Hey! we had a OpenVPN Server running for a while now and it worked fine. It's used mostly for accessing perforce and RDPíng into clients. So recently we switched out our old Asus Router (with Tomato installed) for an Ubiquiti Edgemax EP8. Since then VPN seems to randomly drop packets for services while pings still work fine. For instance when connecting to perforce it works half the time, the other half we get a WSACONNRESET error. Once connected it usually kicks you out within about 10-15 minutes. RDP let's you connect sometimes, and sometimes it doesn't. Usually kicks you out after a while too. None of these issues apply when RDPíng into the server that terminates the VPN tho. (so i am currently RDPíng into the terminating server and then onto what i really want to RDP into). I am not sure why the switch of the firewall made this happen because the connection should be encrypted between the client and the server, the Firewall shouldn't really be involved (with the exception of routing the packets through). There are no rules that should drop these packets. Our network topology for this part essentially exists of a Windows 2008r2 Server behind the mentioned Ubiquiti firewall. The clients and servers that need accessing over OpenVPN are all on the same subnet as the Windows 2008 Server that terminates VPN. Here is our config (oh, and i take any suggestions to make it nicer, it's not the prettiest :) ) [code]local 192.168.91.8 port 1194 proto udp ;dev tap ;dev-node TAP-Bridge dev tun topology subnet ;dev-node TAP-Bridge ca C:\\Server\\OpenVPN\\config\\ca.crt cert C:\\Server\\OpenVPN\\config\\server.crt key C:\\Server\\OpenVPN\\config\\server.key dh C:\\Server\\OpenVPN\\config\\dh2048.pem server 10.8.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt ;server-bridge 10.8.0.4 255.255.255.0 10.8.0.50 10.8.0.100 ;server-bridge 192.168.91.8 255.255.255.0 192.168.91.246 192.168.91.254 ;server-bridge ;push "route 192.168.10.0 255.255.255.0" route 172.72.72.0 255.255.255.0 route 192.168.91.0 255.255.255.0 route 10.26.0.0 255.255.255.0 push "route 10.26.0.0 255.255.255.0 192.168.91.16 1" push "route 192.168.91.0 255.255.255.0" push "route 172.72.72.0 255.255.255.0 192.168.91.16 1 " fragment 1500 mssfix ;client-config-dir ccd ;route 192.168.40.128 255.255.255.248 ;client-config-dir ccd ;route 10.9.0.0 255.255.255.252 ;learn-address ./script ;push "redirect-gateway def1 bypass-dhcp" push "dhcp-option DNS 192.168.91.240" push "dhcp-option WINS 192.168.91.240" ;push "dhcp-option DNS 208.67.220.220" ;client-to-client ;duplicate-cn keepalive 10 120 ;tls-auth ta.key 0 # This file is secret ;cipher BF-CBC # Blowfish (default) ;cipher AES-128-CBC # AES ;cipher DES-EDE3-CBC # Triple-DES comp-lzo ;max-clients 100 ;user nobody ;group nobody persist-key persist-tun status openvpn-status.log ;log openvpn.log ;log-append openvpn.log verb 3 ;mute 20 [/code] I would appreciate any help because i tried quite a lot at this point. Thank You! Best Regards Patrick

Please see the [b][color=#A40000]Forum rules[/color][/b] (top of page) Please post evidence of: [i]"OpenVPN randomly dropping packets"[/i] ... if possible ...

[quote="Traffic"][quote="mpm97"]we had a OpenVPN Server running for a while now and it worked fine[/quote][quote="mpm97"]So recently we switched out our old Asus Router (with Tomato installed) for an Ubiquiti Edgemax EP8. Since then VPN seems to randomly drop packets [/quote]Looks like your router is not configured correctly , if you did not change anything on the VPN server ...[/quote] Well, so what is to configure to make OpenVPN work? I mean, there is a port forward to the OpenVPN Server which was the only thing OpenVPN that needed configuring on the old one. Most other settings are default and shouldn't have much to do with OpenVPN. Do you think there is something that i am accidentally blocking? Thanks!

[quote="mpm97"]Most other settings are default and shouldn't have much to do with OpenVPN[/quote]Wrong ... Did you read this: [url=http://openvpn.net/index.php/open-source/documentation/howto.html#scope]HOWTO: Expanding the scope of the VPN to include additional machines[/url] *Attention*[quote="HOWTO"]The last step, and one that is [b]often forgotten[/b] ...[/quote]But read it [b]all[/b]!

OpenVPN randomly dropping packets since switching router

mpm97

Hey!

we had a OpenVPN Server running for a while now and it worked fine. It's used mostly for accessing perforce and RDPíng into clients. So recently we switched out our old Asus Router (with Tomato installed) for an Ubiquiti Edgemax EP8. Since then VPN seems to randomly drop packets for services while pings still work fine. For instance when connecting to perforce it works half the time, the other half we get a WSACONNRESET error. Once connected it usually kicks you out within about 10-15 minutes. RDP let's you connect sometimes, and sometimes it doesn't. Usually kicks you out after a while too. None of these issues apply when RDPíng into the server that terminates the VPN tho. (so i am currently RDPíng into the terminating server and then onto what i really want to RDP into). I am not sure why the switch of the firewall made this happen because the connection should be encrypted between the client and the server, the Firewall shouldn't really be involved (with the exception of routing the packets through). There are no rules that should drop these packets.

Our network topology for this part essentially exists of a Windows 2008r2 Server behind the mentioned Ubiquiti firewall. The clients and servers that need accessing over OpenVPN are all on the same subnet as the Windows 2008 Server that terminates VPN.

Here is our config (oh, and i take any suggestions to make it nicer, it's not the prettiest 🙂 )

local 192.168.91.8
port 1194
proto udp
;dev tap
;dev-node TAP-Bridge
dev tun
topology subnet
;dev-node TAP-Bridge
ca C:\\Server\\OpenVPN\\config\\ca.crt
cert C:\\Server\\OpenVPN\\config\\server.crt
key C:\\Server\\OpenVPN\\config\\server.key 
dh C:\\Server\\OpenVPN\\config\\dh2048.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
;server-bridge 10.8.0.4 255.255.255.0 10.8.0.50 10.8.0.100
;server-bridge 192.168.91.8 255.255.255.0 192.168.91.246 192.168.91.254
;server-bridge
;push "route 192.168.10.0 255.255.255.0"
route 172.72.72.0 255.255.255.0
route 192.168.91.0 255.255.255.0
route 10.26.0.0 255.255.255.0
push "route 10.26.0.0 255.255.255.0 192.168.91.16 1"
push "route 192.168.91.0 255.255.255.0"
push "route 172.72.72.0 255.255.255.0 192.168.91.16 1 "
fragment 1500
mssfix
;client-config-dir ccd
;route 192.168.40.128 255.255.255.248
;client-config-dir ccd
;route 10.9.0.0 255.255.255.252
;learn-address ./script
;push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 192.168.91.240"
push "dhcp-option WINS 192.168.91.240"
;push "dhcp-option DNS 208.67.220.220"
;client-to-client
;duplicate-cn
keepalive 10 120
;tls-auth ta.key 0 # This file is secret
;cipher BF-CBC        # Blowfish (default)
;cipher AES-128-CBC   # AES
;cipher DES-EDE3-CBC  # Triple-DES
comp-lzo
;max-clients 100
;user nobody
;group nobody
persist-key
persist-tun
status openvpn-status.log
;log         openvpn.log
;log-append  openvpn.log
verb 3
;mute 20

I would appreciate any help because i tried quite a lot at this point.

Thank You!
Best Regards
Patrick

Traffic

Please see the Forum rules (top of page)

Please post evidence of: "OpenVPN randomly dropping packets" ... if possible ...

mpm97

What kind of evidence you'd like? Wireshark Capture?

I mostly think its OpenVPN because i tried directly forwarding the ports of the relevant services and that works. (which is the current workaround) Only when using OpenVPN i get dropped services. Another reason why i think it's OpenVPN is that i googled around a bunch trying to solve this and found several forum posts/articles mentioning packets dropping/Services not working while still being able to ping at the same time which essentially exactly describes my problem. I am currently trying to solve this with the fragment and mssfix Options which seemed to improve things for at least one user, when i tried myself i still had the same issues tho.

Traffic

mpm97 wrotewe had a OpenVPN Server running for a while now and it worked fine

mpm97 wroteSo recently we switched out our old Asus Router (with Tomato installed) for an Ubiquiti Edgemax EP8. Since then VPN seems to randomly drop packets

Looks like your router is not configured correctly , if you did not change anything on the VPN server ...

mpm97

Traffic wrote
mpm97 wrotewe had a OpenVPN Server running for a while now and it worked fine
mpm97 wroteSo recently we switched out our old Asus Router (with Tomato installed) for an Ubiquiti Edgemax EP8. Since then VPN seems to randomly drop packets
Looks like your router is not configured correctly , if you did not change anything on the VPN server ...

Well, so what is to configure to make OpenVPN work? I mean, there is a port forward to the OpenVPN Server which was the only thing OpenVPN that needed configuring on the old one. Most other settings are default and shouldn't have much to do with OpenVPN. Do you think there is something that i am accidentally blocking?

Thanks!

Traffic

mpm97 wroteMost other settings are default and shouldn't have much to do with OpenVPN

Wrong ...

Did you read this:
HOWTO: Expanding the scope of the VPN to include additional machines

*Attention*

HOWTO wroteThe last step, and one that is often forgotten ...

But read it all!

mpm97

Yeah, i read that and did all of that including routing back to the OpenVPN Subnet on the Router. Sorry, it's been a while since i did this so i kinda forgot, but i did essentially copy the whole configuration from the old to the new router. Only thing in that section of the article I didn't do was the whole client-config-dir thing which i don't think we need. (as there should just be one machine on the clients side)

Also the VPN itself technically works. I can ping, i can access all the stuff maybe half the time, but it often just drops application connections.

Traffic

mpm97 wroteSorry, it's been a while since i did this so i kinda forgot

I wonder what else you have forgotten ...

AFAIK, when OpenVPN drops a packet it records it in the log file, with a reason. So unless you can provide proof that OpenVPN is randomly dropping packets, I strongly advise you check the rest of your network again. After all, I think if the devs were made aware that their highly respected code has suddenly developed a flaw, like sporadically dropping packets for no reason and you could provide proof, you would probably win a medal.

As you have not been very forth-coming with your information I will just say, there is a bug with the new TAP adapter, please investigate that on your network:
https://forums.openvpn.net/topic16933.html