openvpn-devel Mailing List for OpenVPN

Johan Ymerson wrote: > Heiko Hund <hh...@as...> wrote on 2010-04-07 15:26:05: > >>> Then I don't think we see the same problem. We have been using 2.0.9 on >>> ~100 machines for a couple of years now without these problems. We >>> upgraded 3 of them to 2.1.1, and they all instantly got this problem. We >>> downgraded them to 2.0.9, and all problems gone. Then started switching >>> between 2.0.9 and 2.1_rcX to determine when this problem started, but all >>> 2.1_rcX seems to suffer from it, but 2.0.9 does _not_! So something must >>> have changed between 2.0.9 and 2.1 that at least makes this a lot worse. >>> >> Strange, we tested with 2.1_rc22 and the driver from 2.0.9 and ran into the >> problem within ten attempts. I can't image that the problem is related to >> userspace openvpn. Do you have the problem every time you connect and do you >> see the DNS servers in the output of `ipconfig /all`? >> > > I have not tested with 2.1.1 and tap driver from 2.0.9. Vanilla 2.0.9 does not have this problem (at least not in the thousands of connect attempts I have made by now). Vanilla 2.1.1 (and all rc versions I have found) does have the problem. It shows up in 1-2 attempts. > > `ipconfig /all` shows all the correct values. > And, this is funny, nslookup always work. > > what exactly do you mean with 'nslookup always works' ? > I bet this actually is a change in the behavior of the userspace part, not the driver. Something userspace did after configuring the interface, but it doesn't do anymore. Something that made Windows re-examine the DNS order. > this could be a timing issue, which could be caused by changes to the userspace openvpn part; did you try playing with the route-delay tap-sleep dhcp-renew flags ? did that have any affect? cheers, JJK 

Heiko Hund <hh...@as...> wrote on 2010-04-07 15:26:05: > > Then I don't think we see the same problem. We have been using 2.0.9 on > > ~100 machines for a couple of years now without these problems. We > > upgraded 3 of them to 2.1.1, and they all instantly got this problem. We > > downgraded them to 2.0.9, and all problems gone. Then started switching > > between 2.0.9 and 2.1_rcX to determine when this problem started, but all > > 2.1_rcX seems to suffer from it, but 2.0.9 does _not_! So something must > > have changed between 2.0.9 and 2.1 that at least makes this a lot worse. > > Strange, we tested with 2.1_rc22 and the driver from 2.0.9 and ran into the > problem within ten attempts. I can't image that the problem is related to > userspace openvpn. Do you have the problem every time you connect and do you > see the DNS servers in the output of `ipconfig /all`? I have not tested with 2.1.1 and tap driver from 2.0.9. Vanilla 2.0.9 does not have this problem (at least not in the thousands of connect attempts I have made by now). Vanilla 2.1.1 (and all rc versions I have found) does have the problem. It shows up in 1-2 attempts. `ipconfig /all` shows all the correct values. And, this is funny, nslookup always work. I bet this actually is a change in the behavior of the userspace part, not the driver. Something userspace did after configuring the interface, but it doesn't do anymore. Something that made Windows re-examine the DNS order. /Johan 

On Wednesday 07 April 2010 14:04:18 Johan Ymerson wrote: > "Heiko Hund" <hh...@as...> wrote on 2010-04-07 09:59:08: > > We also tried 2.0.9 but were able to reproduce the bug with it as well, > > so it has nothing to do with the openvpn driver version involved. I came > > to the conclusion that it's rather some kind of race condition in the > > Windows XP DNS resolver. At least I haven't seen this problem on Vista > > or 7 personally. > > Then I don't think we see the same problem. We have been using 2.0.9 on > ~100 machines for a couple of years now without these problems. We > upgraded 3 of them to 2.1.1, and they all instantly got this problem. We > downgraded them to 2.0.9, and all problems gone. Then started switching > between 2.0.9 and 2.1_rcX to determine when this problem started, but all > 2.1_rcX seems to suffer from it, but 2.0.9 does _not_! So something must > have changed between 2.0.9 and 2.1 that at least makes this a lot worse. Strange, we tested with 2.1_rc22 and the driver from 2.0.9 and ran into the problem within ten attempts. I can't image that the problem is related to userspace openvpn. Do you have the problem every time you connect and do you see the DNS servers in the output of `ipconfig /all`? Heiko -- Heiko Hund | Software Engineer | Phone +49-721-25516-237 | Fax -200 Astaro AG | An der RaumFabrik 33a | 76227 Karlsruhe | Germany Executive Board: Markus Hennig, Jan Hichert, Günter Junk, Dr. Frank Nellissen Chairman of the Supervisory Board: Stanley J. Krasnow Headquarter Location: Karlsruhe Commercial Register: Mannheim HRB 108997 

On Wednesday 07 April 2010 13:52:22 Jan Just Keijser wrote: > > We've contacted Microsoft tech support about this issue. If anything > > like a > > fix comes out of that I'll post an update here. If not we'll have to > > consider > > a workaround of some kind, but let's wait with that discussion until > > we're > > sure it's not fixable the right way. > > isn't > ipconfig /flushdns No, that doesn't do it. > or > net stop dnscache > net start dnscache That works as well as `ipconfig /renew`. Even `ipconfig /registerdns` helps because it does an implicit /renew. > enough? This might be related to > http://support.microsoft.com/kb/311218 Sadly it's not. Seems to have effect on MS RAS protocols only. PPTP and L2TP get their DNS settings via PPP IPCP, so it's kind of clear that this fix does not apply to the ones from openvpn via DHCP. > I've recommended to people on the -users list to use an 'up' script with > net stop dnscache > net start dnscache > this has worked in 99% of the cases. True, but it's not the solution I'm looking for, but a rather high level workaround. Heiko -- Heiko Hund | Software Engineer | Phone +49-721-25516-237 | Fax -200 Astaro AG | An der RaumFabrik 33a | 76227 Karlsruhe | Germany Executive Board: Markus Hennig, Jan Hichert, Günter Junk, Dr. Frank Nellissen Chairman of the Supervisory Board: Stanley J. Krasnow Headquarter Location: Karlsruhe Commercial Register: Mannheim HRB 108997 

 Jan Just Keijser <ja...@ni...> wrote on 2010-04-07 13:52:22: > isn't > ipconfig /flushdns No, doesn't help in this case. > or > net stop dnscache > net start dnscache I hadn't tested this before, but yes, it does seem to help (only done limited testing so far). > enough? This might be related to > http://support.microsoft.com/kb/311218 Related maybe, but at least that work around does not work in my case. > > I've recommended to people on the -users list to use an 'up' script with > net stop dnscache > net start dnscache > this has worked in 99% of the cases. For me, it doesn't work in the 'up' script, I must put it in the 'route-up' script. Maybe that is the last 1% :-) /Johan 

 "Heiko Hund" <hh...@as...> wrote on 2010-04-07 09:59:08: > > Hi, > On Tuesday 06 April 2010 22:36:31 Johan Ymerson wrote: > > I have tested on 3 PC's with Windows XP, all 3 show the same problem, at > > almost 100% of my connection attempts. OpenVPN 2.0.9 does not have this > > issue (ie. reverting back to 2.0.9 on the same machines with the same > > config never show the problem). > We also tried 2.0.9 but were able to reproduce the bug with it as well, so it > has nothing to do with the openvpn driver version involved. I came to the > conclusion that it's rather some kind of race condition in the Windows XP DNS > resolver. At least I haven't seen this problem on Vista or 7 personally. Then I don't think we see the same problem. We have been using 2.0.9 on ~100 machines for a couple of years now without these problems. We upgraded 3 of them to 2.1.1, and they all instantly got this problem. We downgraded them to 2.0.9, and all problems gone. Then started switching between 2.0.9 and 2.1_rcX to determine when this problem started, but all 2.1_rcX seems to suffer from it, but 2.0.9 does _not_! So something must have changed between 2.0.9 and 2.1 that at least makes this a lot worse. /Johan 

Heiko Hund wrote: > > Hi, > > On Tuesday 06 April 2010 22:36:31 Johan Ymerson wrote: > > I have tested on 3 PC's with Windows XP, all 3 show the same > problem, at > > almost 100% of my connection attempts. OpenVPN 2.0.9 does not have this > > issue (ie. reverting back to 2.0.9 on the same machines with the same > > config never show the problem). > > We also tried 2.0.9 but were able to reproduce the bug with it as > well, so it > has nothing to do with the openvpn driver version involved. I came to the > conclusion that it's rather some kind of race condition in the Windows > XP DNS > resolver. At least I haven't seen this problem on Vista or 7 personally. > > > Is this problem known, and is someone working on it? > > I can of course help debugging this, but I don't have the development > > environment needed to compile the Windows binaries. > > Not much to debug anyway. The DNS servers get passed correctly via > DHCP and > Windows actually takes notice of them as they show up in `ipconfig /all`. > Problem is that XP resolver somehow forgets to reprioritize the DNS > servers > list after an DHCP update sometimes and sticks with the old preferred > name > server until the scheduled reprioritization. At least that's my personal > conclusion. And it would explain why a /renew fixes it. > > We've contacted Microsoft tech support about this issue. If anything > like a > fix comes out of that I'll post an update here. If not we'll have to > consider > a workaround of some kind, but let's wait with that discussion until > we're > sure it's not fixable the right way. > isn't ipconfig /flushdns or net stop dnscache net start dnscache enough? This might be related to http://support.microsoft.com/kb/311218 I've recommended to people on the -users list to use an 'up' script with net stop dnscache net start dnscache this has worked in 99% of the cases. cheers, JJK 

Hi, The topics for tomorrow's community meeting (18:00 UTC, #openvpn-devel at irc.freenode.net) are listed on this page: <http://www.secure-computing.net/wiki/index.php/OpenVPN/IRC_meetings/Topics-2010-04-08> If there are topics that are missing, please let me know / add them to the page yourself. -- Samuli Seppänen Community Manager OpenVPN Technologies, Inc irc freenode net: mattock 

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN"> <HTML> <HEAD> <META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1"> <META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7654.12"> <TITLE>Re: [Openvpn-devel] DNS problems with openvpn 2.1 on Windows</TITLE> </HEAD> <BODY> <!-- Converted from text/plain format --> <P><FONT SIZE=2>Hi,</FONT> </P> <P><FONT SIZE=2>On Tuesday 06 April 2010 22:36:31 Johan Ymerson wrote:</FONT> <BR><FONT SIZE=2>&gt; I have tested on 3 PC's with Windows XP, all 3 show the same problem, at</FONT> <BR><FONT SIZE=2>&gt; almost 100% of my connection attempts. OpenVPN 2.0.9 does not have this</FONT> <BR><FONT SIZE=2>&gt; issue (ie. reverting back to 2.0.9 on the same machines with the same</FONT> <BR><FONT SIZE=2>&gt; config never show the problem).</FONT> </P> <P><FONT SIZE=2>We also tried 2.0.9 but were able to reproduce the bug with it as well, so it </FONT> <BR><FONT SIZE=2>has nothing to do with the openvpn driver version involved. I came to the </FONT> <BR><FONT SIZE=2>conclusion that it's rather some kind of race condition in the Windows XP DNS </FONT> <BR><FONT SIZE=2>resolver. At least I haven't seen this problem on Vista or 7 personally.</FONT> <BR><FONT SIZE=2>&nbsp;</FONT> <BR><FONT SIZE=2>&gt; Is this problem known, and is someone working on it?</FONT> <BR><FONT SIZE=2>&gt; I can of course help debugging this, but I don't have the development</FONT> <BR><FONT SIZE=2>&gt; environment needed to compile the Windows binaries.</FONT> </P> <P><FONT SIZE=2>Not much to debug anyway. The DNS servers get passed correctly via DHCP and </FONT> <BR><FONT SIZE=2>Windows actually takes notice of them as they show up in `ipconfig /all`. </FONT> <BR><FONT SIZE=2>Problem is that XP resolver somehow forgets to reprioritize the DNS servers </FONT> <BR><FONT SIZE=2>list after an DHCP update sometimes and sticks with the old preferred name </FONT> <BR><FONT SIZE=2>server until the scheduled reprioritization. At least that's my personal </FONT> <BR><FONT SIZE=2>conclusion. And it would explain why a /renew fixes it.</FONT> </P> <P><FONT SIZE=2>We've contacted Microsoft tech support about this issue. If anything like a </FONT> <BR><FONT SIZE=2>fix comes out of that I'll post an update here. If not we'll have to consider </FONT> <BR><FONT SIZE=2>a workaround of some kind, but let's wait with that discussion until we're </FONT> <BR><FONT SIZE=2>sure it's not fixable the right way.</FONT> </P> <P><FONT SIZE=2>Regards</FONT> <BR><FONT SIZE=2>Heiko</FONT> <BR><FONT SIZE=2>-- </FONT> <BR><FONT SIZE=2>Heiko Hund | Software Engineer | Phone +49-721-25516-237 | Fax -200</FONT> <BR><FONT SIZE=2>Astaro AG | An der RaumFabrik 33a | 76227 Karlsruhe | Germany</FONT> </P> <P><FONT SIZE=2>Executive Board: Markus Hennig, Jan Hichert, Günter Junk, Dr. Frank Nellissen</FONT> <BR><FONT SIZE=2>Chairman of the Supervisory Board: Stanley J. Krasnow</FONT> <BR><FONT SIZE=2>Headquarter Location: Karlsruhe</FONT> <BR><FONT SIZE=2>Commercial Register: Mannheim HRB 108997</FONT> </P> </BODY> </HTML> 

On 04/06/2010 09:39 PM, Jan Just Keijser wrote: > op...@rk... wrote: > >> Hi, >> >> >> >> I have been using two different config files to connect to my OpenVPN >> server - as I am sometimes behind a proxy server, and sometimes not. >> So to fix this I tried using auto-proxy ... but it didn't work (in the >> proxy case) ... :-(. >> >> >> >> I am running the client on Windows - so it should work, no? >> >> >> >> > note to the developers: all error codes when using the > InternetQueryOption API are lost ... also read > http://support.microsoft.com/kb/226473 > Openvpn 2.1 uses the "old" IE4 API . > Another note to developers. Can they work on enabling auto-proxy to work in configs that contain both UDP and TCP-based "<connection>" profiles? :-) In a similar vein, the following ticket is in the bug tracking system - there seems to be a general problem with mixing TCP and UDP options (eg mssfix, nobind, fragment) http://sourceforge.net/tracker/index.php?func=detail&aid=2945147&group_id=48978&atid=454720 -- Cheers Jason Haar Information Security Manager, Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417 PGP Fingerprint: 7A2E 0407 C9A6 CAF6 2B9F 8422 C063 5EBB FE1D 66D1