Hi there,
I was trying to set up openvpn the last couple of weeks on a Windows platform. All seems to be fine at first and I was able to connect from clients (Win 7) to server (Win 2008 x64). One particular issue that causing me headache was the server loses its Internet connection after x minutes (seems to be intermittent, from 10 minutes to 60 minutes etc). When that happens, client won't be able to re-connect to the server (stuck on "connecting" status), and on the server end, the openvpn showing "green" light, but the network icon has a yellow "!" sign to it indicating "No Internet access". The only way to get it back up and running is to restart the server, and re-connect to OpenVPN.
I have been searching for answers for over 2 weeks without any solid resolution (prob due to Windows platform not being used a lot for openvpn?) I hope to start this topic and to get some clear helps and solution to this. Thanks in advance.
My set up:
Server: 2008 x64 on VM (with version 2.1.4 installed, as I was told that it is the stable version with correct openssl files in placed)
I have had the
IPEnableRouter enabled, and have installed / enabled Windows 2008
Routing & Remote Access role to redirect traffic through LAN on server side. Firewall is off.
Client: Win7 (32 and x64), using Desktop Client for Windows (
https://openvpn.net/index.php?option=com_content&id=357). Firewall is off.
Server config:
local {server LAN ip}
port 443
proto tcp
dev tap
ca "C:\\Program Files (x86)\\OpenVPN\\config\\ca.crt"
cert "C:\\Program Files (x86)\\OpenVPN\\config\\server.crt"
key "C:\\Program Files (x86)\\OpenVPN\\config\\server.key" # This file should be kept secret
dh "C:\\Program Files (x86)\\OpenVPN\\config\\dh2048.pem"
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.1.0 255.255.255.0"
push "redirect-gateway def1"
push "dhcp-option DNS {DNS server IP}"
push "dhcp-option DOMAIN {Domain address}"
client-to-client
keepalive 10 6000 # Trying different value out but doesn't seem to make any different to the issue.
comp-lzo
max-clients 6
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
verb 6
Client config:
client
dev tap
proto tcp
remote {Server WAN IP} 443
route 192.168.1.0 255.255.255.0 10.8.0.1
resolv-retry infinite
nobind
persist-key
persist-tun
ca "C:\\Users\\user1\\Desktop\\ovpn\\ca.crt"
cert "C:\\Users\\user1\\Desktop\\ovpn\\user1.crt"
key "C:\\Users\\user1\\Desktop\\ovpn\\user1.key"
ns-cert-type server
comp-lzo
verb 5
Error on logs:
..
..
..
..
..
192.168.1.249:49463: P_DATA_V1 kid=0 DATA len=196
Tue Jun 25 14:59:18 2013 us=413000 user1/userIP:49463 TCPv4_SERVER WRITE [197] to userIP:49463: P_DATA_V1 kid=0 DATA len=196
Tue Jun 25 14:59:22 2013 us=423000 user1/userIP:49463 TCPv4_SERVER WRITE [197] to userIP:49463: P_DATA_V1 kid=0 DATA len=196
Tue Jun 25 14:59:30 2013 us=425000 user1/userIP:49463 TCPv4_SERVER WRITE [197] to userIP:49463: P_DATA_V1 kid=0 DATA len=196
Tue Jun 25 14:59:33 2013 us=779000 user1/userIP:49463 TCPv4_SERVER WRITE [229] to userIP:49463: P_DATA_V1 kid=0 DATA len=228
Tue Jun 25 14:59:36 2013 us=10000 user1/userIP:49463 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Tue Jun 25 14:59:36 2013 us=10000 user1/userIP:49463 TLS Error: TLS handshake failed
Tue Jun 25 14:59:36 2013 us=10000 user1/userIP:49463 TLS: move_session: dest=TM_LAME_DUCK src=TM_ACTIVE reinit_src=1
Tue Jun 25 14:59:36 2013 us=10000 user1/userIP:49463 Fatal TLS error (check_tls_errors_co), restarting
Tue Jun 25 14:59:36 2013 us=10000 user1/userIP:49463 SIGUSR1[soft,tls-error] received, client-instance restarting
Tue Jun 25 14:59:36 2013 us=10000 TCP/UDP: Closing socket
I was able to connect to the server (most of the time) and browse the internet / network files, but the connection won't last long. It seems more to the server problem.
I saw some articles that using the same cn cert for different users will cause some disconnection problem, but I generated the key using different diff cn for diff users, so this can't be the case.
Thanks in advance for all the helps.
