Disconnecting from OpenVPN DCO server does not fully release the IP address.

[mantaspau98]

Describe the bug
Disconnect calls "netsh" command to delete IP address from adapter, but it has the flag "store=active" which seems to make it so the IP isn't fully removed. Next time computer is rebooted, the address is taken by the adapter so other adapters are unable to use it. I noticed that there is a comment ""store=active" is needed in Windows 8(.1) to delete the address we added" in the source code, if that is only needed for windows 8(.1), maybe the flag could be removed for newer Windows versions, avoiding this issue?

openvpn/src/openvpn/tun.c

Line 6338 in 2e2ac94

argv_printf(&argv, "%s%s interface %s delete address %lu %s store=active", get_win_sys_path(),

To Reproduce

• Connect to OpenVPN DCO server.
• Disconnect.

The IP is still set for the adapter, but is not visible when "ipconfig /all" command is called

• Restart computer.
• IP cannot be set to other adapters.

Expected behavior
OpenVPN adapter fully cleans up, allows the IP to be used by other adapters.

Version information (please complete the following information):

• OS: Windows 11.
• OpenVPN DCO is used.

[lstipakov]

Hi,

First - active shouldn't make it persistent according to the doc:

store - Specifies the address persistence. Use active for a temporary address removed on reboot, or persistent to retain the address after reboot (default).

Second - are you using the interactive service? In this case the IP address is set via IPAPI in the service code and not via netsh. With interactive service (and this is a recommended way to use OpenVPN on Windows) I cannot reproduce the issue with two DCO adapters:

• Connected via DCO adapter A
• Disconnected
• Added --dev-node <guid> to make OpenVPN use DCO adapter B
• Connected via DCO adapter B

[mantaspau98]

Hello,

Regarding first point, you probably looked at ipv4 add address part in the doc, ipv4 delete address (which is where I assume the problem lies) says store - Use active to make the deletion temporary (until next boot), or persistent to make it permanent (default). So in this case the deletion will be temporary, until next boot. And I think setting the IP address does not specify the store flag at all so by default it is persistent.

openvpn/src/openvpn/tun.c

Line 5367 in 2e2ac94

argv_printf(&argv, "%s%s interface ip set address %lu static %s %s", get_win_sys_path(),

In the end, this is what we get - setting the address is persistent, deleting is active.

In reproduction steps I mentioned that you need to reboot in order to reproduce the issue. I'm not using interactive service, I saw these netsh commands in the OpenVPN output log.

[cron2]

So the fix is to add store=active to the set ip address %lu static command?

(While we do want to get rid of all IP address config inside OpenVPN.exe, for the time being we have it, and so we can fix it if things are not doing the right thing. This said, the recommended way is "dhcp for IPv4 on TAP" or "iservice for everything", so this is a rarely-excercised code path)

[cron2]

I should point out that this is, of course, a legacy-IP-only problem. IPv6 handling does this correctly :-)

[mantaspau98]

Its either adding store=active to set ip address command or removing store=active from delete address command. Both ways would make sense IMHO.

Although adding store=active to set ip address would mean that if you previously had IP set to persistent store (which is the case right now), it will never get removed from it unless you run the delete command without store=active manually, or recreate the adapter, for example.

[cron2]

Our goal never is to install persistent interface configs - when openvpn ends (or the system crashes) the IP address needs to be gone. So store=active is what needs to be done.

We can't fix "something else has pre-configured a permanent same or other IP address" in the general cases - and so for this niche case, we might end up requiring some manual interaction to clear the situation.