Outline-client: windows v1.2 client may use system's default DNS server(s)

[ercxar]

Hello

Today my outline client app got updated to v1.2. It created a virtual adapter with preconfigured settings such as IP, Network Mask, DNS, etc.
I don't know if it's a system bug or a conflict, although with newest version I can connect to the server but none of my traffic goes through server. I also changed my DNS settings with no luck.
I had to uninstall outline v1.2 and reinstall my previous version beta v1.1.1 which solved my problem. Everything works fine now!
It won't create a virtual adapter which I think is the source of my problem.

[studentmain]

Create virtual adapter is expected, they just introduced 'full vpn'.

On my system, when I install new version, I lost all server config. System proxy setting not change ( generated by old client ), browser keep old proxy setting When I set the proxy setting to off and manually set the server. everyting goes well.

Can you check your proxy setting, and paste your route table here? (run route print in cmd to display it)

[ercxar]

Thank you for your reply.
I had system proxy settings on automatic, I also double checked it when I encountered with this issue, but no success.
I removed new version and all it's footprints including registry entries and virtual adapter and installed v1.1.1 which was the only old version that I had. Everything seems to be working again without the 'full vpn' feature.

I will try to reproduce the issue and gather the route table. I will update you here if I was successful.

[ercxar]

I reproduced the issue, here are a little more details in my route table;

When I want to open the websites which are restricted on my network (almost everything) I will get the empty response error from the browser.

Here is also the preconfigured settings in the new virtual adapter:

IP Address: 10.0.85.2

Subnet mask: 255.255.255.0

DNS1:208.67.222.222

DNS2:216.146.35.35

Here are the route tables in these versions:
v1.2.txt
v1.1.1.txt

[trevj]

@ercxar As I wrote on Reddit:

I have a few questions which will help us debug this:

• When you were trying to connect with 1.2.0, how did you verify your IP address had changed?
• If you turn off your proxy, what does this website tell you?: http://ipv6leak.com/ (click on START)
• If you can install 1.2.0 again, can you please try connecting and, when it fails, submit feedback with your handle? That will send us a bunch of useful debugging logs.

[ercxar]

Thank you @trevj , I will reply to you here from now on.
I checked my IP with websites that show you what is your IP address, which verified that I have my server's IP address.

• I'm currently on v1.2 and connected through it. I can see my IP address has changed but I can't browse any websites that are restricted on my network. I can use and browse all other services that are "NOT" restricted on my network without any issues (including those websites that show your IP address). Is it related to the DNS servers? Because I'm suspicious that they may have also blocked a few DNS servers as well!

• Whether my proxy is off (outline disconnected) or on, that website shows that my IPv6 is not leaking.

• I don't have any issues regarding connections through outline, so I'm not able to submit any feedback through it, because I can successfully connect and disconnect without any issues, my problem is with v1.2, when I'm connected, my traffic won't go through the server, hence not able to bypass restrictions on my network. But anyway, I submitted a feedback on server connection category with "v1.2 traffic won't pass through server" title.

[studentmain]

I think i found the problem, look at line1 and line2 of v1.2's ipv4 route
table.

Line1's metric is 25, line2's metric is 35. When a packet match both line,
it will choose the one with lower metric, so all traffic go through line1.
Here, line2 is set by Outline.

If so, manually set line2's metric to a lower valve can make it work.

On my system, line1 and line2's metric are both 35. Maybe we can set a
lower metric for Outline's route or set a higher metric for default route.

ercxar [e-mail] 于 2018年7月25日周三 20:55写道：

I reproduced the issue, here are a little more details in my route table;

When I want to open the websites which are restricted on my network
(almost everything) I will get the empty response error from the browser.

Here is also the preconfigured settings in the new virtual adapter:

IP Address: 10.0.85.2

Subnet mask: 255.255.255.0

DNS1:208.67.222.222

DNS2:216.146.35.35

The route table with v1.1.1:

`===========================================================================
Interface List
4...60 a4 4c * * ** ......Intel(R) 82579V Gigabit Network Connection
1...........................Software Loopback Interface 1 IPv4 Route Table Active
Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.1.1 192.168.1.58 25
127.0.0.0 255.0.0.0 On-link 127.0.0.1 331
127.0.0.1 255.255.255.255 On-link 127.0.0.1 331
127.255.255.255 255.255.255.255 On-link 127.0.0.1 331
192.168.1.0 255.255.255.0 On-link 192.168.1.58 281
192.168.1.58 255.255.255.255 On-link 192.168.1.58 281
192.168.1.255 255.255.255.255 On-link 192.168.1.58 281
224.0.0.0 240.0.0.0 On-link 127.0.0.1 331
224.0.0.0 240.0.0.0 On-link 192.168.1.58 281
255.255.255.255 255.255.255.255 On-link 127.0.0.1 331
255.255.255.255 255.255.255.255 On-link 192.168.1.58 281

Persistent Routes:
None
IPv6 Route Table Active Routes:
If Metric Network Destination Gateway
1 331 ::1/128 On-link
4 281 fe80::/64 On-link
4 281 fe80::c5cf:b846:ca95:59ea/128
On-link
1 331 ff00::/8 On-link
4 281 ff00::/8 On-link

Persistent Routes:
None`

and here is the route table with v1.2:

`===========================================================================
Interface List
4...60 a4 4c * * * ......Intel(R) 82579V Gigabit Network Connection
32...00 ff f3 * * * ......TAP-Windows Adapter V9
1...........................Software Loopback Interface 1 IPv4 Route Table Active
Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.1.1 192.168.1.58 25
0.0.0.0 128.0.0.0 10.0.85.1 10.0.85.2 35
10.0.85.0 255.255.255.0 On-link 10.0.85.2 291
10.0.85.2 255.255.255.255 On-link 10.0.85.2 291
10.0.85.255 255.255.255.255 On-link 10.0.85.2 291
127.0.0.0 255.0.0.0 On-link 127.0.0.1 331
127.0.0.1 255.255.255.255 On-link 127.0.0.1 331
127.255.255.255 255.255.255.255 On-link 127.0.0.1 331
128.0.0.0 128.0.0.0 10.0.85.1 10.0.85.2 35
162.212.152.203 255.255.255.255 192.168.1.1 192.168.1.58 25
192.168.1.0 255.255.255.0 On-link 192.168.1.58 281
192.168.1.58 255.255.255.255 On-link 192.168.1.58 281
192.168.1.255 255.255.255.255 On-link 192.168.1.58 281
224.0.0.0 240.0.0.0 On-link 127.0.0.1 331
224.0.0.0 240.0.0.0 On-link 192.168.1.58 281
224.0.0.0 240.0.0.0 On-link 10.0.85.2 291
255.255.255.255 255.255.255.255 On-link 127.0.0.1 331
255.255.255.255 255.255.255.255 On-link 192.168.1.58 281
255.255.255.255 255.255.255.255 On-link 10.0.85.2 291 Persistent Routes:
Network Address Netmask Gateway Address Metric
162.212.152.203 255.255.255.255 192.168.1.1 0
0.0.0.0 128.0.0.0 10.0.85.1 0
128.0.0.0 128.0.0.0 10.0.85.1 0 IPv6 Route Table Active Routes:
If Metric Network Destination Gateway
1 331 ::1/128 On-link
1 75 2000::/4 On-link
1 75 3000::/4 On-link
1 75 fc00::/7 On-link
4 281 fe80::/64 On-link
32 291 fe80::/64 On-link
32 291 fe80::9466:def:bb62:c28f/128
On-link
4 281 fe80::c5cf:b846:ca95:59ea/128
On-link
1 331 ff00::/8 On-link
4 281 ff00::/8 On-link
32 291 ff00::/8 On-link

Persistent Routes:
If Metric Network Destination Gateway
0 0 fc00::/7 On-link
0 0 2000::/4 On-link
0 0 3000::/4 On-link

===========================================================================`

—
You are receiving this because you commented.

Reply to this email directly, view it on GitHub
https://github.com/Jigsaw-Code/outline-client/issues/191#issuecomment-407744442,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AQVHEqGSu-d4E_7PZKTgxBWFD52L6uKcks5uKGqogaJpZM4VfmkD
.

[ercxar]

Thank you @studentmain , I had to google to learn how to use route command in cmd.

But I modified those two values using route change that you mentioned in your comment, I changed them to have the same metric (35), still can't bypass my network restrictions.

I also tried to give line2's metric a lower value, but same it didn't work either. I still have the same problem with v1.2.

EDIT: I also noticed that I'm not able to ping anything while connected using v1.2.

[studentmain]

The OpenVPN Windows TAP driver (which Outline using) doesn't support ICMP. So ping shouldn't work.

Can you run Find-NetRoute -RemoteIPAddress "$SOME_IP_ADDR" in powershell? It will display which route is chosen for specific IP. If route configured well, output interface should be "outline-tap" or something similar.

[trevj]

@ercxar Thanks for sticking with this - we would love to help you resolve this, reports like this are invaluable to us.

@studentmain Thanks for the sample commands! I agree it's confusing that route reports a lower metric for the old default gateway - AIUI, each network interface has its own priority which route also includes in route print. We had to do a lot of manual testing to figure that out... Your command helps remove doubt :-)

So, with those answers I'm satisfied that the computer is connecting to the VPN - I suspect the problem is with DNS, as you say. Could it be that DNS requests are not being routed through the proxy? I think that would explain what we're seeing. I'm going to perform some tests here on my own system and post the results here.

[trevj]

@ercxar I believe your system may still be using, in some cases at least, your network's regular DNS server rather than the DNS servers we configure for the TAP device.

I haven't figured out a permanent solution - Windows DNS resolution works differently to other platforms - but I believe we can workaround the issue by lowering the metric of the TAP device:

• Open Network Connections in Control Panel (easiest way to access is by searching for "network connections" in the taskbar)
• Right click outline-tap0 and select Properties.
• Double click Internet Protocol Version 4.
• Click Advanced... in the lower-right hand corner.
• Uncheck Automatic metric and enter a low number, e.g. 1.
• Dismiss all the dialogs: click OK several times, returning to Network Connections.

Now, I believe your system will use the "open" DNS servers in all cases.

[ercxar]

@studentmain I typed the command in powershell and the interfacealias result was outline-tap0.

@trevj I did what you wrote, I've changed the metric value to be 1. And it did the trick! Now everything is working as it should!

Thanks to both of you guys!

[trevj]

@ercxar Great to hear this unblocked you - thanks again for testing! FYI, I am working on a more permanent fix for this issue and will update this issue when it's ready.

[trevj]

OK, so https://github.com/Jigsaw-Code/outline-client/releases/tag/windows-v1.2.0 and https://github.com/Jigsaw-Code/outline-client/releases/tag/windows-v1.2.1 both include https://github.com/Jigsaw-Code/outline-client/pull/193. We're still ironing out some issues with the "full VPN" on Windows before going to 100% but I haven't heard any more reports like this so I'm going to close this issue. @ercxar Thanks again for working through this with us!

[trevj]

@ercxar FYI we recently discovered that this fix wasn't sufficient to prevent DNS leaks in all situations, especially on Windows 10. This PR should address it on all platforms:
https://github.com/Jigsaw-Code/outline-client/pull/394