Home / server / Questions / 163879
Accepted
Tuinslak
Asked: 2010-07-26 04:09:05 +0800 CST

OpenVPN randomly disconnects, refuses to reconnect

  • 772

I am running an OpenVPN server on a Debian virtual machine.

OpenVPN 2.1.0 x86_64-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [MH] [PF_INET6] [eurephia] built on Jul  9 2010
Originally developed by James Yonan
Copyright (C) 2002-2009 OpenVPN Technologies, Inc. <[email protected]>

I recently switch from the TCP protocol to UDP. I had to use TCP as this was the only protocol that wasn't blocked in the network I used my VPN. I However won't be using that network anymore, and UDP should be allowed on all networks I'll be using the VPN in now.

However, I recently started to notice random disconnects on the VPN clients (both on a Mac and a Windows 7). I sometimes manage to stay connected for over an hour, sometimes only a couple of minutes. Also attempting to reconnect rarely works and I need to reload or restart the VPN service for it to work.

This is what's in the server log:

Sun Jul 25 12:54:29 2010 us=83586 vpn.rootspirit.com/85.234.196.37:59101 PUSH: Received control message: 'PUSH_REQUEST'
Sun Jul 25 12:54:29 2010 us=83660 vpn.rootspirit.com/85.234.196.37:59101 SENT CONTROL [vpn.rootspirit.com]: 'PUSH_REPLY,route 85.12.6.190 255.255.255.0,dhcp-option DOMAIN vpn.tuinslak.org,dhcp-option DNS 10.19.88.1,dhcp-option DNS 85.12.6.171,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,dhcp-option NTP 85.12.6.130,redirect-gateway def1,route 10.19.88.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.19.88.6 10.19.88.5' (status=1)
Sun Jul 25 13:49:23 2010 us=593925 MULTI: multi_create_instance called
Sun Jul 25 13:49:23 2010 us=593996 85.234.196.37:63398 Re-using SSL/TLS context
Sun Jul 25 13:49:23 2010 us=594028 85.234.196.37:63398 LZO compression initialized
Sun Jul 25 13:49:23 2010 us=594125 85.234.196.37:63398 Control Channel MTU parms [ L:1542 D:166 EF:66 EB:0 ET:0 EL:0 ]
Sun Jul 25 13:49:23 2010 us=594140 85.234.196.37:63398 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Sun Jul 25 13:49:23 2010 us=594175 85.234.196.37:63398 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 0,cipher DES-EDE3-CBC,auth SHA1,keysize 192,tls-auth,key-method 2,tls-server'
Sun Jul 25 13:49:23 2010 us=594188 85.234.196.37:63398 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher DES-EDE3-CBC,auth SHA1,keysize 192,tls-auth,key-method 2,tls-client'
Sun Jul 25 13:49:23 2010 us=594206 85.234.196.37:63398 Local Options hash (VER=V4): 'b5edb94e'
Sun Jul 25 13:49:23 2010 us=594222 85.234.196.37:63398 Expected Remote Options hash (VER=V4): '53f7fc82'
Sun Jul 25 13:49:23 2010 us=594255 85.234.196.37:63398 TLS: Initial packet from 85.234.196.37:63398, sid=ad75fbfb 003c5c1f
Sun Jul 25 13:50:23 2010 us=47907 85.234.196.37:63398 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Sun Jul 25 13:50:23 2010 us=47956 85.234.196.37:63398 TLS Error: TLS handshake failed
Sun Jul 25 13:50:23 2010 us=48048 85.234.196.37:63398 SIGUSR1[soft,tls-error] received, client-instance restarting
Sun Jul 25 13:53:09 2010 us=208133 vpn.rootspirit.com/85.234.196.37:59101 [vpn.rootspirit.com] Inactivity timeout (--ping-restart), restarting
Sun Jul 25 13:53:09 2010 us=208192 vpn.rootspirit.com/85.234.196.37:59101 SIGUSR1[soft,ping-restart] received, client-instance restarting

Everything seems to lead to a ping timeout or broken internet connection. However, other PCs here in this network stay connected to the internet just fine. So I don't think it's my vDSL connection that's dropping. Same for packet loss to the server; close to 0% loss.

Keep alive is set to this:

keepalive 10 120

Any idea what might cause this issue?

Kind regards, Tuinslak

openvpn

2 Answers

  1. I had similar behaviour when I happened to have multiple clients with same certificate or certificates with same common name while duplicate-cn setting was not enabled. Solving either of these causes made the connection stable.

    Information from OpenVPN server config:

    # Uncomment this directive if multiple clients
# might connect with the same certificate/key
# files or common names.  This is recommended
# only for testing purposes.  For production use,
# each client should have its own certificate/key
# pair.
#
# IF YOU HAVE NOT GENERATED INDIVIDUAL
# CERTIFICATE/KEY PAIRS FOR EACH CLIENT,
# EACH HAVING ITS OWN UNIQUE "COMMON NAME",
# UNCOMMENT THIS LINE OUT.
;duplicate-cn
    • 1
  2. Best Answer

    I haven't used the VPN for a while -- because of the reason stated above.

    However, I recently used it again and it no longer seems to disconnected. I'm guessing it was a bug somewhere fixed when updating software. I also upgraded from Lenny to Squeeze a while back.

    • 0