OpenVPN Community Edition (keepalive and User's Connections)

macaujohn2000

Dear all,

I am using OpenVPN Community Edition, and I have set 'keepalive 2 10', how can I verify OpenVPN has ping to client to detect failure? because I have used wireshark to capture but there are no any keepalive packet in tun0 of clients.

On the other hand, how can i see what users are currently connecting to openvpn? can i set a limited bandwidth for dedicated users?

Thanks!

janjust

I am using OpenVPN Community Edition, and I have set 'keepalive 2 10', how can I verify OpenVPN has ping to client to detect failure? because I have used wireshark to capture but there are no any keepalive packet in tun0 of clients.

if you use

verb 5

or higher (perhaps even 4) you will see the ping keepalive packets popping up in the log files on both sides. The ping packets are control packets and are not seen on the tun devices.

On the other hand, how can i see what users are currently connecting to openvpn? can i set a limited bandwidth for dedicated users?

use the management interface to view the currently connected users.
Add the 'shaper' directive to the client configuration files to limit the upload speed of the clients ; it's not possible to limit the download speed (i.e. the rate at which packets are sent from the server to the client).

macaujohn2000

As I am just a beginner, could you specify any documents that I can refer to? such as how to do per user access list to OpenVPN's server farm and limit uploading and downloading bandwidth.

janjust

Start by reading the HOWTO:
http://openvpn.net/index.php/open-source/documentation/howto.html

The stuff you want is not beginner level stuff, so you will have to learn more about openvpn and routing yourself.

macaujohn2000

oh i saw in man page:

--shaper n
Limit bandwidth of outgoing tunnel data to n bytes per second on the TCP/UDP port. If you want to limit the bandwidth in both directions, use this option on both peers.
OpenVPN uses the following algorithm to implement traffic shaping: Given a shaper rate of n bytes per second, after a datagram write of b bytes is queued on the TCP/UDP port, wait a minimum of (b / n) seconds before queuing the next write.

It should be noted that OpenVPN supports multiple tunnels between the same two peers, allowing you to construct full-speed and reduced bandwidth tunnels at the same time, routing low-priority data such as off-site backups over the reduced bandwidth tunnel, and other data over the full-speed tunnel.

Also note that for low bandwidth tunnels (under 1000 bytes per second), you should probably use lower MTU values as well (see above), otherwise the packet latency will grow so large as to trigger timeouts in the TLS layer and TCP connections running over the tunnel.

OpenVPN allows n to be between 100 bytes/sec and 100 Mbytes/sec.

>>>>>>>>>>>>>>>>>>>>>>.>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
But is it available 'shaper n' just add into 'server.conf' rather than in command line interface?

janjust

IIRC you cannot use 'shaper N' in the server config, add it to the client config instead.

macaujohn2000

So what I mean is that when client is to modify client.conf, the traffic sharp will no longer be use, i need to prevent users from doing this...!!!!!!!!!!!!!!!! thanks!