Hello. Such a problem: There is an openvpn server (linux, IP 111.111.111.111) and many clients (win xp) connecting to it. On most client stations, everything works fine, but some do not add routes when the openvpn service starts, and Addition was successful. When you try to restart the server with your hands, periodically routes are added.

Customer log:

Mon Nov 26 08:00:57 2012 us=62500 PUSH: Received control message: 'PUSH_REPLY,route 172.17.2.200 255.255.255.255,route 172.17.1.100 255.255.255.255,dhcp-option DNS 172.17.1.100,route 10.1.0.1,topology net30,ping 40,ping-restart 120,ifconfig 10.1.0.138 10.1.0.137'Mon Nov 26 08:00:57 2012 us=62500 OPTIONS IMPORT: timers and/or timeouts modifiedMon Nov 26 08:01:11 2012 us=500000 TEST ROUTES: 3/3 succeeded len=3 ret=1 a=0 u/d=upMon Nov 26 08:01:11 2012 us=500000 C:\WINDOWS\system32\route.exe ADD 172.17.2.200 MASK 255.255.255.255 10.1.0.137Mon Nov 26 08:01:11 2012 us=500000 Route addition via IPAPI succeeded [adaptive]Mon Nov 26 08:01:11 2012 us=500000 C:\WINDOWS\system32\route.exe ADD 172.17.1.100 MASK 255.255.255.255 10.1.0.137Mon Nov 26 08:01:11 2012 us=500000 Route addition via IPAPI succeeded [adaptive]Mon Nov 26 08:01:11 2012 us=500000 C:\WINDOWS\system32\route.exe ADD 10.1.0.1 MASK 255.255.255.255 10.1.0.137Mon Nov 26 08:01:11 2012 us=500000 Route addition via IPAPI succeeded [adaptive]SYSTEM ROUTING TABLE0.0.0.0 0.0.0.0 192.168.1.172 p=0 i=2 t=4 pr=3 a=34 h=0 m=10/-1/-1/-1/-110.1.0.1 255.255.255.255 10.1.0.137 p=0 i=3 t=4 pr=3 a=0 h=0 m=1/-1/-1/-1/-110.1.0.136 255.255.255.252 10.1.0.138 p=0 i=3 t=3 pr=2 a=0 h=0 m=30/-1/-1/-1/-110.1.0.138 255.255.255.255 127.0.0.1 p=0 i=1 t=3 pr=2 a=0 h=0 m=30/-1/-1/-1/-110.255.255.255 255.255.255.255 10.1.0.138 p=0 i=3 t=3 pr=2 a=0 h=0 m=30/-1/-1/-1/-1127.0.0.0 255.0.0.0 127.0.0.1 p=0 i=1 t=3 pr=2 a=41 h=0 m=1/-1/-1/-1/-1172.17.1.100 255.255.255.255 10.1.0.137 p=0 i=3 t=4 pr=3 a=0 h=0 m=1/-1/-1/-1/-1172.17.2.200 255.255.255.255 10.1.0.137 p=0 i=3 t=4 pr=3 a=0 h=0 m=1/-1/-1/-1/-1192.168.1.0 255.255.255.0 192.168.1.20 p=0 i=2 t=3 pr=2 a=34 h=0 m=10/-1/-1/-1/-1192.168.1.20 255.255.255.255 127.0.0.1 p=0 i=1 t=3 pr=2 a=34 h=0 m=10/-1/-1/-1/-1192.168.1.255 255.255.255.255 192.168.1.20 p=0 i=2 t=3 pr=2 a=34 h=0 m=10/-1/-1/-1/-1224.0.0.0 240.0.0.0 10.1.0.138 p=0 i=3 t=3 pr=2 a=0 h=0 m=30/-1/-1/-1/-1224.0.0.0 240.0.0.0 192.168.1.20 p=0 i=2 t=3 pr=2 a=34 h=0 m=10/-1/-1/-1/-1255.255.255.255 255.255.255.255 10.1.0.138 p=0 i=3 t=3 pr=2 a=41 h=0 m=1/-1/-1/-1/-1255.255.255.255 255.255.255.255 192.168.1.20 p=0 i=2 t=3 pr=2 a=41 h=0 m=1/-1/-1/-1/-1SYSTEM ADAPTER LIST

Server config:

 daemondev tunproto tcpport 1194#server ip & poolserver 10.1.0.0 255.255.0.0push "route 172.17.2.200 255.255.255.255"push "route 172.17.1.100 255.255.255.255"tls-auth ta.key 0#certificatesca /etc/openvpn/easy_rsa/keys/ca.crtcert /etc/openvpn/easy_rsa/keys/MAIN_SERV.crtkey /etc/openvpn/easy_rsa/keys/MAIN_SERV.keydh /etc/openvpn/easy_rsa/keys/dh1024.pem#revoke listcrl-verify /etc/openvpn/crl/crl.pem#general settingscomp-lzokeepalive 40 120#need to downgrade privilegiesuser nobodygroup nobodypersist-keypersist-tun

Client config

 dev tunproto tcpport 1194client# vpn serverremote 111.111.111.111ns-cert-type server#certificatesca ./ca.crtcert ./win_test.crtkey ./win_test.keytls-auth ta.key 1#general settingscomp-lzo#check is server aliveping 40register-dnsreneg-sec 0#log settingsstatus vpn_status.loglog client.logverb 10

On the client after the connection is established, route print does not contain routes to 172.17.2.200 and 172.17.1.100.

Please tell me what could be the problem.

PS: All external IP addresses are fictional and coincidences with them are random.

    2 answers 2

    The following should be added to the client config

     route-method exe route-delay 2

    This is true for 7-ki

    • @sharptop, do you think this is a problem? I suspect that once the routing table in the log is printed out correctly, then something / someone periodically loses the table records on the client. Can any AD / Netware policy deal with such nasty things? - gg4me
    • I recommend reading the topic on ixbt about this forum.ixbt.com/topic.cgi?id=14:40906 - it’s pretty detailed there, which may cause such an error. I personally faced the same problem and it was a working solution. - sharptop

    There was a similar case, only reset of tcp\ip parameters helped.

    http://support.microsoft.com/kb/299357