VPN Provider - KryptoVPN: Reconnection problems

millpond

I use KryptoVPN wihch is essentially .ovpn script based - and have a problem which exists on both WinXP and Debian Testing.
On two different machines:

I have allready enquired to KryptoVPN and essentially they haven a clue.

What happens is that OpenVPN will connect fine to a server, and even renogiatiate the connection after an hour.
But after a while if the connection drops and when OpenVPN goes to re-establish the connection it apparently cannont get to the net or find the DNS, even when its in the Hosts file.

Internet connectivity is apparently lost.
On Win I need to kill and re-set the TAP/TUN connection, and reconenct.
Havent a clue on how to do this in Debian, so I have to reboot.

In a way this is a feature: When the VPN goes down I do NOT want the default IP restored.
I would just as soon kill the entire connection as i cannot seem to find a decent Guard type utility which will shut down all net and p2p apps when the VPN goes down. The few I've seen are Win based, which is problematic.

However, I would like the connection to be able to find the DNS and automatically reconnect.

I know little about networking and next to nothing about network interfaces.
If I cant find a way to reconnect, at least I would like to be able reset the connection the way the Win batch files do In the Win version - but in Debian.

Also: what I would like to know and this is VERY important!
During the 10 seconds that the VPN is renogiating every hour , is my home IP exposed?

Sun Jun 15 14:14:39 2014 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Sun Jun 15 14:14:39 2014 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Jun 15 14:14:39 2014 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Sun Jun 15 14:14:39 2014 [vpn.kryptotel.net] Peer Connection Initiated with [AF_INET]178.239.59.82:80
Sun Jun 15 14:14:41 2014 SENT CONTROL [vpn.kryptotel.net]: 'PUSH_REQUEST' (status=1)
Sun Jun 15 14:14:41 2014 PUSH: Received control message: 'PUSH_REPLY,route 0.0.0.0 0.0.0.0,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 10.80.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.80.0.78 10.80.0.77'
Sun Jun 15 14:14:41 2014 OPTIONS IMPORT: timers and/or timeouts modified
Sun Jun 15 14:14:41 2014 OPTIONS IMPORT: --ifconfig/up options modified
Sun Jun 15 14:14:41 2014 OPTIONS IMPORT: route options modified
Sun Jun 15 14:14:41 2014 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Sun Jun 15 14:14:41 2014 ROUTE_GATEWAY 192.168.0.1/255.255.255.0 IFACE=eth1 HWADDR=00:11:2f:59:38:2f
Sun Jun 15 14:14:41 2014 TUN/TAP device tun0 opened
Sun Jun 15 14:14:41 2014 TUN/TAP TX queue length set to 100
Sun Jun 15 14:14:41 2014 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Sun Jun 15 14:14:41 2014 /sbin/ip link set dev tun0 up mtu 1500
Sun Jun 15 14:14:41 2014 /sbin/ip addr add dev tun0 local 10.80.0.78 peer 10.80.0.77
Sun Jun 15 14:14:41 2014 /sbin/ip route add 178.239.59.82/32 via 192.168.0.1
Sun Jun 15 14:14:41 2014 /sbin/ip route add 0.0.0.0/1 via 10.80.0.77
Sun Jun 15 14:14:41 2014 /sbin/ip route add 128.0.0.0/1 via 10.80.0.77
Sun Jun 15 14:14:41 2014 /sbin/ip route add 0.0.0.0/0 via 10.80.0.77
RTNETLINK answers: File exists
Sun Jun 15 14:14:41 2014 ERROR: Linux route add command failed: external program exited with error status: 2
Sun Jun 15 14:14:41 2014 /sbin/ip route add 10.80.0.1/32 via 10.80.0.77
Sun Jun 15 14:14:41 2014 Initialization Sequence Completed
Sun Jun 15 15:14:42 2014 VERIFY OK: depth=1, C=AE, ST=Dubai, L=Dubai, O=Kryptotel fz llc, CN=Kryptotel fz llc CA, emailAddress=info@kryptotel.net
Sun Jun 15 15:14:42 2014 VERIFY OK: nsCertType=SERVER
Sun Jun 15 15:14:42 2014 VERIFY OK: depth=0, C=SC, ST=Victoria, L=Victoria, O=Kryptotel Bravotelco llc, CN=vpn.kryptotel.net, emailAddress=info@kryptotel.net
Sun Jun 15 15:14:46 2014 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Sun Jun 15 15:14:46 2014 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Jun 15 15:14:46 2014 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Sun Jun 15 15:14:46 2014 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Jun 15 15:14:46 2014 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Sun Jun 15 16:14:39 2014 TLS: tls_process: killed expiring key
Sun Jun 15 16:14:47 2014 VERIFY OK: depth=1, C=AE, ST=Dubai, L=Dubai, O=Kryptotel fz llc, CN=Kryptotel fz llc CA, emailAddress=info@kryptotel.net
Sun Jun 15 16:14:47 2014 VERIFY OK: nsCertType=SERVER
Sun Jun 15 16:14:47 2014 VERIFY OK: depth=0, C=SC, ST=Victoria, L=Victoria, O=Kryptotel Bravotelco llc, CN=vpn.kryptotel.net, emailAddress=info@kryptotel.net
Sun Jun 15 16:14:51 2014 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Sun Jun 15 16:14:51 2014 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Jun 15 16:14:51 2014 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Sun Jun 15 16:14:51 2014 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Sun Jun 15 16:14:51 2014 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA

millpond

This appears to be an OpenVPN problem.

It is losing access to DNS and not reconnecting.
The commerciual service is secondary and apparently irrelevant to the problem.
It works, no problem connecting to it.

The problem exists when the connection is lost, and OPENVPN tries but cannot reconnect.
At that point all network connectivity is lost.
Keyword ALL.
Need to reboot to get the network in Debian.

This is NOT using any commercial software. ONLY OPENVPN.

millpond

debbie10t wrote
millpond wroteThis appears to be an OpenVPN problem
Appearances can be very deceptive.

This is a problem for you on your network connection. Connecting to the KryptoVPN server renders your computer unable to resolve DNS requests because KryptoVPN have a poor server setup and inadequate help for you to solve the problem with their service.

Without the KryptoVPN Server Config there is nothing this forum can do to help.
Also, you have not posted your client config .. so we would be guessing*** anyway.

Actually, I am not using *any* KVPN setup.
This is simply pure OVPN using the KVPN .OVPN scripts which are very basic and look like this:

client
dev tun
proto udp
remote hideip-egypt.kryptotel.net
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert my.crt
key my.key
ns-cert-type server
cipher AES-256-CBC
comp-lzo
verb 3

The Win verison of KVPN indeed uses some type of wrapper, which might have led to some misunderstanding, but in actually, even in Win I ginore it and go straight OVPN and simply use the config files.

The issue is apparently not with the config files: as long as thje connection is maintained they work, and work fine. And will renogiate the connections;

The problem is when the connection drops the routing tables are in some kind of limbo: They cannot access the net, so they cannot access DNS. I can put a local 'DNS' for the servers in my Hosts file - but as the routing table is knackered nothing works.

This is apparently not an unusual problem. Others have reported VPN connections forcing reboots to restore connectivity.

So the issue, is apparently how to restore the original IP tables which can be done simply enough in Win, but I get absolutely
conflicting information for what here is a Debian 8 system, with no netctl, no apparent directory of routing scripts, otr other customiziations. OVPN apparently has no scripts for storing and replacing the IP tables.

My normal IP tables are:
Destination Gateway Genmask Flags Metric Ref Use Iface
0.0.0.0 192.168.0.1 0.0.0.0 UG 0 0 0 eth1
192.168.0.0 0.0.0.0 255.255.255.0 U 1 0 0 eth1

I can IP FLUSH the tables,

and try various combinations of :
route add defaut gw 192.168.0.0 eth1
route add -net 192.168.0.0 netmask 255.255.255.0 dev eth1
route add -net 192.168.0.1 netmask 255.255.255.0 gw 192.168.0.0 dev eth1
ip route add default via 192.168.1.1 dev eth1
eth1 net 192.168.0.0 netmask 255.255.255.0 gw 192.168.0.1
eth1 net 0.0.0.0 netmask 0.0.0.0 gw 192.168.0.1
route add -net default gw 192.168.0.1 dev eth1

I really have no clue what I am doing here except it is not working and does not recreate the original routing table .
Any advice here would be greatly appreciated. I am not new to Linux, but am rather frustrated that all the old tools and tricks seem to be disappearing or relocated to parts unknown. And truth be told, I can network easily enough two systems, but havent much detailed knowledge of the intracacies. Especially with tun/tap

Flushing and service networking restart DOES NOT WORK.

I can try the bridge-up method and change tun to tap0 in the .ovpn file and that recreated immediately the *problem*.
Except that now the ovpn bridge br0 will not permit any net traffic, and OVPN itself failes to connect.
Only soultion there is reboot.

Once again , i tend to regard this as a feature.
When the VPN server goes down, it *GOOD* to see it NOT automatically fall back to my ISP.
I would just as soon have it kill all networking as a security precaution. Which it does.
The PROBLEM, is how to restore the network manually, preferably from a script that can kill all net processes that were running prior to the VPN going down (ie, Web browsers, p2p clients, ssh connections, email, etc).
(A restored connection with running processes will expose them all before the VPN connects, and represent a *severe* security hazard - something which the few folks who have 'VPN guards' try to address, but there are none that I am aware of designed for OVPN - at least in English).

OK I am new here. But my *surprise* is that this issue has not been tackled more vigorously.

*** With regard to what you have posted:
millpond wroteSun Jun 15 14:14:41 2014 /sbin/ip addr add dev tun0 local 10.80.0.78 peer 10.80.0.77
Sun Jun 15 14:14:41 2014 /sbin/ip route add 178.239.59.82/32 via 192.168.0.1
Sun Jun 15 14:14:41 2014 /sbin/ip route add 0.0.0.0/1 via 10.80.0.77
Sun Jun 15 14:14:41 2014 /sbin/ip route add 128.0.0.0/1 via 10.80.0.77
Sun Jun 15 14:14:41 2014 /sbin/ip route add 0.0.0.0/0 via 10.80.0.77
RTNETLINK answers: File exists
Sun Jun 15 14:14:41 2014 ERROR: Linux route add command failed: external program exited with error status: 2
This probably means that the route OpenVPN tried to add is already present .. which in this case is probably due to OpenVPN trying to run a second instance of the same config file. Which would indicate user error.

1 /sbin/ip route add 178.239.59.82/32 via 192.168.0.1 - remote server replacing network gateway.
2 /sbin/ip route add 0.0.0.0/1 via 10.80.0.77 - is this the ethernet card being assigned 10.80.0.77?
3. /sbin/ip route add 128.0.0.0/1 via 10.80.0.77 no idea what this is ...
4. /sbin/ip route add 0.0.0.0/0 via 10.80.0.77 - looks like a repeat of #2
(The error, btw, does not cause any connection problems)

millpond wroteOn Win I need to kill and re-set the TAP/TUN connection, and reconenct.
Havent a clue on how to do this in Debian, so I have to reboot.
Probably something like this:
sudo service openvpn stop
sudo service openvpn start ### Ubuntu
millpond wrotePUSH: Received control message: 'PUSH_REPLY,route 0.0.0.0 0.0.0.0,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 10.80.0.1,topology net30,ping 10,ping-restart 120,ifconfig 10.80.0.78 10.80.0.77'
KrytoVPN are setting your client to time-out after 120 seconds of inactivity .. so when the VPN times out you have to wait 2 minutes for OpenVPN to detect this .. After this, OpenVPN will restart the connection.

NOW... When OVPN tries to restart the connection it cannot find the network. Its not a DNS problem - i can hardwire that without help.

On debian you may require this in your client config:
script-security 2
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf
this will setup/tear down your DNS servers on connect/disconnect ... but KryptoVPN should have this on their help pages and in their client configs (for Linux).

I dont have those files.

There are example OVPN startup and shutsown scripts.
The startup aspect is not a problem. OVPN *works*. Except when it dont.
The *shutdown* scripts need perhaps some customization, with perhaps some restoration of IP routing tables.

KVPN has no real instructions on anything.
All it is is a wrapper for OVPN.

I have been avoiding Linux for a better part of a year, because I knew it would be a bear to tackle OVPN on a front I was unfamiliar with. I use it on Win without problems - same scenario: take the KVPN config/user files, dump them in /config - all is well. Dont use the KVPN software.

Their .ovpn files seem pretty generic. Is there anything special about them? (Which would make them outside the scope of standard OVPN?)

I am running off a pure Debian 8 install of OVPN. v2.3.2
(Which has NOT been supplied by any third party...)

millpond

I have made some progress.

When the connection is dropped, OVPN is left with a useless routing table - so it cannot reconnect.

If OVPN can be made to cleanly exit manually, it will restore the routing table and the system will resume on the default routing tables: networking will work.

But.... killing the process (or processes) is not a simple matter.

A kill command will return a prompt to a terminal (though it can it times freeze it).

But however the processes (sometimes more than one) will continue. And therefor not return the routing table.

kill -9 PID on the processes works to return normalcy to the network, though it turns the proceses into zombies.

Something along the lines of
ps -aux | grep -i openvpn | split | kill -9 $2 (in pseudo perl code)
might work.

Are there any scripts like this floating around?

What i would like to know is how to check for a *live* connection. I'm not a programmer so have no clue as how to get a script to parse the error messages on another terminal.

With the info, I can:
parse for the error message
killall firefox,thunderbird,ktorrent,filezilla,wget, etc.
kill -9 ovpn
start ovpn
fire up net utilities.

One thing i do NOT want is for OVPN to drop to the ISP connection if the OVPN server connection drops. THAT is a true security hazard, not often addressed by the VPN community, and most providers totally ignore the issue.

So if its a bug, please dont fix it.

millpond

My apologies if english is not your native language, but it seems we are either having communications problems or you are simply being nasty.

The problems I am having are cerntering around:
1. OVPN not being able to re-establsih a connection and killing system networking.
2. It being unable to shut down cleanly afterwards. On Win I need to shut down the Tap conection. Simple there.

This is not an original problem:
http://serverfault.com/questions/580960/how-to-completely-quit-openvpn-make-network-work-normal

I was enquiring for information on not how the system is supposed to work, but any assistance on how is *does not* work, and any info, links, or general advice for a user not particularly savvy in networking.

A simple pointer on how to shut down the tun connection and restore the IP tables if necessary would be quite sufficient.

Ctrl-C does NOT always work....

millpond

Oh well, nevermind.

I hacked together a monitor script that showed the results of when it hung and was killed.

The key thing I was looking for was:

/sbin/ip addr del dev tun0 local 10.80.0.82 peer 10.80.0.81

However, I dont really need it as killing the process *frees* the connection.

I guess this off topic a bit.
How your software interacts with real would systems and apps.