8

OpenVPN version 2.5.0 on windows 10. After the installation, I got two new network adapters: OpenVPN Wintun and OpenVPN TAP-Windows6.

My .ovpn configuration file contains the line dev tun so I was assuming the connection would have used the tun interface, but no, it uses the tap one. I tried reinstalling OpenVPN installing only the tun interface, and the connection fails with this log:

...
open_tun
MANAGEMENT: Client disconnected
All tap-windows6 adapters on this system are currently in use
Exiting due to fatal error

That makes sense because there's no tap adapter installed, but why doesn't it use the tun one if the config says so? The log even tells open_tun.

I tried changing dev tun to dev tap out of curiosity and it fails with multiple errors, so my vpn is really of the tun type. Can anyone explain me why it works this way? What's the use of the OpenVPN Wintun adapter if the tap one is used anyway?

If for any reason this behavior is correct, is it actually operating at level 3 like tun should or not?

1 Answer 1

9

Support for Wintun (brought in from WireGuard) is a very recent addition to OpenVPN 2.5, so you need to explicitly opt in to using it:

windows-driver wintun

For a long time, there wasn't anything resembling a 'tun' interface on Windows that could be used by OpenVPN, so dev tun had no choice but to use the "TAP-Windows" driver and create an L2 Ethernet interface even for a L3 tunnel – it would just emulate all L2 things (like ARP responses on the client side, even serving fake DHCP to the local machine.

However, as clunky as it was for layer-3 links, the "TAP-Windows "driver has worked for a long time and so remains the default for now. (Wintun also has been written with stricter permission checks, so OpenVPN needs to run as a service with System privileges. It seems that OpenVPN uses the "Interactive service" mode for this.)

Another similar option is OpenVPN's own "Data Channel Offload" driver ovpn-dco, which will become available with OpenVPN 2.6.

2
  • 2
    To clarify, this new windows-driver wintun line is added to the config file, along with keeping the existing dev tun ine.
    – Nate
    Apr 30, 2021 at 23:19
  • I needed to add windows-driver tap-windows6 instead of wintun to make it work.
    – Ari
    Sep 25, 2023 at 11:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .