Client not failing over to second remote option

palesius

I'm having trouble getting failover to a secondary server to work in the client config.

My client config is as follows:

dev tun
persist-tun
persist-key
proto udp
cipher AES-256-CBC
tls-client
client
remote x.x.x.x 1195
remote y.y.y.y 1194
resolv-retry infinite
tls-remote VPNServer
auth-user-pass
ca OpenVPN-ca.crt
tls-auth OpenVPN-tls.key 1
comp-lzo

It connects just fine to the 1st server. And if I swap the servers it connects just fine to the second.
However if I make the 1st server deliberately unreachable (to test failover). It doesn't seem to ever try the second server.
Connection log below:

Wed Oct 03 09:37:10 2012 OpenVPN 2.2.0 i686-pc-mingw32 [SSL] [LZO2] [PKCS11] [IPv6 payload 20110521-1 (2.2.0)] built on May 21 2011
Enter Management Password:
Wed Oct 03 09:37:14 2012 WARNING: Make sure you understand the semantics of --tls-remote before using it (see the man page).
Wed Oct 03 09:37:14 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Wed Oct 03 09:37:15 2012 Control Channel Authentication: using 'OpenVPN-tls.key' as a OpenVPN static key file
Wed Oct 03 09:37:15 2012 LZO compression initialized
Wed Oct 03 09:37:15 2012 UDPv4 link local (bound): [undef]:1194
Wed Oct 03 09:37:15 2012 UDPv4 link remote: x.x.x.x:1195
Wed Oct 03 09:38:15 2012 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Wed Oct 03 09:38:15 2012 TLS Error: TLS handshake failed
Wed Oct 03 09:38:15 2012 SIGTERM[soft,tls-error] received, process exiting

Mimiko

May be try remove this:

resolv-retry infinite

Actually it must fail to the next remote. But try to update OpenVPN. There were version when after a succesfull connection to one remote, it will not try others.

palesius

Mimiko wrote Actually it must fail to the next remote. But try to update OpenVPN. There were version when after a succesfull connection to one remote, it will not try others.

Thanks, that did the trick.
Apparently the 2.2.0 client (which is what I was using as it is what is bundled in with pfSense where I have my server running) does not handle the failover properly.
The 2.2.2 client worked as expected.