LAN Access Randomly Drops Out.

eekay

Hello, All. I tried to search the forums for anything related to this but I found nothing. Also, if this is not the correct place to post this, my apologies.

As the topic states, I'm trying to hunt down an issue I am having with LAN access from my VPN client. Everything appears to be working fine as far as connecting the client to the server as well as routing (I can touch my inside LAN without any issues). However, periodically (and what seems to be randomly) my LAN becomes inaccessible from my VPN client. SSH sessions to systems on the LAN become unresponsive (timeout) and I am unable to re-connect to the systems on the LAN again unless I ping the system(s) first. A quick example:

Try to SSH to remote system on LAN:

user@local> ssh user@remote (no response)
ssh: connect to host remote: Connection timed out

Pinging the remote system on LAN is successful:

user@local> ping remote
PING remote (192.168.1.2) 56(84) bytes of data.
64 bytes from stig (192.168.1.2): icmp_seq=1 ttl=62 time=21.6 ms
64 bytes from stig (192.168.1.2): icmp_seq=2 ttl=63 time=22.1 ms

After the ping, I am able to connect again:

user@local> ssh user@remote
user@remote>

Has anyone seen this type of issue before? It's not a major issue, really, just a bit of a nuisance as each hour or so I get disconnected (from LAN access, not the VPN server) and need to ping and reconnect to the systems on the LAN.

Also, here are my server and client configuration files:

server.conf

proto udp
port 1194
dev tun0
keepalive 10 120 
server 10.10.8.0 255.255.255.0
ifconfig-pool-persist /usr/local/etc/openvpn/ipp.txt
comp-lzo yes
ca /usr/local/etc/openvpn/keys/ca.crt
dh /usr/local/etc/openvpn/keys/dh1024.pem
cert /usr/local/etc/openvpn/keys/server.crt
key /usr/local/etc/openvpn/keys/server.key
tls-auth /usr/local/etc/openvpn/keys/ta.key 0
persist-key
persist-tun
;duplicate-cn
crl-verify /usr/local/etc/openvpn/keys/crl.pem
client-config-dir /usr/local/etc/openvpn/ccd
client-to-client
log /var/log/openvpn/openvpn.log
status-version 2
status /var/log/openvpn/status.log
verb 3
mute 20
management localhost 7505
user nobody
group nobody
push "route 192.168.1.0 255.255.255.0"

client.conf

client
dev tun
proto udp
remote vpn.server.com 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
ns-cert-type server
tls-auth ta.key 1
comp-lzo
verb 3
mute 10

eekay

Hello Debbie,

Thank you for the reply. I was thinking the exact same thing. I do see the renegotiation happening each hour and I thought that very well may be it. Does the renegotiation need to be enabled or can this be set to 0 on just the server side and be done with it or is this frowned upon (or might not even be an option...)? I'll take a look at my firewall and see what I can find regarding this as well.

eekay

Hrm. Very strange. I've tried disabling and extending the reneg-sec option in both the server and client configuration files and that doesn't seem to change anything. Still random disconnects. Another strange thing I'm seeing is connecting to the client system from the LAN never gets disconnected. it will idle happily for days. It's only connections from outside the LAN over the VPN that seem to have this issue.

Also, just an FYI, I am using pfSense as my firewall but the OpenVPN server is not running on the firewall. Perhaps someone else that has done this as well might be able to shed some light with their experience with a similar setup.

eekay

Strangely enough, I've migrated the OpenVPN server to a different system (physically) on the LAN and I no longer have this issue... I'm stumped! Anyhow, I suppose since I can no longer test or reproduce the problem, this thread can be closed (if it needs to be...)

eekay

Spoke too soon. Still having the issue. Even upon connecting the client to the server, I am unable to connect to other systems on the LAN unless I ping them first. Never seen anything like it. My guess is that it's route related, though. Still digging for a resolution...