Windows client does not connect on Windows 11 24H2 ARM #261

bepok commented 2025年04月09日 11:31:11 +02:00

Hello,

I have 2 users using Windows 11 on ARM (different hardware). About 3 months ago I tested the application on my system and it worked. A few days ago a colleague came to me reporting that the client does not connect to the server on his machine. When I tried (usually I run Linux on this machine) it doesn't work anymore. I had Windows updates installed since the time the connection worked. I tried updating the client to the last released version but that did not resolve the issue.

The symptom is that the client authorization works (opens VPN server in browser, login and authorize the client is OK), but then when clicking the connect slider in the client it tries connecting and then fails after a second or two.

I have a bunch of other users using Windows on Intel/AMD who have no issues. Also no issues on other systems (Mac and Linux).

Using OpenVPN connect or Wireguard client (with manual configuration) on the misbehaving system works, so it doesn't seem to be a server issue.

Server is up to date v3 on Debian 12. All I get in the logs there is this when I try to connect with the misbehaving client:

Apr 09 11:02:37 openvpn1 openvpn[464]: MANAGEMENT: Client connected from /run/openvpn-server/XXX-admins-1.sock
Apr 09 11:02:37 openvpn1 openvpn[464]: MANAGEMENT: CMD 'kill CaIW1stqA5aYSHIQ/ZSi7fyXoLeQ0bMyEp4GJs4I5BE='
Apr 09 11:02:37 openvpn1 openvpn[471]: MANAGEMENT: Client connected from /run/openvpn-server/XXX-users-1.sock
Apr 09 11:02:37 openvpn1 openvpn[471]: MANAGEMENT: CMD 'kill CaIW1stqA5aYSHIQ/ZSi7fyXoLeQ0bMyEp4GJs4I5BE='
Apr 09 11:02:37 openvpn1 openvpn[471]: MANAGEMENT: Client disconnected
Apr 09 11:02:37 openvpn1 openvpn[463]: MANAGEMENT: Client connected from /run/openvpn-server/XXX-admins-0.sock
Apr 09 11:02:37 openvpn1 openvpn[463]: MANAGEMENT: CMD 'kill CaIW1stqA5aYSHIQ/ZSi7fyXoLeQ0bMyEp4GJs4I5BE='
Apr 09 11:02:37 openvpn1 openvpn[463]: MANAGEMENT: Client disconnected
Apr 09 11:02:37 openvpn1 openvpn[465]: MANAGEMENT: Client connected from /run/openvpn-server/XXX-users-0.sock
Apr 09 11:02:37 openvpn1 openvpn[465]: MANAGEMENT: CMD 'kill CaIW1stqA5aYSHIQ/ZSi7fyXoLeQ0bMyEp4GJs4I5BE='
Apr 09 11:02:37 openvpn1 openvpn[465]: MANAGEMENT: Client disconnected
Apr 09 11:02:37 openvpn1 openvpn[464]: MANAGEMENT: Client disconnected

I managed to get the client logs by editing the config file directly, but I don't see anything useful there. I attached a sanitized version (replaced server hostname, my username and computer name).

I didn't know how to force the usage of wireguard for testing in the client, it seems it only tries openvpn. Also it would probably be useful to get openvpn client logs, but I don't know how to get those.

Hello, I have 2 users using Windows 11 on ARM (different hardware). About 3 months ago I tested the application on my system and it worked. A few days ago a colleague came to me reporting that the client does not connect to the server on his machine. When I tried (usually I run Linux on this machine) it doesn't work anymore. I had Windows updates installed since the time the connection worked. I tried updating the client to the last released version but that did not resolve the issue. The symptom is that the client authorization works (opens VPN server in browser, login and authorize the client is OK), but then when clicking the connect slider in the client it tries connecting and then fails after a second or two. I have a bunch of other users using Windows on Intel/AMD who have no issues. Also no issues on other systems (Mac and Linux). Using OpenVPN connect or Wireguard client (with manual configuration) on the misbehaving system works, so it doesn't seem to be a server issue. Server is up to date v3 on Debian 12. All I get in the logs there is this when I try to connect with the misbehaving client: ``` Apr 09 11:02:37 openvpn1 openvpn[464]: MANAGEMENT: Client connected from /run/openvpn-server/XXX-admins-1.sock Apr 09 11:02:37 openvpn1 openvpn[464]: MANAGEMENT: CMD 'kill CaIW1stqA5aYSHIQ/ZSi7fyXoLeQ0bMyEp4GJs4I5BE=' Apr 09 11:02:37 openvpn1 openvpn[471]: MANAGEMENT: Client connected from /run/openvpn-server/XXX-users-1.sock Apr 09 11:02:37 openvpn1 openvpn[471]: MANAGEMENT: CMD 'kill CaIW1stqA5aYSHIQ/ZSi7fyXoLeQ0bMyEp4GJs4I5BE=' Apr 09 11:02:37 openvpn1 openvpn[471]: MANAGEMENT: Client disconnected Apr 09 11:02:37 openvpn1 openvpn[463]: MANAGEMENT: Client connected from /run/openvpn-server/XXX-admins-0.sock Apr 09 11:02:37 openvpn1 openvpn[463]: MANAGEMENT: CMD 'kill CaIW1stqA5aYSHIQ/ZSi7fyXoLeQ0bMyEp4GJs4I5BE=' Apr 09 11:02:37 openvpn1 openvpn[463]: MANAGEMENT: Client disconnected Apr 09 11:02:37 openvpn1 openvpn[465]: MANAGEMENT: Client connected from /run/openvpn-server/XXX-users-0.sock Apr 09 11:02:37 openvpn1 openvpn[465]: MANAGEMENT: CMD 'kill CaIW1stqA5aYSHIQ/ZSi7fyXoLeQ0bMyEp4GJs4I5BE=' Apr 09 11:02:37 openvpn1 openvpn[465]: MANAGEMENT: Client disconnected Apr 09 11:02:37 openvpn1 openvpn[464]: MANAGEMENT: Client disconnected ``` I managed to get the client logs by editing the config file directly, but I don't see anything useful there. I attached a sanitized version (replaced server hostname, my username and computer name). I didn't know how to force the usage of wireguard for testing in the client, it seems it only tries openvpn. Also it would probably be useful to get openvpn client logs, but I don't know how to get those.

rozmansi commented 2025年04月11日 08:13:02 +02:00

Thank you for reporting this. Will investigate...

Thank you for reporting this. Will investigate...

rozmansi commented 2025年04月15日 14:09:59 +02:00

I did research on this issue. It happens on every ARM64 Windows. The call path is: eduVPN Client >> openvpnserv.exe >> openvpn.exe >> OpenSSL initialization >> Access Violation 0xc0000005.

I've upgraded OpenSSL from 3.4.1 to 3.5, but the problem remains.

There is already a GitHub issue about it here: https://github.com/openssl/openssl/issues/26239.

Disabling optimizations for OpenSSL library did help to get it past initialization, but the crypto is still not working, OpenVPN can't do the key exchange with the server.

I'm afraid, best we can do is wait for the OpenSSL team to fix this. eduVPN Client for Windows ARM64 remains broken for OpenVPN connections. Maybe you can offer WireGuard tunnels on your VPN server too?

Downgrading OpenSSL to the last version that worked is security-wise not acceptable.

Should OpenSSL team not fix this in reasonable time, I may attempt to compile OpenVPN to use MbedTLS on ARM64? Thou would like to keep the same crypto library on all platforms for convenience.

I did research on this issue. It happens on every ARM64 Windows. The call path is: eduVPN Client >> openvpnserv.exe >> openvpn.exe >> OpenSSL initialization >> Access Violation 0xc0000005. I've upgraded OpenSSL from 3.4.1 to 3.5, but the problem remains. There is already a GitHub issue about it here: https://github.com/openssl/openssl/issues/26239. Disabling optimizations for OpenSSL library did help to get it past initialization, but the crypto is still not working, OpenVPN can't do the key exchange with the server. I'm afraid, best we can do is wait for the OpenSSL team to fix this. eduVPN Client for Windows ARM64 remains broken for OpenVPN connections. Maybe you can offer WireGuard tunnels on your VPN server too? Downgrading OpenSSL to the last version that worked is security-wise not acceptable. Should OpenSSL team not fix this in reasonable time, I may attempt to compile OpenVPN to use MbedTLS on ARM64? Thou would like to keep the same crypto library on all platforms for convenience.

rozmansi commented 2025年04月22日 18:38:55 +02:00

I have compiled OpenSSL and OpenVPN using Visual Studio 2019 which is not affected by this bug. On my test ARM64 device eduVPN client works now.

You can download the release here: https://codeberg.org/eduVPN/windows/releases/tag/4.3.2

Thank you for your patience.

I have compiled OpenSSL and OpenVPN using Visual Studio 2019 which is not affected by this bug. On my test ARM64 device eduVPN client works now. You can download the release here: https://codeberg.org/eduVPN/windows/releases/tag/4.3.2 Thank you for your patience.

bepok commented 2025年04月23日 13:01:06 +02:00

I can confirm it works, thank you!

I can confirm it works, thank you!

rozmansi commented 2025年05月16日 18:09:40 +02:00

The latest release 4.4-pre was compiled using Visual Studio 2022 17.14.0 which was supposed to fix this issue, but the OpenVPN still does not work on ARM64 (while on x64 and x86 it does).

The latest release [4.4-pre](https://codeberg.org/eduVPN/windows/releases/tag/4.3.99.0) was compiled using Visual Studio 2022 17.14.0 which was supposed to fix this issue, but the OpenVPN still does not work on ARM64 (while on x64 and x86 it does).

rozmansi commented 2026年02月11日 14:25:27 +01:00

Appears that some Visual Studio 2022 updates later, the OpenSSL on ARM64 issue is finally resolved. I've built a fresh client release and OpenVPN+OpenSSL on ARM64 works normally now.

Appears that some Visual Studio 2022 updates later, the OpenSSL on ARM64 issue is finally resolved. I've built a fresh client release and OpenVPN+OpenSSL on ARM64 works normally now.