[Closed] Openvpn/Gopenvpn not reconnect after wlan fail

abderrahman

Can you post your config?
And details about your OpenVPN client?

Also, what does the log say during the timeout?

pouchette

Thanks for answering :-)

well, where do i find the logs files of my vpn client ?

by configuration, you mean configuration of the vpn server ?

well, here is the config of one of them (cause I use several but all with the same config except the vpn server ip)

##############################################
# Sample client-side OpenVPN 2.0 config file #
# for connecting to multi-client server.     #
#                                            #
# This configuration can be used by multiple #
# clients, however each client should have   #
# its own cert and key files.                #
#                                            #
# On Windows, you might want to rename this  #
# file so it has a .ovpn extension           #
##############################################

# Specify that we are a client and that we
# will be pulling certain config file directives
# from the server.
client

auth-user-pass
#management-query-passwords
#management-hold

# Disable management port for debugging port issues
#management 127.0.0.1 13010

ping 5
ping-exit 30

# Use the same setting as you are using on
# the server.
# On most systems, the VPN will not function
# unless you partially or fully disable
# the firewall for the TUN/TAP interface.
#;dev tap
dev tun

# Windows needs the TAP-Win32 adapter name
# from the Network Connections panel
# if you have more than one.  On XP SP2,
# you may need to disable the firewall
# for the TAP adapter.
;dev-node MyTap

# Are we connecting to a TCP or
# UDP server?  Use the same setting as
# on the server.
;proto tcp
proto udp

# The hostname/IP and port of the server.
# You can have multiple remote entries
# to load balance between the servers.
# All VPN Servers are added at the very end
;remote my-server-2 1194

# Choose a random host from the remote
# list for load-balancing.  Otherwise
# try hosts in the order specified.
# We order the hosts according to number of connections.
# So no need to randomize the list
# remote-random

# Keep trying indefinitely to resolve the
# host name of the OpenVPN server.  Very useful
# on machines which are not permanently connected
# to the internet such as laptops.
resolv-retry infinite

# Most clients don't need to bind to
# a specific local port number.
nobind

# Downgrade privileges after initialization (non-Windows only)
;user nobody
;group nobody

# Try to preserve some state across restarts.
persist-key
persist-tun

# If you are connecting through an
# HTTP proxy to reach the actual OpenVPN
# server, put the proxy server/IP and
# port number here.  See the man page
# if your proxy server requires
# authentication.
;http-proxy-retry # retry on connection failures
;http-proxy [proxy server] [proxy port #]

# Wireless networks often produce a lot
# of duplicate packets.  Set this flag
# to silence duplicate packet warnings.
;mute-replay-warnings

# SSL/TLS parms.
# See the server config file for more
# description.  It's best to use
# a separate .crt/.key file pair
# for each client.  A single ca
# file can be used for all clients.
ca ca.crt
cert hmauser.crt
key hmauser.key

# Verify server certificate by checking
# that the certicate has the nsCertType
# field set to "server".  This is an
# important precaution to protect against
# a potential attack discussed here:
#  http://openvpn.net/howto.html#mitm
#
# To use this feature, you will need to generate
# your server certificates with the nsCertType
# field set to "server".  The build-key-server
# script in the easy-rsa folder will do this.
;ns-cert-type server

# If a tls-auth key is used on the server
# then every client must also have the key.
;tls-auth ta.key 1

# Select a cryptographic cipher.
# If the cipher option is used on the server
# then you must also specify it here.
;cipher x

# Enable compression on the VPN link.
# Don't enable this unless it is also
# enabled in the server config file.
#comp-lzo

# Set log file verbosity.
verb 3

# Silence repeating messages
;mute 20

# Detect proxy auto matically
#auto-proxy

# Need this for Vista connection issue
route-metric 1

# Get rid of the cached password warning
#auth-nocache

#
# Remote servers added dynamically by the master server
# DO NOT CHANGE below this line
#
remote 62.233.34.2 53 # 0

as I said, I'm using the graphical Gui (Gopenvpn for linux) which is based on openvpn.

so in my etc/openvpn folder I have all the servers config +certificate (ca.crt) + 2 files named hmauser.crt + hmauser.key

I'll check for the log file if i can find it.

abderrahman

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.

pouchette

Again, very dear 'abderrahman' thanks a lot for helping :-)

The config you posted is the client config (it's what I need to see), the server config is your provider's side and you don't see it. Just wanted to correct the terminology

he he ! thank you so much to 'light up' my so bad ignorance in that domain !!!!
I of course didn't mean my provider config, that is at least somthg i know ! What i meant is the config of the vpn client server, i might be wrong indeed but a vpn is a 'tunnel', ok, but isn't it a server we connect to between my provider network and all other destination i want to connect to ? (well, kind of hard for me to talk about that in right appropriates terms !!)

With EtherApe I can have a look of the network and it is very interesting and funny even if I don't understand everything I see !!

and, the beginning of my conf file starts with :

Sample client-side OpenVPN 2.0 config file #
# for connecting to multi-client server

'client server', which is a server, no ?

(well, end of bracket !)

So
1) I'm very afraid to upgrade my openvpn version, till now it caused me lots of crash troubles, and finally updating initramfs-tools resolved the openvpn crashes.

2) (i'm only using synaptics, hate this softw center hours to load and all its advertising), and in synaptic don't have any upgrade version of openvpn, only the 2.2.1
So, as it is not proposed in synaptic, i'm afraid it won't be absolutely compatible with my 12.04 version of ubuntu.

3) I absolutely don't want to upgrade my Ubuntu, I yes have several years before it'll be obsolete, Lts = long term support, this long term for 12.04 is 5 years, and it came out in 2012, the 12.01 version is only supported for 18 mth (and 13.xx I think).
And really, I got so many troubles in the beginning of the install, incompatibilities pb with my asus, it took me a while to fix everything, graphical card drivers, video acceleration, etc...
So now that everthing is perfectly stable, I won't take a chance to risk it !
And before installing 12.04 I first tried to install 12.10 which was worse.

So now I just have this 'little' issue with this vpn disconnection, and it worth to fix it.

I'm using Hma cause it seemed to be easy, and was a little lazy to look for a better solution.
I have since a long time a dual boot with Windows 7, and I had before experienced Hma which was so easy and well working under Windows.

Actually till now i didn't think about security risks, and when I looked at the log today i also thought about the security factor.

I'm now in France and we have here troubles with hadopi 'big brother' watching illegal downloads, and when I'm not in France I need a vpn to be able to watch french tv or usa tv !! (well for usa i use ultasurf proxy with wine but vpn is a more complete solution).
so the good thing with Hma is that they propose multiple countries ip, and have very good bandwidth.

And, vpn network manager doesn't work, well I tried, and open port in the router, but still have a lake of knowledge with vpn pptb protocol to make it work.
Do you think it would be better to use network-manager ? but with Hma it won't change the lake of security, right ?

And I have to confess that this Gopenvpn gui is so so convenient !!

So despite not advertising, could you may be advise me a good vpn client safer to use ?

Otherwise, what does "ping-exit 30" means ? what does it mean "I will stay protected even when the connection is idle" ?
And what does also mean "route-metric 1" ?

very sorry to bother you but I really like to understand a bit what i'm doing, so it also gives me a chance to learn :-)

Again and again : Thanks a looooooooootttttttttt !!

abderrahman

First, correcting terms

Here's a nice picture from Wikipedia that helps (https://en.wikipedia.org/wiki/File:Client-server-model.svg)

Also the French version explaining client-server: https://fr.wikipedia.org/wiki/Client-serveur

Imagine you're at a restaurant. You sit down, you're the client. You have a waiter that serves you... he's a server. You order food and he brings it. Multi-client server means that your waiter also serves other tables at the same time, not just you. 99.99% of websites and services you use are multi-client servers... it's not just you that can use that service or website, right? Multi-client means more than one... you can't be a client AND a server at the same time (you don't eat then take orders from other people at the restaurant!)

Tunneling is what we call the action of the whole thing. When you connect to a VPN you're tunneling. The connection between you is called a tunnel. It's a direct path between you no one sees inside it. It's like le tunnel sous la Manche, a direct connection, only goes in the direction of France or UK.

Upgrade your OVPN. Upgrading doesn't break things. You have a correct config, so everything should be in order. 2.3.2 doesn't use new technology that's incompatible with older versions of OpenVPN (as of 2.0 that is), again no problems to be expected. Upgrading is important as it supports new technologies, and patches security holes.
Upgrade through the official OVPN repos, as shown in the link I sent in the previous reply. I've just Googled it, and it seems that Ubuntu for some reason is still stuck at 2.2.1

Uninstall HMA's crap, and use the official client, and through NetworkManager. You can import your .ovpn configs. Check this: http://askubuntu.com/questions/187511/how-can-i-use-a-ovpn-file-with-network-manager
I think you could keep using gopenvpn too, if it causes you trouble you could easily uninstall (BTW gopenvpn is also dated and hasn't been updated in a while)

Newer kernel, and newer Ubuntu releases always add support for more hardware and resolve a lot of issues. Don't be afraid of getting out of your comfort zone just to keep things stable for a little more. Sooner or later you'll be facing the upgrade... you'll have to. Linux releases have a more rapid cycle, so unlike Windows, fairly "new" versions get outdated quick (for example Ubuntu 12.x is only a year and something old... but it's already "outdated". On Windows some people still use WinXP!)
Try a test run with a live media (CD or USB) and see how things work out. Also, everything has got a solution. Other people probably faced the same problem before you so you just have to apply the same steps they took.

For your information, HideMyAss isn't tolerant of BitTorrent. They also have a history of handing people over to authorities, they log... so the VPN kinda loses its purpose. Again, I advice you to just type "torrentfreak best vpn" in Google and you'll find answers on the first page.
Look for P2P friendliness, no logging policy, cheap, unlimited bandwidth, and reputation

Don't use PPTP! Is very weak, and actually not safe at all. You have an OpenVPN connection... why use PPTP?

Are you asking about a safer client, or a better VPN provider? PM I'll give a link to a good article that compares trusty providers

--ping-exit x means that OVPN will quit after the number of seconds "x" if there's no traffic. You don't want that.
I'm not very good with routing tables, so I can't explain a lot about --route-metric... all I know is that it's not needed in your situation since values are set automatically. --route-metric, as I understand, is used to define which route connections should take (as defined in the routing tables). You VPN pushes those settings automatically, no config on your side is needed

pouchette

Hi teacher ;-)

But in you wiki picture, where is the vpn-client I'm connecting to ?

Yes, you're right, I should definitely change vpn.
And thanks for your PM, I'll check.

So I'll may be upgrade openvpn :?

But really out of the quetion to upgrade Ubuntu for now !
I yes choose the 'coward' solution !
I could test a try with a cd but waste of time for me cause with the cd we don't have access to all the features and all the hiding bugs don't show up immediately, it's always a surprise !

So I'll wait for the next Lts, yes later or sooner I'll have to face upgrading, but for now I choose 'later' !!

Otherwise, the modif conf ping exit, ping restart and 'route-metric 1' didn't make the job, didn't fix the issue.

I'd rather use the vpn manager, but in the manager config options I only have pptp choice, it says that if other choices do not appear in the selection means that I don't have the necessary hum.. "plugin" "extension' (don't know the exact term in english for 'greffon' :oops:

2- about openvpn, in windows it seems to have a graphical gui coming with, under linux you don't, that's why i finally chosen to use gopenvpn which is indeed outdated but partially works (makes the job but makes openvpn apps crash all the time).

So I guess i'll have to use openvpn through terminal command lines, which is ok, but not so convenient ; each time open terminal, enter the command etc...

Is there a better way to use openvpn in Linux ?

And do you have an idea of what to add (install) to be able to use network manager with other options than pptp ?

pouchette

[EDIT]

Ok.

Here is what I find (I also post it for others who would need help on the same problem)

Ubuntu Linux 12.04: OpenVPN via Network Manager Setup

You need to install : openvpn ; network-manager-openvpn and network-manager-openvpn-gnome

Open a Terminal, and run:
sudo apt-get install openvpn network-manager-openvpn network-manager-openvpn-gnome
This will prompt for both your password, and a Y/n answer, please provide it with your password, and Y
(those can also be installed directly from synaptic)

Once installed, open System Settings, then Network
Press the + symbol to add a new connection, and select the VPN Interface, then press Create
Choose OpenVPN as your VPN Connection Type, and press Create
The following will walk you though all configuration steps needed for the VPN you subscribed to.

- Gateway: Select one of the Hostnames (generally provided on the NETWORK PAGE of your vpn provider website)
- Then fill all the connection details of your vpn :
Authentication : Type Password
Username: The username provided with your vpn account
Password: The password provided with your vpn account
CA Certificate: Downloaded certificate file or zip file from your vpn service website, put or extract the ca.crt file to somewhere it won't be deleted

Now, question about the new OpenVPN releases (2.3.3 and later) which is not in synaptic.

It says about that (I do not understand what does it mean) :

The current incarnation of OpenVPN apt repositories is the third one. The first repositories were hosted on build.openvpn.net and the second ones on repos.openvpn.net, a now discontinued server. The apt lines for the latter still work, but new OpenVPN releases (2.3.3 and later) will only be added to current swupdate.openvpn.net repos. Unfortunately due to the complete restructuring of the apt repository structure it is not possible to cleanly migrate from the repos.openvpn.net-based configuration to the swupdate.openvpn.net configuration.

"Cleanly migrate" ?
so it will "dirtily" migrate ?!!! :?: :?:

Then what do i do ? stuck with the 'official' 2.2 version or what ?

abderrahman

You need a special package for NetworkManager in GNOME, it's called networ-manager-openvpn & network-manager-openvpn-gnome. This addes OpenVPN to the list

OpenVPN in Linux doesn't offer a GUI. The GUI in Windows is a separate project someone developed, then the OpenVPN community decided to include it with OVPN client for Windows
But, there are a few options. Gopenvpn is one of them, there's also OAST, OpenVPN-Status

As for your connectivity problem with HMA, I've read some reports that they have connectivity issues. Try to add the line "float" to your config and see if that helps

You need to read more about VPN and what it is. This is a good start: http://gizmodo.com/5990192/vpns-what-they-do-how-they-work-and-why-youre-dumb-for-not-using-one but not enough. Search for it in French if that helps you understand better

"Cleanly migrate" ?
so it will "dirtily" migrate ?!!

The "clean" or "dirty" migration isn't meant for the end-user, me and you. That's a note for developers, or people who have previously the old repo.openvpn.net

You need to do all that because you have an old Ubuntu. In Ubuntu 13.10 OVPN 2.3.2 is available in Software Center, try to search in your Software Center for openvpn and check the version... maybe they've updated it too

In case they haven't, and you're not very sure, uninstall the current openvpn, then follow the steps to add the swupdate.openvpn.net repo, then install

pouchette

No they haven't (upgraded it) and I'm sure !

and please : stop to say my 12.04 is old !!! smthg like a year !!
it's not such a dinosaur !!! I don't believe it !!

And I LOVE IT !!! and I customized it and so it's a queen of beauty !!!

but do you think that it really worth it, to uprage the so old ovpn rather than using the 2.2 one ??

and do you think that this disconnection issue (not reconnect itself after wlan failure) will be fixed using ovpn/ntwk manag ?

No I won't need any gui if i can connect directly from the ntwk-manager, and i'll be glad to get rid of gopenvpn, as i said even if it 'works' and even if it stays connected, it makes openvpn crash all the time..

abderrahman

No reason to get angry. The "sure" part wasn't for whether they've upgraded or not, it means if you're hesitant about breaking something, just uninstall and install the new one

You don't have to upgrade, just make sure you install the updates, and you have the latest kernel

I doubt that the disconnection issue will be solved with NetworkManager, because that's just an interface. OpenVPN is what does the work

Have you tried the --float command?

pouchette

I'm not angry at all !!! I'm so thankful for your help

I was just kidding and teasing you a bit !!

well, I'm not afraid to break anything, just afraid that the latest release of ovpn won't work fine on 12.04, so I yes uninstall ovpn and re-install it 'cleanly'
but i think i'll use the 2.2 from synaptic (yep cowardly :oops: )

and what is "the --float command" ? where is it, in the conf file of vpnclient ?

abderrahman

Linux is modular. If a package doesn't work you just remove it. However as I said you're free to do whatever you like, if you're not comfortable with the idea of upgrading, don't 🙂
And 2.3.2 works on 12.04, OpenVPN built a version for it

--float (add it without --) is a command that allows your OpenVPN to accept connection sent from another address as the one you got during connection. It's a bit complex to explain, but if the first time you connected to 1.2.3.4 then the connection dropped, OVPN tries to resume the connection but finds that it's 1.2.3.1 now... it will refuse to connect (as a security measure). This command allows it to connect anyway if everything else is OK (password, username, certificate etc)

pouchette

[EDIT]

I did find the all solution so I'm gonna post here a summary of the different steps to follow
(I want to do it cause sometimes there are quite simple things on specific subjects that we totally ignore)

I also want to mention the very kindness and thoughtfulness of @abderrahman for the time spent and his precious help

First of all, do not use the Gui Gopenvpn to manage your openvpn client, it's now outdated, it causes bad openvpn crashes, and it won't give you any option to get your vpn auto-connect after wlan, vpn or network failure.

To fix the issue there is a very useful application named VPNautoconnect, that will make the job perfectly, and will re-connect your VPN automatically in case of : Wlan, Vpn or Network disconnection.

As soon as your connection is back, it will re-connect your Vpn instantly.

Thanks to "mastergb" who brought it to us.

1) Use OpenVPN via Network Manager Setup

You need to install : openvpn ; network-manager-openvpn ; network-manager-openvpn-gnome

1) Installing Openvpn latest release (2.3.3), follow the steps here (do exactly what they say)

2) Insall those 2 packages : "network-manager-openvpn" and "network-manager-openvpn-gnome" from synaptic or software center.

3) Once installed, you need to enter the settings of your vpn provider service into your network-manager.

To do so :

open "System Settings", then Network menu
Press the + symbol to add a new connection, and select the VPN Interface, then press Create
Choose OpenVPN as your VPN Connection Type, and press Create
The following will walk you though all configuration steps needed for the VPN you subscribed to.

> Gateway: Select one of the Hostnames, or IP server (provided on the "network page" of your vpn provider website)
or download the .ovpn files as indicated by your vpn provider (for exemple create a folder in your "Home" named "openvpn", and extract there those files, so you can find them easily)

> Then fill all the connection details of your vpn :
Authentication : Type Password (or Passwd +Tls) whatever your vpn provider instuctions are.
- Username: The username provided with your vpn account
- Password: The password provided with your vpn account
- CA Certificate: Downloaded certificate file or zip file from your vpn service website, put or extract the ca.crt file to somewhere it won't be deleted, then browse and add it.

(Nota : most of the time, if you directly import a .ovpn file (from the network-manager main window settings), the ca.crt will be included and automatically added)

2) Ok, now your are all set for the 2nd step : Install the cute very useful and very easy to use app VPNautoconnect, which is a kind of "add-on" working directly with Network-Manager, and gives a very good alternative to the lack of auto-connect option of the Network-Manager in Ubuntu.

1) Download VPNautoconnect .deb file
(it will take a few sec for the download process to start)

For Ubuntu 32 bit here

For Ubuntu 64 bit here

(you may want to visit the website : go here)

2) Install VPNautoconnect

- Once downloaded, double click on the .deb file, it will open the software center, and will ask you to install it, do so.
Note : be careful, during the install process a window will pop up and you will be asked to click the "ok" (or "next") button to proceed, until you don't, the install will not end.

This install warning is important, it says :

Do not forget to check the "connect automatically" option in your vpn settings (in Network-manager)

- Then Run the VPNautoconnect application, you'll find a small icon in your system tray.

3) VPNautoconnect settings

- Click the icon and set the preferences from the VPNautoconnect Menu

- Click the small arrow (at the right) to create a new tab

Select your wireless connection in the Parent Connection drop down menu, and your VPN in the VPN Connection drop down menu.
Then click Save.

Your VPN should now connect automatically whenever the selected wireless network is connected. If you use more than one wireless network you'll need to create a new tab in the preferences menu for each one you want to auto connect to a VPN you are using.
(but do not set 2 different Vpn with the same wireless connection ! this would cause a Vpn conflict ; both Vpn will try to re-connect at the same time !)

Do not use the "AppArmor" option (applications in jail), because you will not be able to revert this option. In theory you could, but in fact there is here a bug.

What does AppArmor do ?

Indeed, it's also a useful option : in case of Vpn/Wlan disconnection, your "jailed" apps will be "frozen" and stop working. It will prevent them to be exposed to a direct network connection (while donwloadind/uploading..).

And it does the job, I've tested it.

But if you use it, and plan to use back your "jailed" apps via a direct connection, it will be problematic to get rid of it. Even if you free your apps from the "jail" option, your apps will stay "frozen" and won't be able to connect the network at all.

Therefore, you'll have to completely uninstall your app cleanly from a terminal (+ delete config and preferences files), and re-install it cleanly from a teminal (and not from synaptic).

So, you can use it at your own risk if you never plan to use back your apps without Vpn, or if you're ready to face a tiresome reverse manipulation !

Instead, you might want to find another script that kills your application process in case of Vpn disconnection.

Well, that's it !..