Server / Client question

cvau89

I'm new to openvpn, I've read some documentation but I have some configuration questions that may help improve our use of the application.
Several clients are reporting Openvpn issues where the client on the mobile side cannot connect. Upon reviewing the Openvpn client it appears to be working properly. The tray icon is green, the status window is reporting no errors. However, neither mobile client or web client can make a connection to the service being provided through the vpn. Stopping and starting the Openvpn client resolves the issue, until what ever happens again and the client seems to lose connectivity.

I was reading the command line options looking for a solution and I ran across the Ping options. I tried to search for some topics relating to these parameters but the system told me those words were too simple and ignored them lol. I tried ping restart.

So I hope I'm not asking a question that has been asked and answered.

From reading the options for --ping n , -ping-exit n , --ping-restart n I'm feeling like I may be able to have the system monitor itself and restart if the pings are unsuccessful?

Our configuration file is kind of small, a few of our options are listed if helpful

client
dev tun
proto udp
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert name.crt
key name.key
cipher AES-128-CBC
comp-lzo
verb 3

From reading these parameters, it looks like I need to have the ping-reset configured on both the server configuration and the client configuration but I'm not clear based on the documentation and I can't seem to find any examples on server / client would need to be configured.

We'd like the client to ping the server and if no ping was received for the client to exit and reconnect without any user intervention. Am I barking up the right tree?

Thanks in advance,
Chris

cvau89

Be easy now, I didn't set this up... 🙂

port 2011
proto udp
dev tun
ca "c:\\progra~1\\openvpn\\config\\ca.crt"
cert "c:\\progra~1\\openvpn\\config\\server.crt"
key "c:\\progra~1\\openvpn\\config\\server.key"  # This file should be kept secret
dh "c:\\progra~1\\openvpn\\config\\dh1024.pem"
server 10.8.0.0 255.255.255.0
route 10.8.1.0 255.255.255.0
route 10.8.2.0 255.255.255.0
client-config-dir ccd
route 10.9.0.0 255.255.255.252
keepalive 10 120
cipher AES-128-CBC   # AES
comp-lzo
persist-key
persist-tun
status openvpn-status.log
verb 3

cvau89

debbie10t wrotePlease see this: https://forums.openvpn.net/topic14112.html

My apologies, thanks for pointing that out I would have never found that on my own! Won't happen again. 🙂 I'm coming at this from the angle that someone else set all this up and I'm being tasked to figure out issues and that persons no longer involved so I'm trying to catch up. 🙂 So I understand correctly, community edition servers are strictly supported through this forum and Access Edition servers with paid licensing have phone support based on the pricing from the web page https://openvpn.net/index.php/access-server/pricing.html?

debbie10t wrote Look in your client log for "ping and timers modified"

I'm not finding those words in the client logs at all so I started looking to figure out what version of the openVpn was running at this site, so I right click on the app in they system tray and it's says OpenVpn GUI v.1.0.3. Yikes.... So maybe that older version didn't log that information. Going to check our server and see what version we are running there and look at updating the client first. I think I read something about a reset flush that wasn't working in older versions, so I'm hoping upgrading the client may be a resolution

debbie10t wroteThere are example files in C:\Program Files\OpenVPN\sample-config
There is also the HOWTO:http://openvpn.net/index.php/open-source/documentation/howto.html

I did look at those samples but it wasn't clear to me because of all the references made to dnydns.org as I was focused on the 'ping' options and I hadn't even looked at the keepalive option, but I found another page with all the commands and now understand what that one does.

debbie10t wrote How long does the time out take ?
What traffic do you want to send over the VPN .. all or just selected ?

It's seemed to happen sometime this morning but no one was in the system at the time. So it ran all day and all night yeserday with no hiccups. The traffic over the vpn is a Sybase Sql connection from a web cloud server to a clients server.

It's clear to me that this client is having some network issues after reading the client logs. I see things like the following. I could post the whole log but for security reasons I didn't and because I didn't have time to edit out anything sensitive.

Wed Apr 09 21:24:24 2014 TLS: tls_process: killed expiring key
Wed Apr 09 21:24:25 2014 TLS: soft reset sec=0 bytes=100118/0 pkts=1191/0
Thu Apr 10 05:24:31 2014 TLS: tls_process: killed expiring key
Thu Apr 10 05:44:44 2014 [server] Inactivity timeout (--ping-restart), restarting
Thu Apr 10 05:44:44 2014 SIGUSR1[soft,ping-restart] received, process restarting
Thu Apr 10 05:44:44 2014 Restart pause, 2 second(s)
Thu Apr 10 05:44:46 2014 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Thu Apr 10 05:45:47 2014 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Thu Apr 10 05:45:47 2014 TLS Error: TLS handshake failed
Thu Apr 10 05:45:47 2014 TCP/UDP: Closing socket
Thu Apr 10 05:45:47 2014 SIGUSR1[soft,tls-error] received, process restarting
Thu Apr 10 05:45:47 2014 Restart pause, 2 second(s)
Thu Apr 10 05:45:49 2014 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Thu Apr 10 05:46:49 2014 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Thu Apr 10 05:46:49 2014 TLS Error: TLS handshake failed
Thu Apr 10 05:46:49 2014 TCP/UDP: Closing socket
Thu Apr 10 05:46:49 2014 SIGUSR1[soft,tls-error] received, process restarting
Thu Apr 10 05:46:49 2014 Restart pause, 2 second(s)
Thu Apr 10 05:46:51 2014 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Thu Apr 10 05:47:51 2014 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Thu Apr 10 05:47:51 2014 TLS Error: TLS handshake failed
Thu Apr 10 05:47:51 2014 TCP/UDP: Closing socket
Thu Apr 10 05:47:51 2014 SIGUSR1[soft,tls-error] received, process restarting
Thu Apr 10 05:47:51 2014 Restart pause, 2 second(s)
Thu Apr 10 05:47:53 2014 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Thu Apr 10 05:47:53 2014 TLS: Initial packet from XXX.XXX.XXX.30:2011, sid=af4fe2b1 08bf2d00

But on top of that I think the reset was not flushing cache or something and due to the older version I believe that's why it appeared to be running and we could connect to the services but things were not working after that last log line. I've upgraded the client now, so I'm monitoring the logs and will proceed from there.

Will the openvpn executable accept passed parameters? I have not looked very hard for that yet but it sure would be nice to have a /connect so the user doesn't have to right click then connect. I'll keep looking! 🙂

Thank you for your help!