read UDPv4 [EHOSTUNREACH]: No route to host (code=113)

euler24

Hi,

I have some trouble finding out what "read UDPv4 [EHOSTUNREACH]: No route to host (code=113)" really means and what I can do about it. Connecting still works perfectly though. I had a running server and client configuration for a long time and I changed nothing on my server or client. But recently I experience this error message and I try to make sense of it. Where do I start? I use OpenVPN 2.2.0.

Any help is appreciated.
e.

My server.conf:

server 10.8.0.0 255.255.255.0

dev tun
port 11094
proto udp

#tun-mtu 1500
#fragment 1300
#mssfix

ca ca.crt
cert cert.crt
key key.key
dh dh1024.pem

comp-lzo

push "redirect-gateway def1"
push "dhcp-option DNS xxx.xx.xxx.xxx"
push "dhcp-option DNS yyy.yy.yyy.yyy"

ping-timer-rem
keepalive 10 120

persist-key
persist-tun

verb 3
mute 50

Mimiko

Where is this error occuring? On server? Post the logs, network configuration. Which system you are running?

euler24

The error happens only on the client side. I have two clients connection to the server and both report this error. The clients are on the same LAN. One clients is running Ubuntu 11.10 and the other 12.04. The server is in a different location (far away) and is running the server edition of Ubuntu 11.10. I never saw this error before and I changed nothing on my network nor on the servers network. But I can't speak for the hosting company. Maybe they changed something which I don't know of. The weird thing is, connecting works just fine but surfing or downloading is terribly slow but it is working though.

The client output:

Sun May  6 12:00:52 2012 OpenVPN 2.2.1 x86_64-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Mar 30 2012
Sun May  6 12:00:52 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Sun May  6 12:00:52 2012 LZO compression initialized
Sun May  6 12:00:52 2012 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Sun May  6 12:00:52 2012 Socket Buffers: R=[229376->131072] S=[229376->131072]
Sun May  6 12:00:52 2012 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Sun May  6 12:00:52 2012 Local Options hash (VER=V4): '41690919'
Sun May  6 12:00:52 2012 Expected Remote Options hash (VER=V4): '530fdded'
Sun May  6 12:00:52 2012 UDPv4 link local (bound): [undef]
Sun May  6 12:00:52 2012 UDPv4 link remote: [AF_INET]173.67.XX.XXX:11094
Sun May  6 12:01:06 2012 TLS: Initial packet from [AF_INET]173.67.XX.XXX:11094, sid=4afe55bb 72c0041d
Sun May  6 12:01:22 2012 VERIFY OK: depth=1, xxx
Sun May  6 12:01:22 2012 VERIFY OK: nsCertType=SERVER
Sun May  6 12:01:22 2012 VERIFY OK: depth=0, xxx
Sun May  6 12:01:41 2012 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sun May  6 12:01:41 2012 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun May  6 12:01:41 2012 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sun May  6 12:01:41 2012 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun May  6 12:01:41 2012 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Sun May  6 12:01:41 2012 [vpnbox] Peer Connection Initiated with [AF_INET]173.67.XX.XXX:11094
Sun May  6 12:01:43 2012 SENT CONTROL [vpnbox]: 'PUSH_REQUEST' (status=1)
Sun May  6 12:01:48 2012 SENT CONTROL [vpnbox]: 'PUSH_REQUEST' (status=1)
Sun May  6 12:01:49 2012 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 178.37.12X.XXX,dhcp-option DNS 178.37.12X.XXX,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Sun May  6 12:01:49 2012 OPTIONS IMPORT: timers and/or timeouts modified
Sun May  6 12:01:49 2012 OPTIONS IMPORT: --ifconfig/up options modified
Sun May  6 12:01:49 2012 OPTIONS IMPORT: route options modified
Sun May  6 12:01:49 2012 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Sun May  6 12:01:49 2012 ROUTE default_gateway=192.168.178.1
Sun May  6 12:01:49 2012 TUN/TAP device tun0 opened
Sun May  6 12:01:49 2012 TUN/TAP TX queue length set to 100
Sun May  6 12:01:49 2012 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Sun May  6 12:01:49 2012 /sbin/ifconfig tun0 10.8.0.6 pointopoint 10.8.0.5 mtu 1500
Sun May  6 12:01:49 2012 /sbin/route add -net 173.67.XX.XXX netmask 255.255.255.255 gw 192.168.178.1
Sun May  6 12:01:49 2012 /sbin/route add -net 0.0.0.0 netmask 128.0.0.0 gw 10.8.0.5
Sun May  6 12:01:49 2012 /sbin/route add -net 128.0.0.0 netmask 128.0.0.0 gw 10.8.0.5
Sun May  6 12:01:49 2012 /sbin/route add -net 10.8.0.1 netmask 255.255.255.255 gw 10.8.0.5
Sun May  6 12:01:49 2012 Initialization Sequence Completed
Sun May  6 12:02:29 2012 read UDPv4 [EHOSTUNREACH]: No route to host (code=113)
Sun May  6 12:02:31 2012 read UDPv4 [EHOSTUNREACH]: No route to host (code=113)
Sun May  6 12:02:31 2012 read UDPv4 [EHOSTUNREACH]: No route to host (code=113)
Sun May  6 12:02:34 2012 read UDPv4 [EHOSTUNREACH]: No route to host (code=113)
Sun May  6 12:02:34 2012 read UDPv4 [EHOSTUNREACH]: No route to host (code=113)
Sun May  6 12:02:34 2012 read UDPv4 [EHOSTUNREACH]: No route to host (code=113)
Sun May  6 12:02:35 2012 read UDPv4 [EHOSTUNREACH]: No route to host (code=113)
Sun May  6 12:02:36 2012 read UDPv4 [EHOSTUNREACH]: No route to host (code=113)
...

The server output:

May  7 00:44:24 ubuntu ovpn-server[10345]: MULTI: multi_create_instance called
May  7 00:44:24 ubuntu ovpn-server[10345]: 96.221.xx.xxx:61062 Re-using SSL/TLS context
May  7 00:44:24 ubuntu ovpn-server[10345]: 96.221.xx.xxx:61062 LZO compression initialized
May  7 00:44:24 ubuntu ovpn-server[10345]: 96.221.xx.xxx:61062 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
May  7 00:44:24 ubuntu ovpn-server[10345]: 96.221.xx.xxx:61062 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
May  7 00:44:24 ubuntu ovpn-server[10345]: 96.221.xx.xxx:61062 Local Options hash (VER=V4): '530fdded'
May  7 00:44:24 ubuntu ovpn-server[10345]: 96.221.xx.xxx:61062 Expected Remote Options hash (VER=V4): '41690919'
May  7 00:44:24 ubuntu ovpn-server[10345]: 96.221.xx.xxx:61062 TLS: Initial packet from [AF_INET]96.221.xx.xxx:61062, sid=b294fccd 91280f68
May  7 00:44:30 ubuntu ovpn-server[10345]: 96.221.xx.xxx:61062 VERIFY OK: depth=1, xxx
May  7 00:44:30 ubuntu ovpn-server[10345]: 96.221.xx.xxx:61062 VERIFY OK: depth=0, xxx
May  7 00:44:32 ubuntu ovpn-server[10345]: 96.221.xx.xxx:61062 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
May  7 00:44:32 ubuntu ovpn-server[10345]: 96.221.xx.xxx:61062 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
May  7 00:44:32 ubuntu ovpn-server[10345]: 96.221.xx.xxx:61062 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
May  7 00:44:32 ubuntu ovpn-server[10345]: 96.221.xx.xxx:61062 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
May  7 00:44:37 ubuntu ovpn-server[10345]: 96.221.xx.xxx:61062 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
May  7 00:44:37 ubuntu ovpn-server[10345]: 96.221.xx.xxx:61062 [moon] Peer Connection Initiated with [AF_INET]96.221.xx.xxx:61062
May  7 00:44:37 ubuntu ovpn-server[10345]: moon/96.221.xx.xxx:61062 MULTI_sva: pool returned IPv4=10.8.0.10, IPv6=38e8:b401::60f3:a001:0:0
May  7 00:44:37 ubuntu ovpn-server[10345]: moon/96.221.xx.xxx:61062 MULTI: Learn: 10.8.0.10 -> moon/96.221.xx.xxx:61062
May  7 00:44:37 ubuntu ovpn-server[10345]: moon/96.221.xx.xxx:61062 MULTI: primary virtual IP for moon/96.221.xx.xxx:61062: 10.8.0.10
May  7 00:44:39 ubuntu ovpn-server[10345]: moon/96.221.xx.xxx:61062 PUSH: Received control message: 'PUSH_REQUEST'
May  7 00:44:39 ubuntu ovpn-server[10345]: moon/96.221.xx.xxx:61062 send_push_reply(): safe_cap=960
May  7 00:44:39 ubuntu ovpn-server[10345]: moon/96.221.xx.xxx:61062 SENT CONTROL [moon]: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.10 10.8.0.9' (status=1)
May  7 00:52:49 ubuntu ovpn-server[10345]: moon/96.221.xx.xxx:61062 [moon] Inactivity timeout (--ping-restart), restarting
May  7 00:52:49 ubuntu ovpn-server[10345]: moon/96.221.xx.xxx:61062 SIGUSR1[soft,ping-restart] received, client-instance restarting

gloner

Are client's connections wireless?

euler24

gloner wroteAre client's connections wireless?

Yes, both clients connect wireless.

gloner

euler24 wroteYes, both clients connect wireless.

Therefore you should try

push "redirect-gateway local def1"

instead of

push "redirect-gateway def1"

euler24

gloner wrote Therefore you should try

push "redirect-gateway local def1"

I see. Thanks for the tipp. I tried it, but with this enabled I got no connection at all. The routes are not looking correct.

Fri May 11 11:13:17 2012 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway local def1,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,dhcp-option DNS 8.8.8.8,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Fri May 11 11:13:17 2012 OPTIONS IMPORT: timers and/or timeouts modified
Fri May 11 11:13:17 2012 OPTIONS IMPORT: --ifconfig/up options modified
Fri May 11 11:13:17 2012 OPTIONS IMPORT: route options modified
Fri May 11 11:13:17 2012 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Fri May 11 11:13:17 2012 ROUTE default_gateway=192.168.178.1
Fri May 11 11:13:17 2012 TUN/TAP device tun0 opened
Fri May 11 11:13:17 2012 TUN/TAP TX queue length set to 100
Fri May 11 11:13:17 2012 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Fri May 11 11:13:17 2012 /sbin/ifconfig tun0 10.8.0.6 pointopoint 10.8.0.5 mtu 1500
Fri May 11 11:13:17 2012 /sbin/route add -net 0.0.0.0 netmask 128.0.0.0 gw 10.8.0.5
Fri May 11 11:13:17 2012 /sbin/route add -net 128.0.0.0 netmask 128.0.0.0 gw 10.8.0.5
Fri May 11 11:13:17 2012 /sbin/route add -net 10.8.0.1 netmask 255.255.255.255 gw 10.8.0.5
Fri May 11 11:13:17 2012 Initialization Sequence Completed

Mimiko

For wireless connections read this topic http://forums.openvpn.net/topic7749.html may be it will help you.

euler24

Mimiko wroteFor wireless connections read this topic http://forums.openvpn.net/topic7749.html may be it will help you.

Still getting this message over and over. What firewall rules do I have to apply on my router and the wireless clients? Maybe it is a firewall issue...

Mimiko

Try a cabled connection to see if this error appears.

euler24

Mimiko wroteTry a cabled connection to see if this error appears.

Yes it does. Cabled or wireless makes no difference.

Mimiko

Did you tried to change mtu? With the commented out lines in your config file. Lowering the MTU can help? Deploy same OpenVPN server to another client in your lan and try connecting them toghether to see if error is present.

euler24

Mimiko wroteDid you tried to change mtu? With the commented out lines in your config file. Lowering the MTU can help? Deploy same OpenVPN server to another client in your lan and try connecting them toghether to see if error is present.

Yes, I tried this. Problem's still there and I got additional MTU warnings:

Thu May 17 09:47:35 2012 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1542', remote='link-mtu 1442'
Thu May 17 09:47:35 2012 WARNING: 'tun-mtu' is used inconsistently, local='tun-mtu 1500', remote='tun-mtu 1400'
...
Thu May 17 09:47:38 2012 Initialization Sequence Completed
Thu May 17 09:48:09 2012 read UDPv4 [EHOSTUNREACH]: No route to host (code=109)
Thu May 17 09:48:09 2012 read UDPv4 [EHOSTUNREACH]: No route to host (code=109)

Mimiko

Of course, mtu settings must be changed both on server and client.

euler24

Mimiko wroteOf course, mtu settings must be changed both on server and client.

You are right, my bad. I use

tun-mtu 1400

now. Should I set the fragment option too?

The EHOSTUNREACH error message is gone now. Thanks Mimiko! I still have some questions though.

1. How can I determine the best mtu? Will mtu 1400 slow me down in any way?
2. Why did this happen after all? I never had such a error message showing up before and I didn't change my provider, my configuration nor my hosting company recently.
3. I have other clients from other networks that connect to the server. Will the lower mtu affect their connection in any bad way? Is there a general rule of thumb regarding the mtu setting for the server? I guess 1500 is standard, right?

janjust

1. How can I determine the best mtu? Will mtu 1400 slow me down in any way?

lowering the MTU and/or modifying the 'fragment' value can affect performance. The only real method for finding the optimal values is by experimenting. I find 'iperf' to be a handy tool for this (available for Linux, Mac and Windows).

3. I have other clients from other networks that connect to the server. Will the lower mtu affect their connection in any bad way? Is there a general rule of thumb regarding the mtu setting for the server? I guess 1500 is standard, right?

if you lower the MTU on the server then the MTU needs to be adjusted for *ALL* clients.

Mimiko

1. Best MTU is determined empirically only by testing for specific connection.
2. A slight change on packet route thru the internet can encounter fragmentation.
3. 1500 bytes per packet is a standart size in IPv4 connections. Old switches and hubs can't handle packets with size bigger than 1500, so the packet will be fragmented and more acknowledge packets will be present in transmit media. Lowering OpenVPN MTU allows for lower layers to add their informative bytes to packet in such that the packet will not be fragmented in its way to destination.

So, mtu must be as high as possible without invoking fragmentation on the way.