Connection Continually Reauthorizing

lenwood

Hi All, I've been using OpenVPN for several months without difficulty. I have it running on a VPS and its been perfect. Last week the host rebooted the server, and since then I can connect, but when I try to surf the web through it the connection is reset and TunnelBlick goes through the connection/authorization process again and again. Nothing has changed that I know of, I'm scratching my head to figure this one out.

Here are a couple of notes:
I'm the only one with access to the box. My wife also uses the VPN for surfing, but no one else has logged into to the server.

In troubleshooting this I notice that my ipp.txt file has multiple entries for my computer, and it still has entries for systems that are no longer in use. Is it okay for me to edit this file directly? I'm not sure how the duplicate entries were added, but I didn't knowingly do this.

My logfile is below, I'm hoping that will give clues to someone that knows how to read it. I've edited out anything directly identifiable, otherwise this is exactly what I pulled from the server.

Wed Nov  7 14:25:34 2012 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Wed Nov  7 14:25:34 2012 Diffie-Hellman initialized with 1024 bit key
Wed Nov  7 14:25:34 2012 /usr/bin/openssl-vulnkey -q -b 1024 -m <modulus omitted>
Wed Nov  7 14:25:38 2012 TLS-Auth MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Wed Nov  7 14:25:38 2012 Socket Buffers: R=[139264->131072] S=[139264->131072]
Wed Nov  7 14:25:38 2012 ROUTE: default_gateway=UNDEF
Wed Nov  7 14:25:38 2012 TUN/TAP device tun0 opened
Wed Nov  7 14:25:38 2012 TUN/TAP TX queue length set to 100
Wed Nov  7 14:25:38 2012 /sbin/ifconfig tun0 10.8.0.1 pointopoint 10.8.0.2 mtu 1500
Wed Nov  7 14:25:38 2012 /sbin/route add -net 10.8.0.0 netmask 255.255.255.0 gw 10.8.0.2
Wed Nov  7 14:25:38 2012 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Wed Nov  7 14:25:38 2012 UDPv4 link local (bound): [undef]
Wed Nov  7 14:25:38 2012 UDPv4 link remote: [undef]
Wed Nov  7 14:25:38 2012 MULTI: multi_init called, r=256 v=256
Wed Nov  7 14:25:38 2012 IFCONFIG POOL: base=10.8.0.4 size=62
Wed Nov  7 14:25:38 2012 IFCONFIG POOL LIST
Wed Nov  7 14:25:38 2012 oldsys1,10.8.0.4
Wed Nov  7 14:25:38 2012 oldsys2,10.8.0.8
Wed Nov  7 14:25:38 2012 oldsys3,10.8.0.12
Wed Nov  7 14:25:38 2012 oldsys4,10.8.0.16
Wed Nov  7 14:25:38 2012 oldsys2,10.8.0.20
Wed Nov  7 14:25:38 2012 system1,10.8.0.24
Wed Nov  7 14:25:38 2012 system2,10.8.0.28
Wed Nov  7 14:25:38 2012 system1,10.8.0.32
Wed Nov  7 14:25:38 2012 Initialization Sequence Completed
Wed Nov  7 14:25:49 2012 MULTI: multi_create_instance called
Wed Nov  7 14:25:49 2012 xxx.xxx.xxx.xxx:55901 Re-using SSL/TLS context
Wed Nov  7 14:25:49 2012 xxx.xxx.xxx.xxx:55901 LZO compression initialized
Wed Nov  7 14:25:49 2012 xxx.xxx.xxx.xxx:55901 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Wed Nov  7 14:25:49 2012 xxx.xxx.xxx.xxx:55901 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Wed Nov  7 14:25:49 2012 xxx.xxx.xxx.xxx:55901 Local Options hash (VER=V4): '530fdded'
Wed Nov  7 14:25:49 2012 xxx.xxx.xxx.xxx:55901 Expected Remote Options hash (VER=V4): '41690919'
Wed Nov  7 14:25:49 2012 xxx.xxx.xxx.xxx:55901 TLS: Initial packet from [AF_INET]xxx.xxx.xxx.xxx:55901, sid=71fe0386 fdbf1713
Wed Nov  7 14:25:49 2012 xxx.xxx.xxx.xxx:55901 VERIFY OK: depth=1, /C=US/ST=TX/L=City/O=login/CN=domain_CA/emailAddress=me@gmail.com
Wed Nov  7 14:25:49 2012 xxx.xxx.xxx.xxx:55901 VERIFY OK: depth=0, /C=US/ST=TX/L=City/O=login/CN=system1/emailAddress=me@gmail.com
Wed Nov  7 14:25:49 2012 xxx.xxx.xxx.xxx:55901 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Nov  7 14:25:49 2012 xxx.xxx.xxx.xxx:55901 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Nov  7 14:25:49 2012 xxx.xxx.xxx.xxx:55901 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Nov  7 14:25:49 2012 xxx.xxx.xxx.xxx:55901 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Nov  7 14:25:50 2012 xxx.xxx.xxx.xxx:55901 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Wed Nov  7 14:25:50 2012 xxx.xxx.xxx.xxx:55901 [system1] Peer Connection Initiated with [AF_INET]xxx.xxx.xxx.xxx:55901
Wed Nov  7 14:25:50 2012 system1/xxx.xxx.xxx.xxx:55901 MULTI: Learn: 10.8.0.26 -> system1/xxx.xxx.xxx.xxx:55901
Wed Nov  7 14:25:50 2012 system1/xxx.xxx.xxx.xxx:55901 MULTI: primary virtual IP for system1/xxx.xxx.xxx.xxx:55901: 10.8.0.26
Wed Nov  7 14:25:52 2012 system1/xxx.xxx.xxx.xxx:55901 PUSH: Received control message: 'PUSH_REQUEST'
Wed Nov  7 14:25:52 2012 system1/xxx.xxx.xxx.xxx:55901 SENT CONTROL [system1]: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 10.8.0.1,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.26 10.8.0.25' (status=1)
Wed Nov  7 14:26:31 2012 MULTI: multi_create_instance called
Wed Nov  7 14:26:31 2012 xxx.xxx.xxx.xxx:59456 Re-using SSL/TLS context
Wed Nov  7 14:26:31 2012 xxx.xxx.xxx.xxx:59456 LZO compression initialized
Wed Nov  7 14:26:31 2012 xxx.xxx.xxx.xxx:59456 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Wed Nov  7 14:26:31 2012 xxx.xxx.xxx.xxx:59456 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Wed Nov  7 14:26:31 2012 xxx.xxx.xxx.xxx:59456 Local Options hash (VER=V4): '530fdded'
Wed Nov  7 14:26:31 2012 xxx.xxx.xxx.xxx:59456 Expected Remote Options hash (VER=V4): '41690919'
Wed Nov  7 14:26:31 2012 xxx.xxx.xxx.xxx:59456 TLS: Initial packet from [AF_INET]xxx.xxx.xxx.xxx:59456, sid=ccc665b3 45996efc
Wed Nov  7 14:26:32 2012 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Wed Nov  7 14:26:32 2012 xxx.xxx.xxx.xxx:59456 VERIFY OK: depth=1, /C=US/ST=TX/L=City/O=login/CN=domain_CA/emailAddress=me@gmail.com
Wed Nov  7 14:26:32 2012 xxx.xxx.xxx.xxx:59456 VERIFY OK: depth=0, /C=US/ST=TX/L=City/O=login/CN=system1/emailAddress=me@gmail.com
Wed Nov  7 14:26:32 2012 xxx.xxx.xxx.xxx:59456 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Nov  7 14:26:32 2012 xxx.xxx.xxx.xxx:59456 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Nov  7 14:26:32 2012 xxx.xxx.xxx.xxx:59456 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Nov  7 14:26:32 2012 xxx.xxx.xxx.xxx:59456 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Nov  7 14:26:32 2012 xxx.xxx.xxx.xxx:59456 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Wed Nov  7 14:26:32 2012 xxx.xxx.xxx.xxx:59456 [system1] Peer Connection Initiated with [AF_INET]xxx.xxx.xxx.xxx:59456
Wed Nov  7 14:26:32 2012 MULTI: new connection by client 'system1' will cause previous active sessions by this client to be dropped.  Remember to use the --duplicate-cn option if you want multiple clients using the same certificate or username to concurrently connect.
Wed Nov  7 14:26:32 2012 MULTI: Learn: 10.8.0.26 -> system1/xxx.xxx.xxx.xxx:59456
Wed Nov  7 14:26:32 2012 MULTI: primary virtual IP for system1/xxx.xxx.xxx.xxx:59456: 10.8.0.26
Wed Nov  7 14:26:34 2012 system1/xxx.xxx.xxx.xxx:59456 PUSH: Received control message: 'PUSH_REQUEST'
Wed Nov  7 14:26:34 2012 system1/xxx.xxx.xxx.xxx:59456 SENT CONTROL [system1]: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 10.8.0.1,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.26 10.8.0.25' (status=1)
Wed Nov  7 14:26:43 2012 MULTI: multi_create_instance called
Wed Nov  7 14:26:43 2012 xxx.xxx.xxx.xxx:62693 Re-using SSL/TLS context
Wed Nov  7 14:26:43 2012 xxx.xxx.xxx.xxx:62693 LZO compression initialized
Wed Nov  7 14:26:43 2012 xxx.xxx.xxx.xxx:62693 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Wed Nov  7 14:26:43 2012 xxx.xxx.xxx.xxx:62693 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Wed Nov  7 14:26:43 2012 xxx.xxx.xxx.xxx:62693 Local Options hash (VER=V4): '530fdded'
Wed Nov  7 14:26:43 2012 xxx.xxx.xxx.xxx:62693 Expected Remote Options hash (VER=V4): '41690919'
Wed Nov  7 14:26:43 2012 xxx.xxx.xxx.xxx:62693 TLS: Initial packet from [AF_INET]xxx.xxx.xxx.xxx:62693, sid=1e3173aa 3ca30e33
Wed Nov  7 14:26:44 2012 xxx.xxx.xxx.xxx:62693 VERIFY OK: depth=1, /C=US/ST=TX/L=City/O=login/CN=domain_CA/emailAddress=me@gmail.com
Wed Nov  7 14:26:44 2012 xxx.xxx.xxx.xxx:62693 VERIFY OK: depth=0, /C=US/ST=TX/L=City/O=login/CN=system1/emailAddress=me@gmail.com
Wed Nov  7 14:26:44 2012 xxx.xxx.xxx.xxx:62693 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Nov  7 14:26:44 2012 xxx.xxx.xxx.xxx:62693 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Nov  7 14:26:44 2012 xxx.xxx.xxx.xxx:62693 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Nov  7 14:26:44 2012 xxx.xxx.xxx.xxx:62693 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Nov  7 14:26:44 2012 xxx.xxx.xxx.xxx:62693 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Wed Nov  7 14:26:44 2012 xxx.xxx.xxx.xxx:62693 [system1] Peer Connection Initiated with [AF_INET]xxx.xxx.xxx.xxx:62693
Wed Nov  7 14:26:44 2012 MULTI: new connection by client 'system1' will cause previous active sessions by this client to be dropped.  Remember to use the --duplicate-cn option if you want multiple clients using the same certificate or username to concurrently connect.
Wed Nov  7 14:26:44 2012 MULTI: Learn: 10.8.0.26 -> system1/xxx.xxx.xxx.xxx:62693
Wed Nov  7 14:26:44 2012 MULTI: primary virtual IP for system1/xxx.xxx.xxx.xxx:62693: 10.8.0.26
Wed Nov  7 14:26:46 2012 system1/xxx.xxx.xxx.xxx:62693 PUSH: Received control message: 'PUSH_REQUEST'
Wed Nov  7 14:26:46 2012 system1/xxx.xxx.xxx.xxx:62693 SENT CONTROL [system1]: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 10.8.0.1,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.26 10.8.0.25' (status=1)
Wed Nov  7 14:26:56 2012 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Wed Nov  7 14:27:06 2012 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Wed Nov  7 14:27:16 2012 read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Wed Nov  7 14:27:20 2012 event_wait : Interrupted system call (code=4)
Wed Nov  7 14:27:20 2012 TCP/UDP: Closing socket
Wed Nov  7 14:27:20 2012 /sbin/route del -net 10.8.0.0 netmask 255.255.255.0
Wed Nov  7 14:27:20 2012 Closing TUN/TAP interface
Wed Nov  7 14:27:21 2012 /sbin/ifconfig tun0 0.0.0.0
Wed Nov  7 14:27:21 2012 SIGTERM[hard,] received, process exiting

xauen

You can remove the ipp.txt and other files like {username}.local files then can also try checking your iptable rules and make sure you are NATting your openvpn ip. After all is done you can restart your openvpn "service openvpn restart".

lenwood

I've tried all of these things and the result is the same.

This morning I reinstalled the operating system and set up OpenVPN from scratch again. This didn't change anything. I can always connect to the VPN, but as soon as I try to surf the web the connection resets and has to reauthorize. I'm unable to access the web through my VPN.

I'm at a loss for what to do next. I think this must have something to do with my host's network, as everything was fine until their server went down. They've supposedly checked and found no issues.

You mentioned my firewall, here's what's in my rc.local.

- iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -s 10.8.0.0/24 -j ACCEPT
iptables -A FORWARD -j REJECT
iptables -t nat -A POSTROUTING  -s 10.8.0.0/24 -o venet0 -j SNAT --to-source xxx.xxx.xxx.xxx

I've swapped out xx's for my VPN's IP address, but otherwise this is the configuration.

Thanks for any help or direction you can provide.

lenwood

This is now resolved. The issue had nothing to do with OpenVPN, so me rebuilding the server from scratch wasn't necessary. I'm on a Mac and had upgraded from Lion to Mountain Lion. The solution for me was to update Tunnelblick (the software I use to connect to OpenVPN) to the latest version. Since then I haven't had a single issue. I hope this helps someone else.