8
6
Fork
You've already forked windows
1

A single IP (/32) route breaks the windows client when using wireguard protocol #263

Closed
opened 2025年05月06日 11:20:46 +02:00 by user234987 · 7 comments

Please redirect me to the correct place if this issue wasn't supposed to be opened here, I've searched the docs and I didn't find any mention of this.

With wireguard protocol, when using a split-tunnel configuration and pushing routes to clients, if a single IP (1.2.3.4/32) is pushed the windows client breaks and won't connect to the VPN anymore. Changing it to a /31 fixes it.

It works fine with OpenVPN protocol. The client version is 4.3.2.

On the server side, in the Profile configuration it doesn't matter if the IP address is written with or without /32 as when it's pushed to the client is always translated as a /32.

The full error is

eduWireGuard.ManagerService.ManagerServiceException: WireGuardOpenAdapter failed: Element not found. (Error 0x490)
 at eduWireGuard.ManagerService.Session.GetAdapterLUID(CancellationToken ct)
 at eduVPN.ViewModels.VPN.WireGuardSession.Run()
 at eduVPN.ViewModels.VPN.Session.Execute()
 at eduVPN.ViewModels.Pages.ConnectionPage.<>c__DisplayClass33_0.<ActivateSession>b__0()

I've attached a screenshot.

Please redirect me to the correct place if this issue wasn't supposed to be opened here, I've searched the docs and I didn't find any mention of this. With wireguard protocol, when using a split-tunnel configuration and pushing routes to clients, if a single IP (`1.2.3.4/32`) is pushed the windows client breaks and won't connect to the VPN anymore. Changing it to a `/31` fixes it. It works fine with OpenVPN protocol. The client version is 4.3.2. On the server side, in the Profile configuration it doesn't matter if the IP address is written with or without `/32` as when it's pushed to the client is always translated as a `/32`. The full error is ``` eduWireGuard.ManagerService.ManagerServiceException: WireGuardOpenAdapter failed: Element not found. (Error 0x490) at eduWireGuard.ManagerService.Session.GetAdapterLUID(CancellationToken ct) at eduVPN.ViewModels.VPN.WireGuardSession.Run() at eduVPN.ViewModels.VPN.Session.Execute() at eduVPN.ViewModels.Pages.ConnectionPage.<>c__DisplayClass33_0.<ActivateSession>b__0() ``` I've attached a screenshot.
Collaborator
Copy link

This is correct place to report this. Thank you for reporting it.

I shall look into it.

Meanwhile, can you test if the same issue happens with client v4.3, please? I've introduced a significant change in /32 handling in the WireGuard case after 4.3. Maybe you found a corner case?

This is correct place to report this. Thank you for reporting it. I shall look into it. Meanwhile, can you test if the same issue happens with client v4.3, please? I've introduced a significant change in /32 handling in the WireGuard case after 4.3. Maybe you found a corner case?

Sure. I've tried the 4.3 version of the client and it works as expected.

I've also checked with route print and I can see the route properly added to windows (see screenshot).

Sure. I've tried the [4.3 version of the client](https://codeberg.org/eduVPN/windows/releases/tag/4.3) and it works as expected. I've also checked with `route print` and I can see the route properly added to windows (see screenshot).
Collaborator
Copy link

I did locate the spot where Windows fails to return adapter LUID which triggers your issue. Unfortunately, I wasn't able to reproduce it.
Nevertheless, I've upgraded the client to tolerate this issue and made a release: https://codeberg.org/eduVPN/windows/releases/tag/4.3.99.0

Please, test it to confirm WireGuard connections work now. Pay attention to route table and do report back.

Thank you for your patience.

I did locate the spot where Windows fails to return adapter LUID which triggers your issue. Unfortunately, I wasn't able to reproduce it. Nevertheless, I've upgraded the client to tolerate this issue and made a release: https://codeberg.org/eduVPN/windows/releases/tag/4.3.99.0 Please, test it to confirm WireGuard connections work now. Pay attention to route table and do report back. Thank you for your patience.

Thanks for the feedback!

Unfortunately this version also does not work, the behaviour is different tough.

The clients get stuck connecting (see screenshot) and this is the logs output:

2025年05月16日 14:43:20.804172: [Tunnel] LetsConnect/eduWGSvcHost v4.3.99.0, Copyright © 2022-2025 The Commons Conservancy
2025年05月16日 14:43:21.233077: [TUN] [redacted.vpn.endpoint.fqdn] Starting WireGuard/0.5.3 (Windows 10.0.26100; amd64)
2025年05月16日 14:43:21.233077: [TUN] [redacted.vpn.endpoint.fqdn] Watching network interfaces
2025年05月16日 14:43:21.234745: [TUN] [redacted.vpn.endpoint.fqdn] Resolving DNS names
2025年05月16日 14:43:21.238964: [TUN] [redacted.vpn.endpoint.fqdn] Creating network adapter
2025年05月16日 14:43:21.411854: [TUN] [redacted.vpn.endpoint.fqdn] Using existing driver 0.10
2025年05月16日 14:43:21.417926: [TUN] [redacted.vpn.endpoint.fqdn] Creating adapter
2025年05月16日 14:43:21.570734: [TUN] [redacted.vpn.endpoint.fqdn] Using WireGuardNT/0.10
2025年05月16日 14:43:21.570734: [TUN] [redacted.vpn.endpoint.fqdn] Restricted routes: 10.248.46.202/32, 172.29.106.10/32, 10.146.112.64/32, 10.248.46.110/32
2025年05月16日 14:43:21.570734: [TUN] [redacted.vpn.endpoint.fqdn] Enabling firewall rules
2025年05月16日 14:43:21.536759: [TUN] [redacted.vpn.endpoint.fqdn] Interface created
2025年05月16日 14:43:21.636000: [TUN] [redacted.vpn.endpoint.fqdn] Shutting down
2025年05月16日 14:43:21.638820: [TUN] panic: runtime error: index out of range [0] with length 0
2025年05月16日 14:43:21.638820: [TUN] goroutine 36 [running]:
2025年05月16日 14:43:21.638820: [TUN] golang.zx2c4.com/wireguard/windows/tunnel/firewall.blockRoutes({0xc0000ec200, 0x4, 0xc?}, 0x28cf41a6b70, 0xc00009efc0, 0x0)
2025年05月16日 14:43:21.638820: [TUN] golang.zx2c4.com/wireguard/windows/tunnel/firewall/rules.go:981 +0xb12
2025年05月16日 14:43:21.638820: [TUN] golang.zx2c4.com/wireguard/windows/tunnel/firewall.EnableFirewall.func1(0x28cf41a6b70)
2025年05月16日 14:43:21.638820: [TUN] golang.zx2c4.com/wireguard/windows/tunnel/firewall/blocker.go:166 +0x198
2025年05月16日 14:43:21.638820: [TUN] golang.zx2c4.com/wireguard/windows/tunnel/firewall.runTransaction(0x28cf41a6b70, 0xc000027a30)
2025年05月16日 14:43:21.638820: [TUN] golang.zx2c4.com/wireguard/windows/tunnel/firewall/helpers.go:24 +0x3d
2025年05月16日 14:43:21.638820: [TUN] golang.zx2c4.com/wireguard/windows/tunnel/firewall.EnableFirewall(0x35008000000000, {0xc0000ec200, 0x4, 0x4}, {0xc00001c060, 0x2, 0x2})
2025年05月16日 14:43:21.638820: [TUN] golang.zx2c4.com/wireguard/windows/tunnel/firewall/blocker.go:175 +0xfe
2025年05月16日 14:43:21.638820: [TUN] golang.zx2c4.com/wireguard/windows/tunnel.enableFirewall(0xc0000000e0, 0x35008000000000)
2025年05月16日 14:43:21.638820: [TUN] golang.zx2c4.com/wireguard/windows/tunnel/addressconfig.go:197 +0x28e
2025年05月16日 14:43:21.638820: [TUN] golang.zx2c4.com/wireguard/windows/tunnel.(*tunnelService).Execute(0xc000094490, {0x0?, 0x0?, 0x0?}, 0xc000116000, 0xc000116070)
2025年05月16日 14:43:21.638820: [TUN] golang.zx2c4.com/wireguard/windows/tunnel/service.go:200 +0xbfe
2025年05月16日 14:43:21.638820: [TUN] golang.org/x/sys/windows/svc.serviceMain.func2()
2025年05月16日 14:43:21.638820: [TUN] golang.org/x/sys@v0.31.0/windows/svc/service.go:234 +0x3f
2025年05月16日 14:43:21.638820: [TUN] created by golang.org/x/sys/windows/svc.serviceMain in goroutine 18
2025年05月16日 14:43:21.638820: [TUN] golang.org/x/sys@v0.31.0/windows/svc/service.go:233 +0x273

I'm using Windows 11, ver 24H2

Thanks for the feedback! Unfortunately this version also does not work, the behaviour is different tough. The clients get stuck connecting (see screenshot) and this is the logs output: ``` 2025年05月16日 14:43:20.804172: [Tunnel] LetsConnect/eduWGSvcHost v4.3.99.0, Copyright © 2022-2025 The Commons Conservancy 2025年05月16日 14:43:21.233077: [TUN] [redacted.vpn.endpoint.fqdn] Starting WireGuard/0.5.3 (Windows 10.0.26100; amd64) 2025年05月16日 14:43:21.233077: [TUN] [redacted.vpn.endpoint.fqdn] Watching network interfaces 2025年05月16日 14:43:21.234745: [TUN] [redacted.vpn.endpoint.fqdn] Resolving DNS names 2025年05月16日 14:43:21.238964: [TUN] [redacted.vpn.endpoint.fqdn] Creating network adapter 2025年05月16日 14:43:21.411854: [TUN] [redacted.vpn.endpoint.fqdn] Using existing driver 0.10 2025年05月16日 14:43:21.417926: [TUN] [redacted.vpn.endpoint.fqdn] Creating adapter 2025年05月16日 14:43:21.570734: [TUN] [redacted.vpn.endpoint.fqdn] Using WireGuardNT/0.10 2025年05月16日 14:43:21.570734: [TUN] [redacted.vpn.endpoint.fqdn] Restricted routes: 10.248.46.202/32, 172.29.106.10/32, 10.146.112.64/32, 10.248.46.110/32 2025年05月16日 14:43:21.570734: [TUN] [redacted.vpn.endpoint.fqdn] Enabling firewall rules 2025年05月16日 14:43:21.536759: [TUN] [redacted.vpn.endpoint.fqdn] Interface created 2025年05月16日 14:43:21.636000: [TUN] [redacted.vpn.endpoint.fqdn] Shutting down 2025年05月16日 14:43:21.638820: [TUN] panic: runtime error: index out of range [0] with length 0 2025年05月16日 14:43:21.638820: [TUN] goroutine 36 [running]: 2025年05月16日 14:43:21.638820: [TUN] golang.zx2c4.com/wireguard/windows/tunnel/firewall.blockRoutes({0xc0000ec200, 0x4, 0xc?}, 0x28cf41a6b70, 0xc00009efc0, 0x0) 2025年05月16日 14:43:21.638820: [TUN] golang.zx2c4.com/wireguard/windows/tunnel/firewall/rules.go:981 +0xb12 2025年05月16日 14:43:21.638820: [TUN] golang.zx2c4.com/wireguard/windows/tunnel/firewall.EnableFirewall.func1(0x28cf41a6b70) 2025年05月16日 14:43:21.638820: [TUN] golang.zx2c4.com/wireguard/windows/tunnel/firewall/blocker.go:166 +0x198 2025年05月16日 14:43:21.638820: [TUN] golang.zx2c4.com/wireguard/windows/tunnel/firewall.runTransaction(0x28cf41a6b70, 0xc000027a30) 2025年05月16日 14:43:21.638820: [TUN] golang.zx2c4.com/wireguard/windows/tunnel/firewall/helpers.go:24 +0x3d 2025年05月16日 14:43:21.638820: [TUN] golang.zx2c4.com/wireguard/windows/tunnel/firewall.EnableFirewall(0x35008000000000, {0xc0000ec200, 0x4, 0x4}, {0xc00001c060, 0x2, 0x2}) 2025年05月16日 14:43:21.638820: [TUN] golang.zx2c4.com/wireguard/windows/tunnel/firewall/blocker.go:175 +0xfe 2025年05月16日 14:43:21.638820: [TUN] golang.zx2c4.com/wireguard/windows/tunnel.enableFirewall(0xc0000000e0, 0x35008000000000) 2025年05月16日 14:43:21.638820: [TUN] golang.zx2c4.com/wireguard/windows/tunnel/addressconfig.go:197 +0x28e 2025年05月16日 14:43:21.638820: [TUN] golang.zx2c4.com/wireguard/windows/tunnel.(*tunnelService).Execute(0xc000094490, {0x0?, 0x0?, 0x0?}, 0xc000116000, 0xc000116070) 2025年05月16日 14:43:21.638820: [TUN] golang.zx2c4.com/wireguard/windows/tunnel/service.go:200 +0xbfe 2025年05月16日 14:43:21.638820: [TUN] golang.org/x/sys/windows/svc.serviceMain.func2() 2025年05月16日 14:43:21.638820: [TUN] golang.org/x/sys@v0.31.0/windows/svc/service.go:234 +0x3f 2025年05月16日 14:43:21.638820: [TUN] created by golang.org/x/sys/windows/svc.serviceMain in goroutine 18 2025年05月16日 14:43:21.638820: [TUN] golang.org/x/sys@v0.31.0/windows/svc/service.go:233 +0x273 ``` I'm using Windows 11, ver 24H2
Collaborator
Copy link

I see now, thank you... This log file should help me find and fix the true issue you are having.

WireGuardOpenAdapter failed: Element not found. was just a consequence of WireGuard crashing and its adapter was closed and gone missing.

Will fix this and publish a new version.

I see now, thank you... This log file should help me find and fix the true issue you are having. `WireGuardOpenAdapter failed: Element not found. ` was just a consequence of WireGuard crashing and its adapter was closed and gone missing. Will fix this and publish a new version.
Collaborator
Copy link

I've released a new version that should fix this now: https://codeberg.org/eduVPN/windows/releases/tag/4.3.99.1

I've released a new version that should fix this now: https://codeberg.org/eduVPN/windows/releases/tag/4.3.99.1

I confirm that now it works as expected.

Thank you!

I confirm that now it works as expected. Thank you!
Sign in to join this conversation.
No Branch/Tag specified
master
study/no-token-import
ver/3.x
govVPN
ver/3.3.0.x
ver/2.x
ver/1.x
4.6
4.5.99.8
4.5.99.7
4.5.99.6
4.5.99.5
4.5.99.4
4.5.99.3
4.5.99.2
4.5.99.1
4.5.99.0
4.5
4.4.99.4
4.4.99.3
4.4.99.2
4.4.99.1
4.4.99.0
4.4
4.3.99.1
4.3.99.0
4.3.2
4.3.1
4.3
4.2.8
4.2.7
4.2.6
4.2.5
4.2.4
4.2.3
4.2.2
4.2.1
4.2
4.1.7
4.1.6
4.1.5
4.1.4
4.1.3
4.1.2
4.1.1
4.1
4.0
3.255.23
3.255.22
3.255.21
3.255.20
3.255.19
3.7
3.6.2
3.6.1
3.255.18
3.255.17
3.255.16
3.255.15
3.6
3.255.14
3.5
3.255.13
3.4.3
3.255.12
3.255.11
3.255.10
3.255.9
3.255.8
3.255.7
3.255.6
3.255.5
3.255.4
3.255.3
3.255.2
3.4.2
3.4.1
3.255.1
3.255
3.4
3.3.8
3.3.7
3.3.6
3.3.5
3.3.4
3.3.0.1
3.3.3
3.3.2
3.3.1
3.3
3.2.2
3.2.1
3.2
3.1.8
3.1.7
3.1.6
3.1.5
3.1.4
3.1.3
3.1.2
3.1.1
3.1
3.0.5
3.0.4
3.0.3
3.0.2
3.0.1
3.0
2.255.6
2.255.5
2.255.4
2.255.3
2.255.2
2.255.1
2.1.4
2.255.0
2.1.3
2.1.2
2.1.1
2.1
2.0.7
2.0.6
2.0.5
2.0.4
2.0.3
2.0.2
2.0.1
2.0
1.255.11
1.255.10
1.255.9
1.0.39
1.255.8
1.255.7
1.255.6
1.255.5
1.0.38
1.255.4
1.0.37
1.255.3
1.255.2
1.255.1
1.255.0
1.0.36
1.0.34
1.0.35
1.0.33
1.0.32
1.0.31
1.0.30
1.0.29
1.0.28
1.0.27
1.0.26
1.0.25
1.0.24
1.0.23
1.0.22
1.0.21
1.0.20
1.0.19
1.0.18
1.0.17
1.0.16
audit/2017-12
1.0.15
1.0.14
1.0.13
1.0.12
1.0.11
1.0-alpha8
1.0-alpha6
1.0-alpha5
1.0-alpha4a
1.0-alpha3
1.0-alpha2a
1.0-alpha1
1.0-alpha
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
eduVPN/windows#263
Reference in a new issue
eduVPN/windows
No description provided.
Delete branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?