2025-02-24 12:45:33Samuli Seppänen:
Switch to non-AI version
Pages/Managing TAP-Windows drivers.md ..
@@ 1,132 1,161 @@
-
# Introduction
-
The OpenVPN's Windows TAP-drivers consists of four files for each platform (32/64-bit):
-
- *<something>.cat:* contains cryptographic signature for the actual drivers
-
- *<something>.sys:* contains the actual driver
-
- *<something>.inf:* contains driver metadata
-
-
If you need to run OpenVPN on Windows Vista/7 64-bit you have to use signed TAP drivers. Unless you sign them yourself, you need to extract drivers from an existing OpenVPN installer. See below for instructions.
-
-
OpenVPN installers come bundled with a command-line tool called `<tap-windows-install-dir>\bin\devcon.exe` for managing the TAP-driver. Two wrapper scripts, `addtap.bat` and `deltapall.bat` are also available in the same directory. For details on `devcon.exe` usage look at [Microsoft's Devcon.exe documentation](http://support.microsoft.com/kb/311272).
-
-
**NOTES:**
-
- OpenVPN 2.3_alpha1 and earlier `devcon.exe` was called `tapinstall.exe`.
-
- OpenVPN 2.3_rc2 installer does not install TAP utilities by default. This bug is fixed in later releases.
-
-
# Manual configuration of the TAP-Windows adapter
-
On XP Go to `Start -> Control Panel -> Network Connections`.
-
-
You should see a "TAP-Windows Adapter" with a name like "Local Area Connection 3". Right click and rename this to something shorter and without embedded spaces such as "my-tap".
-
-
Now right click again and select properties.
-
-
Select Internet Protocol (TCP/IP) from the list and click on "Properties".
-
-
Set the IP address and subnet mask of your new TAP device. For the example below we will use an IP of 10.3.0.1 and a subnet mask of 255.255.255.0. Other fields can be left as they are.
-
-
Note also that the command line tool "netsh" can do many of these same functions.
-
-
For example, the following command will set the IP and subnet for my-tap:
-
```
-
$ netsh interface ip set address my-tap static 10.3.0.1 255.255.255.0
-
```
-
This setting is persistent across reboots.
-
-
# Installing and uninstalling TAP-drivers
-
Occasionally you may need play with different TAP-driver versions. In this case you can use `devcon.exe` from the Windows command-prompt. Below are some common commands you can run from an administrator Powershell or cmd.exe console:
-
-
List available TAP-Windows adapters:
-
```
-
$ openvpn --show-adapters
-
Available TAP-Windows devices:[1] 'my-tap'
-
```
-
-
List network interfaces (incl. TAP-Windows adapters):
Device node created. Install is complete when drivers are installed...Updating drivers for <id> from C:\Program Files\TAP-Windows\driver\OemVista.inf.
-
Drivers installed successfully.
-
```
-
-
Update a TAP-driver:
-
```
-
> tapinstall.exe update <something.inf> <id>
-
Updating drivers for <id> from C:\Program Files\TAP-Windows\driver\OemVista.inf.
-
Drivers installed successfully.
-
```
-
-
Notes:
-
- `<id>` refers to the driver identifier which is `tap0901` for OpenVPN 2.2+, but may be different in older/newer OpenVPN versions.
-
- `<something.inf>` is typically `OemWin2k.inf` (old tap-drivers) or `!OemVista.inf` (newer tap-drivers). You need to specify the full path to this file, e.g. `C:\Program Files\TAP-Windows\driver\!OemVista.inf`.
-
-
By installing multiple times, you will create additional TAP-Windows adapter instances, which can be used for multiple concurrent VPN tunnels. It is also possible to install using `Control Panel -> Add New Hardware`, and it is possible to uninstall using `Control Panel -> System -> Hardware -> Device Manager`.
-
-
# Extracting TAP-drivers from OpenVPN installers
-
Extracting TAP-drivers from an OpenVPN installer is relatively easy: you can use [7-zip](http://www.7-zip.org/) to open the installer executable. There are both 32-bit and 64-bit versions, but the latter are larger in size.
-
-
# Windows TAP device naming
-
Basically what happens when you install the TAP-Windows driver is that you get a new network adapter that shows up in your network control panel. You right click on the TAP adapter and set the TCP/IP properties, i.e. IP address and netmask. Then you rename the TAP adapter icon to something like "my-tap" and reference it using the --dev-node option in OpenVPN.
-
-
Windows also has command line utilities to accomplish these same kinds of tasks such as "devcon", "netsh", and "ipconfig".
-
-
# Renaming the TAP-driver
-
Look at [this page](Tap%20rename%20script) for a script that can be used to rename TAP-drivers.
-
-
# Debugging installation problems
-
People occasionally report tap-windows installation issues, assuming they are all caused by a single bug, because `devcon.exe` gives the same error message/code. This is unfortunately not the case, and the reason for an install failure could be:
-
- Lack of privileges for installing the driver(?)
-
- Broken driver
-
- Invalid driver signature
-
- Expired driver signature
-
- Conflicting drivers: pretty much every OpenVPN-based VPN service has its own Windows client installer, which install some version of the tap-windows driver. If the installers do a bad job, they could end up installing tap-windows drivers that conflict with the official OpenVPN tap-windows drivers.
-
- Something else
-
-
An exhaustive PPTX presentation of Windows driver installation can be downloaded from [here](http://download.microsoft.com/download/a/f/d/afdfd50d-6eb9-425e-84e1-b4085a80e34e/dvr-t396_wh07.pptx). The basic process of driver installation is this:
-
1. The driver is imported in the driver store
-
2. The driver is installed to driver folder
-
3. The driver is loaded
-
-
The `setupapi.dev.log` (see below) should tell you at which phase the driver installation failed. The presentation linked to above also shows common debugging steps that should prove useful.
-
-
In case you have tap-windows installation issues, you should try the following:
-
1. Back up all OpenVPN configuration files, both for official and for unofficial OpenVPN Windows installers
-
2. Uninstall the [official OpenVPN Windows client](http://openvpn.net/index.php/download/community-downloads.html) using its own uninstaller
-
3. Uninstall any unofficial OpenVPN Windows clients using their own uninstallers or `!Add/Remove programs`
-
- Note that many of these are not called OpenVPN at all
-
4. [Remove all installed tap-windows drivers](http://www.pcworld.com/article/246041/how_to_uninstall_drivers_in_windows.html)
-
- Note that many of these are not called tap-windows at all
-
5. [Remove tap-windows drivers from the driver store](http://technet.microsoft.com/en-us/library/cc730875.aspx)
-
- `Remove-Tapwindows.ps1` script in [tap-windows-scripts](https://github.com/mattock/tap-windows-scripts) repository can delete all standard tap-windows drivers from the driverstore
-
6. Reboot
-
7. Try installing OpenVPN using the official installer
-
-
If you're still having issues installing the tap-windows driver, you should try installing it on another computer. If installation to another computer works, it's highly likely the problem is in your system, not in the OpenVPN/tap-windows installer itself.
-
-
You can further debug tap-windows installation issues by looking at the common log file for all Windows driver installations, which on Windows 7 is normally located in `C:\Windows\inf\setupapi.dev.log`. If you're filing a bug report, you should attach the logs for the tap-windows installation part to the bug report.
-
-
Sometimes tap-windows install failures are related to registry corruption. For details, look at these forum postings:
The OpenVPN's Windows TAP-drivers consists of four files for each platform (32/64-bit):
+
+
* *\<something\>.cat:* contains cryptographic signature for the actual drivers
+
* *\<something\>.sys:* contains the actual driver
+
* *\<something\>.inf:* contains driver metadata
+
+
If you need to run OpenVPN on Windows Vista/7 64-bit you have to use signed TAP drivers. Unless you sign them yourself, you need to extract drivers from an existing OpenVPN installer. See below for instructions.
+
+
OpenVPN installers come bundled with a command-line tool called *\<tap-windows-install-dir\>\\bin\\devcon.exe* for managing the TAP-driver. Two wrapper scripts, *addtap.bat* and *deltapall.bat* are also available in the same directory. For details on *devcon.exe* usage look at [Devcon.exe documentation](http://support.microsoft.com/kb/311272).
+
+
**NOTES:**
+
+
* In OpenVPN 2.3_alpha1 and earlier *devcon.exe* was called *tapinstall.exe*.
+
* OpenVPN 2.3_rc2 installer does not install TAP utilities by default. This bug is fixed in later releases.
+
+
# Manual configuration of the TAP-Windows adapter
+
+
On XP Go to *Start -> Control Panel -> Network Connections*.
+
+
You should see a "TAP-Windows Adapter" with a name like "Local Area Connection 3". Right click and rename this to something shorter and without embedded spaces such as "my-tap".
+
+
Now right click again and select properties.
+
+
Select Internet Protocol (TCP/IP) from the list and click on "Properties".
+
+
Set the IP address and subnet mask of your new TAP device. For the example below we will use an IP of 10.3.0.1 and a subnet mask of 255.255.255.0. Other fields can be left as they are.
+
+
Note also that the command line tool "netsh" can do many of these same functions.
+
+
For example, the following command will set the IP and subnet for my-tap:
+
+
```
+
$ netsh interface ip set address my-tap static 10.3.0.1 255.255.255.0
+
```
+
+
This setting is persistent across reboots.
+
+
# Installing and uninstalling TAP-drivers
+
+
Occasionally you may need play with different TAP-driver versions. In this case you can use *devcon.exe* from the Windows command-prompt. Below are some common commands you can run from an administrator Powershell or cmd.exe console:
+
+
List available TAP-Windows adapters:
+
+
```
+
$ openvpn --show-adapters
+
Available TAP-Windows devices:
+
[1] 'my-tap'
+
```
+
+
List network interfaces (incl. TAP-Windows adapters):
+
+
```
+
$ ipconfig
+
```
+
+
View information about an installed driver:
+
+
```
+
> tapinstall.exe hwids <id>
+
ROOT\NET\0000
+
Name: TAP-Windows Adapter V9
+
Hardware IDs:
+
tap0901
+
1 matching device(s) found.
+
```
+
+
Uninstall a TAP-driver:
+
+
```
+
> tapinstall.exe remove <id>
+
ROOT\NET\0000
+
1 device(s) were removed
+
```
+
+
To verify TAP-driver removal:
+
+
```
+
> tapinstall.exe hwids <id>
+
No matching devices found.
+
```
+
+
Install a new TAP-driver:
+
+
```
+
> tapinstall.exe install <something.inf> <id>
+
Device node created. Install is complete when drivers are installed...
+
Updating drivers for <id> from C:\Program Files\TAP-Windows\driver\OemVista.inf.
+
Drivers installed successfully.
+
```
+
+
Update a TAP-driver:
+
+
```
+
> tapinstall.exe update <something.inf> <id>
+
Updating drivers for <id> from C:\Program Files\TAP-Windows\driver\OemVista.inf.
+
Drivers installed successfully.
+
```
+
+
Notes:
+
+
* *<id>* refers to the driver identifier which is *tap0901* for OpenVPN 2.2+, but may be different in older/newer OpenVPN versions.
+
* *<something.inf>* is typically *OemWin2k.inf* (old tap-drivers) or *OemVista.inf* (newer tap-drivers). You need to specify the full path to this file, e.g.*C:\Program Files\TAP-Windows\driver\!OemVista.inf*.
+
+
By installing multiple times, you will create additional TAP-Windows adapter instances, which can be used for multiple concurrent VPN tunnels. It is also possible to install using *Control Panel -> Add New Hardware*, and it is possible to uninstall using *Control Panel -> System -> Hardware -> Device Manager*.
+
+
# Extracting TAP-drivers from OpenVPN installers
+
+
Extracting TAP-drivers from an OpenVPN installer is relatively easy: you can use [http://www.7-zip.org/ 7-zip] to open the installer executable. There are both 32-bit and 64-bit versions, but the latter are larger in size.
+
+
# Windows TAP device naming
+
+
Basically what happens when you install the TAP-Windows driver is that you get a new network adapter that shows up in your network control panel. You right click on the TAP adapter and set the TCP/IP properties, i.e. IP address and netmask. Then you rename the TAP adapter icon to something like "my-tap" and reference it using the --dev-node option in OpenVPN.
+
+
Windows also has command line utilities to accomplish these same kinds of tasks such as "devcon", "netsh", and "ipconfig".
+
+
# Renaming the TAP-driver
+
+
Look at [this page](/Pages/TapRenameScript) for a script that can be used to rename TAP-drivers.
+
+
# Debugging installation problems
+
+
People occasionally report tap-windows installation issues, assuming they are all caused by a single bug, because *devcon.exe* gives the same error message/code. This is unfortunately not the case, and the reason for a install failure could be:
+
+
* Lack of privileges for installing the driver(?)
+
* Broken driver
+
* Invalid driver signature
+
* Expired driver signature
+
* Conflicting drivers: pretty much every OpenVPN-based VPN service has it's own Windows client installer, which install some version of the tap-windows driver. If the installers do a bad job, they could end up installing tap-windows drivers that conflict with the official OpenVPN tap-windows drivers.
+
* Something else
+
+
An exhaustive PPTX presentation of Windows driver installation can be downloaded from [http://download.microsoft.com/download/a/f/d/afdfd50d-6eb9-425e-84e1-b4085a80e34e/dvr-t396_wh07.pptx here]. The basic process of driver installation is this:
+
+
1. The driver is imported in the driver store
+
1. The driver is installed to driver folder
+
1. The driver is loaded
+
+
The *setupapi.dev.log* (see below) should tell you at which phase the driver installation failed. The presentation linked to above also shows common debugging steps that should prove useful.
+
+
In case you have tap-windows installation issues, you should try the following:
+
+
1. Back up all OpenVPN configuration files, both for official and for unofficial OpenVPN Windows installers
+
1. Uninstall the [http://openvpn.net/index.php/download/community-downloads.html official OpenVPN Windows client] using it's own uninstaller
+
1. Uninstall any unofficial OpenVPN Windows clients using their own uninstallers or *Add/Remove programs*
+
* Note that many of these are not called OpenVPN at all
+
1. [Remove all installed tap-windows drivers](http://www.pcworld.com/article/246041/how_to_uninstall_drivers_in_windows.html)
+
* Note that many of these are not called tap-windows at all
+
1. [Remove tap-windows drivers from the driver store](http://technet.microsoft.com/en-us/library/cc730875.aspx)
+
* *Remove-Tapwindows.ps1* script in [tap-windows-scripts](https://github.com/mattock/tap-windows-scripts) repository can delete all standard tap-windows drivers from the driverstore
+
1. Reboot
+
1. Try installing OpenVPN using the official installer
+
+
If you're still having issues installing the tap-windows driver, you should try installing it on another computer. If installation to another computer works, it's highly likely the problem is in your system, not in the OpenVPN/tap-windows installer itself.
+
+
You can further debug tap-windows installation issues by looking at the common log file for all Windows driver installations, which on Windows 7 is normally located in *C:\\Windows\\inf\\setupapi.dev.log*. If you're filing a bug report, you should attach the logs for the tap-windows installation part to the bug report.
+
+
Sometimes tap-windows install failures are related to registry corruption. For details, look at these forum postings:
