Openvpn dual wan connection issues.

ericf706

I am having trouble getting a stable connection with my current setup. I have a server that has two wan connections. One of the connections is a failover in case the primary connection goes down. The client can connect and everything is working, but then the connection will randomly drop and reinitialize.

I have discovered that the cause of this issue is that instead of answering from the interface that the connection was initialized on, the server is responding out of the other interface. The client will then initialize a connection with the other interface. This will work until the server decides to switch interfaces again and the connection will drop and reinitialize.

I have put the float option in the client configuration file, should this allow a response from a different ip address to be ok as long as the credentials are validated?

I have struggled to figure out *why* the server will randomly (it seems) start using the other interface for the vpn. (The route tables seem to force replies out of the same interface the initial packet was recieved)
Client conf:

client
dev tun
proto udp
remote x.x.x.x 1194
remote y.y.y.y 1194
nobind
keepalive 15 120
persist-key
persist-tun
ca /etc/openvpn/ca.pem
cert /etc/openvpn/bnfw.pem
key /etc/openvpn/bnfwKey.pem
comp-lzo
verb 3
float

server conf:

port 1194
proto udp
dev tun
ca ca.pem
cert drfw.pem
key drfwKey.pem
dh dh2048.pem
server 10.2.0.0 255.255.0.0
ifconfig-pool-persist ipp.txt
push "route 172.30.20.0 255.255.255.0"
client-config-dir ccd
route 172.30.31.0 255.255.255.0
keepalive 10 120
comp-lzo
persist-key
persist-tun
verb 4

maikcat

hi there,

One of the connections is a failover in case the primary connection goes down.

I have discovered that the cause of this issue is that instead of answering from the interface that the connection was initialized on, the server is responding out of the other interface.

if its failover scenario how this can happen?
can you please more info about your failover setup?

also are you familiar with this: http://kindlund.wordpress.com/2007/11/19/configuring-multiple-default-routes-in-linux/

Michael.

ericf706

Hi,
Its a fail over for the vpn connection. In the client configuration it has remote options for each of the ip addresses, along with the float option. The vpn attempts to connect to the first listed ip, and then the second ip if it cannot connect to the first. If the connection drops then the client vpn will automatically connect to the other remote ip (after the timeout).

Route:

0:	from all lookup local 
10000:	from all fwmark 0x1/0xff lookup T1 
10001:	from all fwmark 0x2/0xff lookup T6 
20000:	from x.x.x.x lookup T1 
20000:	from y.y.y.y lookup T6 
32766:	from all lookup main 
32767:	from all lookup default

iptables (mangle table prerouting chain):

MARK       all  --  eth0   *       0.0.0.0/0            0.0.0.0/0           MARK set 0x1 
MARK       all  --  eth1   *       0.0.0.0/0            0.0.0.0/0           MARK set 0x2

Table T1 and T6 route traffic out the interface associated with each connection.

I found out that responses to the keep-alive pings were switching interfaces by using a tcpdump (filtered on port 1194) on both interfaces.

I can provide more info, but I am a little stumped were to look from here, or what else to provide. When I run openvpn with increased verbosity, I can see the ping request and responses. Then when the replies switch interfaces the server responses are refused by the client untill the connection gets reinitialized on the second remote ip.

ericf706

I fixed this issue on Monday. Reading the man page for openvpn, I came across a directive I have missed previously that seems to have fixed the issue. The multihome option added to the server conf file took care of the interface swapping.

opalomo

Hi there. It's good that you have fixed your problem. However I am facing the same but running openvpn over ClearOs 5.2 Sp1

It is showing the exact same behavior and I haven't found a fix or a workaround. Sometimes it keeps working for days and suddenly it starts acting up and I am not able to connect the branch vpn to the Headquarters office vpn.

If anyone has a suggestion, it is welcome.

Thanks in advance.