cannot restart after "Inactivity timeout (--ping-restart)"

saybye

Hi.

I have a working configuration for Windows 7 client and my openvpn server on Tomato router. I took the configuration files from Windows and moved it to Linux to create a new client on Ubuntu.
I'm able to create a VPN tunel from the new Linux client but after a couple of minutes client wants to restart due to "Inactivity timeout (--ping-restart)" and this restart fails - and I completely lose the internet connection on the client.

I have two question:
1) Why there's an inactivity timeout in the first place? I thought that's what "keepalive" parameter is for
2) Why the client loses the internet connection and therefore is unable to restart the connection?

Thanks in advance, guys.

client log:

Wed Aug  6 14:21:04 2014 us=896109 Initialization Sequence Completed
Wed Aug  6 14:22:40 2014 us=32329 [js] Inactivity timeout (--ping-restart), restarting
Wed Aug  6 14:22:40 2014 us=33352 TCP/UDP: Closing socket
Wed Aug  6 14:22:40 2014 us=33700 SIGUSR1[soft,ping-restart] received, process restarting
Wed Aug  6 14:22:40 2014 us=33869 Restart pause, 5 second(s)
Wed Aug  6 14:22:45 2014 us=34276 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Wed Aug  6 14:22:45 2014 us=34500 Re-using SSL/TLS context
Wed Aug  6 14:22:45 2014 us=35039 LZO compression initialized
Wed Aug  6 14:22:45 2014 us=35376 Control Channel MTU parms [ L:1576 D:140 EF:40 EB:0 ET:0 EL:0 ]
Wed Aug  6 14:22:45 2014 us=35604 Socket Buffers: R=[87380->131072] S=[16384->131072]
Wed Aug  6 14:22:45 2014 us=35755 Data Channel MTU parms [ L:1576 D:1450 EF:44 EB:135 ET:32 EL:0 AF:3/1 ]
Wed Aug  6 14:22:45 2014 us=35921 Local Options String: 'V4,dev-type tap,link-mtu 1576,tun-mtu 1532,proto TCPv4_CLIENT,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Wed Aug  6 14:22:45 2014 us=36033 Expected Remote Options String: 'V4,dev-type tap,link-mtu 1576,tun-mtu 1532,proto TCPv4_SERVER,comp-lzo,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Wed Aug  6 14:22:45 2014 us=36199 Local Options hash (VER=V4): '31fdf004'
Wed Aug  6 14:22:45 2014 us=36361 Expected Remote Options hash (VER=V4): '3e6d1056'
Wed Aug  6 14:22:45 2014 us=36499 Attempting to establish TCP connection with [AF_INET]89.176.108.22:1194 [nonblock]
Wed Aug  6 14:22:55 2014 us=40688 TCP: connect to [AF_INET]89.176.108.22:1194 failed, will try again in 5 seconds: Connection timed out
Wed Aug  6 14:23:10 2014 us=44137 TCP: connect to [AF_INET]89.176.108.22:1194 failed, will try again in 5 seconds: Connection timed out
Wed Aug  6 14:23:25 2014 us=47662 TCP: connect to [AF_INET]89.176.108.22:1194 failed, will try again in 5 seconds: Connection timed out
Wed Aug  6 14:23:40 2014 us=52430 TCP: connect to [AF_INET]89.176.108.22:1194 failed, will try again in 5 seconds: Connection timed out
Wed Aug  6 14:23:55 2014 us=57115 TCP: connect to [AF_INET]89.176.108.22:1194 failed, will try again in 5 seconds: Connection timed out
Wed Aug  6 14:24:10 2014 us=61056 TCP: connect to [AF_INET]89.176.108.22:1194 failed, will try again in 5 seconds: Connection timed out
Wed Aug  6 14:24:25 2014 us=64992 TCP: connect to [AF_INET]89.176.108.22:1194 failed, will try again in 5 seconds: Connection timed out
Wed Aug  6 14:24:40 2014 us=69314 TCP: connect to [AF_INET]89.176.108.22:1194 failed, will try again in 5 seconds: Connection timed out
Wed Aug  6 14:24:55 2014 us=73245 TCP: connect to [AF_INET]89.176.108.22:1194 failed, will try again in 5 seconds: Connection timed out
Wed Aug  6 14:25:10 2014 us=77206 TCP: connect to [AF_INET]89.176.108.22:1194 failed, will try again in 5 seconds: Connection timed out
Wed Aug  6 14:25:23 2014 us=258828 TCP/UDP: Closing socket
Wed Aug  6 14:25:23 2014 us=259026 Closing TUN/TAP interface
Wed Aug  6 14:25:23 2014 us=259129 /sbin/ip addr del dev tap0 192.168.1.50/24
Wed Aug  6 14:25:23 2014 us=294270 SIGINT[hard,init_instance] received, process exiting

client config:

client
proto tcp-client
dev tap
ca /etc/openvpn/ca.crt
cert /etc/openvpn/say.crt
key /etc/openvpn/say.key
#remote ***.no-ip.org 1194
remote internet.ip 1194
cipher BF-CBC
comp-lzo
verb 4
log /etc/openvpn/vpn.log
mute 20
persist-key
persist-tun
float
resolv-retry infinite
nobind

server config

# Automatically generated configuration
daemon
server-bridge 192.168.1.5 255.255.255.0 192.168.1.50 192.168.1.55
proto tcp-server
port 1194
dev tap22
cipher BF-CBC
comp-lzo adaptive
keepalive 15 60
verb 3
push "dhcp-option DNS 192.168.1.5"
ca ca.crt
dh dh.pem
cert server.crt
key server.key
status-version 2
status status

saybye

debbie10t wroteDid you use the same certificates/keys for your new linux client as your windows client .. or did you create new cert/keys for the new client ?

Yes.
I know I should create a new one, but I thought it does not matter when I'm the only one who uses the Windows client and I'm also the only one who uses the new Linux client. Those two clients are never connected at the same time.

debbie10t wrote
Log wroteNOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x. Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
This could be the problem ...

Good point. I have tried the new linux client from a public internet cafe and from my cousin's house: both times without any issue.
Now I'm at my second house and I'm facing the problems here. I haven't had these issues from this place with the old Windows client - that's the reason why I did not pay attention to subnet adresses - it used to work for Windows.

I have changed my local LAN to 192.168.17.x - while the remote one(the one where vpn server is) is still 192.168.1.x
The VPN connection is running for 3 hours now withou any issue. Problem seems to be solved. I probably should change the other subnet too, but there are many virtual machines with static IPs and I'm lazy to change each and every one manually 🙂

Anyway, thanks a lot for your help!