Hello there!
I think this is not an configuration problem itself, because I've stable connection to ~20 customers.
A short technical summary:
- Our server is sitting behind a cable connection, connected 24/7 to the internet with a public static IP
- Our server is running OpenVPN v2.1.4
- All of my customers using a small VPN-Box installed an configured by me.
- The VPN-Boxes are running a voyage-linux system with OpenVPN v2.1.3
- The link is established from customer side to our server (customer outgoing connection)
- Most of my customers using proto udp. Some (because of network restrictions) proto tcp
- To handle both connection types, I'm running two separate openvpn servers (one for udp, one for tcp)
This all is running very fine for all but one customer so far. Said customer (proto udp) loose its connection after a few hours (maybe over night). It seems that the openvpn installation on the customers VPN-Box isn't aware of this because the tap device still exists with its configured IP and the last log entries from openvpn are from last night:
Jul 25 23:43:45 voyage ovpn-openvpn[8251]: [vpnserver] Inactivity timeout (--ping-restart), restarting
Jul 25 23:43:45 voyage ovpn-openvpn[8251]: SIGUSR1[soft,ping-restart] received, process restarting
Jul 25 23:43:47 voyage ovpn-openvpn[8251]: Re-using SSL/TLS context
Jul 25 23:43:47 voyage ovpn-openvpn[8251]: LZO compression initialized
Jul 25 23:43:47 voyage ovpn-openvpn[8251]: UDPv4 link local (bound): [undef]:1194
Jul 25 23:43:47 voyage ovpn-openvpn[8251]: UDPv4 link remote: xxx.xxx.xxx.xxx:1194
Jul 25 23:44:47 voyage ovpn-openvpn[8251]: TLS Error: TLS key negotiation failed to occur within 60 seconds
(check your network connectivity)
Jul 25 23:44:47 voyage ovpn-openvpn[8251]: TLS Error: TLS handshake failed
Jul 25 23:44:47 voyage ovpn-openvpn[8251]: SIGUSR1[soft,tls-error] received, process restarting
Jul 25 23:44:49 voyage ovpn-openvpn[8251]: Re-using SSL/TLS context
Jul 25 23:44:49 voyage ovpn-openvpn[8251]: LZO compression initialized
Jul 25 23:44:49 voyage ovpn-openvpn[8251]: UDPv4 link local (bound): [undef]:1194
Jul 25 23:44:49 voyage ovpn-openvpn[8251]: UDPv4 link remote: xxx.xxx.xxx.xxx:1194
Jul 25 23:45:07 voyage ovpn-openvpn[8251]: TLS Error: Unroutable control packet received from xxx.xxx.xxx.xxx
:1194 (si=3 op=P_ACK_V1)
Jul 25 23:45:19 voyage last message repeated 6 times
Jul 25 23:45:21 voyage ovpn-openvpn[8251]: [vpnserver] Peer Connection Initiated with xxx.xxx.xxx.xxx:1194
Jul 25 23:45:23 voyage ovpn-openvpn[8251]: Preserving previous TUN/TAP instance: tap0
Jul 25 23:45:23 voyage ovpn-openvpn[8251]: Initialization Sequence Completed
It seems that my customer got his normal 24h disconnect round about this time. It looks normal and usually I must be able to access the VPN-Endpoint of my customer from my server. But I can't.
Here is the relevant output of my server status table :
OpenVPN CLIENT LIST
[...]
172.31.16.13,yyy.yyy.yyy.yyy:59155,211047245,45178863,Mon Jul 8 10:26:48 2013
[...]
ROUTING TABLE
[...]
The internet IP-Adress is correct, but there is no entry for this customer in the ROUTING TABLE. My server thinks the connection is still established, but because this endpoint don't have an entry in the "ROUTING TABLE" my server is sending an ARP-Request if I try to ping the endpoint 172.31.16.13:
# tcpdump -i vpnudp -vvv -n
10:53:51.198872 arp who-has 172.31.16.13 tell 172.31.16.1
10:53:52.200539 arp who-has 172.31.16.13 tell 172.31.16.1
But the endpoint isn't responding.
Because I've the possibility to connect to this customer with a 3rd party program, I'm able to connect to my VPN-Box using putty from a one of my customers clients. If I now just send ONE ping from this VPN-Box to my VPN-Server-Endpoint (172.31.16.1) the link is active again and I'm able to ping from both sides. It seems that the link is broken somewhere between both openvpn endpoints (maybe the router of my customer loose the corresponding NAT-Entries or what). But why do the customers openvpn doesn't recognize this an starts a ping or something else to get the link up again?
In this situation the link is broken and I can't re-establish it from server side. I need to do active taskts on customer-side which isn't desirable.
Here is the configuration of my customers openvpn installation:
port 1194
remote hostname-of-my-server
client
proto udp
dev tap
tls-client
tun-mtu 1500
fragment 1400
mssfix
ns-cert-type server
ca /etc/openvpn/cacert.pem
cert /etc/openvpn/newcert.pem
key /etc/openvpn/newkey.pem
tls-auth /etc/openvpn/ta.key 1
comp-lzo
persist-key
persist-tun
keepalive 10 120
pull
Any ideas how to overcome this problem? The first idea is to add a crontask on customers vpn-box and send one ping to my server-endpoint every minute. This seems to work - but I like more general solutions.
Regards
Martin
