No internet for few mins after connecting or disconnecting

txlife

Hi,i have an openvpn server set on linode vps.
But a lot users are having a connection issue.
They can connect to the openvpn server successfully and even and get everything working well.
However, the first about 3 mins after their connection or disconnection, they are not allowed to do anything with the internet.
No data flow. But after then, everything will be fine.
Im just wondering what reason causes this problem.

Here's my server.conf

local myipaddress
port 1135
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status.log
log         openvpn.log
verb 3

#begin mysql
plugin ./openvpn-auth-pam.so openvpn
client-cert-not-required
username-as-common-name

# record in database
script-security 2
client-connect ./connect.sh
client-disconnect ./disconnect.sh

Here's my client.ovpn
I'm using some ports for random selection just in order to avoid any ports got banned by firewall.
They are all prerouted to the original port and working well

max-routes 5000
explicit-exit-notify
dev tun
proto udp

remote my ip address 1135
remote my ip address $port
remote my ip address $port
remote my ip address $port
remote my ip address $port
remote my ip address $port
remote my ip address $port
remote my ip address $port
remote my ip address $port
remote my ip address $port

remote-random
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
auth-user-pass
ns-cert-type server
comp-lzo

verb 3

Since I don't get the problem they get, so I asked one of the user to provide his log file:

Sat Sep 14 17:57:30 2013 OpenVPN 2.3.2 i686-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [eurephia] [IPv6] built on Aug 22 2013
Enter Management Password:
Sat Sep 14 17:57:30 2013 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Sat Sep 14 17:57:30 2013 Need hold release from management interface, waiting...
Sat Sep 14 17:57:31 2013 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Sat Sep 14 17:57:31 2013 MANAGEMENT: CMD 'state on'
Sat Sep 14 17:57:31 2013 MANAGEMENT: CMD 'log all on'
Sat Sep 14 17:57:31 2013 MANAGEMENT: CMD 'hold off'
Sat Sep 14 17:57:31 2013 MANAGEMENT: CMD 'hold release'
Sat Sep 14 17:57:36 2013 MANAGEMENT: CMD 'username "Auth" "USER-NAME"'
Sat Sep 14 17:57:36 2013 MANAGEMENT: CMD 'password [...]'
Sat Sep 14 17:57:36 2013 Socket Buffers: R=[8192->8192] S=[8192->8192]
Sat Sep 14 17:57:36 2013 UDPv4 link local: [undef]
Sat Sep 14 17:57:36 2013 UDPv4 link remote: [AF_INET]<MY IP ADDRESS : RANDOM PORT>
Sat Sep 14 17:57:36 2013 MANAGEMENT: >STATE:1379152656,WAIT,,,
Sat Sep 14 17:57:36 2013 MANAGEMENT: >STATE:1379152656,AUTH,,,
Sat Sep 14 17:57:36 2013 TLS: Initial packet from [AF_INET]<MY IP ADDRESS : RANDOM PORT>, sid=07822e27 e5453439
Sat Sep 14 17:57:36 2013 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Sat Sep 14 17:57:37 2013 VERIFY OK: depth=1, C=CN, ST=BJ, L=Beijing, O=Elite-Union, CN=Elite-Union CA, emailAddress="***"
Sat Sep 14 17:57:37 2013 VERIFY OK: nsCertType=SERVER
Sat Sep 14 17:57:37 2013 VERIFY OK: depth=0, C=CN, ST=BJ, L=Beijing, O=Elite-Union, CN=server, emailAddress="***"
Sat Sep 14 17:57:37 2013 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sat Sep 14 17:57:37 2013 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Sep 14 17:57:37 2013 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sat Sep 14 17:57:37 2013 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Sep 14 17:57:37 2013 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Sat Sep 14 17:57:37 2013 [server] Peer Connection Initiated with [AF_INET]106.187.102.227:11136
Sat Sep 14 17:57:38 2013 MANAGEMENT: >STATE:1379152658,GET_CONFIG,,,
Sat Sep 14 17:57:39 2013 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Sat Sep 14 17:57:39 2013 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.14 10.8.0.13'
Sat Sep 14 17:57:39 2013 OPTIONS IMPORT: timers and/or timeouts modified
Sat Sep 14 17:57:39 2013 OPTIONS IMPORT: --ifconfig/up options modified
Sat Sep 14 17:57:39 2013 OPTIONS IMPORT: route options modified
Sat Sep 14 17:57:39 2013 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Sat Sep 14 17:57:39 2013 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Sat Sep 14 17:57:39 2013 MANAGEMENT: >STATE:1379152659,ASSIGN_IP,,10.8.0.14,
Sat Sep 14 17:57:39 2013 open_tun, tt->ipv6=0
Sat Sep 14 17:57:39 2013 TAP-WIN32 device [本地连接 2] opened: \\.\Global\{0F1D66E4-BF92-4B8E-9866-B317EEF6D4FA}.tap
Sat Sep 14 17:57:39 2013 TAP-Windows Driver Version 9.9 
Sat Sep 14 17:57:39 2013 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.14/255.255.255.252 on interface {0F1D66E4-BF92-4B8E-9866-B317EEF6D4FA} [DHCP-serv: 10.8.0.13, lease-time: 31536000]
Sat Sep 14 17:57:39 2013 Successful ARP Flush on interface [16] {0F1D66E4-BF92-4B8E-9866-B317EEF6D4FA}
Sat Sep 14 17:57:44 2013 TEST ROUTES: 2/2 succeeded len=1 ret=1 a=0 u/d=up
Sat Sep 14 17:57:44 2013 C:\Windows\system32\route.exe ADD 106.187.102.227 MASK 255.255.255.255 192.168.1.1
Sat Sep 14 17:57:44 2013 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Sat Sep 14 17:57:44 2013 Route addition via IPAPI succeeded [adaptive]
Sat Sep 14 17:57:44 2013 C:\Windows\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.8.0.13
Sat Sep 14 17:57:44 2013 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Sat Sep 14 17:57:44 2013 Route addition via IPAPI succeeded [adaptive]
Sat Sep 14 17:57:44 2013 C:\Windows\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.8.0.13
Sat Sep 14 17:57:44 2013 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Sat Sep 14 17:57:44 2013 Route addition via IPAPI succeeded [adaptive]
Sat Sep 14 17:57:44 2013 MANAGEMENT: >STATE:1379152664,ADD_ROUTES,,,
Sat Sep 14 17:57:44 2013 C:\Windows\system32\route.exe ADD 10.8.0.1 MASK 255.255.255.255 10.8.0.13
Sat Sep 14 17:57:44 2013 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Sat Sep 14 17:57:44 2013 Route addition via IPAPI succeeded [adaptive]
Sat Sep 14 17:57:44 2013 Initialization Sequence Completed
Sat Sep 14 17:57:44 2013 MANAGEMENT: >STATE:1379152664,CONNECTED,SUCCESS,10.8.0.14,[MY IP ADDRESS]
Sat Sep 14 18:57:37 2013 TLS: soft reset sec=0 bytes=58617933/0 pkts=146255/0
Sat Sep 14 18:57:37 2013 VERIFY OK: depth=1, C=CN, ST=BJ, L=Beijing, O=Elite-Union, CN=Elite-Union CA, emailAddress="***"
Sat Sep 14 18:57:37 2013 VERIFY OK: nsCertType=SERVER
Sat Sep 14 18:57:37 2013 VERIFY OK: depth=0, C=CN, ST=BJ, L=Beijing, O=Elite-Union, CN=server, emailAddress="***"
Sat Sep 14 18:57:38 2013 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sat Sep 14 18:57:38 2013 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Sep 14 18:57:38 2013 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sat Sep 14 18:57:38 2013 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Sep 14 18:57:38 2013 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Sat Sep 14 19:57:37 2013 TLS: tls_process: killed expiring key
Sat Sep 14 19:57:38 2013 TLS: soft reset sec=0 bytes=38872779/0 pkts=110649/0
Sat Sep 14 19:57:41 2013 VERIFY OK: depth=1, C=CN, ST=BJ, L=Beijing, O=Elite-Union, CN=Elite-Union CA, emailAddress=admin@euclan.com
Sat Sep 14 19:57:41 2013 VERIFY OK: nsCertType=SERVER
Sat Sep 14 19:57:41 2013 VERIFY OK: depth=0, C=CN, ST=BJ, L=Beijing, O=Elite-Union, CN=server, emailAddress=admin@euclan.com
Sat Sep 14 19:57:42 2013 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sat Sep 14 19:57:42 2013 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Sep 14 19:57:42 2013 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sat Sep 14 19:57:42 2013 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sat Sep 14 19:57:42 2013 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Sat Sep 14 20:11:56 2013 SIGTERM received, sending exit notification to peer
Sat Sep 14 20:11:57 2013 C:\Windows\system32\route.exe DELETE 10.8.0.1 MASK 255.255.255.255 10.8.0.13
Sat Sep 14 20:11:57 2013 Route deletion via IPAPI succeeded [adaptive]
Sat Sep 14 20:11:57 2013 C:\Windows\system32\route.exe DELETE 106.187.102.227 MASK 255.255.255.255 192.168.1.1
Sat Sep 14 20:11:57 2013 Route deletion via IPAPI succeeded [adaptive]
Sat Sep 14 20:11:57 2013 C:\Windows\system32\route.exe DELETE 0.0.0.0 MASK 128.0.0.0 10.8.0.13
Sat Sep 14 20:11:57 2013 Route deletion via IPAPI succeeded [adaptive]
Sat Sep 14 20:11:57 2013 C:\Windows\system32\route.exe DELETE 128.0.0.0 MASK 128.0.0.0 10.8.0.13
Sat Sep 14 20:11:57 2013 Route deletion via IPAPI succeeded [adaptive]
Sat Sep 14 20:11:57 2013 Closing TUN/TAP interface
Sat Sep 14 20:11:57 2013 SIGTERM[soft,exit-with-notification] received, process exiting
Sat Sep 14 20:11:57 2013 MANAGEMENT: >STATE:1379160717,EXITING,exit-with-notification,,

Here's another one, is from another vpn server which is located in HK, same config,same issue

Sun Sep 15 00:26:27 2013 OpenVPN 2.3.2 i686-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [eurephia] [IPv6] built on Aug 22 2013
Enter Management Password:
Sun Sep 15 00:26:27 2013 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25341
Sun Sep 15 00:26:27 2013 Need hold release from management interface, waiting...
Sun Sep 15 00:26:28 2013 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25341
Sun Sep 15 00:26:28 2013 MANAGEMENT: CMD 'state on'
Sun Sep 15 00:26:28 2013 MANAGEMENT: CMD 'log all on'
Sun Sep 15 00:26:28 2013 MANAGEMENT: CMD 'hold off'
Sun Sep 15 00:26:28 2013 MANAGEMENT: CMD 'hold release'
Sun Sep 15 00:26:40 2013 MANAGEMENT: CMD 'username "Auth" "Fancheseco"'
Sun Sep 15 00:26:40 2013 MANAGEMENT: CMD 'password [...]'
Sun Sep 15 00:26:40 2013 Socket Buffers: R=[8192->8192] S=[8192->8192]
Sun Sep 15 00:26:40 2013 UDPv4 link local: [undef]
Sun Sep 15 00:26:40 2013 UDPv4 link remote: [AF_INET]<MY IP ADDRESS>:<RANDOM PORT>
Sun Sep 15 00:26:40 2013 MANAGEMENT: >STATE:1379176000,WAIT,,,
Sun Sep 15 00:26:40 2013 MANAGEMENT: >STATE:1379176000,AUTH,,,
Sun Sep 15 00:26:40 2013 TLS: Initial packet from [AF_INET]<MY IP ADDRESS>:<RANDOM PORT>, sid=d9ba5c9d f6ec78b8
Sun Sep 15 00:26:40 2013 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Sun Sep 15 00:26:40 2013 VERIFY OK: depth=1, C=CN, ST=HK, L=Hongkong, O=vpn.euclan.com, CN=vpn.euclan.com CA, emailAddress="***"
Sun Sep 15 00:26:40 2013 VERIFY OK: nsCertType=SERVER
Sun Sep 15 00:26:40 2013 VERIFY OK: depth=0, C=CN, ST=HK, L=Hongkong, O=vpn.euclan.com, CN=euhk, emailAddress="***"
Sun Sep 15 00:26:40 2013 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sun Sep 15 00:26:40 2013 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Sep 15 00:26:40 2013 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Sun Sep 15 00:26:40 2013 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Sep 15 00:26:40 2013 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Sun Sep 15 00:26:40 2013 [euhk] Peer Connection Initiated with [AF_INET]<MY IP ADDRESS>:<RANDOM PORT>
Sun Sep 15 00:26:41 2013 MANAGEMENT: >STATE:1379176001,GET_CONFIG,,,
Sun Sep 15 00:26:43 2013 SENT CONTROL [euhk]: 'PUSH_REQUEST' (status=1)
Sun Sep 15 00:26:43 2013 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.18 10.8.0.17'
Sun Sep 15 00:26:43 2013 OPTIONS IMPORT: timers and/or timeouts modified
Sun Sep 15 00:26:43 2013 OPTIONS IMPORT: --ifconfig/up options modified
Sun Sep 15 00:26:43 2013 OPTIONS IMPORT: route options modified
Sun Sep 15 00:26:43 2013 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Sun Sep 15 00:26:43 2013 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Sun Sep 15 00:26:43 2013 MANAGEMENT: >STATE:1379176003,ASSIGN_IP,,10.8.0.18,
Sun Sep 15 00:26:43 2013 open_tun, tt->ipv6=0
Sun Sep 15 00:26:43 2013 TAP-WIN32 device [本地连接 2] opened: \\.\Global\{0F1D66E4-BF92-4B8E-9866-B317EEF6D4FA}.tap
Sun Sep 15 00:26:43 2013 TAP-Windows Driver Version 9.9 
Sun Sep 15 00:26:43 2013 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.18/255.255.255.252 on interface {0F1D66E4-BF92-4B8E-9866-B317EEF6D4FA} [DHCP-serv: 10.8.0.17, lease-time: 31536000]
Sun Sep 15 00:26:43 2013 Successful ARP Flush on interface [16] {0F1D66E4-BF92-4B8E-9866-B317EEF6D4FA}
Sun Sep 15 00:26:48 2013 TEST ROUTES: 2/2 succeeded len=1 ret=1 a=0 u/d=up
Sun Sep 15 00:26:48 2013 C:\Windows\system32\route.exe ADD <MY IP ADDRESS> MASK 255.255.255.255 192.168.1.1
Sun Sep 15 00:26:48 2013 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Sun Sep 15 00:26:48 2013 Route addition via IPAPI succeeded [adaptive]
Sun Sep 15 00:26:48 2013 C:\Windows\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.8.0.17
Sun Sep 15 00:26:48 2013 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Sun Sep 15 00:26:48 2013 Route addition via IPAPI succeeded [adaptive]
Sun Sep 15 00:26:48 2013 C:\Windows\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.8.0.17
Sun Sep 15 00:26:48 2013 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Sun Sep 15 00:26:48 2013 Route addition via IPAPI succeeded [adaptive]
Sun Sep 15 00:26:48 2013 MANAGEMENT: >STATE:1379176008,ADD_ROUTES,,,
Sun Sep 15 00:26:48 2013 C:\Windows\system32\route.exe ADD 10.8.0.1 MASK 255.255.255.255 10.8.0.17
Sun Sep 15 00:26:48 2013 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=30 and dwForwardType=4
Sun Sep 15 00:26:48 2013 Route addition via IPAPI succeeded [adaptive]
Sun Sep 15 00:26:48 2013 Initialization Sequence Completed
Sun Sep 15 00:26:48 2013 MANAGEMENT: >STATE:1379176008,CONNECTED,SUCCESS,10.8.0.18,<MY IP ADDRESS>

The server's log is attached below, I'm sry is a bit long so I uploaded it to my ftp
http://vpn.euclan.com/doc/openvpn.log

I've done a lot research, but just couldn't find anything and dats y i come here for some help.
I'd be very glad if someone can give me a clue.
Thanks!!!