openVPN on linux: no internet-connection after standby

oli57

Hi everyone,

at first: sorry, when my english is not perfect, it's not my native language.

Recently I installed a linux mint (15 KDE "Olivia" RC) on my laptop as a dual boot system together with my windows xp.
For a longer time I have been using openVPN (on my windows systems) as client just to anonymize me.
So I wanted openVPN to run on my linux too. If I remember right, it was already installed (package management, Version 2.2.1-Bubuntu3) by system installation, but I'm not sure anymore, because I deinstalled and installed it again, with the package managament).
I copied the openVPN configuration files (ca.crt, xxx.crt, xxx.key and the .ovpn files) in the openVPN folder under etc/openvpn.
Then I start openVPN via console/bash with the commands:

cd /etc/openvpn/
sudo openvpn --config ForExample_Server.ovpn

Then it connects (successfull!) while I can see this in the console:

me-ThinkPad-T61 me # cd /etc/openvpn/
me-ThinkPad-T61 openvpn # sudo openvpn --config ForExample_Server.ovpn
Wed Jul 24 13:48:13 2013 OpenVPN 2.2.1 i686-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Feb 13 2013
Wed Jul 24 13:48:13 2013 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Wed Jul 24 13:48:13 2013 WARNING: file '257738.key' is group or others accessible
Wed Jul 24 13:48:13 2013 LZO compression initialized
Wed Jul 24 13:48:13 2013 WARNING: normally if you use --mssfix and/or --fragment, you should also set --tun-mtu 1500 (currently it is 1374)
Wed Jul 24 13:48:13 2013 Control Channel MTU parms [ L:1432 D:138 EF:38 EB:0 ET:0 EL:0 ]
Wed Jul 24 13:48:13 2013 Socket Buffers: R=[180224->131072] S=[180224->131072]
Wed Jul 24 13:48:13 2013 Data Channel MTU parms [ L:1432 D:1432 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]
Wed Jul 24 13:48:13 2013 Local Options hash (VER=V4): '6273fa05'
Wed Jul 24 13:48:13 2013 Expected Remote Options hash (VER=V4): 'fa395498'
Wed Jul 24 13:48:13 2013 UDPv4 link local: [undef]
Wed Jul 24 13:48:13 2013 UDPv4 link remote: [AF_INET]xxx.xxx.xxx.xxx:1194
Wed Jul 24 13:48:13 2013 TLS: Initial packet from [AF_INET]xxx.xxx.xxx.xxx:1194, sid=54304a17 833a859e
Wed Jul 24 13:48:13 2013 VERIFY OK: depth=1, /C=AE/ST=CFR/L=CFR/O=xxx_fz_llc/CN=xxx_fz_llc_CA/emailAddress=info@xxx.net
Wed Jul 24 13:48:13 2013 VERIFY OK: nsCertType=SERVER
Wed Jul 24 13:48:13 2013 VERIFY OK: depth=0, /C=SC/ST=Victoria/L=Victoria/O=xxx_llc/CN=ForExample.xxx.net/emailAddress=info@xxx.net
Wed Jul 24 13:48:14 2013 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1432', remote='link-mtu 1558'
Wed Jul 24 13:48:14 2013 WARNING: 'tun-mtu' is used inconsistently, local='tun-mtu 1374', remote='tun-mtu 1500'
Wed Jul 24 13:48:14 2013 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Wed Jul 24 13:48:14 2013 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Jul 24 13:48:14 2013 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Wed Jul 24 13:48:14 2013 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Jul 24 13:48:14 2013 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Wed Jul 24 13:48:14 2013 [ForExample.xxx.net] Peer Connection Initiated with [AF_INET]xxx.xxx.xxx.xxx:1194
Wed Jul 24 13:48:16 2013 SENT CONTROL [ForExample.xxx.net]: 'PUSH_REQUEST' (status=1)
Wed Jul 24 13:48:16 2013 PUSH: Received control message: 'PUSH_REPLY,route 0.0.0.0 0.0.0.0,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route xx.xx.xx.xx,topology net30,ping 10,ping-restart 120,ifconfig xx.xx.xx.xy xx.xx.xx.xz'
Wed Jul 24 13:48:16 2013 OPTIONS IMPORT: timers and/or timeouts modified
Wed Jul 24 13:48:16 2013 OPTIONS IMPORT: --ifconfig/up options modified
Wed Jul 24 13:48:16 2013 OPTIONS IMPORT: route options modified
Wed Jul 24 13:48:16 2013 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Wed Jul 24 13:48:16 2013 ROUTE default_gateway=xxx.xxx.xxx.x
Wed Jul 24 13:48:16 2013 TUN/TAP device tun0 opened
Wed Jul 24 13:48:16 2013 TUN/TAP TX queue length set to 100
Wed Jul 24 13:48:16 2013 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Jul 24 13:48:16 2013 /sbin/ifconfig tun0 xx.xx.xx.xy pointopoint xx.xx.xx.xz mtu 1374
Wed Jul 24 13:48:16 2013 /sbin/route add -net xxx.xxx.xxx.xxx netmask 255.255.255.255 gw xxx.xxx.xxx.x
Wed Jul 24 13:48:16 2013 /sbin/route add -net 0.0.0.0 netmask 128.0.0.0 gw xx.xx.xx.xz
Wed Jul 24 13:48:16 2013 /sbin/route add -net 128.0.0.0 netmask 128.0.0.0 gw xx.xx.xx.xz                                                                                                               
Wed Jul 24 13:48:16 2013 WARNING: potential route subnet conflict between local LAN [xxx.xxx.xxx.y/255.255.255.0] and remote VPN [0.0.0.0/0.0.0.0]                                                   
Wed Jul 24 13:48:16 2013 /sbin/route add -net 0.0.0.0 netmask 0.0.0.0 gw xx.xx.xx.xz                                                                                                                   
Wed Jul 24 13:48:16 2013 WARNING: potential route subnet conflict between local LAN [10.8.0.0/255.255.255.0] and remote VPN [xx.xx.xx.xx/255.255.255.255]                                               
Wed Jul 24 13:48:16 2013 /sbin/route add -net xx.xx.xx.xx netmask 255.255.255.255 gw xx.xx.xx.xz                                                                                                          
Wed Jul 24 13:48:16 2013 Initialization Sequence Completed    
Wed Jul 24 13:49:34 2013 Replay-window backtrack occurred [2]

After that it runs, I tested the IP with my Internet Browser, it has changed - fine!

But after wakeup from standby, there's no internet anymore. 🙁

In the openVPN bash it says:

Wed Jul 24 13:51:34 2013 [ForExample.xxx.net] Inactivity timeout (--ping-restart), restarting
Wed Jul 24 13:51:34 2013 TCP/UDP: Closing socket
Wed Jul 24 13:51:34 2013 SIGUSR1[soft,ping-restart] received, process restarting
Wed Jul 24 13:51:34 2013 Restart pause, 2 second(s)
Wed Jul 24 13:51:36 2013 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Wed Jul 24 13:51:36 2013 Re-using SSL/TLS context
Wed Jul 24 13:51:36 2013 LZO compression initialized
Wed Jul 24 13:51:36 2013 WARNING: normally if you use --mssfix and/or --fragment, you should also set --tun-mtu 1500 (currently it is 1374)
Wed Jul 24 13:51:36 2013 Control Channel MTU parms [ L:1432 D:138 EF:38 EB:0 ET:0 EL:0 ]
Wed Jul 24 13:51:36 2013 Socket Buffers: R=[180224->131072] S=[180224->131072]
Wed Jul 24 13:51:36 2013 Data Channel MTU parms [ L:1432 D:1432 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]
Wed Jul 24 13:51:36 2013 Local Options hash (VER=V4): '6273da05'
Wed Jul 24 13:51:36 2013 Expected Remote Options hash (VER=V4): 'fa399498'
Wed Jul 24 13:51:36 2013 UDPv4 link local: [undef]
Wed Jul 24 13:51:36 2013 UDPv4 link remote: [AF_INET]xxx.xxx.xxx.xxx:1194
Wed Jul 24 13:52:37 2013 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Wed Jul 24 13:52:37 2013 TLS Error: TLS handshake failed
Wed Jul 24 13:52:37 2013 TCP/UDP: Closing socket
Wed Jul 24 13:52:37 2013 SIGUSR1[soft,tls-error] received, process restarting
Wed Jul 24 13:52:37 2013 Restart pause, 2 second(s)
...

And this whole part repeats again and again ...

My .ovpn parameters are:

client
dev tun
proto udp
link-mtu 1432
remote ForExample.net
resolv-retry infinite
nobind
persist-tun
persist-key
persist-local-ip
persist-remote-ip
ca ca.crt
cert xxx.crt
key yyy.key
ns-cert-type server
cipher AES-256-CBC
comp-lzo
verb 3

The W-LAN says, that it's connected, but even, when I finish/stop openVPN in the still open bash with the comand strg (ctrl) + c, I cannot connect to the internet for example with the browser, or also the update service says, that it has no connection. And it makes also no difference to restart openVPN again. There's no connection anymore, untill I reboot the system.

The thing is, I have openVPN also on my Windows XP (I told about the dual-boot system) with the same config files and there it works fine even after coming up from standby!
I thought, maybe it was such a "driver thing" with the W-LAN-Adapter under linux, so I tried also to connect directly via LAN, but it makes no difference. First it works, but after standby not anymore.

I'm not really familiar with linux, so I have no idea anymore!

Does anyone know council? :?:

oli57

Addition/Correction:

Now have installed openSUSE and the situation is a bit different:
After coming up from standby, it's the same as usual. No internet connection any more and openVPN shows the mentioned error messages.
But if I stop openVPN in the console via strg (ctrl) + c, then suddenly internet works again! :o
And then I can start openVPN again like described and it also works again!

I think, it has something to do with this "TLS Error":

TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
TLS Error: TLS handshake failed
TCP/UDP: Closing socket
SIGUSR1[soft,tls-error] received, process restarting

But I can't find anything suitable to! (Some threads go in the direction of false certificates, but that can't be it in my case (I think!), because everything with the same certificates goes after a restart again!)

No one an idea? :?