VPN connection is being reset from for all clients

compello

Hello!
I have an OpenVPN running on pfSense firewall. I am running latest updates on pfSense and OpenVPN.
The issue is OpenVPN connection is being dropped from time to time. I cannot determine the reason. Sometime it can work for 4-6 hours another day it is restarting every 10 minutes. All clients are getting reconnected.
I would appreciate any help with this matter.
Thank you!

On this image take a look at "Connected Since" column. Reconnected in about 2-3 seconds apart.

Here are the logs from a client (server IP replaced with XXX.XXX.XXX.XXX):
Tue Oct 28 11:06:03 2014 [VPN] Inactivity timeout (--ping-restart), restarting
Tue Oct 28 11:06:03 2014 SIGUSR1[soft,ping-restart] received, process restarting
Tue Oct 28 11:06:05 2014 UDPv4 link local (bound): [undef]
Tue Oct 28 11:06:05 2014 UDPv4 link remote: [AF_INET]XXX.XXX.XXX.XXX:1194
Tue Oct 28 11:06:10 2014 [VPN] Peer Connection Initiated with [AF_INET]XXX.XXX.XXX.XXX:1194
Tue Oct 28 11:06:12 2014 Preserving previous TUN/TAP instance: Local Area Connection
Tue Oct 28 11:06:12 2014 NOTE: Pulled options changed on restart, will need to close and reopen TUN/TAP device.
Tue Oct 28 11:06:13 2014 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Tue Oct 28 11:06:13 2014 open_tun, tt->ipv6=0
Tue Oct 28 11:06:13 2014 TAP-WIN32 device [Local Area Connection] opened: \\.\Global\{751E08CA-9488-413D-A7A2-2867F4A14FA2}.tap
Tue Oct 28 11:06:13 2014 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.10.10.22/255.255.255.252 on interface {751E08CA-9488-413D-A7A2-2867F4A14FA2} [DHCP-serv: 10.10.10.21, lease-time: 31536000]
Tue Oct 28 11:06:13 2014 Successful ARP Flush on interface [50] {751E08CA-9488-413D-A7A2-2867F4A14FA2}
Tue Oct 28 11:06:18 2014 Initialization Sequence Completed
Tue Oct 28 11:08:09 2014 [VPN] Inactivity timeout (--ping-restart), restarting
Tue Oct 28 11:08:09 2014 SIGUSR1[soft,ping-restart] received, process restarting
Tue Oct 28 11:08:11 2014 UDPv4 link local (bound): [undef]
Tue Oct 28 11:08:11 2014 UDPv4 link remote: [AF_INET]XXX.XXX.XXX.XXX:1194

Here is the server side logs:
Oct 28 11:08:48 openvpn[41870]: <mUserLogin>/<mUserIP>:1194 send_push_reply(): safe_cap=940
Oct 28 11:08:46 openvpn[41870]: <VUserLogin>/<VUserIP>:1194 send_push_reply(): safe_cap=940
Oct 28 11:08:46 openvpn[41870]: <AUserLogin>/<AUserIP>:1194 MULTI_sva: pool returned IPv4=10.10.10.22, IPv6=(Not enabled)
Oct 28 11:08:46 openvpn[41870]: <AUserIP>:1194 [<AUserIP>] Peer Connection Initiated with [AF_INET]<AUserIP>:1194
Oct 28 11:08:46 openvpn[41870]: <aUserLogin>/<aUserIP>:1194 send_push_reply(): safe_cap=940
Oct 28 11:08:46 openvpn[41870]: <mUserLogin>/<mUserIP>:1194 MULTI_sva: pool returned IPv4=10.10.10.18, IPv6=(Not enabled)
Oct 28 11:08:46 openvpn[41870]: <mUserIP>:1194 [<mUserLogin>] Peer Connection Initiated with [AF_INET]<mUserIP>:1194
Oct 28 11:08:46 openvpn: user '<AUserLogin>' authenticated
Oct 28 11:08:45 openvpn: user '<mUserLogin>' authenticated
Oct 28 11:08:45 openvpn[41870]: <VUserLogin>/<VUserIP>:1194 MULTI_sva: pool returned IPv4=10.10.10.14, IPv6=(Not enabled)
Oct 28 11:08:45 openvpn[41870]: <VUserIP>:1194 [<VUserLogin>] Peer Connection Initiated with [AF_INET]<VUserIP>:1194
Oct 28 11:08:44 openvpn[41870]: <jUserLogin>/<jUserIP>:1194 send_push_reply(): safe_cap=940
Oct 28 11:08:44 openvpn: user '<VUserLogin>' authenticated
Oct 28 11:08:44 openvpn[41870]: <a2UserLogin>/<a2UserIP>:1194 MULTI_sva: pool returned IPv4=10.10.10.10, IPv6=(Not enabled)
Oct 28 11:08:44 openvpn[41870]: <a2UserIP>:1194 [<a2UserLogin>] Peer Connection Initiated with [AF_INET]<a2UserIP>:1194
Oct 28 11:08:43 openvpn: user '<a2UserLogin>' authenticated
Oct 28 11:08:43 openvpn[41870]: <jUserLogin>/<jUserIP>:1194 MULTI_sva: pool returned IPv4=10.10.10.6, IPv6=(Not enabled)
Oct 28 11:08:43 openvpn[41870]: <jUserIP>:1194 [<jUserLogin>] Peer Connection Initiated with [AF_INET]<jUserIP>:1194
Oct 28 11:08:43 openvpn: user '<jUserLogin>' authenticated
Oct 28 11:07:43 openvpn[41870]: Initialization Sequence Completed
Oct 28 11:07:43 openvpn[41870]: UDPv4 link remote: [undef]
Oct 28 11:07:43 openvpn[41870]: UDPv4 link local (bound): [AF_INET]XXX.XXX.XXX.XXX:1194
Oct 28 11:07:42 openvpn[40719]: /usr/local/sbin/ovpn-linkup ovpns1 1500 1558 10.10.10.1 10.10.10.2 init
Oct 28 11:07:42 openvpn[40719]: /sbin/ifconfig ovpns1 10.10.10.1 10.10.10.2 mtu 1500 netmask 255.255.255.255 up
Oct 28 11:07:42 openvpn[40719]: do_ifconfig, tt->ipv6=1, tt->did_ifconfig_ipv6_setup=0
Oct 28 11:07:42 openvpn[40719]: TUN/TAP device /dev/tun1 opened
Oct 28 11:07:42 openvpn[40719]: TUN/TAP device ovpns1 exists previously, keep at program end
Oct 28 11:07:42 openvpn[40719]: Control Channel Authentication: using '/var/etc/openvpn/server1.tls-auth' as a OpenVPN static key file
Oct 28 11:07:42 openvpn[40719]: WARNING: POTENTIALLY DANGEROUS OPTION --client-cert-not-required may accept clients which do not present a certificate
Oct 28 11:07:42 openvpn[40719]: Initializing OpenSSL support for engine 'cryptodev'
Oct 28 11:07:42 openvpn[40719]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Oct 28 11:07:42 openvpn[40719]: OpenVPN 2.3.3 amd64-portbld-freebsd8.3 [SSL (OpenSSL)] [LZO] [MH] [IPv6] built on Aug 15 2014
Oct 28 11:07:42 openvpn[95363]: SIGTERM[hard,] received, process exiting
Oct 28 11:07:42 openvpn[95363]: /usr/local/sbin/ovpn-linkdown ovpns1 1500 1558 10.10.10.1 10.10.10.2 init
Oct 28 11:07:41 openvpn[95363]: event_wait : Interrupted system call (code=4)
Oct 28 11:07:41 openvpn[95363]: <mUserLogin>/<mUserIP>:1194 send_push_reply(): safe_cap=940
Oct 28 11:07:40 openvpn[95363]: <VUserLogin>/<VUserIP>:1194 MULTI_sva: pool returned IPv4=10.10.10.14, IPv6=(Not enabled)
Oct 28 11:07:40 openvpn[95363]: <VUserIP>:1194 [<VUserLogin>] Peer Connection Initiated with [AF_INET]<VUserIP>:1194
Oct 28 11:07:40 openvpn: user '<VUserLogin>' authenticated
Oct 28 11:07:40 openvpn[95363]: <eUserLogin>/<eUserIP>:1194 send_push_reply(): safe_cap=940
Oct 28 11:07:39 openvpn[95363]: <mUserLogin>/<mUserIP>:1194 MULTI_sva: pool returned IPv4=10.10.10.10, IPv6=(Not enabled)
Oct 28 11:07:39 openvpn[95363]: <mUserIP>:1194 [<mUserLogin>] Peer Connection Initiated with [AF_INET]<mUserIP>:1194
Oct 28 11:07:38 openvpn: user '<mUserLogin>' authenticated
Oct 28 11:07:37 openvpn[95363]: <eUserLogin>/<eUserIP>:1194 MULTI_sva: pool returned IPv4=10.10.10.6, IPv6=(Not enabled)
Oct 28 11:07:37 openvpn[95363]: <eUserIP>:1194 [<eUserLogin>] Peer Connection Initiated with [AF_INET]<eUserIP>:1194
Oct 28 11:07:36 openvpn: user '<eUserLogin>' authenticated
Oct 28 11:06:41 openvpn[95363]: Initialization Sequence Completed
Oct 28 11:06:41 openvpn[95363]: UDPv4 link remote: [undef]
Oct 28 11:06:41 openvpn[95363]: UDPv4 link local (bound): [AF_INET]XXX.XXX.XXX.XXX:1194
Oct 28 11:06:41 openvpn[94068]: /usr/local/sbin/ovpn-linkup ovpns1 1500 1558 10.10.10.1 10.10.10.2 init
Oct 28 11:06:40 openvpn[94068]: /sbin/ifconfig ovpns1 10.10.10.1 10.10.10.2 mtu 1500 netmask 255.255.255.255 up
Oct 28 11:06:40 openvpn[94068]: do_ifconfig, tt->ipv6=1, tt->did_ifconfig_ipv6_setup=0
Oct 28 11:06:40 openvpn[94068]: TUN/TAP device /dev/tun1 opened
Oct 28 11:06:40 openvpn[94068]: TUN/TAP device ovpns1 exists previously, keep at program end
Oct 28 11:06:40 openvpn[94068]: Control Channel Authentication: using '/var/etc/openvpn/server1.tls-auth' as a OpenVPN static key file
Oct 28 11:06:40 openvpn[94068]: WARNING: POTENTIALLY DANGEROUS OPTION --client-cert-not-required may accept clients which do not present a certificate
Oct 28 11:06:40 openvpn[94068]: Initializing OpenSSL support for engine 'cryptodev'
Oct 28 11:06:40 openvpn[94068]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Oct 28 11:06:40 openvpn[94068]: OpenVPN 2.3.3 amd64-portbld-freebsd8.3 [SSL (OpenSSL)] [LZO] [MH] [IPv6] built on Aug 15 2014
Oct 28 11:06:40 openvpn[22947]: SIGTERM[hard,] received, process exiting
Oct 28 11:06:40 openvpn[22947]: /usr/local/sbin/ovpn-linkdown ovpns1 1500 1558 10.10.10.1 10.10.10.2 init
Oct 28 11:06:38 openvpn[22947]: event_wait : Interrupted system call (code=4)

Traffic

compello wrote WARNING: POTENTIALLY DANGEROUS OPTION --client-cert-not-required may accept clients which do not present a certificate

Looks serious ..

Can you post your complete server config as a configuration file not screen shots .. ?

compello

Traffic wrote
compello wrote WARNING: POTENTIALLY DANGEROUS OPTION --client-cert-not-required may accept clients which do not present a certificate
Looks serious ..

Can you post your complete server config as a configuration file not screen shots .. ?

I guess this warning is OK. I am using Radius (Authentication service) to authenticate users.
Can you tell me where server.config is located? I do not see /etc/openvpn directory.

Thank you!

compello

Traffic wrote
compello wrote WARNING: POTENTIALLY DANGEROUS OPTION --client-cert-not-required may accept clients which do not present a certificate
Looks serious ..

Can you post your complete server config as a configuration file not screen shots .. ?

Found it:

dev ovpns1
dev-type tun
tun-ipv6
dev-node /dev/tun1
writepid /var/run/openvpn_server1.pid
#user nobody
#group nobody
script-security 3
daemon
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
proto udp
cipher AES-256-CBC
up /usr/local/sbin/ovpn-linkup
down /usr/local/sbin/ovpn-linkdown
client-connect /usr/local/sbin/openvpn.attributes.sh
client-disconnect /usr/local/sbin/openvpn.attributes.sh
local XXX.XXX.XXX.XXX
engine cryptodev
tls-server
server 10.10.10.0 255.255.255.0
client-config-dir /var/etc/openvpn-csc
client-cert-not-required
username-as-common-name
auth-user-pass-verify /var/etc/openvpn/server1.php via-env
tls-verify /var/etc/openvpn/server1.tls-verify.php
lport 1194
management /var/etc/openvpn/server1.sock unix
max-clients 64
push "route 192.168.0.0 255.255.0.0"
push "dhcp-option DOMAIN HelloWorld.local"
push "dhcp-option DNS 192.168.XXX.YYY"
push "dhcp-option DNS 192.168.XXX.ZZZ"
push "dhcp-option NTP NNN.NNN.NNN.NNN"
push "dhcp-option NTP NNN.NNN.NNN.NNN"
client-to-client
ca /var/etc/openvpn/server1.ca
cert /var/etc/openvpn/server1.cert
key /var/etc/openvpn/server1.key
dh /etc/dh-parameters.1024
tls-auth /var/etc/openvpn/server1.tls-auth 0
comp-lzo
persist-remote-ip
float

Traffic

compello wrotetake a look at "Connected Since" column. Reconnected in about 2-3 seconds apart

I suggest you check all your network equipment .. this looks suspiciously like some hardware is failing ..

compello

Traffic wrote
compello wrotetake a look at "Connected Since" column. Reconnected in about 2-3 seconds apart
I suggest you check all your network equipment .. this looks suspiciously like some hardware is failing ..

Let me investigate.
Thank you!