rezroo
Hi - I'm running "OpenVPN 2.2.1 x86_64-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Mar 30 2012" as a server and client. I've configured the server for "keepalive 10 120" and I have tcpdump running on the client. I do not see any ping messages from the server to the client, but I do see them when I explicitly ping the client from the server. Below is the output when I issue an explicit "ping 10.55.49.6" and after that there is no more output. Is keepalive broken in this release of the server? My server config is below.
Thanks in advance.
owner@ubuntu-hypervisor:~$ sudo tcpdump -i tun0 -nSvv
tcpdump: listening on tun0, link-type RAW (Raw IP), capture size 65535 bytes
16:28:37.488057 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto ICMP (1), length 84)
10.55.49.1 > 10.55.49.6: ICMP echo request, id 15170, seq 1, length 64
16:28:37.488100 IP (tos 0x0, ttl 64, id 33207, offset 0, flags [none], proto ICMP (1), length 84)
10.55.49.6 > 10.55.49.1: ICMP echo reply, id 15170, seq 1, length 64
16:28:38.489236 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto ICMP (1), length 84)
10.55.49.1 > 10.55.49.6: ICMP echo request, id 15170, seq 2, length 64
# grep -vE '^#|^;|^$' server.conf
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh2048.pem
server 10.55.49.0 255.255.255.0
ifconfig-pool-persist ipp.txt
client-config-dir ccd
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
log openvpn.log
verb 6
rezroo
Hi - posted a previous message regarding this but it never made it to be public. Here is my second attempt. I'm trying to confirm that keepalive ping messages are send from the openvpn server to the client (or vice versa, if that is the case). I'm using "tcpdump -i tun0 -nSvv" both on the client and the server. I have a second window showing "tail -f openvpn.log". While I see a lot of log messages in openvpn.log, I see nothing in tcpdump. If I ping explicitly then I see the icmp packets in tcpdump. The read/write messages are also in the log file as "TUN READ" or "TUN WRITE", while the stuff that don't show in tcpdump are "UDPv4 READ" or "UDPv4 WRITE". I think that is why UDPv4 packets don't show on the tcpdump of tun0. My question is if keepalive is implemented not using the normal ICMP ping, and if so is there a way to confirm the keepalive messages using tcpdump?
Thanks,
Rez
Mimiko
Try the phisical interface insteed. As I'm aware, keepalive pings are not send via tunnel, but rather directly.
