Hi, I've got a little /funny/ problem concerning my OpenVPN setup. Whenever I use the OpenVPN GUI in admin mode and connect to pfSense running OpenVPN it correctly connects, but times out. After 3 minutes (don't know why this long) it reconnects and performs flawlessly. If I run OpenVPN GUI without admin rights it connects correctly aswell, and doesn't time out. My client machine is Windows 7 Pro SP1, OpenVPN 2.3.4, with config; [code]dev tun persist-tun persist-key cipher AES-256-CBC auth SHA1 tls-client client resolv-retry infinite remote 192.168.1.29 1194 udp lport 0 verify-x509-name "cookie.XXX.org" name auth-user-pass pkcs12 cookie-udp-1194-Hendrik.p12 tls-auth cookie-udp-1194-Hendrik-tls.key 1 ns-cert-type server comp-lzo [/code] Server instance is a virtual pfSense installation (ESXi) running OpenVPN. I'm not sure how to /grab/ the openVPN configuration from pfSense, but I basically follow [url=https://www.highlnk.com/2013/12/configuring-openvpn-on-pfsense/]this guide[/url]. Server is currently running on the same LAN as the client, as I'm trying to install and config it correctly before colocating it. Client LAN / pfSense WAN: 192.168.1.0/24 pfSense LAN: 10.0.0.0/24 OpenVPN VPN LAN: 10.0.10.0/24 Routes are fine, as I can ping and connect to 10.0.0.0/24 when I connect to LAN (I need to add manual route when OpenVPN GUI is not being run as admin, which makes sense). Problem is the timeout issue. Any hints? Thanks in advance. ~ Hendrik

OpenVPN start session times out

Hendrik

Hi,

I've got a little /funny/ problem concerning my OpenVPN setup.
Whenever I use the OpenVPN GUI in admin mode and connect to pfSense running OpenVPN it correctly connects, but times out. After 3 minutes (don't know why this long) it reconnects and performs flawlessly.
If I run OpenVPN GUI without admin rights it connects correctly aswell, and doesn't time out.

My client machine is Windows 7 Pro SP1, OpenVPN 2.3.4, with config;

dev tun
persist-tun
persist-key
cipher AES-256-CBC
auth SHA1
tls-client
client
resolv-retry infinite
remote 192.168.1.29 1194 udp
lport 0
verify-x509-name "cookie.XXX.org" name
auth-user-pass
pkcs12 cookie-udp-1194-Hendrik.p12
tls-auth cookie-udp-1194-Hendrik-tls.key 1
ns-cert-type server
comp-lzo

Server instance is a virtual pfSense installation (ESXi) running OpenVPN. I'm not sure how to /grab/ the openVPN configuration from pfSense, but I basically follow this guide.

Server is currently running on the same LAN as the client, as I'm trying to install and config it correctly before colocating it.
Client LAN / pfSense WAN: 192.168.1.0/24
pfSense LAN: 10.0.0.0/24
OpenVPN VPN LAN: 10.0.10.0/24

Routes are fine, as I can ping and connect to 10.0.0.0/24 when I connect to LAN (I need to add manual route when OpenVPN GUI is not being run as admin, which makes sense).

Problem is the timeout issue. Any hints?

Thanks in advance.

~ Hendrik

Hendrik

I can't seem to find the edit-button, so a reply instead.

Here's the OpenVPN client log;

Thu May 15 19:31:16 2014 OpenVPN 2.3.4 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on May  2 2014
Thu May 15 19:31:16 2014 library versions: OpenSSL 1.0.1g 7 Apr 2014, LZO 2.05
Enter Management Password:
Thu May 15 19:31:33 2014 Control Channel Authentication: using 'cookie-udp-1194-Hendrik-tls.key' as a OpenVPN static key file
Thu May 15 19:31:33 2014 UDPv4 link local (bound): [undef]
Thu May 15 19:31:33 2014 UDPv4 link remote: [AF_INET]192.168.1.29:1194
Thu May 15 19:31:33 2014 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Thu May 15 19:31:34 2014 [cookie.XXX.org] Peer Connection Initiated with [AF_INET]192.168.1.29:1194
Thu May 15 19:31:37 2014 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Thu May 15 19:31:37 2014 open_tun, tt->ipv6=0
Thu May 15 19:31:37 2014 TAP-WIN32 device [LAN-verbinding 2] opened: \\.\Global\{AC384E93-2389-44F5-B5AB-EE42E8585D10}.tap
Thu May 15 19:31:37 2014 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.0.10.6/255.255.255.252 on interface {AC384E93-2389-44F5-B5AB-EE42E8585D10} [DHCP-serv: 10.0.10.5, lease-time: 31536000]
Thu May 15 19:31:37 2014 Successful ARP Flush on interface [20] {AC384E93-2389-44F5-B5AB-EE42E8585D10}
Thu May 15 19:31:43 2014 Initialization Sequence Completed
Thu May 15 19:33:07 2014 [cookie.XXX.org] Inactivity timeout (--ping-restart), restarting
Thu May 15 19:33:07 2014 SIGUSR1[soft,ping-restart] received, process restarting
Thu May 15 19:33:09 2014 UDPv4 link local (bound): [undef]
Thu May 15 19:33:09 2014 UDPv4 link remote: [AF_INET]192.168.1.29:1194
Thu May 15 19:33:10 2014 [cookie.XXX.org] Peer Connection Initiated with [AF_INET]192.168.1.29:1194
Thu May 15 19:33:13 2014 Preserving previous TUN/TAP instance: LAN-verbinding 2
Thu May 15 19:33:13 2014 Initialization Sequence Completed

No internet, no ping, nothing.

~Hendrik

Hendrik

Hi,

Thanks for the quick reply.

I wish I found a way to export pfSense's default OpenVPN server config, but haven't come across such an option yet. I've followed the guide linked above to the letter, which might give a little indication. No commands were added to the Advanced part either.

I did however find the OpenVPN server log file;

May 15 19:21:19 	openvpn: user 'Hendrik' authenticated
May 15 19:21:19 	openvpn[57187]: 192.168.1.10:65512 [Hendrik] Peer Connection Initiated with [AF_INET]192.168.1.10:65512
May 15 19:21:19 	openvpn[57187]: MULTI_sva: pool returned IPv4=10.0.10.6, IPv6=(Not enabled)
May 15 19:21:21 	openvpn[57187]: Hendrik/192.168.1.10:65512 send_push_reply(): safe_cap=940
May 15 19:23:25 	openvpn[57187]: Hendrik/192.168.1.10:65512 [Hendrik] Inactivity timeout (--ping-restart), restarting
May 15 19:24:24 	openvpn: user 'Hendrik' authenticated
May 15 19:24:25 	openvpn[57187]: 192.168.1.1:54876 [Hendrik] Peer Connection Initiated with [AF_INET]192.168.1.1:54876
May 15 19:24:25 	openvpn[57187]: Hendrik/192.168.1.1:54876 MULTI_sva: pool returned IPv4=10.0.10.6, IPv6=(Not enabled)
May 15 19:24:26 	openvpn[57187]: Hendrik/192.168.1.1:54876 send_push_reply(): safe_cap=940

As you can see I connect correctly, but receive a timeout. After 2 minutes the server kicks me off, another minute later the client notices (client might have 3 minute timeout by default?) and reconnects. When reconnected, everything is working fine. Routing works perfect, internet works perfect, working as intended.

The problem I'm facing is that as soon as the client connects for the first time (by that I mean each time you click on Connect), it does something funky either on the server or client side that results in the connection timing out. But as soon as it automatically reconnects back, everything is working fine (routes, internet, everything..)

I tried to change the keepalive setting aswell, but that only seems to change the length of the timeout; it's not actually fixing the underlying issue. And I know that by not providing a server config you can't fully debug the issue, but if you know how to grab it from pfSense I'm all ears.

Thanks,

~Hendrik

Hendrik

Hi,

I've added keepalive 10 30 to pfSense's OpenVPN Advanced section, and added ping 10 and ping-restart 30 to the client config file, without much luck.

I've seen the timeout be reduced by half to about 90 seconds (was 180), but it still times out at first-contact.

Server OpenVPN log:

May 17 20:39:22 openvpn: user 'Hendrik' authenticated
May 17 20:39:22 openvpn[777]: 192.168.1.10:63212 [Hendrik] Peer Connection Initiated with [AF_INET]192.168.1.10:63212
May 17 20:39:22 openvpn[777]: Hendrik/192.168.1.10:63212 MULTI_sva: pool returned IPv4=10.0.10.6, IPv6=(Not enabled)
May 17 20:39:25 openvpn[777]: Hendrik/192.168.1.10:63212 send_push_reply(): safe_cap=940
May 17 20:40:29 openvpn[777]: Hendrik/192.168.1.10:63212 [Hendrik] Inactivity timeout (--ping-restart), restarting
May 17 20:40:57 openvpn: user 'Hendrik' authenticated
May 17 20:40:58 openvpn[777]: 192.168.1.1:61543 [Hendrik] Peer Connection Initiated with [AF_INET]192.168.1.1:61543
May 17 20:40:58 openvpn[777]: Hendrik/192.168.1.1:61543 MULTI_sva: pool returned IPv4=10.0.10.6, IPv6=(Not enabled)
May 17 20:41:00 openvpn[777]: Hendrik/192.168.1.1:61543 send_push_reply(): safe_cap=940

Client OpenVPN log:

Sat May 17 20:39:23 2014 OpenVPN 2.3.4 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on May 2 2014
Sat May 17 20:39:23 2014 library versions: OpenSSL 1.0.1g 7 Apr 2014, LZO 2.05
Enter Management Password:
Sat May 17 20:39:27 2014 Control Channel Authentication: using 'cookie-udp-1194-Hendrik-tls.key' as a OpenVPN static key file
Sat May 17 20:39:27 2014 UDPv4 link local (bound): [undef]
Sat May 17 20:39:27 2014 UDPv4 link remote: [AF_INET]192.168.1.29:1194
Sat May 17 20:39:27 2014 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Sat May 17 20:39:28 2014 [cookie.XXX.org] Peer Connection Initiated with [AF_INET]192.168.1.29:1194
Sat May 17 20:39:31 2014 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Sat May 17 20:39:31 2014 open_tun, tt->ipv6=0
Sat May 17 20:39:31 2014 TAP-WIN32 device [LAN-verbinding 2] opened: \\.\Global\{AC384E93-2389-44F5-B5AB-EE42E8585D10}.tap
Sat May 17 20:39:31 2014 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.0.10.6/255.255.255.252 on interface {AC384E93-2389-44F5-B5AB-EE42E8585D10} [DHCP-serv: 10.0.10.5, lease-time: 31536000]
Sat May 17 20:39:31 2014 Successful ARP Flush on interface [20] {AC384E93-2389-44F5-B5AB-EE42E8585D10}
Sat May 17 20:39:36 2014 Initialization Sequence Completed
Sat May 17 20:41:01 2014 [cookie.XXX.org] Inactivity timeout (--ping-restart), restarting
Sat May 17 20:41:01 2014 SIGUSR1[soft,ping-restart] received, process restarting
Sat May 17 20:41:03 2014 UDPv4 link local (bound): [undef]
Sat May 17 20:41:03 2014 UDPv4 link remote: [AF_INET]192.168.1.29:1194
Sat May 17 20:41:04 2014 [cookie.XXX.org] Peer Connection Initiated with [AF_INET]192.168.1.29:1194
Sat May 17 20:41:06 2014 Preserving previous TUN/TAP instance: LAN-verbinding 2
Sat May 17 20:41:06 2014 Initialization Sequence Completed

Current Client OpenVPN config:

dev tun
persist-tun
persist-key
cipher AES-256-CBC
auth SHA1
tls-client
client
resolv-retry infinite
ping 10
ping-restart 30
remote 192.168.1.29 1194 udp
lport 0
verify-x509-name "cookie.XXX.org" name
auth-user-pass
pkcs12 cookie-udp-1194-Hendrik.p12
tls-auth cookie-udp-1194-Hendrik-tls.key 1
ns-cert-type server
comp-lzo

Any thoughts?

~ Hendrik

glenn07

Hendrik,

The OpenVPN server config can be retrieved from the following location: "/var/etc/openvpn/server1.conf". You can SSH over to your pfSense box in order to retrieve it.

Regards,

Glenn