deity.parts
1.)we have a openvpn setup on different geographical locations.
2.)during an operation we restarted openvpn service on client. due to some network issues sigterm of client openvpn didn't reach on parent.
3.) now after openvpn is restarted on client, server considers this as a "TLS: new session incoming connection from $CLIENT IP" and doesn't treat it as a connection.
4.) so on server, client-connect script isn't get called.
5.) Is there some way by which server always consider tls seesions from client as a fresh connection and call client-connect script everytime.
thanks
deity.parts
Using OpenVPN 2.2.2
deity.parts
server.conf
port 1194
proto udp
dev tun
daemon
topology subnet
ca ./ca.crt
cert ./server.crt
key ./server.key
dh ./dh1024.pem
server 10.10.1.0 255.255.255.0
ifconfig-pool-persist ipp.txt
client-config-dir ./ccd/
keepalive 10 120
comp-lzo
max-clients 100
user nobody
group nobody
persist-key
persist-tun
status ./openvpn-status.log
log-append ./openvpn.log
verb 3
script-security 2
client-connect ./client-connect.sh
client-disconnect ./client-disconnect.sh
writepid /var/run/openvpnd.pid
client.conf
client
dev tun
proto udp
resolv-retry infinite
daemon
user nobody
group nobody
persist-key
persist-tun
ca ./ca.crt
cert ./slave.crt
key ./slave.key
ns-cert-type server
comp-lzo
status ./openvpn-status.log
log-append ./openvpn.log
verb 3
writepid /var/run/openvpnd.pid
explicit-exit-notify 3
logs
read UDPv4 [EHOSTUNREACH]: No route to host (code=113)
read UDPv4 [EHOSTUNREACH]: No route to host (code=113)
client_#/##.##.##.##:1194 TLS: new session incoming connection from ####:1194
VERIFY OK:
VERIFY OK:
Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
TLS: move_session: dest=TM_ACTIVE src=TM_UNTRUSTED reinit_src=1
tls_multi_process: untrusted session promoted to semi-trusted
Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
PUSH: Received control message: 'PUSH_REQUEST'
P.S.
how can we control
"TLS: new session incoming connection from" doesn't take place.
And, if client openvpn is restarted, server must know this and don't treat this as a new connection and call client-connect.sh script.
deity.parts
though if we've added explicit-exit-notify 3 in client.conf.
but due to network problem, server doesn't get this sigterm, client-disconnect.sh will not be get called.
and in the same way client-connect also will not be called.
handling should be like, if client openvpn restarts, server should take care of this action, if not at once [say network problem], but when connection resumes.
deity.parts
Thanks a lot man ....
It worked.!!!!
😃
