float option in not working with changing client source port

[deleted]

Hi ,
I have a situation where clients UDP source ports will be changed frequently.
should float option in server fulfill that . or any way to keep openvpn working in this situation.
I cheeked float working with frequently changed client source IP .

But when Client source port is changing servers reply not coming to client. ( But It should work as per Openvpn man page )

Few articles say after Tunnel is setup then after source port change is allowed.
I am using user password verification. Server mode. Duplicate CN is off. Client cert not required.
Can you pls suggest .

This link has same situation like mine: http://openvpn.net/archive/openvpn-devel/2006-03/msg00003.html

I found this link also : http://openvpn.net/archive/openvpn-users/2002-06/msg00004.html

Thanks
jon

maikcat

which openvpn version are you using?

Michael.

[deleted]

Hi ,
I am using OpenVPN 2.3.2 x86_64-redhat-linux-gnu

Thanks

[deleted]

Hi Maikcat,
I have tried v2.2 also in server . I have only enabled float option in server. Am I doing anything wrong.

Thank you

[deleted]

Can you Please check following TCPDUMP which shows openvpn server still sending packet to the first port .

[
216.203.218.111 = client IP
196.196.19.12 = server ip
server port = 500
Client port starts from 1 and increment by 1 ( 1 ,2 ,3 ,4 ,...)
tcpmux==port 1
]

1 packets captured
40 packets received by filter
2 packets dropped by kernel
[root@CentOS-64-64-minimal ~]# tcpdump net 216.203.218.111 and port 500
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes

[first packet from client ( src port :1 ) to server : 500 ]
13:18:21.309005 IP 216.203.218.111.1 > 196.196.19.12.500: [|500]

[Ok: server sent the reply packet to client port 1 ]
13:18:21.309302 IP 196.196.19.12.500 > 216.203.218.111.tcpmux: [|500]

[ now for 2 nd packet client source port is = 2 ]
13:18:21.525639 IP 216.203.218.111.2 > 196.196.19.12.500: [|500]
13:18:21.566360 IP 216.203.218.111.4 > 196.196.19.12.500: 500:
13:18:21.566392 IP 216.203.218.111.3 > 196.196.19.12.500: 500:
13:18:21.566401 IP 216.203.218.111.5 > 196.196.19.12.500: [|500]

[ But seems server rejected the packet came from port 2
hence its retryign to send first packet again to port 1 ..hence connection timeout
]
13:18:23.677000 IP 196.196.19.12.500 > 216.203.218.111.tcpmux: [|500]

13:18:23.848259 IP 216.203.218.111.6 > 196.196.19.12.500: 500:
13:18:23.921284 IP 216.203.218.111.7 > 196.196.19.12.500: [|500]
13:18:25.074303 IP 216.203.218.111.8 > 196.196.19.12.500: 500:
13:18:26.244084 IP 216.203.218.111.9 > 196.196.19.12.500: [|500]
13:18:27.299509 IP 196.196.19.12.500 > 216.203.218.111.tcpmux: [|500]

13:18:27.543585 IP 216.203.218.111.10 > 196.196.19.12.500: [|500]
13:18:28.695192 IP 216.203.218.111.12 > 196.196.19.12.500: 500:
13:18:28.700173 IP 216.203.218.111.11 > 196.196.19.12.500: 500:
13:18:30.544175 IP 216.203.218.111.13 > 196.196.19.12.500: [|500]
13:18:37.293027 IP 216.203.218.111.14 > 196.196.19.12.500: 500:
13:18:38.407896 IP 216.203.218.111.15 > 196.196.19.12.500: 500:
13:18:39.479807 IP 216.203.218.111.16 > 196.196.19.12.500: [|500]
^C
19 packets captured
22 packets received by filter
0 packets dropped by kernel
[root@CentOS-64-64-minimal ~]#

Thanks