 i=1 t=3 pr=2 a=84568 h=0 m=306/0/0/0/0
127.255.255.255 255.255.255.255 127.0.0.1 p=0 i=1 t=3 pr=2 a=84568 h=0 m=306/0/0/0/0
128.0.0.0 128.0.0.0 10.30.1.1 p=0 i=10 t=4 pr=3 a=0 h=0 m=20/0/0/0/0
192.168.1.0 255.255.255.0 192.168.1.115 p=0 i=8 t=3 pr=2 a=84556 h=0 m=281/0/0/0/0
192.168.1.115 255.255.255.255 192.168.1.115 p=0 i=8 t=3 pr=2 a=84556 h=0 m=281/0/0/0/0
192.168.1.255 255.255.255.255 192.168.1.115 p=0 i=8 t=3 pr=2 a=84556 h=0 m=281/0/0/0/0
192.168.56.0 255.255.255.0 192.168.56.1 p=0 i=7 t=3 pr=2 a=84561 h=0 m=266/0/0/0/0
192.168.56.1 255.255.255.255 192.168.56.1 p=0 i=7 t=3 pr=2 a=84561 h=0 m=266/0/0/0/0
192.168.56.255 255.255.255.255 192.168.56.1 p=0 i=7 t=3 pr=2 a=84561 h=0 m=266/0/0/0/0
224.0.0.0 240.0.0.0 127.0.0.1 p=0 i=1 t=3 pr=2 a=84568 h=0 m=306/0/0/0/0
224.0.0.0 240.0.0.0 192.168.56.1 p=0 i=7 t=3 pr=2 a=84565 h=0 m=266/0/0/0/0
224.0.0.0 240.0.0.0 192.168.1.115 p=0 i=8 t=3 pr=2 a=84560 h=0 m=281/0/0/0/0
224.0.0.0 240.0.0.0 10.30.1.4 p=0 i=10 t=3 pr=2 a=2768 h=0 m=276/0/0/0/0
255.255.255.255 255.255.255.255 127.0.0.1 p=0 i=1 t=3 pr=2 a=84568 h=0 m=306/0/0/0/0
255.255.255.255 255.255.255.255 192.168.56.1 p=0 i=7 t=3 pr=2 a=84565 h=0 m=266/0/0/0/0
255.255.255.255 255.255.255.255 192.168.1.115 p=0 i=8 t=3 pr=2 a=84560 h=0 m=281/0/0/0/0
255.255.255.255 255.255.255.255 10.30.1.4 p=0 i=10 t=3 pr=2 a=2768 h=0 m=276/0/0/0/0
SYSTEM ADAPTER LIST
VirtualBox Host-Only Ethernet Adapter
  Index = 7
  GUID = {7190082D-DE11-49F5-A991-69749CA819FA}
  IP = 192.168.56.1/255.255.255.0 
  MAC = 0a:00:27:00:00:07
  GATEWAY = 0.0.0.0/255.255.255.255 
  DNS SERV = 78.46.223.24/255.255.255.255 162.242.211.137/255.255.255.255 
Intel(R) Dual Band Wireless-AC 8260
  Index = 8
  GUID = {735F9562-13DF-473A-B9B4-81E14996782E}
  IP = 192.168.1.115/255.255.255.0 
  MAC = 44:85:00:ec:ec:2b
  GATEWAY = 192.168.1.1/255.255.255.255 
  DHCP SERV = 192.168.1.1/255.255.255.255 
  DHCP LEASE OBTAINED = Tue Aug 16 17:31:24 2016
  DHCP LEASE EXPIRES  = Tue Aug 23 16:11:24 2016
  DNS SERV = 78.46.223.24/255.255.255.255 162.242.211.137/255.255.255.255 
TAP-Windows Adapter V9
  Index = 10
  GUID = {83B07A98-A3E8-4A53-BDA5-44BA2C3ABB1B}
  IP = 10.30.1.4/255.255.255.0 
  MAC = 00:ff:83:b0:7a:98
  GATEWAY = 0.0.0.0/255.255.255.255 
  DHCP SERV = 10.30.1.254/255.255.255.255 
  DHCP LEASE OBTAINED = Tue Aug 16 18:16:56 2016
  DHCP LEASE EXPIRES  = Wed Aug 16 18:16:56 2017
  DNS SERV = 208.67.222.222/255.255.255.255 208.67.220.220/255.255.255.255 
Intel(R) Ethernet Connection (2) I219-LM
  Index = 9
  GUID = {7AC44F3C-D902-4C9C-A02E-06DEE26BAEC8}
  IP = 0.0.0.0/0.0.0.0 
  MAC = 50:7b:9d:f6:98:80
  GATEWAY = 192.168.1.1/255.255.255.255 
  DHCP SERV =  
  DHCP LEASE OBTAINED = Tue Aug 16 18:17:31 2016
  DHCP LEASE EXPIRES  = Tue Aug 16 18:17:31 2016
  DNS SERV =  
Microsoft Wi-Fi Direct Virtual Adapter
  Index = 11
  GUID = {97977503-C285-490A-9494-4FF80043ED78}
  IP = 0.0.0.0/0.0.0.0 
  MAC = 44:85:00:ec:ec:2c
  GATEWAY = 0.0.0.0/255.255.255.255 
  DHCP SERV =  
  DHCP LEASE OBTAINED = Tue Aug 16 18:17:31 2016
  DHCP LEASE EXPIRES  = Tue Aug 16 18:17:31 2016
  DNS SERV =  
TAP-Windows Adapter V9 | NordVPN-9.21.2
  Index = 13
  GUID = {A8974F3C-BDB6-4CAF-912A-C8EAF9EE00C0}
  IP = 0.0.0.0/0.0.0.0 
  MAC = 00:ff:a8:97:4f:3c
  GATEWAY = 0.0.0.0/255.255.255.255 
  DHCP SERV =  
  DHCP LEASE OBTAINED = Tue Aug 16 18:17:31 2016
  DHCP LEASE EXPIRES  = Tue Aug 16 18:17:31 2016
  DNS SERV =  
Tue Aug 16 18:17:31 2016 Initialization Sequence Completed With Errors ( see http://openvpn.net/faq.html#dhcpclientserv )
Tue Aug 16 18:17:31 2016 MANAGEMENT:   >STATE:1471364251,CONNECTED,ERROR,10.30.1.4,MY_SERVER_IP

The worrisome series of lines are:

Tue Aug 16 18:17:01 2016 TEST ROUTES: 1/3 succeeded len=2 ret=0 a=0 u/d=up
Tue Aug 16 18:17:01 2016 Route: Waiting for TUN/TAP interface to come up...

In the case of the first connection, the relevant (different between both logs) part of the connection log is

(...)
Tue Aug 16 18:42:07 2016 Successful ARP Flush on interface [10] {83B07A98-A3E8-4A53-BDA5-44BA2C3ABB1B}
Tue Aug 16 18:42:12 2016 TEST ROUTES: 3/3 succeeded len=3 ret=1 a=0 u/d=up
Tue Aug 16 18:42:12 2016 MANAGEMENT: >STATE:1471365732,ADD_ROUTES,,,
Tue Aug 16 18:42:12 2016 C:\Windows\system32\route.exe ADD 10.10.10.0 MASK 255.255.255.0 10.30.1.1
Tue Aug 16 18:42:12 2016 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Tue Aug 16 18:42:12 2016 Route addition via IPAPI succeeded [adaptive]
Tue Aug 16 18:42:12 2016 C:\Windows\system32\route.exe ADD 10.10.11.0 MASK 255.255.255.0 10.30.1.1
Tue Aug 16 18:42:12 2016 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Tue Aug 16 18:42:12 2016 Route addition via IPAPI succeeded [adaptive]
Tue Aug 16 18:42:12 2016 C:\Windows\system32\route.exe ADD 10.10.12.0 MASK 255.255.255.0 10.30.1.1
Tue Aug 16 18:42:12 2016 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Tue Aug 16 18:42:12 2016 Route addition via IPAPI succeeded [adaptive]
Tue Aug 16 18:42:12 2016 Initialization Sequence Completed
Tue Aug 16 18:42:12 2016 MANAGEMENT: >STATE:1471365732,CONNECTED,SUCCESS,10.30.1.4,MY_SERVER_IP

This seems to be a known problem (for a few years) but only for connections which ultimately fail (as mentioned above, both of my clients scenarios do connect). There are some esoteric workarounds which do not work for me (they are however centered around enabling the interface - which is not a problem in my case).

It looks like the issue is in the setting of the routes coming from the server. The ones set by the client are straightforwardly applied.

  • Is this a case of the tunnel becoming the preferred route to its own endpoint? – David Schwartz Aug 16 '16 at 18:24
  • @DavidSchwartz: could you please expand on that a bit? I am not sure I understand what you mean. The routing table (after the connection is up) is normal, connectivity is fine and directed though the expected routes (in both cases) – WoJ Aug 17 '16 at 9:23
  • Do you understand why a tunnel can't work if it's the preferred route to its own endpoint? And are you sure none of the routes could possibly cause that situation? – David Schwartz Aug 17 '16 at 9:26
  • Yes, I understand routing. The point is that the tunnel does work (in both cases). In the second case (where the client accepts routes from the server) the interface is taking an unexpected time to come up (and does come up, eventually). This doe snot happen in the first case, also on the same client (when starting the connection with one, then the other configuration) – WoJ Aug 17 '16 at 9:30
  • Why would it add route via a non-existant 10.20.1.0/24 network here: C:\Windows\system32\route.exe ADD 10.10.10.0 MASK 255.255.255.0 10.20.1.254? There is something wrong with your config... – Anubioz Aug 17 '16 at 9:32
2

When diagnosing problems, I recommend to start with searching logs for lines around those that contain error/fail/denied/warning, since they usually are the most helpful. You log gives this lines:

Tue Aug 16 18:17:31 2016 C:\Windows\system32\route.exe ADD 10.10.10.0 MASK 255.255.255.0 10.20.1.254
Tue Aug 16 18:17:31 2016 Warning: route gateway is not reachable on any active network adapters: 10.20.1.254
Tue Aug 16 18:17:31 2016 Route addition via IPAPI failed [adaptive]
Tue Aug 16 18:17:31 2016 Route addition fallback to route.exe
Tue Aug 16 18:17:31 2016 env_block: add PATH=C:\Windows\System32;C:\Windows;C:\Windows\System32\Wbem
Tue Aug 16 18:17:31 2016 C:\Windows\system32\route.exe ADD 10.10.12.0 MASK 255.255.255.0 10.20.1.254
Tue Aug 16 18:17:31 2016 Warning: route gateway is not reachable on any active network adapters: 10.20.1.254
Tue Aug 16 18:17:31 2016 Route addition via IPAPI failed [adaptive]
Tue Aug 16 18:17:31 2016 Route addition fallback to route.exe
Tue Aug 16 18:17:31 2016 env_block: add PATH=C:\Windows\System32;C:\Windows;C:\Windows\System32\Wbem

Which means that your config file contains invalid directive to create a route to 10.10.10.0/24 with a non-existent 10.20.1.254 adapter, which might be a leftover from an older configuration...

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.