Only one client at the same time can connect to ovpn server

alanruiz

Hi, all. I am a openvpn "newbie".

I have a computer running a openvpn server at office. I and my
co-worker have a openvpn client running at home (my home and his home).

When we try to connect to the server only one can connect at the same
time. If i connect, he can not and viceversa. If i disconnect, a while
later he can connect, but not as soon as i disconnected. However, if
we connect from same ip we can connect simultaneously (in example
both from my home) without problems.

Can someone help me ?

Here's server config and a client config. Everyone of us have its
own certificate.

Server:

proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
keepalive 10 120
comp-lzo
max-clients 10
persist-key
persist-tun
status openvpn-status.log
verb 3

Client1 (same for client2 except certificate)

client
dev tun
proto udp
remote XXX.XXX.XXX.XXX
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client1.crt
key client1.key
ns-cert-type server
comp-lzo
verb 3

alanruiz

I am sorry. Here it is:

Client 2 log (client 1 is connected):

Feb 28 21:25:48 laptop ovpn-client2[2974]: OpenVPN 2.2.1 i686-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Feb 27 2013
Feb 28 21:25:48 laptop ovpn-client2[2974]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Feb 28 21:25:48 laptop ovpn-client2[2974]: LZO compression initialized
Feb 28 21:25:48 laptop ovpn-client2[2974]: Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Feb 28 21:25:48 laptop ovpn-client2[2974]: Socket Buffers: R=[163840->131072] S=[163840->131072]
Feb 28 21:25:48 laptop ovpn-client2[2974]: Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Feb 28 21:25:48 laptop ovpn-client2[2974]: Local Options hash (VER=V4): '41690919'
Feb 28 21:25:48 laptop ovpn-client2[2974]: Expected Remote Options hash (VER=V4): '530fdded'
Feb 28 21:25:48 laptop ovpn-client2[2975]: UDPv4 link local: [undef]
Feb 28 21:25:48 laptop ovpn-client2[2975]: UDPv4 link remote: [AF_INET]XXX.XXX.XXX.XXX
Feb 28 21:26:48 laptop ovpn-client2[2975]: TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Feb 28 21:26:48 laptop ovpn-client2[2975]: TLS Error: TLS handshake failed
Feb 28 21:26:48 laptop ovpn-client2[2975]: TCP/UDP: Closing socket
Feb 28 21:26:48 laptop ovpn-client2[2975]: SIGUSR1[soft,tls-error] received, process restarting
Feb 28 21:26:48 laptop ovpn-client2[2975]: Restart pause, 2 second(s)

Server log:

Feb 28 21:25:50 office ovpn-server[2685]: MULTI: multi_create_instance called
Feb 28 21:25:50 office ovpn-server[2685]: ZZZ.ZZZ.ZZZ.ZZZ:57262 Re-using SSL/TLS context
Feb 28 21:25:50 office ovpn-server[2685]: ZZZ.ZZZ.ZZZ.ZZZ:57262 LZO compression initialized
Feb 28 21:25:50 office ovpn-server[2685]: ZZZ.ZZZ.ZZZ.ZZZ:57262 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Feb 28 21:25:50 office ovpn-server[2685]: ZZZ.ZZZ.ZZZ.ZZZ:57262 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Feb 28 21:25:50 office ovpn-server[2685]: ZZZ.ZZZ.ZZZ.ZZZ:57262 Local Options hash (VER=V4): '530fdded'
Feb 28 21:25:50 office ovpn-server[2685]: ZZZ.ZZZ.ZZZ.ZZZ:57262 Expected Remote Options hash (VER=V4): '41690919'
Feb 28 21:25:50 office ovpn-server[2685]: ZZZ.ZZZ.ZZZ.ZZZ:57262 TLS: Initial packet from [AF_INET]ZZZ.ZZZ.ZZZ.ZZZ:57262, sid=73297934 1c45e5b4
Feb 28 21:26:50 office ovpn-server[2685]: ZZZ.ZZZ.ZZZ.ZZZ:57262 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Feb 28 21:26:50 office ovpn-server[2685]: ZZZ.ZZZ.ZZZ.ZZZ:57262 TLS Error: TLS handshake failed
Feb 28 21:26:50 office ovpn-server[2685]: ZZZ.ZZZ.ZZZ.ZZZ:57262 SIGUSR1[soft,tls-error] received, client-instance restarting

[the previous sequence repeats itself once again]

Feb 28 21:29:14 office ovpn-server[2685]: read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Feb 28 21:29:25 office ovpn-server[2685]: read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Feb 28 21:29:35 office ovpn-server[2685]: read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Feb 28 21:29:45 office ovpn-server[2685]: read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
Feb 28 21:29:55 office ovpn-server[2685]: read UDPv4 [ECONNREFUSED]: Connection refused (code=111)
[...]

alanruiz

debbie10t wroteIn order for your server to have some control of what state each connection is in add this to the server config:

push "explicit-exit-notify 3"

After adding this line, the message "read UDPv4 [ECONNREFUSED]:
Connection refused (code=111)" has disappeared but i still can't
connect.

I think that nothing is blocking the traffic because when client1 and
client2 try to connect from same public inet ip they can connect
simultaneously without problems (tested from serveral places).

This is the log on server when client2 connect from the same ip that
client1 (this is connected previously). Everything looks ok, right ?

Mar  1 00:11:06 office ovpn-server[2686]: MULTI: multi_create_instance called
Mar  1 00:11:06 office ovpn-server[2686]: ZZZ.ZZZ.ZZZ.ZZZ:17405 Re-using SSL/TLS context
Mar  1 00:11:06 office ovpn-server[2686]: ZZZ.ZZZ.ZZZ.ZZZ:17405 LZO compression initialized
Mar  1 00:11:06 office ovpn-server[2686]: ZZZ.ZZZ.ZZZ.ZZZ:17405 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Mar  1 00:11:06 office ovpn-server[2686]: ZZZ.ZZZ.ZZZ.ZZZ:17405 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Mar  1 00:11:06 office ovpn-server[2686]: ZZZ.ZZZ.ZZZ.ZZZ:17405 Local Options hash (VER=V4): '530fdded'
Mar  1 00:11:06 office ovpn-server[2686]: ZZZ.ZZZ.ZZZ.ZZZ:17405 Expected Remote Options hash (VER=V4): '41690919'
Mar  1 00:11:06 office ovpn-server[2686]: ZZZ.ZZZ.ZZZ.ZZZ:17405 TLS: Initial packet from [AF_INET]ZZZ.ZZZ.ZZZ.ZZZ:17405, sid=8e3138a5 b7f13029
Mar  1 00:11:08 office ovpn-server[2686]: ZZZ.ZZZ.ZZZ.ZZZ:17405 VERIFY OK: depth=1, /C=ES/ST=...
Mar  1 00:11:08 office ovpn-server[2686]: ZZZ.ZZZ.ZZZ.ZZZ:17405 VERIFY OK: depth=0, /C=ES/ST=...
Mar  1 00:11:08 office ovpn-server[2686]: ZZZ.ZZZ.ZZZ.ZZZ:17405 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mar  1 00:11:08 office ovpn-server[2686]: ZZZ.ZZZ.ZZZ.ZZZ:17405 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mar  1 00:11:08 office ovpn-server[2686]: ZZZ.ZZZ.ZZZ.ZZZ:17405 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Mar  1 00:11:08 office ovpn-server[2686]: ZZZ.ZZZ.ZZZ.ZZZ:17405 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mar  1 00:11:08 office ovpn-server[2686]: ZZZ.ZZZ.ZZZ.ZZZ:17405 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Mar  1 00:11:08 office ovpn-server[2686]: ZZZ.ZZZ.ZZZ.ZZZ:17405 [client2] Peer Connection Initiated with [AF_INET]ZZZ.ZZZ.ZZZ.ZZZ:17405
Mar  1 00:11:08 office ovpn-server[2686]: client2/ZZZ.ZZZ.ZZZ.ZZZ:17405 MULTI_sva: pool returned IPv4=10.8.0.14, IPv6=1c2a:7eb7:14f8:d3bf:f8fa:d3bf:9091:fb9
Mar  1 00:11:08 office ovpn-server[2686]: client2/ZZZ.ZZZ.ZZZ.ZZZ:17405 MULTI: Learn: 10.8.0.14 -> client2/ZZZ.ZZZ.ZZZ.ZZZ:17405
Mar  1 00:11:08 office ovpn-server[2686]: client2/ZZZ.ZZZ.ZZZ.ZZZ:17405 MULTI: primary virtual IP for client2/ZZZ.ZZZ.ZZZ.ZZZ:17405: 10.8.0.14
Mar  1 00:11:11 office ovpn-server[2686]: client2/ZZZ.ZZZ.ZZZ.ZZZ:17405 PUSH: Received control message: 'PUSH_REQUEST'
Mar  1 00:11:11 office ovpn-server[2686]: client2/ZZZ.ZZZ.ZZZ.ZZZ:17405 send_push_reply(): safe_cap=960
Mar  1 00:11:11 office ovpn-server[2686]: client2/ZZZ.ZZZ.ZZZ.ZZZ:17405 SENT CONTROL [client2]: 'PUSH_REPLY,explicit-exit-notify 3,route 10.8.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.14 10.8.0.13' (status=1)

alanruiz

debbie10t wroteClose OpenVPN and delete ipp.txt

Thank you very much for your help, debbie10t, but it doesn't work for me.

After a lot of tests i have a suspicion that the problem could be
with the Zyxel P-660HW-T1 router on server side but i can not be more
specify given my limited qualifications.

Regardless, I will continue to try it.

alanruiz

After a lot of tests I decided to try my OpenVpn config changing the
router on server side. I have tried three others routers and all of
them worked.

Taking my simple router config into account (i have no firewall rules
or another advanced config, only the OpenVpn port forwarding) i think
that the Zyxel has a problem with UDP protocol managing in the
OpenVpn context (i could get it to work with TCP protocol).

Currently i have my OpenVpn server working properly with a Comtrend
router. I would have liked to test the Zyxel with a firmware update
but it was not possible because it does not have a simple option to
do it.

My router was a Zyxel P-660HW-T1 v2 with V3.40(BEN.0)b2 (01/25/2008)
firmware, if someone can confirm my theory.

Thank you for all, debbie10t