MSI-installed client (v1.6.x) fails to establish tunnel on Windows 11 #824

F1L337 · 2026-04-23T09:57:15Z

F1L337
Apr 23, 2026

Hello everyone,

I am experiencing issues with the Defguard client when installed via MSI (tested with versions 1.6.0 through 1.6.8).

Environment

OS: Windows 11
Defguard: v2.0.0-beta1
Installation method: MSI installer

Issue

The client starts normally and authentication via Keycloak works successfully. However, the VPN tunnel is not established.

Observations

No VPN adapters are visible in Get-NetAdapter
The WireGuard interface appears to be created temporarily but fails during configuration
The following error appears in the logs:

CreateIpForwardEntry2: Element nicht gefunden. (os error 1168)

Troubleshooting performed

Uninstalled all previous Defguard client versions
Removed other VPN clients (including OpenVPN and TAP adapters)
Verified that no VPN adapters are present in the system
Reset network stack (netsh int ip reset, netsh winsock reset)
Rebooted the system

Comparison

When using the .exe installer from version 1.5.2, the exact same setup works without any issues.

Question

Is this a known issue related to the MSI installation?
Are there any known workarounds or additional debugging steps I could try?

Logs

Click to expand logs

[23.4.2026, 10:59:37][INFO][Client] Automatically retrieved the newest instance configuration from core for 1 instances, sleeping for 30s
[23.4.2026, 10:59:55][DEBUG][VPN] Initializing ServiceLocationApi
[23.4.2026, 10:59:55][DEBUG][VPN] Creating directory: "C:\\ProgramData\\Defguard\\service_locations"
[23.4.2026, 10:59:55][DEBUG][VPN] Setting ACLs on service locations directory
[23.4.2026, 10:59:55][DEBUG][VPN] Setting secure ACLs on: C:\ProgramData\Defguard\service_locations
[23.4.2026, 10:59:55][DEBUG][VPN] Removing all existing ACL entries for C:\ProgramData\Defguard\service_locations
[23.4.2026, 10:59:55][DEBUG][VPN] Cleared existing ACL entries, now adding secure entries
[23.4.2026, 10:59:55][DEBUG][VPN] Adding SYSTEM with full control
[23.4.2026, 10:59:55][DEBUG][VPN] Adding Administrators with full control
[23.4.2026, 10:59:55][DEBUG][VPN] Successfully set secure ACLs on C:\ProgramData\Defguard\service_locations for SYSTEM and Administrators
[23.4.2026, 10:59:55][DEBUG][VPN] ServiceLocationApi initialized successfully
[23.4.2026, 10:59:55][INFO][VPN] Service locations storage initialized successfully
[23.4.2026, 10:59:55][INFO][VPN] Attempting to auto-connect to service locations (attempt 1/5)
[23.4.2026, 10:59:55][DEBUG][VPN] Attempting to auto-connect to VPN...
[23.4.2026, 10:59:55][INFO][VPN] Starting network change monitoring
[23.4.2026, 10:59:55][INFO][VPN] Starting login/logoff event monitoring
[23.4.2026, 10:59:55][DEBUG][VPN] Starting Defguard interface management daemon
[23.4.2026, 10:59:55][DEBUG][VPN] Creating named pipe server stream
[23.4.2026, 10:59:55][INFO][VPN] Created named pipe server stream
[23.4.2026, 10:59:55][INFO][VPN] Defguard daemon version 1.6.8-9b7b953 started, listening on named pipe \\.\pipe\defguard_daemon
[23.4.2026, 10:59:55][DEBUG][VPN] Defguard daemon configuration: Config { log_level: "info", log_dir: "/Logs/defguard-service", stats_period: 10 }
[23.4.2026, 10:59:55][DEBUG][VPN] Creating tokio secure pipe
[23.4.2026, 10:59:55][DEBUG][VPN] Creating secure named pipe \\.\pipe\defguard_daemon
[23.4.2026, 10:59:55][DEBUG][VPN] Loaded service locations data for 0 instances
[23.4.2026, 10:59:55][DEBUG][VPN] Loaded 0 instance(s) from ServiceLocationApi
[23.4.2026, 10:59:55][DEBUG][VPN] Auto-connect attempt completed
[23.4.2026, 10:59:55][INFO][VPN] All service locations connected successfully (attempt 1/5)
[23.4.2026, 10:59:55][INFO][VPN] Service location auto-connect task finished
[23.4.2026, 10:59:55][INFO][VPN] Created secure named pipe \\.\pipe\defguard_daemon
[23.4.2026, 10:59:55][INFO][VPN] Created tokio secure pipe
[23.4.2026, 11:00:07][INFO][Client] Automatically retrieved the newest instance configuration from core for 1 instances, sleeping for 30s
[23.4.2026, 11:00:15][INFO][Client] Location DOMAIN- VPN .1(ID: 1) preshared key decoded.
[23.4.2026, 11:00:15][INFO][Client] Created windows gRPC client
[23.4.2026, 11:00:15][DEBUG][VPN] Creating tokio secure pipe
[23.4.2026, 11:00:15][DEBUG][VPN] Creating secure named pipe \\.\pipe\defguard_daemon
[23.4.2026, 11:00:15][INFO][VPN] Created secure named pipe \\.\pipe\defguard_daemon
[23.4.2026, 11:00:15][INFO][VPN] Created tokio secure pipe
[23.4.2026, 11:00:15][DEBUG][VPN] Received a request to create a new interface
[23.4.2026, 11:00:15][DEBUG][VPN] Checking if all commands required by wireguard-rs are available
[23.4.2026, 11:00:15][DEBUG][VPN] All commands required by wireguard-rs are available
[23.4.2026, 11:00:15][DEBUG][VPN] Creating new interface DOMAIN-VPN1
[23.4.2026, 11:00:15][DEBUG][VPN] Opening/creating interface DOMAIN-VPN1
[23.4.2026, 11:00:15][ERROR][VPN] wireguard: Failed to find matching adapter name: Element nicht gefunden. (Code 0x00000490)
[23.4.2026, 11:00:15][DEBUG][VPN] Adapter DOMAIN-VPN1 does not exist, creating
[23.4.2026, 11:00:15][INFO][VPN] wireguard: Using existing driver 0.10
[23.4.2026, 11:00:15][INFO][VPN] wireguard: Creating adapter
[23.4.2026, 11:00:15][INFO][VPN] Opened/created interface DOMAIN-VPN1
[23.4.2026, 11:00:15][INFO][VPN] Done creating a new interface DOMAIN-VPN1
[23.4.2026, 11:00:15][DEBUG][VPN] Preparing DNS configuration for interface DOMAIN-VPN1
[23.4.2026, 11:00:15][DEBUG][VPN] DNS configuration for interface DOMAIN-VPN1: DNS: [192.168.100.1, 192.168.100.2], Search domains: ["DOMAIN--gmbh.de"]
[23.4.2026, 11:00:15][DEBUG][VPN] Configuring interface DOMAIN-VPN1 with config: InterfaceConfiguration { name: "DOMAIN-VPN1", addresses: [IpAddrMask { address: 192.168.20.2, cidr: 32 }], port: 0, peers: [Peer { public_key: xxxxxxxxxxxxxxxxxPUBLIC-KEYxxxxxxxxxxxxxxxxxxxxxxx, protocol_version: None, endpoint: Some(34.44.44.100:51820), last_handshake: None, tx_bytes: 0, rx_bytes: 0, persistent_keepalive_interval: Some(25), allowed_ips: [IpAddrMask { address: 0.0.0.0, cidr: 0 }, IpAddrMask { address: ::, cidr: 0 }], .. }], mtu: None, fwmark: None, .. }
[23.4.2026, 11:00:15][DEBUG][VPN] Preparing peers for adapter DOMAIN-VPN1
[23.4.2026, 11:00:15][DEBUG][VPN] Applying configuration for adapter DOMAIN-VPN1
[23.4.2026, 11:00:15][INFO][VPN] endpoint: 34.44.44.100:51820
[23.4.2026, 11:00:15][DEBUG][VPN] Assigning addresses to adapter DOMAIN-VPN1: [IpAddrMask { address: 192.168.20.2, cidr: 32 }]
[23.4.2026, 11:00:15][ERROR][VPN] Failed to configure WireGuard interface DOMAIN-VPN1: CreateIpForwardEntry2: Element nicht gefunden. (os error 1168)
[23.4.2026, 11:00:15][ERROR][VPN] Failed to configure interface DOMAIN-VPN1. Error: code: 'Internal error', message: "Failed to configure WireGuard interface DOMAIN-VPN1: CreateIpForwardEntry2: Element nicht gefunden. (os error 1168)"
[23.4.2026, 11:00:15][DEBUG][VPN] Removing newly created interface DOMAIN-VPN1 due to configuration failure
[23.4.2026, 11:00:15][DEBUG][VPN] Removing interface DOMAIN-VPN1
[23.4.2026, 11:00:15][INFO][VPN] Interface DOMAIN-VPN1 removed successfully
[23.4.2026, 11:00:15][ERROR][Client] Failed to send a request to the background service to create an interface for location DOMAIN- VPN .1(ID: 1) with the following configuration: InterfaceConfiguration { name: "DOMAIN-VPN1", addresses: [IpAddrMask { address: 192.168.20.2, cidr: 32 }], port: 0, peers: [Peer { public_key: xxxxxxxxxxxxxxxxxPUBLIC-KEYxxxxxxxxxxxxxxxxxxxxxxx, protocol_version: None, endpoint: Some(34.44.44.100:51820), last_handshake: None, tx_bytes: 0, rx_bytes: 0, persistent_keepalive_interval: Some(25), allowed_ips: [IpAddrMask { address: 0.0.0.0, cidr: 0 }, IpAddrMask { address: ::, cidr: 0 }], .. }], mtu: None, fwmark: None, .. }. Error: code: 'Internal error', message: "Failed to configure WireGuard interface DOMAIN-VPN1: CreateIpForwardEntry2: Element nicht gefunden. (os error 1168)"
[23.4.2026, 11:00:15][ERROR][Client] Invoking "connect" failed due to unknown error: "Internal error: Failed to send a request to the background service to create an interface for location DOMAIN- VPN .1(ID: 1). Error: code: 'Internal error', message: \"Failed to configure WireGuard interface DOMAIN-VPN1: CreateIpForwardEntry2: Element nicht gefunden. (os error 1168)\". Check logs for details."
[23.4.2026, 11:00:15][ERROR][Client] [unhandled rejection] Invoking "connect" failed due to unknown error: "Internal error: Failed to send a request to the background service to create an interface for location DOMAIN- VPN .1(ID: 1). Error: code: 'Internal error', message: \"Failed to configure WireGuard interface DOMAIN-VPN1: CreateIpForwardEntry2: Element nicht gefunden. (os error 1168)\". Check logs for details."
[23.4.2026, 11:00:37][INFO][Client] Automatically retrieved the newest instance configuration from core for 1 instances, sleeping for 30s
[23.4.2026, 11:00:38][DEBUG][VPN] Initializing ServiceLocationApi
[23.4.2026, 11:00:38][DEBUG][VPN] Creating directory: "C:\\ProgramData\\Defguard\\service_locations"
[23.4.2026, 11:00:38][DEBUG][VPN] Setting ACLs on service locations directory
[23.4.2026, 11:00:38][DEBUG][VPN] Setting secure ACLs on: C:\ProgramData\Defguard\service_locations
[23.4.2026, 11:00:38][DEBUG][VPN] Removing all existing ACL entries for C:\ProgramData\Defguard\service_locations
[23.4.2026, 11:00:38][DEBUG][VPN] Cleared existing ACL entries, now adding secure entries
[23.4.2026, 11:00:38][DEBUG][VPN] Adding SYSTEM with full control
[23.4.2026, 11:00:38][DEBUG][VPN] Adding Administrators with full control
[23.4.2026, 11:00:38][DEBUG][VPN] Successfully set secure ACLs on C:\ProgramData\Defguard\service_locations for SYSTEM and Administrators
[23.4.2026, 11:00:38][DEBUG][VPN] ServiceLocationApi initialized successfully
[23.4.2026, 11:00:38][INFO][VPN] Service locations storage initialized successfully
[23.4.2026, 11:00:38][INFO][VPN] Starting network change monitoring
[23.4.2026, 11:00:38][INFO][VPN] Attempting to auto-connect to service locations (attempt 1/5)
[23.4.2026, 11:00:38][DEBUG][VPN] Attempting to auto-connect to VPN...
[23.4.2026, 11:00:38][INFO][VPN] Starting login/logoff event monitoring
[23.4.2026, 11:00:38][DEBUG][VPN] Starting Defguard interface management daemon
[23.4.2026, 11:00:38][DEBUG][VPN] Creating named pipe server stream
[23.4.2026, 11:00:38][INFO][VPN] Created named pipe server stream
[23.4.2026, 11:00:38][INFO][VPN] Defguard daemon version 1.6.8-9b7b953 started, listening on named pipe \\.\pipe\defguard_daemon
[23.4.2026, 11:00:38][DEBUG][VPN] Defguard daemon configuration: Config { log_level: "info", log_dir: "/Logs/defguard-service", stats_period: 10 }
[23.4.2026, 11:00:38][DEBUG][VPN] Creating tokio secure pipe
[23.4.2026, 11:00:38][DEBUG][VPN] Creating secure named pipe \\.\pipe\defguard_daemon
[23.4.2026, 11:00:38][DEBUG][VPN] Loaded service locations data for 0 instances
[23.4.2026, 11:00:38][DEBUG][VPN] Loaded 0 instance(s) from ServiceLocationApi
[23.4.2026, 11:00:38][DEBUG][VPN] Auto-connect attempt completed
[23.4.2026, 11:00:38][INFO][VPN] All service locations connected successfully (attempt 1/5)
[23.4.2026, 11:00:38][INFO][VPN] Service location auto-connect task finished
[23.4.2026, 11:00:38][INFO][VPN] Created secure named pipe \\.\pipe\defguard_daemon
[23.4.2026, 11:00:38][INFO][VPN] Created tokio secure pipe
[23.4.2026, 11:00:50][INFO][Client] Location DOMAIN- VPN .1(ID: 1) preshared key decoded.
[23.4.2026, 11:00:50][INFO][Client] Created windows gRPC client
[23.4.2026, 11:00:50][DEBUG][VPN] Creating tokio secure pipe
[23.4.2026, 11:00:50][DEBUG][VPN] Creating secure named pipe \\.\pipe\defguard_daemon
[23.4.2026, 11:00:50][INFO][VPN] Created secure named pipe \\.\pipe\defguard_daemon
[23.4.2026, 11:00:50][INFO][VPN] Created tokio secure pipe
[23.4.2026, 11:00:50][DEBUG][VPN] Received a request to create a new interface
[23.4.2026, 11:00:50][DEBUG][VPN] Checking if all commands required by wireguard-rs are available
[23.4.2026, 11:00:50][DEBUG][VPN] All commands required by wireguard-rs are available
[23.4.2026, 11:00:50][DEBUG][VPN] Creating new interface DOMAIN-VPN1
[23.4.2026, 11:00:50][DEBUG][VPN] Opening/creating interface DOMAIN-VPN1
[23.4.2026, 11:00:50][ERROR][VPN] wireguard: Failed to find matching adapter name: Element nicht gefunden. (Code 0x00000490)
[23.4.2026, 11:00:50][DEBUG][VPN] Adapter DOMAIN-VPN1 does not exist, creating
[23.4.2026, 11:00:50][INFO][VPN] wireguard: Using existing driver 0.10
[23.4.2026, 11:00:50][INFO][VPN] wireguard: Creating adapter
[23.4.2026, 11:00:50][INFO][VPN] Opened/created interface DOMAIN-VPN1
[23.4.2026, 11:00:50][INFO][VPN] Done creating a new interface DOMAIN-VPN1
[23.4.2026, 11:00:50][DEBUG][VPN] Preparing DNS configuration for interface DOMAIN-VPN1
[23.4.2026, 11:00:50][DEBUG][VPN] DNS configuration for interface DOMAIN-VPN1: DNS: [192.168.100.1, 192.168.100.2], Search domains: ["DOMAIN--gmbh.de"]
[23.4.2026, 11:00:50][DEBUG][VPN] Configuring interface DOMAIN-VPN1 with config: InterfaceConfiguration { name: "DOMAIN-VPN1", addresses: [IpAddrMask { address: 192.168.20.2, cidr: 32 }], port: 0, peers: [Peer { public_key: xxxxxxxxxxxxxxxxxPUBLIC-KEYxxxxxxxxxxxxxxxxxxxxxxx, protocol_version: None, endpoint: Some(34.44.44.100:51820), last_handshake: None, tx_bytes: 0, rx_bytes: 0, persistent_keepalive_interval: Some(25), allowed_ips: [IpAddrMask { address: 0.0.0.0, cidr: 0 }, IpAddrMask { address: ::, cidr: 0 }], .. }], mtu: None, fwmark: None, .. }
[23.4.2026, 11:00:50][DEBUG][VPN] Preparing peers for adapter DOMAIN-VPN1
[23.4.2026, 11:00:50][DEBUG][VPN] Applying configuration for adapter DOMAIN-VPN1
[23.4.2026, 11:00:50][INFO][VPN] endpoint: 34.44.44.100:51820
[23.4.2026, 11:00:50][DEBUG][VPN] Assigning addresses to adapter DOMAIN-VPN1: [IpAddrMask { address: 192.168.20.2, cidr: 32 }]
[23.4.2026, 11:00:50][ERROR][VPN] Failed to configure WireGuard interface DOMAIN-VPN1: CreateIpForwardEntry2: Element nicht gefunden. (os error 1168)
[23.4.2026, 11:00:50][ERROR][VPN] Failed to configure interface DOMAIN-VPN1. Error: code: 'Internal error', message: "Failed to configure WireGuard interface DOMAIN-VPN1: CreateIpForwardEntry2: Element nicht gefunden. (os error 1168)"
[23.4.2026, 11:00:50][DEBUG][VPN] Removing newly created interface DOMAIN-VPN1 due to configuration failure
[23.4.2026, 11:00:50][DEBUG][VPN] Removing interface DOMAIN-VPN1
[23.4.2026, 11:00:50][INFO][VPN] Interface DOMAIN-VPN1 removed successfully
[23.4.2026, 11:00:50][ERROR][Client] Failed to send a request to the background service to create an interface for location DOMAIN- VPN .1(ID: 1) with the following configuration: InterfaceConfiguration { name: "DOMAIN-VPN1", addresses: [IpAddrMask { address: 192.168.20.2, cidr: 32 }], port: 0, peers: [Peer { public_key: xxxxxxxxxxxxxxxxxPUBLIC-KEYxxxxxxxxxxxxxxxxxxxxxxx, protocol_version: None, endpoint: Some(34.44.44.100:51820), last_handshake: None, tx_bytes: 0, rx_bytes: 0, persistent_keepalive_interval: Some(25), allowed_ips: [IpAddrMask { address: 0.0.0.0, cidr: 0 }, IpAddrMask { address: ::, cidr: 0 }], .. }], mtu: None, fwmark: None, .. }. Error: code: 'Internal error', message: "Failed to configure WireGuard interface DOMAIN-VPN1: CreateIpForwardEntry2: Element nicht gefunden. (os error 1168)"
[23.4.2026, 11:00:50][ERROR][Client] Invoking "connect" failed due to unknown error: "Internal error: Failed to send a request to the background service to create an interface for location DOMAIN- VPN .1(ID: 1). Error: code: 'Internal error', message: \"Failed to configure WireGuard interface DOMAIN-VPN1: CreateIpForwardEntry2: Element nicht gefunden. (os error 1168)\". Check logs for details."
[23.4.2026, 11:00:50][ERROR][Client] [unhandled rejection] Invoking "connect" failed due to unknown error: "Internal error: Failed to send a request to the background service to create an interface for location DOMAIN- VPN .1(ID: 1). Error: code: 'Internal error', message: \"Failed to configure WireGuard interface DOMAIN-VPN1: CreateIpForwardEntry2: Element nicht gefunden. (os error 1168)\". Check logs for details."
[23.4.2026, 11:01:07][INFO][Client] Automatically retrieved the newest instance configuration from core for 1 instances, sleeping for 30s

jakub-tldr · 2026-05-06T15:32:30Z

jakub-tldr
May 6, 2026
Collaborator

Hello @F1L337,

Can you please confirm that defguard-service process is working?

Additionally, do you have this issue when connecting to non-MFA locations?

Can you show your Allowed IP's and VPN Network CIDR's?

Please respond in #832

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

MSI-installed client (v1.6.x) fails to establish tunnel on Windows 11 #824

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 1 comment

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Select a reply

Uh oh!

Uh oh!

MSI-installed client (v1.6.x) fails to establish tunnel on Windows 11 #824

Uh oh!

Uh oh!

F1L337 Apr 23, 2026

Environment

Issue

Observations

Troubleshooting performed

Comparison

Question

Logs

Replies: 1 comment

Uh oh!

Uh oh!

jakub-tldr May 6, 2026 Collaborator

F1L337
Apr 23, 2026

jakub-tldr
May 6, 2026
Collaborator