p.jeliazkov
Dear OpenVPN Gurus,
Since last month I have a really big and mysterious problems with our network that cannot resolve and I will be really glad if somebody can help me.
We have an OpenVPN server and 4 other OpenVPN clients running Linux.
On each client we have a couple of TAP devices that are in bridge.
We use TCP protocol.
The problem is following and it hapens frequiently on 2 clients not all clients:
The VPN server log says (I replaced the bs1 clients IP address with 111.111.111.111):
Wed Aug 29 14:45:11 2012 bs1/111.111.111.111:47021 MBUF: mbuf packet dropped
Wed Aug 29 14:45:11 2012 bs1/111.111.111.111:47021 MBUF: mbuf packet dropped
Wed Aug 29 14:45:11 2012 bs1/111.111.111.111:47021 MBUF: mbuf packet dropped
Wed Aug 29 14:45:11 2012 bs1/111.111.111.111:47021 MBUF: mbuf packet dropped
Wed Aug 29 14:45:11 2012 bs1/111.111.111.111:47021 MBUF: mbuf packet dropped
Wed Aug 29 14:45:11 2012 bs1/111.111.111.111:47021 MBUF: mbuf packet dropped
Wed Aug 29 14:45:11 2012 bs1/111.111.111.111:47021 MBUF: mbuf packet dropped
Wed Aug 29 14:45:11 2012 bs1/111.111.111.111:47021 MBUF: mbuf packet dropped
Wed Aug 29 14:45:11 2012 bs1/111.111.111.111:47021 MBUF: mbuf packet dropped
Wed Aug 29 14:45:11 2012 bs1/111.111.111.111:47021 MBUF: mbuf packet dropped
Wed Aug 29 14:45:11 2012 bs1/111.111.111.111:47021 MBUF: mbuf packet dropped
Wed Aug 29 14:45:11 2012 bs1/111.111.111.111:47021 Connection reset, restarting [-1]
Wed Aug 29 14:45:11 2012 bs1/111.111.111.111:47021 SIGUSR1[soft,connection-reset] received, client-instance restarting
0
Wed Aug 29 14:45:11 2012 TCP/UDP: Closing socket
Wed Aug 29 14:45:16 2012 MULTI: multi_create_instance called
Wed Aug 29 14:45:16 2012 Re-using SSL/TLS context
Wed Aug 29 14:45:16 2012 LZO compression initialized
................
The client log says:
Wed Aug 29 14:45:11 2012 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #170321 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Wed Aug 29 14:45:11 2012 Fatal decryption error (process_incoming_link), restarting
Wed Aug 29 14:45:11 2012 TCP/UDP: Closing socket
Wed Aug 29 14:45:11 2012 Closing TUN/TAP interface
Wed Aug 29 14:45:11 2012 SIGUSR1[soft,decryption-error] received, process restarting
Wed Aug 29 14:45:11 2012 Restart pause, 5 second(s)
Wed Aug 29 14:45:16 2012 Re-using SSL/TLS context
...
Wed Aug 29 14:45:17 2012 Initialization Sequence Completed
...........................
Another annoying thing that I've figured is that if the stopping client is the Root Bridge at the moment of stopping (client disconecting) the bandwidth monitor says that the traffic throught the forwarding TAP is more than 500 MB/s and the packets are more than 5 billions per second.
I've changed the tcp-queue-limit to 1024 but it doesn't help.
Please help...
Mimiko
In TAP-bridged mode any packet from bridget interface is sent to the tunnel. So if a client have a busy network side, the buffer for tunnel will be spoofed with queued packets. Remember, local LAN is much faster than the tunnel.
