cr9c1
Hello. I have openvpn running under ubuntu server, with the latest release, and the windows client on a laptop of mine. The connection works great. I am using .p12 container files on both server and computer for authentication, using SHA256 and AES-256 encryption. I will paste my server config and client config below. The connection is a routed tunnel, and I am tunneling all traffic through my connection. However, occasionally the connection will just drop randomly. I'll go to a website and it will hang on resolving host, then it will start working again. I've noticed on the server end I'm getting random HMAC decrypt errors, which I have also pasted below. Anyone have any ideas what I can do to fix this? Everything works fine, and then randomly, the connection drops out. The client stays connected, it just wont go anywhere and hangs on resolving host. Then, it starts working again. I have noticed that during these occurrences, the HMAC error is occurring and being logged on the server end.
Server Config:
proto udp
port 1199
dev tun0
topology subnet
server 192.168.60.0 255.255.255.0
push "redirect-gateway def1"
push "route 172.16.5.0 255.255.255.0"
push "dhcp-option DOMAIN home.ld"
push "dhcp-option DNS 172.16.5.1"
dh dh.pem
pkcs12 server.p12
cipher AES-256-CBC
auth SHA256
comp-lzo
verb 4
persist-key
persist-tun
ping-timer-rem
keepalive 10 60
client-to-client
log-append /etc/openvpn/openvpn.log
Client Config:
client
dev tun
proto udp
port 443
pkcs12 colby.p12
remote x.x.x.x 443
auth SHA256
cipher AES-256-CBC
keepalive 10 60
persist-key
persist-tun
ping-timer-rem
comp-lzo
verb 4
register-dns
auth-nocache
And the openvpn log showing the decrypt errors:
Fri Feb 6 07:24:07 2015 us=267102 Colby Ross/x.x.x.x:443 Authenticate/Decrypt packet error: packet HMAC authentication failed
Fri Feb 6 07:30:52 2015 us=429551 Colby Ross/x.x.x.x:443 Authenticate/Decrypt packet error: packet HMAC authentication failed
Fri Feb 6 08:00:43 2015 us=415824 Colby Ross/x.x.x.x:443 Authenticate/Decrypt packet error: packet HMAC authentication failed
Fri Feb 6 08:07:40 2015 us=550511 Colby Ross/x.x.x.x:443 Authenticate/Decrypt packet error: packet HMAC authentication failed
Fri Feb 6 08:22:00 2015 us=646377 Colby Ross/x.x.x.x:443 VERIFY OK: depth=1, CN=vpnca
Fri Feb 6 08:22:00 2015 us=649286 Colby Ross/x.x.x.x:443 VERIFY OK: depth=0, CN=Client
Fri Feb 6 08:22:00 2015 us=831234 Colby Ross/x.x.x.x:443 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Fri Feb 6 08:22:00 2015 us=831377 Colby Ross/x.x.x.x:443 Data Channel Encrypt: Using 256 bit message hash 'SHA256' for HMAC authentication
Fri Feb 6 08:22:00 2015 us=831453 Colby Ross/x.x.x.x:443 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Fri Feb 6 08:22:00 2015 us=831532 Colby Ross/x.x.x.x:443 Data Channel Decrypt: Using 256 bit message hash 'SHA256' for HMAC authentication
Fri Feb 6 08:22:00 2015 us=897409 Colby Ross/x.x.x.x:443 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
maikcat
can you for testing switch to tcp protocol?
Michael.
cr9c1
Ok. I have switched from UDP to TCP. Is there anything else I should be looking at or trying in the meantime, or anything specific you would like me to provide?
maikcat
can you please try while openvpn uses tcp?
Michael.
cr9c1
Ok. Thanks for your help. I am trying it now. Interestingly enough, I noticed these in the log file:
Fri Feb 6 09:02:51 2015 us=223205 Colby Ross/x.x.x.x:50355 MULTI: packet dropped due to output saturation (multi_process_incoming_tun)
Fri Feb 6 09:02:52 2015 us=461385 Colby Ross/x.x.x.x:50355 MULTI: packet dropped due to output saturation (multi_process_incoming_tun)
Fri Feb 6 09:02:52 2015 us=462114 Colby Ross/x.x.x.x:50355 MULTI: packet dropped due to output saturation (multi_process_incoming_tun)
Fri Feb 6 09:10:16 2015 us=60525 Colby Ross/x.x.x.x:50355 MULTI: packet dropped due to output saturation (multi_process_incoming_tun)
Fri Feb 6 09:10:16 2015 us=61073 Colby Ross/x.x.x.x:50355 MULTI: packet dropped due to output saturation (multi_process_incoming_tun)
cr9c1
Ok, so I'm having the same problem, only this time, it is not logging anything other than the errors I just posted:
Fri Feb 6 09:23:40 2015 us=515866 Colby Ross/x.x.x.x:50355 MULTI: packet dropped due to output saturation (multi_process_incoming_tun)
Fri Feb 6 09:23:40 2015 us=520564 Colby Ross/x.x.x.x:50355 MULTI: packet dropped due to output saturation (multi_process_incoming_tun)
Fri Feb 6 09:23:40 2015 us=520946 Colby Ross/x.x.x.x:50355 MULTI: packet dropped due to output saturation (multi_process_incoming_tun)
It is still hanging sometimes when trying to browse to websites, it will hang on resolving host. The connection stays up, but it doesn't function.
cr9c1
Still experiencing intermittent hanging of the connection. Connection stays up, but requests go nowhere, there is usually a 15 second pause and then the data will start flowing again. Log files aren't showing any errors at all anymore.
maikcat
maybe its an MTU issue,
can you try to set lower values?
Michael.
cr9c1
What would you suggest, tun-mtu 1400?
maikcat
you can determine MTU optimal value by ping the server by using
ping -M do -s <size> server
on linux or using
ping -f -l <size> server
on Windows.
vary <size> to find the optimal value
start out with 1472 , as that is the default for ethernet networks.
If the MTU needs to be lowered then lower it on both ends
Michael.
cr9c1
I am currently using:
tun-mtu 1500
fragment 1300
mssfix
I replaced the router to my network last night, it was about 15 years old. I thought it may alleviate some of the issues I am having. I still seem to be having a random network stall. When this happens, I cannot ping the server, or anything on the internet. It just goes no where, and then it picks back up again and goes fine. I have openvpn 2.3.6 running on Ubuntu Server 14.04 LTS on an Acer Netbook. OpenVPN is listening on port 1199. My firewall in my router is configured to forward requests incoming on port 443 to port 1194 on my netbook. Connections all connect great, everything is working fine, but still receiving the stall. I am trying the above posted MTU settings to see if that affects anything. The only other thing I can think of is the network where I am using my VPN connection does occasionally have 1-2% packet loss, but I had this same problem connecting on another network with no loss.
I'm not passing large amounts of data, just surfing the internet, looking at news, sports, etc, and randomly, it will hang, for about 10-15 seconds. The connection still isn't dropping, or showing signs its messed up. I don't think its an issue with ym dd-wrt router since it isn't hosting the VPN connection, only port forwarding for it. But, I had this same issue when hosting the connection with my router. Is this maybe a bug with the Windows TAP driver?
Traffic
Do you connect from many different client sites or do you usually connect the client from the same network ?
cr9c1 wroteoccasionally the connection will just drop randomly. I'll go to a website and it will hang on resolving host, then it will start working again. I've noticed on the server end I'm getting random HMAC decrypt errors,
I wonder if this happens roughly once per hour ...
See
--reneg-sec in
The Manual v23x - Just to make sure :geek:
cr9c1
Scenario. I work for a company that handles data in such a way that we require some complex firewalls and security policies. One of which being, data is logged in case of a breach. Because I use my personal computer for things of a personal nature like email, instant messaging, etc, I decided to use OpenVPN to encrypt said data so all they see is gibberish. This site has a static IP. I have no problems penetrating the firewall with my UDP openvpn connection. Everything works great. This is the only site I connect from, and the only computer. However, to test the problem, I went to my father's house who is on the same cable company network as my VPN server, and had the issue there as well.
It is more frequently than every hour. Thanks for pointing out the reneg-sec variable. I hadn't considered that. However, I have kept a watchful eye on the log files both server and client to see if anything noticeable pops up when the connection hangs, and nothing is being logged. I have seen the renegotiation of the keys occur in the log file before, but not at a time linked to when I was experiencing this issue. So, in summary, I'm mainly connecting from one site, but had the problem at another site inside the physical cable network my VPN server resides on.
Traffic
cr9c1 wrote Is this maybe a bug with the Windows TAP driver?
Maybe .. which version of openvpn is installed on your windows machine ?
cr9c1
v2.3.6. Tap V9, the latest. I reinstalled today just to be certain.
Traffic
cr9c1
Windows 64 bit, file openvpn-install-2.3.6-I601-x86_64.exe
Traffic
cr9c1 wrote openvpn-install-2.3.6-I601
This is the NDIS6 TAP driver version.
Try: Installer (64-bit), Windows XP and later = openvpn-install-2.3.6-I001-x86_64.exe - This is NDIS5 TAP driver
cr9c1
Ok. I installed the version you recommended and verified the TAP driver that installed was in fact an earlier version. Additionally, I deleted the MTU settings I had set in the config file for now, to see how it behaves without manipulation of the MTU.
I did a wireshark capture without the MTU settings and pack sizes all seemed normal, so I don't think it was an MTU issue. Hopefully, the older tap driver will fix the issue I'm having. Is there anything else I should do/look out for? Thanks for your help, I really appreciate it.
Traffic
Presuming all goes well with the NDIS5 TAP version now installed, it appears to be conclusive proof that something is still wrong with the new NDIS6 TAP driver for windows .. Let us know your result - Thanks.
