Route error with OpenVPN 2.7+ Stunnel

[tsybot]

Fri Jul  3 11:55:39 2026 TCP/UDP: Preserving recently used remote address: [AF_INET]127.0.0.1:1193
Fri Jul  3 11:55:39 2026 TCP_CLIENT link local: (not bound)
Fri Jul  3 11:55:39 2026 TCP_CLIENT link remote: [AF_INET]127.0.0.1:1193
Fri Jul  3 11:55:39 2026 MANAGEMENT: >STATE:1783068939,WAIT,,,,,,
Fri Jul  3 11:55:39 2026 MANAGEMENT: >STATE:1783068939,AUTH,,,,,,
Fri Jul  3 11:55:39 2026 TLS: Initial packet from [AF_INET]127.0.0.1:1193, sid=31023e74 2e1069ae
Fri Jul  3 11:55:40 2026 VERIFY OK: depth=1, CN=cn_pVEWWcnAXMReQzd0
Fri Jul  3 11:55:40 2026 VERIFY KU OK
Fri Jul  3 11:55:40 2026 Validating certificate extended key usage
Fri Jul  3 11:55:40 2026 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Fri Jul  3 11:55:40 2026 VERIFY EKU OK
Fri Jul  3 11:55:40 2026 VERIFY X509NAME OK: CN=server_test
Fri Jul  3 11:55:40 2026 VERIFY OK: depth=0, CN=server_test
Fri Jul  3 11:55:40 2026 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, peer certificate: 256 bits ECprime256v1, signature: ecdsa-with-SHA256, peer temporary key: 253 bits X25519, peer signing digest/type: ecdsa_secp256r1_sha256 ECDSA, key agreement: x25519
Fri Jul  3 11:55:40 2026 [server_test] Peer Connection Initiated with [AF_INET]127.0.0.1:1193
Fri Jul  3 11:55:40 2026 TLS: move_session: dest=TM_ACTIVE src=TM_INITIAL reinit_src=1
Fri Jul  3 11:55:40 2026 TLS: tls_multi_process: initial untrusted session promoted to trusted
Fri Jul  3 11:55:40 2026 PUSH: Received control message: 'PUSH_REPLY,sndbuf 393216,rcvbuf 393216,dhcp-option DNS 1.1.1.1,dhcp-option DNS 8.8.8.8,redirect-gateway def1 bypass-dhcp,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.8.0.4 255.255.255.0,peer-id 0,cipher AES-128-GCM,protocol-flags cc-exit tls-ekm dyn-tls-crypt,tun-mtu 1500'
Fri Jul  3 11:55:40 2026 OPTIONS IMPORT: --sndbuf/--rcvbuf options modified
Fri Jul  3 11:55:40 2026 NOTE: setsockopt SO_SNDBUF=393216 failed
Fri Jul  3 11:55:40 2026 NOTE: setsockopt SO_RCVBUF=393216 failed
Fri Jul  3 11:55:40 2026 Socket Buffers: R=[0->0] S=[0->0]
Fri Jul  3 11:55:40 2026 OPTIONS IMPORT: --ifconfig/up options modified
Fri Jul  3 11:55:40 2026 OPTIONS IMPORT: route options modified
Fri Jul  3 11:55:40 2026 OPTIONS IMPORT: route-related options modified
Fri Jul  3 11:55:40 2026 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Fri Jul  3 11:55:40 2026 OPTIONS IMPORT: tun-mtu set to 1500
Fri Jul  3 11:55:40 2026 interactive service msg_channel=636
Fri Jul  3 11:55:40 2026 ovpn-dco device [OpenVPN Data Channel Offload] opened
Fri Jul  3 11:55:40 2026 MANAGEMENT: >STATE:1783068940,ASSIGN_IP,,10.8.0.4,,,,
Fri Jul  3 11:55:40 2026 INET address service: add 10.8.0.4/24
Fri Jul  3 11:55:40 2026 IPv4 dns servers set using service
Fri Jul  3 11:55:40 2026 IPv4 MTU set to 1500 on interface 8 using service
Fri Jul  3 11:55:40 2026 log_connect.bat OpenVPN Data Channel Offload 1500 0 10.8.0.4 255.255.255.0 init
Fri Jul  3 11:55:40 2026 env_block: add PATH=C:\Windows\System32;C:\Windows;C:\Windows\System32\Wbem
Fri Jul  3 11:55:46 2026 Adding WFP block filters using service succeeded.
Fri Jul  3 11:55:46 2026 C:\Windows\system32\route.exe ADD 127.0.0.1 MASK 255.255.255.255 0.0.0.0 IF 1
Fri Jul  3 11:55:46 2026 Warning: route gateway is not reachable on any active network adapters: 0.0.0.0
Fri Jul  3 11:55:46 2026 C:\Windows\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.8.0.1
Fri Jul  3 11:55:46 2026 Route addition via service succeeded
Fri Jul  3 11:55:46 2026 C:\Windows\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.8.0.1
Fri Jul  3 11:55:46 2026 Route addition via service succeeded
Fri Jul  3 11:55:46 2026 Initialization Sequence Completed
Fri Jul  3 11:55:46 2026 MANAGEMENT: >STATE:1783068946,CONNECTED,ROUTE_ERROR,10.8.0.4,127.0.0.1,1193,,
Fri Jul  3 11:55:46 2026 ERROR: Some routes were not successfully added. The connection may not function correctly
Fri Jul  3 11:55:46 2026 Data Channel: cipher 'AES-128-GCM', peer-id: 0
Fri Jul  3 11:55:46 2026 Timers: ping 10, ping-restart 120
Fri Jul  3 11:55:46 2026 Protocol options: protocol-flags cc-exit tls-ekm dyn-tls-crypt

Problem in
Fri Jul 3 11:55:46 2026 C:\Windows\system32\route.exe ADD 127.0.0.1 MASK 255.255.255.255 0.0.0.0 IF 1
Fri Jul 3 11:55:46 2026 Warning: route gateway is not reachable on any active network adapters: 0.0.0.0
Fri Jul 3 11:55:46 2026 ERROR: Some routes were not successfully added. The connection may not function correctly

This problem start with Openvpn 2.7, on 2.6.19 all working without error with same configuration
Problem have on last 2.7.5

Stunnel 5.78 configuration

[openvpn_test]
accept = 127.0.0.1:1193
connect = 111.111.111.111:443
checkHost = checktest.com
verify = 2
CAfile = C:\Program Files (x86)\stunnel\config\certs\ca.crt
cert = C:\Program Files (x86)\stunnel\config\certs\client.crt
key = C:\Program Files (x86)\stunnel\config\certs\client.key

Openvpn configuration

client
proto tcp-client
remote 127.0.0.1 1193
dev tun
nobind
persist-tun
remote-cert-tls server
verify-x509-name server_test name
auth SHA256
cipher AES-128-GCM
tls-client
tls-version-min 1.2
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
mssfix 1280
block-outside-dns
setenv opt block-outside-dns # Prevent Windows 10 DNS leak
verb 3
script-security 2
up log_connect.bat
<ca>
-----BEGIN CERTIFICATE-----
XXXXXXHIDEDXXXXXXX
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
XXXXXXHIDEDXXXXXXX
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
XXXXXXHIDEDXXXXXXX
-----END PRIVATE KEY-----
</key>
<tls-crypt>
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
XXXXXXHIDEDXXXXXXX
-----END OpenVPN Static key V1-----
</tls-crypt>

Im testing only on windows (Windows server 2022 Datacenter) but maybe problem have and on Linux

[ordex]

Adding a host route to 127.0.0.1 (the VPN server, from the client perspective) is failing because the computed GW is 0.0.0.0 (which makes sense).

@tsybot Does this create any issue? I believe you see this error but the VPN just works. Right?

We may try to skip adding this route under these circumstances.

[tsybot]

@ordex Yes, VPN is working, but im see errors in log, and in 2.6.19 all working without errors, maybe it can be fixed anyway

[cron2]

"Tunneling OpenVPN through some other tunneling software running on 127.0.0.1" is one of the edge cases that might break every now and then. This is not the way the developers expect the software to be used.

This said, it shouldn't be very hard to just "do nothing" if the VPN gateway is 127.0.0.1 - or, because this is the next thing someone from the linux side will show up with 127.anything, and of course ::1 as well... - someone needs to code that, test it, maintain it, remember why this was added in the first place...