TCP VPN 100% CPU usage with OpenVPN 2.2.2 x86_64 & OpenVPN

sofo

Hi All,

I am experiencing 100 % Known CPU usage issue in my TCP VPN Server.
It has CENTOS 6.4 installed . I also checked with lower CENTOS version.

After few minutes CPU usage reach to 96-100% and never comedown.
I have checked with latest Openvpn.

I also set verb 3 . verb 0 seems to be a known issue.

Here is my server conf file . Can you please check :

dev tun6
dev-node /dev/net/tun6
dev-type tun

ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/easy-rsa/2.0/keys/server.key
dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem

push "redirect-gateway def1"
push "redirect-gateway def1 bypass-dhcp"

ping 10
ping-exit 60

persist-key
persist-tun
status openvpn-status.log

verb 3
script-security 3

cipher none

comp-lzo
link-mtu 1350

script-security 3
auth-user-pass-verify /etc/openvpn/auth.sh via-env

client-cert-not-required
username-as-common-name
max-clients 30


server 172.25.0.0 255.255.0.0  

sndbuf 131072
rcvbuf 131072
tcp-nodelay

reneg-sec 0
cd /etc/openvpn/openvpn-tcp-1

local 137.10.130.249

I also tried with openvpn 2.2.2 without luck.

Thank you

sofo

Sorry following line missed out

management ip port

Thanks

sofo

Thanks debbie.

here is Client file.


client 
dev tun 
status st.log  
resolvretry 2 
persistkey 
persisttun
authnocache 
nscerttype server 
verb 3  
renegsec 0
ca "ca.crt" 
cipher none 
authuserpass "password.dat" 
scriptsecurity 2 
pingexit 60 
ping 10 

linkmtu 1350
sndbuf 131072  
rcvbuf 131072 
mssfix 1300  

complzo 
remote x.x.x.x 80 
nobind   
routemethod exe
routedelay 3   
proto tcp

I found above server and client config gives me best speed till now. and it was running well without any issue for last few months when server has less users like 5- 10 users.

Also in verb3 I see log file size is 19 MB in just 5-6 hours congaing only following types of log.

server log:

Sun Oct 20 09:57:14 2013 WARNING: normally if you use --mssfix and/or --fragment, you should also set --tun-mtu 1500 (currently it is 1322)
Sun Oct 20 09:57:14 2013 TCP connection established with [AF_INET]97.210.248.51:1110
Sun Oct 20 09:57:17 2013 WARNING: normally if you use --mssfix and/or --fragment, you should also set --tun-mtu 1500 (currently it is 1322)
Sun Oct 20 09:57:17 2013 TCP connection established with [AF_INET]195.135.82.59:4040
Sun Oct 20 09:57:17 2013 195.135.82.59:4040 WARNING: Bad encapsulated packet length from peer (4930), which must be > 0 and <= 1350 -- please ensure that --tun-mtu or --link-mtu is equal on both peers -- this condition could also indicate a possible active attack on the TCP link -- [Attempting restart...]
Sun Oct 20 09:57:17 2013 195.135.82.59:4040 Connection reset, restarting [0]

I think big packets are ( 4930 ) coming from other sources as the server is running in normal HTTP port 80 , not from openvpn client I believe. and openvpn server should drop it. But it seems here after receiving Big packet it is restarting the connection.

Thank you

sofo

Thanks debbie10t.
Sorry for the confusion . Both server and client config are okay. I missed out those TCP and local part to post here for server conf.

I again back to openvpn-2.2.2-1.el6.rf.x86_64.rpm which is working fine for me for last few months.

I did following.

run openvpn tcp server on a different port 7001 using - openvpn-2.2.2-1.el6.rf.x86_64.rpm.

Server load 10-15 users.
Server is still running for more than 40 hours without any issue.

Then in another machine ( same version of centos 6.4) I started openvpn 2.3 ( OpenVPN 2.3.1 x86_64-redhat-linux-gnu ) tcp server on port 7001
Server load 10-15 users.
after 3 hours it shows cpu usage 99% and it was no longer accepting connection. Then I restarted machine again after 40 minutes this time CPU usage reach to 99-100% and so on...
Using openvpn2.3 within 40 mins to 4 hours server CPU usage becomes 100%.

I did not find any clue. But when It serves it is very stable with good speed. and when server is running fine the log it produces is same when it becomes CPU hungry and non responsive.

Pls note : I issue management KILL command to kill users frequently.

During that time STRACE displays something like following infinitely

poll fd  events=POLLIN|POLLPRI. receive = -1  - Resource temporary unavailable

Thank you

ecrist

We don't support anything other than the latest version of openvpn. Currently, that's 2.3.2.

sofo

Ok.
Can you please focus some light , why following message comes with very latest of openvpn too.

Sun Oct 20 09:57:17 2013 195.135.82.59:4040 WARNING: Bad encapsulated packet length from peer (4930), which must be > 0 and <= 1350 -- please ensure that --tun-mtu or --link-mtu is equal on both peers -- this condition could also indicate a possible active attack on the TCP link -- [Attempting restart...]

It clearly shows that message coming from Openvpn client only.

I came across an open issue unfortunately I don't have that link with me - Tell that

If client openvpn.exe fork/exec by another program and close the output steam openvpn client sends LOG directly to server causing user disconnection.

Apart from that both using 2.2 and 2.3.x TCP CPU usage reach to 95-100% and stop accepting connection.
To tell how to replicate is very difficult. Because sometime it happens after 1 hour some time after 24 hours..I am still experiencing that issue with latest version too.

Thanks
sofo

sofo

Thanks. I don't know ..But now with 2.3.2 all are working fine. Thanks