Connection times out, doesn't reconnect & high CPU usage

abderrahman

I'm using OpenVPN 2.3.1 x86_64-w64-mingw32 on Win7

Sometimes my router loses internet connectivity, which promotes the yellow triangle on normal connections. If I'm connected to a VPN server (i.e. using a VPN) PING returns 'request timed out' but the computer assumes the connection is still alive (no yellow triangle on network tray)

OpenVPN-GUI becomes yellow 'reconnecting' but never actually successfully does and keeps giving TLS handshake failure (probably because it can't reach the IP address). It's not resolved until I manually disconnect (or hit 'reconnect' in status window) and connect again.

That's maybe OK if I'm using the computer, but if I leave on in the night and the phone line just happens to disconnect then I'm screwed and nothing is downloaded during the off-hours.

Also, if before the TLS timeout (within 1 minute) the connection returns it works fine... but openvpn.exe CPU usage jumps to 13% and heats up the processor (until either the connection is resumed, or TLS times out and it goes to 'reconnect' mode causing the aforementioned problem)

I Googled, but couldn't find anything like this problem (presumably because people actually have reliable infrastructure that doesn't disconnect many times a day)

– How do I solve the failure to reach the IP address after a timeout?
– Why CPU usage jumps when the connection proper drops, and how do I fix it? (I'm really interested in a detailed explanation)

abderrahman

This is another scenario of when it times out, CPU usage shoots, but can't connect (or doesn't realize something is up)

Immediately after disconnecting PING returns normal

janjust

which version of the openvpn gui is this? it looks like the old version (1.0.3 from the openvpn 2.2 series), but I must admit that I have not used the 2.3 GUI yet.

High CPU usage can be caused by a VPN biting itself in the tail: if openvpn encrypts traffic and then inserts the encrypted stream back into itself then it will chew up CPU time , but not actually send any data.
A situation like this can occur when the default GW is redirected and when the VPN drops the original gateway is not restored properly - are you using "redirect-gateway" ? if so, make sure you're add "def1".

abderrahman

The GUI is v3, I'm using OVPN 2.3.1 I001

I'm not using redirect-gateway, just a basic config:

client
dev tun
proto udp
remote xx.xx.xx.xx 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
tls-client
remote-cert-tls server
auth-user-pass login.conf
comp-lzo
verb 1
reneg-sec 0

I'm guessing it keeps looping encrypted packets through itself because the actual gateway is down, then how do I avoid this? How do I tell it to detect when the packets aren't going out?

And how do I make resolve the address (or even IP) when the connection returns but persists that TUN is still connected (because I think that's the problem, that it thinks TUN is getting a reply from WLAN so it doesn't de-bridge/re-bridge again so it keeps pushing through the actually bridged connection when it's not going anywhere until you allow to go directly through WLAN "hitting disconnect") but I could be wrong since I don't have the technical details

janjust

add

verb 5

to the client config and reconnect to the server - this will show if the server pushes any routes to the client , including gateway redirects.

abderrahman

Apparently it is pushing a redirect-gateway, but also a def1

PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,ping 10,route 10.119.1.1,topology net30,ifconfig 10.119.1.6 10.119.1.5'

here is the complete log: http://pastebin.com/Q8Gc1mzk

janjust

hmmm are you on a 3G/GPRS link?

to see if the "redirect-gateway def1" is the cause of the problem , try adding

route-nopull

to the client config and reconnect - this means your network traffic will not be redirected via the VPN, but you should be able to ping the VPN server itself. If the CPU usage does not go through the roof in this case then at least we know it's got something to do with the default GW.

abderrahman

No. I'm on a WiFi connection from a router, that's taking its connection through ethernet from another router modem
This is a diagram of how I connect to the internet. My wireless router is actually a cheap ADSL router that I made into a Wi-Fi AP. I don't know how many people are actually connected to the center of the network (the router modem), but I use a static internal IP. That would explain why I'm having difficulties with the connection, because when the router modem goes down, my wireless router can't know that since it's not made in the first place to be just an AP (i.e. my router is always down because there's no phone line going into it)

doesn't this make me essentially not connected through a VPN?
the CPU problem only arises when internet connectivity is lost in WLAN, not normal operation. I can't seem to be able to accurately describe it... when "router modem" (center) is on (meaning it's accepting connection), but internet connectivity is lost PING from my computer replies "time out". When the router modem is completely off (meaning I'm just connecting to my own wireless router, therefore no DHCP) it replies "192.168.1.xx (my static IP): destination unreachable". When the first scenario happens (router on, but net is off) the CPU usage shoots until TLS times out in OVPN

But CPU usage is a minor inconvenience (because it times out after a minute then attempts to reconnect), my major problem is that sometimes it can't reconnect until I disconnect

abderrahman

Here's a perfect example of what I'm talking about (internet connectivity lost, attempts to restart but can't resolve)

here's what happened when the internet connection went out:

...**same "bad packet ID"**...
Wed Apr 17 18:50:13 2013 us=80837 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #862381 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Wed Apr 17 18:50:13 2013 us=80837 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #862382 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Wed Apr 17 18:50:13 2013 us=98839 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #862383 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Wed Apr 17 18:52:56 2013 us=72534 [server] Inactivity timeout (--ping-restart), restarting
Wed Apr 17 18:52:56 2013 us=73034 TCP/UDP: Closing socket
Wed Apr 17 18:52:56 2013 us=73034 SIGUSR1[soft,ping-restart] received, process restarting
Wed Apr 17 18:52:56 2013 us=73535 MANAGEMENT: >STATE:1366217576,RECONNECTING,ping-restart,,
Wed Apr 17 18:52:56 2013 us=73535 Restart pause, 2 second(s)
Wed Apr 17 18:52:58 2013 us=73789 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Wed Apr 17 18:52:58 2013 us=74289 Re-using SSL/TLS context
Wed Apr 17 18:52:58 2013 us=74289 LZO compression initialized
Wed Apr 17 18:52:58 2013 us=74789 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Wed Apr 17 18:52:58 2013 us=74789 Socket Buffers: R=[8192->8192] S=[8192->8192]
Wed Apr 17 18:52:58 2013 us=75289 MANAGEMENT: >STATE:1366217578,RESOLVE,,,
Wed Apr 17 18:53:10 2013 us=92815 RESOLVE: Cannot resolve host address: vpn.example.com: The requested name is valid, but no data of the requested type was found. 
Wed Apr 17 18:53:10 2013 us=93315 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Wed Apr 17 18:53:10 2013 us=93315 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Wed Apr 17 18:53:10 2013 us=93315 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Wed Apr 17 18:53:10 2013 us=93815 Local Options hash (VER=V4): '41690919'
Wed Apr 17 18:53:10 2013 us=93815 Expected Remote Options hash (VER=V4): '530fdded'
Wed Apr 17 18:53:10 2013 us=93815 MANAGEMENT: >STATE:1366217590,RESOLVE,,,
Wed Apr 17 18:53:22 2013 us=95839 RESOLVE: Cannot resolve host address: vpn.example.com: The requested name is valid, but no data of the requested type was found. 
Wed Apr 17 18:53:39 2013 us=97998 RESOLVE: Cannot resolve host address: vpn.example.com: The requested name is valid, but no data of the requested type was found. 
Wed Apr 17 18:53:56 2013 us=100657 RESOLVE: Cannot resolve host address: vpn.example.com: The requested name is valid, but no data of the requested type was found. 
...**same "cannot resolve"**...

as I hit "disconnect" it gave this:

Wed Apr 17 18:58:45 2013 us=139860 RESOLVE: signal received during DNS resolution attempt
Wed Apr 17 18:58:45 2013 us=140860 TCP/UDP: Closing socket
Wed Apr 17 18:58:45 2013 us=140860 C:\Windows\system32\route.exe DELETE 10.119.1.1 MASK 255.255.255.255 10.119.1.5
Wed Apr 17 18:58:45 2013 us=146361 Route deletion via IPAPI succeeded [adaptive]
Wed Apr 17 18:58:45 2013 us=146861 C:\Windows\system32\route.exe DELETE 109.201.152.16 MASK 255.255.255.255 192.168.1.1
Wed Apr 17 18:58:45 2013 us=152362 Route deletion via IPAPI succeeded [adaptive]
Wed Apr 17 18:58:45 2013 us=152362 C:\Windows\system32\route.exe DELETE 0.0.0.0 MASK 128.0.0.0 10.119.1.5
Wed Apr 17 18:58:45 2013 us=156362 Route deletion via IPAPI succeeded [adaptive]
Wed Apr 17 18:58:45 2013 us=156862 C:\Windows\system32\route.exe DELETE 128.0.0.0 MASK 128.0.0.0 10.119.1.5
Wed Apr 17 18:58:45 2013 us=161863 Route deletion via IPAPI succeeded [adaptive]
Wed Apr 17 18:58:45 2013 us=162363 Closing TUN/TAP interface
Wed Apr 17 18:58:45 2013 us=162863 SIGTERM[hard,init_instance] received, process exiting
Wed Apr 17 18:58:45 2013 us=162863 MANAGEMENT: >STATE:1366217925,EXITING,init_instance,,

it seems like OVPN doesn't reset route.exe when it restarts after a time out (--ping-restart), and therefore redirect-gateway is still on (as it's clear when after clicking disconnect it resets route.exe from the VPN values)?
so the solution would be to force OVPN to delete route and re-add again every time it --ping-restart (hard restart instead of soft)?

janjust

hmmm can you try replacing the dns name of the openvpn server with its IP address? I've seen reports before where people state that name resolution problems cause an openvpn reconnect issue.

abderrahman

Most of the time I use a numerical IP. Still the problem persists, but less frequently (CPU & inability to reconnect)

It could take me sometime to reproduce the situation or capture it happening (i.e. getting verb 5 logs as before but with IP)

abderrahman

It seems that OVPN changes its mind every now & then!

I've changed all my configs to IP addresses, and connected since the last post
Now it's high CPU usage + time out... but the log shows nothing, and OVPN doesn't sense a drop in the connection and doesn't do a restart like before. It goes on until I disconnect, openvpn.exe will stay at 13% CPU all day long (and a routed connection into the nothing) if I don't disconnect it manually

pouchette

Hi,

I have exactly the same problem, but on Ubuntu (12.04) Linux.
Using the openvpn gui : gopenvpn
(except no cpu high usage, just re-connection issue)

did you finally find a solution ?

I really need to fix this, cause if my wlan connection fails, so openvpn is unable to re-connect itself.
so quite often, when i'm on download in case of absence no more vpn, and direct through regular wlan and exposed.

Please help !

Thanks :-)

abderrahman

I've noticed that the problem is related to the routing table that TUN/TAP sets during connection. When the WLAN goes out it doesn't recognize that ping is timing out until the default value is met (which I think is 120 seconds)

You could partially solve the problem with --ping-restart x. I say partially because although this restores the connection, as it initiates a SIGUSR1, it also leaves you exposed during the time of connection establishment. In Windows that causes HTTPS keep-alive webpages (such as Facebook) and maybe HTTP too (haven't tried any) to keep using the route they established during the disconnection (which means that they're not going through the tunnel even though tunnel is established, because in Win7 OVPN establishes a dynamic route so it doesn't break connectivity. Setting a static routes solves the leak, but breaks the pages until you close the browser)

In Linux the iptables are much better and more reliable than route.exe. I tried a test run in a VM, and nothing got leaked after rebuilding the tunnel (but pages got broken)... that was a brief test though, not extensive. Use Wireshark and post your findings 🙂

pouchette

Thanks a lot for your quick reply !

But you know what ? I have a very poor knowledge in networks management..

So I quite don't get a word of what you're talking about !!!

By the way i'm not using wireshark but EtherApe to check the network which I think are quite the same, however I use it for very basic watch of my network, and curiosity !

I tried a test run in a VM, and nothing got leaked after rebuilding the tunnel (but pages got broken)... that was a brief test though, not extensive. Use Wireshark and post your findings

what do you mean exactly ? what is VM ? In any case it seams very interesting !
and what about torrent download ? do you think that it would keep downloading ?

So could you help me with very simple steps to apply your 'solution' ?

Otherwise, I have an other quiestion, pure curiosity, but something i'd really like to understand.

So, sometimes my wlan connection fails, and my vpn is on, well the wlan gateway (?) to reach the internet network fails, but it seems that the wlan itself still works.
The strange thing to me, is that even if the connection fails, and have my vpn connected, my qbittorrent client is still working downloading/uploading, but i can not access http internet pages.

How is that possible ? how does it works ? so what is the difference between the internet protocol networking and the lan itself ?

Well, can't wait for your help with the openvpn issue ! (if you have a few time to spend on that matter :-)

Edit: Please see this post for continuation by pouchette

abderrahman

That's really a different subject, and I think you should start an new topic. But I will answer some of your questions

etherape and Wireshark do the same job, you could use either

A VM stands for Virtual Machine. The simple explanation is that it's a way to run another OS inside an already running OS, like run Win7 inside your Ubuntu. It's very cool and really helpful, download VirtualBox and explore... also Google "virtual machine" you'll get plenty for How-To's and tutorials

If I understand correctly, in the scenario you describe your connection to the access point doesn't fail, but the default gateway goes offline (which means no internet connection), correct?
I don't know what your settings are, but make sure you have

persist-tun

Also check your iptables when that problem happens, it might give a better view.
To use the --ping-restart command I mentioned, just add

ping-restart "the number of seconds" (e.g. ping-restart 30)

But, the problem is known with P2P clients as they are always establishing new connections. The solution to this is either use a killswitch (a small program that monitors the OVPN connection state, then performs a task when it goes down), or use a client with a binding feature (will not send/receive traffic except through the TUN/TAP). The only program I know of with this feature right now is Vuze

As for the last question (LAN & IP), I didn't understand it. LAN (or WLAN "Wi-Fi") is the physical layer of your network, IP is the protocol. Think of it as a road (LAN) with a car (IP) carrying people (the thing you send/receive, like a webpage)... you can't say "what's the difference" in that way, oranges & apples

EBMOTEL

Pouchette,
are you french ?
je t'invite à aller lire cet article de mon blog tout récent :
http://letombe-tech.blogspot.fr/2013/11/openvpn.html
j'espère que cela te plaira.
Mon script bloque les téléchargements dès qu'il y a un problème avec le VPN
Changement automatique ou manuel de l'IP

pouchette

Thanks @EBMOTEL :-)

Je vais aller voir ce que tu proposes

oui ça peut être très interessant de pouvoir kill the process des telechargements !

Merci :roll:

pouchette

:arrow: You can follow this topic, more specifically about Ubuntu "Openvpn/Gopenvpn not reconnecting after wlan failure" issue, here :

https://forums.openvpn.net/topic14468.html