Hello. I have openvpn running under ubuntu server, with the latest release, and the windows client on a laptop of mine. The connection works great. I am using .p12 container files on both server and computer for authentication, using SHA256 and AES-256 encryption. I will paste my server config and client config below. The connection is a routed tunnel, and I am tunneling all traffic through my connection. However, occasionally the connection will just drop randomly. I'll go to a website and it will hang on resolving host, then it will start working again. I've noticed on the server end I'm getting random HMAC decrypt errors, which I have also pasted below. Anyone have any ideas what I can do to fix this? Everything works fine, and then randomly, the connection drops out. The client stays connected, it just wont go anywhere and hangs on resolving host. Then, it starts working again. I have noticed that during these occurrences, the HMAC error is occurring and being logged on the server end. Server Config: proto udp port 1199 dev tun0 topology subnet server 192.168.60.0 255.255.255.0 push "redirect-gateway def1" push "route 172.16.5.0 255.255.255.0" push "dhcp-option DOMAIN home.ld" push "dhcp-option DNS 172.16.5.1" dh dh.pem pkcs12 server.p12 cipher AES-256-CBC auth SHA256 comp-lzo verb 4 persist-key persist-tun ping-timer-rem keepalive 10 60 client-to-client log-append /etc/openvpn/openvpn.log Client Config: client dev tun proto udp port 443 pkcs12 colby.p12 remote x.x.x.x 443 auth SHA256 cipher AES-256-CBC keepalive 10 60 persist-key persist-tun ping-timer-rem comp-lzo verb 4 register-dns auth-nocache And the openvpn log showing the decrypt errors: Fri Feb 6 07:24:07 2015 us=267102 Colby Ross/x.x.x.x:443 Authenticate/Decrypt packet error: packet HMAC authentication failed Fri Feb 6 07:30:52 2015 us=429551 Colby Ross/x.x.x.x:443 Authenticate/Decrypt packet error: packet HMAC authentication failed Fri Feb 6 08:00:43 2015 us=415824 Colby Ross/x.x.x.x:443 Authenticate/Decrypt packet error: packet HMAC authentication failed Fri Feb 6 08:07:40 2015 us=550511 Colby Ross/x.x.x.x:443 Authenticate/Decrypt packet error: packet HMAC authentication failed Fri Feb 6 08:22:00 2015 us=646377 Colby Ross/x.x.x.x:443 VERIFY OK: depth=1, CN=vpnca Fri Feb 6 08:22:00 2015 us=649286 Colby Ross/x.x.x.x:443 VERIFY OK: depth=0, CN=Client Fri Feb 6 08:22:00 2015 us=831234 Colby Ross/x.x.x.x:443 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key Fri Feb 6 08:22:00 2015 us=831377 Colby Ross/x.x.x.x:443 Data Channel Encrypt: Using 256 bit message hash 'SHA256' for HMAC authentication Fri Feb 6 08:22:00 2015 us=831453 Colby Ross/x.x.x.x:443 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key Fri Feb 6 08:22:00 2015 us=831532 Colby Ross/x.x.x.x:443 Data Channel Decrypt: Using 256 bit message hash 'SHA256' for HMAC authentication Fri Feb 6 08:22:00 2015 us=897409 Colby Ross/x.x.x.x:443 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA

can you for testing switch to tcp protocol? Michael.

Ok. I have switched from UDP to TCP. Is there anything else I should be looking at or trying in the meantime, or anything specific you would like me to provide?

can you please try while openvpn uses tcp? Michael.

Ok. Thanks for your help. I am trying it now. Interestingly enough, I noticed these in the log file: Fri Feb 6 09:02:51 2015 us=223205 Colby Ross/x.x.x.x:50355 MULTI: packet dropped due to output saturation (multi_process_incoming_tun) Fri Feb 6 09:02:52 2015 us=461385 Colby Ross/x.x.x.x:50355 MULTI: packet dropped due to output saturation (multi_process_incoming_tun) Fri Feb 6 09:02:52 2015 us=462114 Colby Ross/x.x.x.x:50355 MULTI: packet dropped due to output saturation (multi_process_incoming_tun) Fri Feb 6 09:10:16 2015 us=60525 Colby Ross/x.x.x.x:50355 MULTI: packet dropped due to output saturation (multi_process_incoming_tun) Fri Feb 6 09:10:16 2015 us=61073 Colby Ross/x.x.x.x:50355 MULTI: packet dropped due to output saturation (multi_process_incoming_tun)

Ok, so I'm having the same problem, only this time, it is not logging anything other than the errors I just posted: Fri Feb 6 09:23:40 2015 us=515866 Colby Ross/x.x.x.x:50355 MULTI: packet dropped due to output saturation (multi_process_incoming_tun) Fri Feb 6 09:23:40 2015 us=520564 Colby Ross/x.x.x.x:50355 MULTI: packet dropped due to output saturation (multi_process_incoming_tun) Fri Feb 6 09:23:40 2015 us=520946 Colby Ross/x.x.x.x:50355 MULTI: packet dropped due to output saturation (multi_process_incoming_tun) It is still hanging sometimes when trying to browse to websites, it will hang on resolving host. The connection stays up, but it doesn't function.

Still experiencing intermittent hanging of the connection. Connection stays up, but requests go nowhere, there is usually a 15 second pause and then the data will start flowing again. Log files aren't showing any errors at all anymore.

maybe its an MTU issue, can you try to set lower values? Michael.

What would you suggest, tun-mtu 1400?

you can determine MTU optimal value by ping the server by using ping -M do -s server on linux or using ping -f -l server on Windows. vary to find the optimal value start out with 1472 , as that is the default for ethernet networks. If the MTU needs to be lowered then lower it on both ends Michael.

I am currently using: tun-mtu 1500 fragment 1300 mssfix I replaced the router to my network last night, it was about 15 years old. I thought it may alleviate some of the issues I am having. I still seem to be having a random network stall. When this happens, I cannot ping the server, or anything on the internet. It just goes no where, and then it picks back up again and goes fine. I have openvpn 2.3.6 running on Ubuntu Server 14.04 LTS on an Acer Netbook. OpenVPN is listening on port 1199. My firewall in my router is configured to forward requests incoming on port 443 to port 1194 on my netbook. Connections all connect great, everything is working fine, but still receiving the stall. I am trying the above posted MTU settings to see if that affects anything. The only other thing I can think of is the network where I am using my VPN connection does occasionally have 1-2% packet loss, but I had this same problem connecting on another network with no loss. I'm not passing large amounts of data, just surfing the internet, looking at news, sports, etc, and randomly, it will hang, for about 10-15 seconds. The connection still isn't dropping, or showing signs its messed up. I don't think its an issue with ym dd-wrt router since it isn't hosting the VPN connection, only port forwarding for it. But, I had this same issue when hosting the connection with my router. Is this maybe a bug with the Windows TAP driver?

[Solved]Random connection drop

cr9c1

This is by no means conclusive proof as of yet, but I had no issues after changing drivers. However, I was only able to use the PC for about 45 minutes. I am off work tomorrow, but back in Thursday, so I will further evaluate it thursday. Shouldn't take long to see if its the problem or not. However, it was working flawlessly before I left, which I am thoroughly impressed with.

I read about the Windows 8 issues and the NDIS6 driver, so hopefully further evaluation will shed some light on whether or not there are still issues.

cr9c1

So, I've been at work since 7AM EST, and it is now 11AM EST and I haven't had one iota of a problem with this connection. It seems using the NDIS5 driver has solved the issue entirely.

« Previous Page