Site to site hangs when provider IP change

forstera

Hello all,
I installed a site to site openvpn between 2 linux servers. Each server receives its public IP adress from its provider and informs a dyndns system. So, I'v not the IP address in my conf but a dns name. The problem is that each time the public IP changes, OpenVPN hangs and cannot reinitialize the connection. Here's my conf files :

First site :

port 1195
proto udp
dev tun
persist-key
persist-tun
remote myfirstsite.poweredbyclear.com
local mysecondsite.poweredbyclear.com
secret /etc/openvpn/keys/neuveville.key
float
ping 10
ping-restart 60
comp-lzo
verb 2
ifconfig 10.100.2.2 10.100.2.1
route 192.168.1.0 255.255.255.0 10.100.2.1

Second Site :

port 1195
proto udp
dev tun
persist-tun
# persist-key
local myfirstsite.poweredbyclear.com
remote mysecondsite.poweredbyclear.com
secret /etc/openvpn/keys/neuveville.key
float
ping 10
ping-restart 60
comp-lzo
verb 2
ifconfig 10.100.2.1 10.100.2.2
route 192.168.3.0 255.255.255.0 10.100.2.2

and here's the logs from one side :

ug 9 22:30:12 system last message repeated 3 times
Aug 9 22:30:22 system openvpn[8756]: Inactivity timeout (--ping-restart), restarting
Aug 9 22:30:22 system openvpn[8756]: TCP/UDP: Closing socket
Aug 9 22:30:22 system openvpn[8756]: SIGUSR1[soft,ping-restart] received, process restarting
Aug 9 22:30:24 system openvpn[8756]: NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Aug 9 22:30:24 system openvpn[8756]: Static Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Aug 9 22:30:24 system openvpn[8756]: Static Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Aug 9 22:30:24 system openvpn[8756]: Static Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Aug 9 22:30:24 system openvpn[8756]: Static Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Aug 9 22:30:24 system openvpn[8756]: LZO compression initialized
Aug 9 22:30:24 system openvpn[8756]: Preserving previous TUN/TAP instance: tun1
Aug 9 22:30:24 system openvpn[8756]: Data Channel MTU parms [ L:1545 D:1450 EF:45 EB:135 ET:0 EL:0 AF:3/1 ]
Aug 9 22:30:24 system openvpn[8756]: Local Options hash (VER=V4): '220412e7'
Aug 9 22:30:24 system openvpn[8756]: Expected Remote Options hash (VER=V4): '454a485a'
Aug 9 22:30:24 system openvpn[8756]: UDPv4 link local (bound): 109.164.201.168:1195
Aug 9 22:30:24 system openvpn[8756]: UDPv4 link remote: 83.78.129.79:1195
Aug 9 22:30:24 system openvpn[8756]: read UDPv4 [ECONNREFUSED]: Connection refused (code=111)

Per advance, thanks very much for your help
Regards

maikcat

hi there,

a best practice is to use at least on static ip...

try to use ping-restart directive (although im not sure if it will work in your case..)

Michael.

forstera

Hello maikat,
thanks for your answer. I forgot to mention that on 1 side, I've a static IP address. On the side where there's no static, I got the following error message :

RESOLVE: Cannot resolve host address: hippen.poweredbyclear.com: [TRY_AGAIN] A temporary error occurred on an authoritative name server.

I'll add the directive you said and see if something changes ...

Thanks very much for your help

Arnaud

maikcat

just to add you can still achieve the same results using
certificates and client-server config without having trouble with dyndns (your client with dynamic will connect to your server with static 😉 )

Michael.

forstera

excuse me if I've a bad understanding but my ovenpn is site-to-site so i need a connection from both sides. What is strange in my case is that the side 'hippen.poweredbyclear.com' is the one with a public ip address (which changes once a day) and it cannot resolve itself because the following error message comes from the 'hippen.poweredbyclear.com' side .. (Cannot resolve host address: hippen.poweredbyclear.com:). ...

thanks very much
Arnaud

maikcat

RESOLVE: Cannot resolve host address: hippen.poweredbyclear.com: [TRY_AGAIN] A temporary error occurred on an authoritative name server.

temporary error on name server... :?

i dont think you can do much about it (except if you own the dns server).

Michael.

forstera

Hello all,

We found a solution for that but it's not optimal :
every 5 minutes, a cron job try to ping the other end of the tunnel. If the ping fail, then the job restar the openvpn service.
this seems to work but users can have a 5 minutes stop in their work. So I was wondering if it exists a way to detect in a few seconds that the tunnel is down and to restart the service ?

Thanks to all