Problem with tun mtu...

bling8d

Hi everybody, I have some problem to set up openvpn in linux, I guess it's a mtu problem. I searched google for hours and also this forum, seems that some people fixed it with tun-mtu-extra 32, didn't work for me
Here's the log:

Sep 25 08:52:18 2012 OpenVPN 2.1.0 i486-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [MH] [PF_INET6] [eurephia] built on Jul 20 2010
Tue Sep 25 08:52:25 2012 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Tue Sep 25 08:52:25 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Tue Sep 25 08:52:25 2012 LZO compression initialized
Tue Sep 25 08:52:25 2012 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Tue Sep 25 08:52:25 2012 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Sep 25 08:52:25 2012 Local Options hash (VER=V4): '41690919'
Tue Sep 25 08:52:25 2012 Expected Remote Options hash (VER=V4): '530fdded'
Tue Sep 25 08:52:25 2012 Socket Buffers: R=[163840->131072] S=[163840->131072]
Tue Sep 25 08:52:25 2012 UDPv4 link local: [undef]
Tue Sep 25 08:52:25 2012 UDPv4 link remote: [AF_INET]192.162.102.162:1194
Tue Sep 25 08:52:25 2012 TLS: Initial packet from [AF_INET]192.162.102.162:1194, sid=8b3b8a18 8738310f
Tue Sep 25 08:52:25 2012 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Tue Sep 25 08:52:26 2012 VERIFY OK: depth=1, /C=NV/ST=NV/L=nVPN/O=nVpn/CN=nVpn_CA/emailAddress=support@nvpn.net
Tue Sep 25 08:52:26 2012 VERIFY OK: depth=0, /C=NV/ST=NV/L=nVPN/O=nVpn/CN=server/emailAddress=support@nvpn.net
Tue Sep 25 08:52:27 2012 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1542', remote='link-mtu 6042'
Tue Sep 25 08:52:27 2012 WARNING: 'tun-mtu' is used inconsistently, local='tun-mtu 1500', remote='tun-mtu 6000'
Tue Sep 25 08:52:27 2012 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Sep 25 08:52:27 2012 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Sep 25 08:52:27 2012 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Sep 25 08:52:27 2012 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Sep 25 08:52:27 2012 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Tue Sep 25 08:52:27 2012 [server] Peer Connection Initiated with [AF_INET]192.162.102.162:1194
Tue Sep 25 08:52:29 2012 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Tue Sep 25 08:52:29 2012 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.8.8,route 10.102.162.1,topology net30,ping 10,ping-restart 120,ifconfig 10.102.162.6 10.102.162.5'
Tue Sep 25 08:52:29 2012 OPTIONS IMPORT: timers and/or timeouts modified
Tue Sep 25 08:52:29 2012 OPTIONS IMPORT: --ifconfig/up options modified
Tue Sep 25 08:52:29 2012 OPTIONS IMPORT: route options modified
Tue Sep 25 08:52:29 2012 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Tue Sep 25 08:52:29 2012 ROUTE default_gateway=10.0.2.2
Tue Sep 25 08:52:29 2012 TUN/TAP device tun0 opened
Tue Sep 25 08:52:29 2012 TUN/TAP TX queue length set to 100
Tue Sep 25 08:52:29 2012 /sbin/ifconfig tun0 10.102.162.6 pointopoint 10.102.162.5 mtu 1500
Tue Sep 25 08:52:29 2012 /sbin/route add -net 192.162.102.162 netmask 255.255.255.255 gw 10.0.2.2
Tue Sep 25 08:52:29 2012 /sbin/route add -net 0.0.0.0 netmask 128.0.0.0 gw 10.102.162.5
Tue Sep 25 08:52:29 2012 /sbin/route add -net 128.0.0.0 netmask 128.0.0.0 gw 10.102.162.5
Tue Sep 25 08:52:29 2012 /sbin/route add -net 10.102.162.1 netmask 255.255.255.255 gw 10.102.162.5
Tue Sep 25 08:52:29 2012 Initialization Sequence Completed

Thank you, tell me if you need anything else, I'll be here all day trying to make this work x)

maikcat

hi there,

Hi everybody, I have some problem to set up openvpn in linux, I guess it's a mtu problem.

with this description you expect someone to help you??

please post logs/configs ,what is working and what is not...

from your log i see you connect ok..

Michael.

bling8d

Yes it seems ok but I have no connection

I thought the problem came from this

Tue Sep 25 08:52:27 2012 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1542', remote='link-mtu 6042'
Tue Sep 25 08:52:27 2012 WARNING: 'tun-mtu' is used inconsistently, local='tun-mtu 1500', remote='tun-mtu 6000'

so I added tun-mtu 6000 in my .ovpn file and the warning is gone.

client
dev tun
auth-user-pass
proto udp
remote u577131.nvpn.so 1194
resolv-retry infinite
nobind
persist-key
persist-tun
tun-mtu 6000

comp-lzo
ca /root/nvpn/nVPN.crt
verb 3

log after that:

Tue Sep 25 14:49:31 2012 OpenVPN 2.1.0 i486-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [MH] [PF_INET6] [eurephia] built on Jul 20 2010
Enter Auth Username:pumpedup
Enter Auth Password:
Tue Sep 25 14:49:38 2012 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Tue Sep 25 14:49:38 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Tue Sep 25 14:49:38 2012 LZO compression initialized
Tue Sep 25 14:49:38 2012 WARNING: normally if you use --mssfix and/or --fragment, you should also set --tun-mtu 1500 (currently it is 6000)
Tue Sep 25 14:49:38 2012 Control Channel MTU parms [ L:6042 D:138 EF:38 EB:0 ET:0 EL:0 ]
Tue Sep 25 14:49:38 2012 Data Channel MTU parms [ L:6042 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Tue Sep 25 14:49:38 2012 Local Options hash (VER=V4): 'be642dac'
Tue Sep 25 14:49:38 2012 Expected Remote Options hash (VER=V4): '1c54aba8'
Tue Sep 25 14:49:38 2012 Socket Buffers: R=[163840->131072] S=[163840->131072]
Tue Sep 25 14:49:38 2012 UDPv4 link local: [undef]
Tue Sep 25 14:49:38 2012 UDPv4 link remote: [AF_INET]192.162.102.162:1194
Tue Sep 25 14:49:38 2012 TLS: Initial packet from [AF_INET]192.162.102.162:1194, sid=39aabb90 d1dfefca
Tue Sep 25 14:49:38 2012 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Tue Sep 25 14:49:40 2012 VERIFY OK: depth=1, /C=NV/ST=NV/L=nVPN/O=nVpn/CN=nVpn_CA/emailAddress=support@nvpn.net
Tue Sep 25 14:49:40 2012 VERIFY OK: depth=0, /C=NV/ST=NV/L=nVPN/O=nVpn/CN=server/emailAddress=support@nvpn.net
Tue Sep 25 14:49:41 2012 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Sep 25 14:49:41 2012 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Sep 25 14:49:41 2012 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Tue Sep 25 14:49:41 2012 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Sep 25 14:49:41 2012 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Tue Sep 25 14:49:41 2012 [server] Peer Connection Initiated with [AF_INET]192.162.102.162:1194
Tue Sep 25 14:49:43 2012 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Tue Sep 25 14:49:43 2012 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.8.8,route 10.102.162.1,topology net30,ping 10,ping-restart 120,ifconfig 10.102.162.6 10.102.162.5'
Tue Sep 25 14:49:43 2012 OPTIONS IMPORT: timers and/or timeouts modified
Tue Sep 25 14:49:43 2012 OPTIONS IMPORT: --ifconfig/up options modified
Tue Sep 25 14:49:43 2012 OPTIONS IMPORT: route options modified
Tue Sep 25 14:49:43 2012 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Tue Sep 25 14:49:43 2012 ROUTE default_gateway=10.0.2.2
Tue Sep 25 14:49:43 2012 TUN/TAP device tun0 opened
Tue Sep 25 14:49:43 2012 TUN/TAP TX queue length set to 100
Tue Sep 25 14:49:43 2012 /sbin/ifconfig tun0 10.102.162.6 pointopoint 10.102.162.5 mtu 6000
Tue Sep 25 14:49:43 2012 /sbin/route add -net 192.162.102.162 netmask 255.255.255.255 gw 10.0.2.2
Tue Sep 25 14:49:43 2012 /sbin/route add -net 0.0.0.0 netmask 128.0.0.0 gw 10.102.162.5
Tue Sep 25 14:49:43 2012 /sbin/route add -net 128.0.0.0 netmask 128.0.0.0 gw 10.102.162.5
Tue Sep 25 14:49:43 2012 /sbin/route add -net 10.102.162.1 netmask 255.255.255.255 gw 10.102.162.5
Tue Sep 25 14:49:43 2012 Initialization Sequence Completed

ifconfig

eth0      Link encap:Ethernet  HWaddr 08:00:27:78:6e:14  
          inet addr:10.0.2.15  Bcast:10.0.2.255  Mask:255.255.255.0
          inet6 addr: fe80::a00:27ff:fe78:6e14/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:4746 errors:0 dropped:0 overruns:0 frame:0
          TX packets:4762 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:930374 (930.3 KB)  TX bytes:520405 (520.4 KB)
          Interrupt:10 Base address:0xd020 

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:528 errors:0 dropped:0 overruns:0 frame:0
          TX packets:528 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:38197 (38.1 KB)  TX bytes:38197 (38.1 KB)

tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00  
          inet addr:10.102.162.6  P-t-P:10.102.162.5  Mask:255.255.255.255
          UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:6000  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

route -n

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
0.0.0.0         10.102.162.5    128.0.0.0       UG    0      0        0 tun0
0.0.0.0         10.0.2.2        0.0.0.0         UG    0      0        0 eth0
10.0.2.0        0.0.0.0         255.255.255.0   U     1      0        0 eth0
10.102.162.1    10.102.162.5    255.255.255.255 UGH   0      0        0 tun0
10.102.162.5    0.0.0.0         255.255.255.255 UH    0      0        0 tun0
128.0.0.0       10.102.162.5    128.0.0.0       UG    0      0        0 tun0
192.162.102.162 10.0.2.2        255.255.255.255 UGH   0      0        0 eth0

Thank you

maikcat

server config?

Michael.

bling8d

I can't, I purchased this vpn at https://nvpn.net

maikcat

have you contacted them about your issue?

Michael.

bling8d

Yes and they weren't able to help me... Their last reply told me to switch to tcp connection but this is irreversible and I'm not sure It will solve my problem so I don't want to do it. I've just sent them a message and asked if I can see the server config.
Btw if anyone want an acces to my machine to help me just tell me (:

Thanks

bling8d

They gave me the server file:

dev tun
proto tcp
port 443
local 192.162.101.189
ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/easy-rsa/2.0/keys/server.key
dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem
auth-user-pass-verify ./xxxx.pl via-env
client-cert-not-required
script-security 3
username-as-common-name
user nobody
group nogroup
server 10.101.189.0 255.255.255.0
persist-key
persist-tun
client-config-dir ccd
mute 20
keepalive 10 120
verb 0
comp-lzo
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
client-connect ./xxxx.pl
client-disconnect ./xxxxx.pl
tun-mtu 1500
fragment 0
mssfix 0
cipher BF-CBC

And they switched me to tcp but it doesn't work either..
Here is the log


Wed Sep 26 18:42:01 2012 OpenVPN 2.1.0 i486-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [MH] [PF_INET6] [eurephia] built on Jul 20 2010
Wed Sep 26 18:42:07 2012 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Wed Sep 26 18:42:07 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Wed Sep 26 18:42:07 2012 LZO compression initialized
Wed Sep 26 18:42:07 2012 Control Channel MTU parms [ L:1544 D:140 EF:40 EB:0 ET:0 EL:0 ]
Wed Sep 26 18:42:07 2012 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]
Wed Sep 26 18:42:07 2012 Local Options hash (VER=V4): '69109d17'
Wed Sep 26 18:42:07 2012 Expected Remote Options hash (VER=V4): 'c0103fa8'
Wed Sep 26 18:42:07 2012 Attempting to establish TCP connection with [AF_INET]192.162.101.189:443 [nonblock]
Wed Sep 26 18:42:08 2012 TCP connection established with [AF_INET]192.162.101.189:443
Wed Sep 26 18:42:08 2012 Socket Buffers: R=[87380->131072] S=[21480->131072]
Wed Sep 26 18:42:08 2012 TCPv4_CLIENT link local: [undef]
Wed Sep 26 18:42:08 2012 TCPv4_CLIENT link remote: [AF_INET]192.162.101.189:443
Wed Sep 26 18:42:08 2012 TLS: Initial packet from [AF_INET]192.162.101.189:443, sid=f670a8f3 689fe790
Wed Sep 26 18:42:08 2012 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Wed Sep 26 18:42:17 2012 VERIFY OK: depth=1, /C=NV/ST=NV/L=nVPN/O=nVpn/CN=nVpn_CA/emailAddress=support@nvpn.net
Wed Sep 26 18:42:17 2012 VERIFY OK: depth=0, /C=NV/ST=NV/L=nVPN/O=nVpn/CN=server/emailAddress=support@nvpn.net
Wed Sep 26 18:42:23 2012 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Sep 26 18:42:23 2012 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Sep 26 18:42:23 2012 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Sep 26 18:42:23 2012 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Sep 26 18:42:23 2012 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Wed Sep 26 18:42:23 2012 [server] Peer Connection Initiated with [AF_INET]192.162.101.189:443
Wed Sep 26 18:42:25 2012 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Wed Sep 26 18:42:26 2012 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.8.8,route 10.101.189.1,topology net30,ping 10,ping-restart 120,ifconfig 10.101.189.22 10.101.189.21'
Wed Sep 26 18:42:26 2012 OPTIONS IMPORT: timers and/or timeouts modified
Wed Sep 26 18:42:26 2012 OPTIONS IMPORT: --ifconfig/up options modified
Wed Sep 26 18:42:26 2012 OPTIONS IMPORT: route options modified
Wed Sep 26 18:42:26 2012 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Wed Sep 26 18:42:26 2012 ROUTE default_gateway=192.168.1.1
Wed Sep 26 18:42:26 2012 TUN/TAP device tun0 opened
Wed Sep 26 18:42:26 2012 TUN/TAP TX queue length set to 100
Wed Sep 26 18:42:26 2012 /sbin/ifconfig tun0 10.101.189.22 pointopoint 10.101.189.21 mtu 1500
Wed Sep 26 18:42:26 2012 /sbin/route add -net 192.162.101.189 netmask 255.255.255.255 gw 192.168.1.1
Wed Sep 26 18:42:26 2012 /sbin/route add -net 0.0.0.0 netmask 128.0.0.0 gw 10.101.189.21
Wed Sep 26 18:42:26 2012 /sbin/route add -net 128.0.0.0 netmask 128.0.0.0 gw 10.101.189.21
Wed Sep 26 18:42:26 2012 /sbin/route add -net 10.101.189.1 netmask 255.255.255.255 gw 10.101.189.21
Wed Sep 26 18:42:26 2012 Initialization Sequence Completed
Wed Sep 26 18:43:27 2012 event_wait : Interrupted system call (code=4)
Wed Sep 26 18:43:27 2012 TCP/UDP: Closing socket
Wed Sep 26 18:43:27 2012 /sbin/route del -net 10.101.189.1 netmask 255.255.255.255
Wed Sep 26 18:43:27 2012 /sbin/route del -net 192.162.101.189 netmask 255.255.255.255
Wed Sep 26 18:43:27 2012 /sbin/route del -net 0.0.0.0 netmask 128.0.0.0
Wed Sep 26 18:43:27 2012 /sbin/route del -net 128.0.0.0 netmask 128.0.0.0
Wed Sep 26 18:43:27 2012 Closing TUN/TAP interface
Wed Sep 26 18:43:27 2012 /sbin/ifconfig tun0 0.0.0.0
Wed Sep 26 18:43:27 2012 SIGHUP[hard,] received, process restarting
Wed Sep 26 18:43:27 2012 OpenVPN 2.1.0 i486-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [MH] [PF_INET6] [eurephia] built on Jul 20 2010
Wed Sep 26 18:43:27 2012 Restart pause, 5 second(s)
Wed Sep 26 18:43:32 2012 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Wed Sep 26 18:43:32 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Wed Sep 26 18:43:32 2012 LZO compression initialized
Wed Sep 26 18:43:32 2012 Control Channel MTU parms [ L:1544 D:140 EF:40 EB:0 ET:0 EL:0 ]
Wed Sep 26 18:43:33 2012 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]
Wed Sep 26 18:43:33 2012 Local Options hash (VER=V4): '69109d17'
Wed Sep 26 18:43:33 2012 Expected Remote Options hash (VER=V4): 'c0103fa8'
Wed Sep 26 18:43:33 2012 Attempting to establish TCP connection with [AF_INET]192.162.101.189:443 [nonblock]

janjust

without the corresponding server log it is impossible to tell what is going on; their UDP config is a bit strange, however, with the MTU of 6000 (but not impossible). The same is true for that setup - you will need to see more of the corresponding server log to find out what the issue is. It could also be a home router issue - can you try connecting to the internet as directly as possible (bypassing local wifi routers etc) ?

bling8d

Ok I've figured out the cause of the problem, it's my routeur. I can connect to my vpn when I'm connected in another connection. Any idea about what could be the problem? I'm in the routeur config but I don't see the problem, I tried to disable the firewall etc but nothing worked

Thank you