Openvpn connections always be reset...

shayuegg

Dear,

My openvpn client cannot establish the connection to the server, please kindly help to have a look the following log I captured, thanks in advance.

Server log(openvpn.log)--

Wed Jul 9 10:40:40 2014 us=995187 MULTI: multi_create_instance called
Wed Jul 9 10:40:40 2014 us=995441 Re-using SSL/TLS context
Wed Jul 9 10:40:40 2014 us=995546 LZO compression initialized
Wed Jul 9 10:40:40 2014 us=996236 Control Channel MTU parms [ L:1576 D:140 EF:40 EB:0 ET:0 EL:0 ]
Wed Jul 9 10:40:40 2014 us=996587 Data Channel MTU parms [ L:1576 D:1450 EF:44 EB:135 ET:32 EL:0 AF:3/1 ]
Wed Jul 9 10:40:40 2014 us=996775 TCP connection established with 61.101.121.214:21631
Wed Jul 9 10:40:40 2014 us=996896 TCPv4_SERVER link local: [undef]
Wed Jul 9 10:40:40 2014 us=997009 TCPv4_SERVER link remote: 61.101.121.214:21631
Wed Jul 9 10:40:40 2014 us=997530 61.101.121.214:21631 TCPv4_SERVER read returned 14
Wed Jul 9 10:40:40 2014 us=997797 61.101.121.214:21631 TCPv4_SERVER READ [14] from 61.101.121.214:21631: P_CONTROL_HARD_RESET_CLIENT_V2 kid=0 sid=8e92fd6b ff31ab45 [ ] pid=0 DATA
Wed Jul 9 10:40:40 2014 us=997950 61.101.121.214:21631 TLS: Initial packet from 61.101.121.214:21631, sid=8e92fd6b ff31ab45
Wed Jul 9 10:40:40 2014 us=998117 event_wait returned 1
Wed Jul 9 10:40:40 2014 us=998380 61.101.121.214:21631 TCPv4_SERVER WRITE [26] to 61.101.121.214:21631: P_CONTROL_HARD_RESET_SERVER_V2 kid=0 sid=fa39fcf7 80928cfe [ 0 sid=8e92fd6b ff31ab45 ] pid=0 DATA
Wed Jul 9 10:40:40 2014 us=998484 61.101.121.214:21631 TCPv4_SERVER write returned -1
Wed Jul 9 10:40:40 2014 us=998638 61.101.121.214:21631 write TCPv4_SERVER [NO-INFO]: Connection reset by peer (code=131)
Wed Jul 9 10:40:40 2014 us=998897 61.101.121.214:21631 Connection reset, restarting [0]
Wed Jul 9 10:40:40 2014 us=999036 61.101.121.214:21631 SIGUSR1[soft,connection-reset] received, client-instance restarting
Wed Jul 9 10:40:40 2014 us=999414 TCP/UDP: Closing socket

Client log --

Wed Jul 09 10:46:03 2014 Restart pause, 5 second(s)
Wed Jul 09 10:46:08 2014 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Wed Jul 09 10:46:08 2014 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Wed Jul 09 10:46:08 2014 LZO compression initialized
Wed Jul 09 10:46:08 2014 Control Channel MTU parms [ L:1576 D:140 EF:40 EB:0 ET:0 EL:0 ]
Wed Jul 09 10:46:08 2014 Socket Buffers: R=[8192->8192] S=[8192->8192]
Wed Jul 09 10:46:08 2014 Data Channel MTU parms [ L:1576 D:1450 EF:44 EB:135 ET:32 EL:0 AF:3/1 ]
Wed Jul 09 10:46:08 2014 Local Options hash (VER=V4): '31fdf004'
Wed Jul 09 10:46:08 2014 Expected Remote Options hash (VER=V4): '3e6d1056'
Wed Jul 09 10:46:08 2014 Attempting to establish TCP connection with 121.34.167.235:443
Wed Jul 09 10:46:08 2014 TCP connection established with 121.34.167.235:443
Wed Jul 09 10:46:08 2014 TCPv4_CLIENT link local: [undef]
Wed Jul 09 10:46:08 2014 TCPv4_CLIENT link remote: 121.34.167.235:443
Wed Jul 09 10:46:08 2014 Connection reset, restarting [-1]
Wed Jul 09 10:46:08 2014 TCP/UDP: Closing socket
Wed Jul 09 10:46:08 2014 SIGUSR1[soft,connection-reset] received, process restarting
Wed Jul 09 10:46:08 2014 Restart pause, 5 second(s)
Wed Jul 09 10:46:13 2014 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Wed Jul 09 10:46:13 2014 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Wed Jul 09 10:46:13 2014 LZO compression initialized
Wed Jul 09 10:46:13 2014 Control Channel MTU parms [ L:1576 D:140 EF:40 EB:0 ET:0 EL:0 ]
Wed Jul 09 10:46:13 2014 Socket Buffers: R=[8192->8192] S=[8192->8192]
Wed Jul 09 10:46:13 2014 Data Channel MTU parms [ L:1576 D:1450 EF:44 EB:135 ET:32 EL:0 AF:3/1 ]
Wed Jul 09 10:46:13 2014 Local Options hash (VER=V4): '31fdf004'
Wed Jul 09 10:46:13 2014 Expected Remote Options hash (VER=V4): '3e6d1056'
Wed Jul 09 10:46:13 2014 Attempting to establish TCP connection with 121.34.167.235:443
Wed Jul 09 10:46:13 2014 TCP connection established with 121.34.167.235:443
Wed Jul 09 10:46:13 2014 TCPv4_CLIENT link local: [undef]
Wed Jul 09 10:46:13 2014 TCPv4_CLIENT link remote: 121.34.167.235:443
Wed Jul 09 10:46:13 2014 Connection reset, restarting [-1]
Wed Jul 09 10:46:13 2014 TCP/UDP: Closing socket
Wed Jul 09 10:46:13 2014 SIGUSR1[soft,connection-reset] received, process restarting
Wed Jul 09 10:46:13 2014 Restart pause, 5 second(s)

client configuration--

client
remote 121.34.167.235 443 # IP & Port
proto tcp
dev tap
nobind
ca ca.crt
cert me.crt
key me.key
comp-lzo
verb 3
keepalive 10 120
resolv-retry infinite

The tcpdump on the server side--

#tcpdump -i pppoe-wan tcp port 443

10:51:41.735966 IP 61.101.121.214.57345 > 121.34.167.235.https: Flags [S], seq 3565706388, win 8192, options [mss 1330,nop,wscale 8,nop,nop,sackOK], length 0
10:51:41.736122 IP 121.34.167.235.https > 61.101.121.214.57345: Flags [S.], seq 289664057, ack 3565706389, win 14520, options [mss 1452,nop,nop,sackOK,nop,wscale 1], length 0
10:51:41.847699 IP 61.101.121.214.57345 > 121.34.167.235.https: Flags [.], ack 1, win 259, length 0
10:51:41.851276 IP 61.101.121.214.57345 > 121.34.167.235.https: Flags [P.], seq 1:17, ack 1, win 259, length 16
10:51:41.851352 IP 121.34.167.235.https > 61.101.121.214.57345: Flags [.], ack 17, win 7260, length 0
10:51:41.852505 IP 121.34.167.235.https > 61.101.121.214.57345: Flags [P.], seq 1:29, ack 17, win 7260, length 28
10:51:41.852691 IP 61.101.121.214.57345 > 121.34.167.235.https: Flags [R], seq 3565706405, win 32000, length 0
10:51:41.852821 IP 61.101.121.214.57345 > 121.34.167.235.https: Flags [R], seq 3565706405, win 32000, length 0

10:51:46.935166 IP 61.101.121.214.61062 > 121.34.167.235.https: Flags [S], seq 751800374, win 8192, options [mss 1330,nop,wscale 8,nop,nop,sackOK], length 0
10:51:46.935328 IP 121.34.167.235.https > 61.101.121.214.61062: Flags [S.], seq 2428644961, ack 751800375, win 14520, options [mss 1452,nop,nop,sackOK,nop,wscale 1], length 0
10:51:47.049181 IP 61.101.121.214.61062 > 121.34.167.235.https: Flags [R], seq 751800391, win 32000, length 0
10:51:47.049254 IP 61.101.121.214.61062 > 121.34.167.235.https: Flags [R], seq 751800391, win 32000, length 0
10:51:47.049271 IP 61.101.121.214.61062 > 121.34.167.235.https: Flags [.], ack 1, win 259, length 0
10:51:47.049325 IP 121.34.167.235.https > 61.101.121.214.61062: Flags [R], seq 2428644962, win 0, length 0
10:51:47.049824 IP 61.101.121.214.61062 > 121.34.167.235.https: Flags [P.], seq 1:17, ack 1, win 259, length 16
10:51:47.049904 IP 121.34.167.235.https > 61.101.121.214.61062: Flags [R], seq 2428644962, win 0, length 0

thanks again.

shayuegg

BTW, I compared with the successful case on the client side, the successful one has "TLS: Initial packet from 121.34.167.235:443, sid=e8970b73 12d3d17e" following the TCP established, the failed just reported "Connection reset, restarting [-1]" --

121.34.167.235 is the Openvpn Server IP.

Wed Jul 09 11:04:09 2014 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Wed Jul 09 11:04:09 2014 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Wed Jul 09 11:04:09 2014 LZO compression initialized
Wed Jul 09 11:04:09 2014 Control Channel MTU parms [ L:1576 D:140 EF:40 EB:0 ET:0 EL:0 ]
Wed Jul 09 11:04:09 2014 Socket Buffers: R=[8192->8192] S=[8192->8192]
Wed Jul 09 11:04:09 2014 Data Channel MTU parms [ L:1576 D:1450 EF:44 EB:135 ET:32 EL:0 AF:3/1 ]
Wed Jul 09 11:04:09 2014 Local Options hash (VER=V4): '31fdf004'
Wed Jul 09 11:04:09 2014 Expected Remote Options hash (VER=V4): '3e6d1056'
Wed Jul 09 11:04:09 2014 Attempting to establish TCP connection with 121.34.167.235:443
Wed Jul 09 11:04:10 2014 TCP connection established with 121.34.167.235:443
Wed Jul 09 11:04:10 2014 TCPv4_CLIENT link local: [undef]
Wed Jul 09 11:04:10 2014 TCPv4_CLIENT link remote: 121.34.167.235:443
Wed Jul 09 11:04:10 2014 TLS: Initial packet from 121.34.167.235:443, sid=e8970b73 12d3d17e
Wed Jul 09 11:04:12 2014 VERIFY OK: depth=1, /C=CN/ST=...
...

shayuegg

And on the server side, compared the failed and successful --

Failed--
Wed Jul 9 11:32:43 2014 us=988243 MULTI: multi_create_instance called
Wed Jul 9 11:32:43 2014 us=988499 Re-using SSL/TLS context
Wed Jul 9 11:32:43 2014 us=988607 LZO compression initialized
Wed Jul 9 11:32:43 2014 us=989096 Control Channel MTU parms [ L:1576 D:140 EF:40 EB:0 ET:0 EL:0 ]
Wed Jul 9 11:32:43 2014 us=989287 Data Channel MTU parms [ L:1576 D:1450 EF:44 EB:135 ET:32 EL:0 AF:3/1 ]
Wed Jul 9 11:32:43 2014 us=989431 TCP connection established with 61.103.122.214:43458
Wed Jul 9 11:32:43 2014 us=989550 TCPv4_SERVER link local: [undef]
Wed Jul 9 11:32:43 2014 us=989666 TCPv4_SERVER link remote: 61.103.122.214:43458
Wed Jul 9 11:32:43 2014 us=990481 61.103.122.214:43458 TLS: Initial packet from 61.103.122.214:43458, sid=b95136b9 e88b1fec
Wed Jul 9 11:32:43 2014 us=992232 61.103.122.214:43458 Connection reset, restarting [-1]
Wed Jul 9 11:32:43 2014 us=992401 61.103.122.214:43458 SIGUSR1[soft,connection-reset] received, client-instance restarting
Wed Jul 9 11:32:43 2014 us=992795 TCP/UDP: Closing socket

OK --
Wed Jul 9 11:32:59 2014 us=588210 MULTI: multi_create_instance called
Wed Jul 9 11:32:59 2014 us=588465 Re-using SSL/TLS context
Wed Jul 9 11:32:59 2014 us=588575 LZO compression initialized
Wed Jul 9 11:32:59 2014 us=589069 Control Channel MTU parms [ L:1576 D:140 EF:40 EB:0 ET:0 EL:0 ]
Wed Jul 9 11:32:59 2014 us=589259 Data Channel MTU parms [ L:1576 D:1450 EF:44 EB:135 ET:32 EL:0 AF:3/1 ]
Wed Jul 9 11:32:59 2014 us=589403 TCP connection established with 61.103.122.214:51708
Wed Jul 9 11:32:59 2014 us=589522 TCPv4_SERVER link local: [undef]
Wed Jul 9 11:32:59 2014 us=589636 TCPv4_SERVER link remote: 61.103.122.214:51708
Wed Jul 9 11:32:59 2014 us=590220 61.103.122.214:51708 TLS: Initial packet from 61.103.122.214:51708, sid=a50665af d5107c71
Wed Jul 9 11:33:04 2014 us=818196 61.103.122.214:51708 VERIFY OK: depth=1, /C=CN/ST=...
Wed Jul 9 11:33:04 2014 us=820194 61.103.122.214:51708 VERIFY OK: depth=0, /C=CN/ST=...
Wed Jul 9 11:33:06 2014 us=503486 61.103.122.214:51708 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Jul 9 11:33:06 2014 us=503701 61.103.122.214:51708 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authenticat
Wed Jul 9 11:33:06 2014 us=504178 61.103.122.214:51708 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Jul 9 11:33:06 2014 us=504301 61.103.122.214:51708 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authenticat
Wed Jul 9 11:33:07 2014 us=74237 61.103.122.214:51708 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Wed Jul 9 11:33:07 2014 us=74512 61.103.122.214:51708 [me] Peer Connection Initiated with 61.103.122.214:51708
Wed Jul 9 11:33:09 2014 us=22148 me/61.103.122.214:51708 PUSH: Received control message: 'PUSH_REQUEST'
Wed Jul 9 11:33:09 2014 us=22584 me/61.103.122.214:51708 SENT CONTROL [me]: 'PUSH_REPLY,route-gateway 192.0.2.1,ping 10,ping-re
Wed Jul 9 11:33:09 2014 us=625476 me/61.103.122.214:51708 MULTI: Learn: 00:ff:fa:c0:60:0c -> me/61.103.122.214:51708

shayuegg

Thanks, here for the server configuration--

package openvpn

config openvpn custom_config

option enabled 0

option config /etc/openvpn/my-vpn.conf

config openvpn lan

option enabled 1

option port 443

option proto tcp

option dev tap0

option ca /etc/openvpn/ca.crt
option cert /etc/openvpn/server.crt

option key /etc/openvpn/server.key

option dh /etc/openvpn/dh1024.pem

option ifconfig_pool_persist /tmp/ipp.txt

option server_bridge "192.0.2.1 255.255.255.0 192.0.2.100 192.0.2.110"

option client_to_client 1

option duplicate_cn 1

option keepalive "10 120"
option comp_lzo 1
option max_clients 10
option persist_key 1
option persist_tun 1
option status /tmp/openvpn-status.log
option log /tmp/openvpn.log
option log_append /tmp/openvpn.log
option verb 9