Pages doesn' t load

heopas

Hello, i have a OpenVPN server at Windows Server 2008.
My problem is that some pages (random) doesn' t load images or doesn' t load at all.
If i refresh this page many times it works.

Server:

port 1194
proto udp
dev tun
dev-node openvpn
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
ca "C:\\Program Files\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files\\OpenVPN\\config\\server.crt"
key "C:\\Program Files\\OpenVPN\\config\\server.key"
dh "C:\\Program Files\\OpenVPN\\config\\dh1024.pem"
client-cert-not-required
username-as-common-name
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1"
push "dhcp-option DNS 208.67.222.222"
push "dhcp-option DNS 208.67.220.220"
client-to-client
keepalive 10 600
comp-lzo
persist-key
persist-tun
verb 3
script-security 3
auth-user-pass-verify "C:\\Program Files\\OpenVPN\\config\\OpenVPNAuthentication.exe" via-file
tmp-dir "C:\\temp"

Client:

client
dev tun
proto udp
remote X.X.X.X 1194
resolv-retry infinite
nobind
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
persist-key
persist-tun
ca encryption.crt
auth-user-pass
auth-retry interact
comp-lzo
verb 3
script-security 3
auth-nocache

mwandelaar

Can you increase the server-log to

verb 4

and check the vpn-log when loading a page is a problem?

It could be you have a flakey connection and therefore loading a page will not work.
If that's not the question i would check your systemlog of the vpn-server. It might have problems with forwarding, resolving, caching, proxy, dns-forwarding or anything else running on that machine, serving the network-connection.

I had an issue a bit like this where the local (caching) nameserver on the client was introducing long delay's.

heopas

Here is the log
http://www.heopas.net/openvpn.log

mwandelaar

I'm triggered by this line:

Tue Mar 12 18:38:08 2013 us=921875 heopas/aa.bb.cc.dd:50242 MULTI: bad source address from client [fe80::690c:4972:a2a1:468c], packet dropped

Are you connected to the server via the local LAN? Because this lookes like the vpn-server is receiving packets from non-routable IPv6 addresses. And if it's dropping packets, loading webpages can be a real problem.

If you are on the local lan and want to experiment with redirecting the gateway, please consider

redirect-gateway local

heopas

I am behind a lan. We don't have ipv6 at Greece.

mwandelaar

Personally i do think greece has IPv6 but that's another discussion.

When 2 or more systems are on the same LAN, they'll automatically create local IPv6-addresses. And the systems find out they can communicate via IPv6 so they will try. And that's the point openvpn tells you in the log it's not accepting packets from that ip-address, as it initiated the connection via IPv4. At least that's how i interpret the loglines.

Are these systems in the same lan?

heopas

Server is on a vps and clients are at the same lan.

mwandelaar

As redirect-gateway def1 is changing your routing-table, you might want to change it to:

redirect-gateway local

as the manpage advise you to do:

manpage openvpn wrote redirect-gateway flags
local -- Add the local flag if both OpenVPN servers are directly connected via a common subnet, such as with wireless. The local flag will cause step 1 above to be omitted.

heopas

Server is on a different network. Hosted in a vps

heopas

I can' t find a solution... Any help?

heopas

UPDATE

After disabling IPv6 from client computer error dissapear, but problem still exist...
:?: :?: :?:

mwandelaar

Based on the logging from the last time, ignoring the lines about IPv6 (which you where able to solve) i cannot really see what's going wrong.
Can you create another logging when this problem arises?

The other thing i can advice you is to monitor the DNS-traffic, specific using wireshark. I'm still having issues myself in a very specific setup where nameresolution isn't working as expected and it load pages in an incomplete way (partially, or no css or no pictures).
When i do not push the DNS, there's no problem. Therefore i can exclude OpenVPN as being an issue so i have to deal with the DNS.

Therefore, please try to either not push a dns or push another (public) DNS (google, 8.8.8.8 or something)

heopas

I have changed server and pages load correct.
Bad Source error still appear and internet speed is very slow...

heopas

heopas wroteI have changed server and pages load correct.
Bad Source error still appear and internet speed is very slow...

- Pages load correct.
- Disabling IPV6 from client and Bad Source error dissapear.
- Ping is normal
Internet Connection is very slow < 0.4 mb (speedtest)

mwandelaar

Depending on the internet-connection where the server is located, your speed can be low, allthough this doesn't have to be strange:
If you are using an ADSL-line, the maximum download-speed for a client through the VPN, will be the upload-limit from the server. This is because traffic from the server to the client is done through the upload.

This counts ofcourse for all the type of internet-connections, but cable and fiber-connections shouldn't be this slow.
With a speedtest you can measure the upload of your server.

heopas

Upload at server and at my pc is fine.
The problem is from the VPN

heopas

I upload wireshark log.
http://www.mediafire.com/download.php?yxzy16b7g8mw63z

mwandelaar

I've been looking around in this pcap-file and i noticed the maximum packetsize in the pcap is 1390 bytes.

The configfile on both server and client explicitly tell to use MTU-sizes of 1500 bytes.
Can you try lowering this value to, say 1340, and try again?

This pcap is made from traffic travelling through the tunnel so i cannot see what's happening on the outer side of the tunnel.