Intermittent connection fault

PistolenPeter

Dear Community

My OpenVPN Server runs on a virtual server with debian wheezy.
Unfortunately there are intermittent connection problems when I login from home.
The connection is stable without any package loss but after a few minutes a timeout error occurs and the connection will be restarted.
Server config comes without any keepalive option. Client keepalive option is 5s ping and 30s timeout.
I can force this problem when I run midnight commander or any command which take some time to execute i.e. "tar -xvf file.tar".
Afaik the connection at home is stable when it is idle.
From office the same configuration works fine without any issues so I suppose that the reason is not to find in vpn configuration.

Client logfile says nothing than timeout even with option verb 6:

[server] Inactivity timeout (--ping-restart), restarting
TCP/UDP: Closing socket
SIGUSR1[soft,ping-restart] received, process restarting
Restart pause, 2 second(s)

Here is an excerpt from server log:

Feb 17 21:25:53 mydomain ovpn-vpn[28550]: 88.152.***.***:57029 Re-using SSL/TLS context
Feb 17 21:25:53 mydomain ovpn-vpn[28550]: 88.152.***.***:57029 WARNING: normally if you use --mssfix and/or --fragment, you should also set --tun-mtu 1500 (currently it is 1400)
Feb 17 21:25:54 mydomain ovpn-vpn[28550]: 88.152.***.***:57029 [peter] Peer Connection Initiated with [AF_INET]88.152.***.***:57029
Feb 17 21:25:54 mydomain ovpn-vpn[28550]: MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=8f3:****:****:0:****:****:48cb:2cb8
Feb 17 21:25:56 mydomain ovpn-vpn[28550]: peter/88.152.***.***:57029 send_push_reply(): safe_cap=960
Feb 17 21:26:28 mydomain ovpn-vpn[28550]: 88.152.***.***:57030 Re-using SSL/TLS context
Feb 17 21:26:28 mydomain ovpn-vpn[28550]: 88.152.***.***:57030 WARNING: normally if you use --mssfix and/or --fragment, you should also set --tun-mtu 1500 (currently it is 1400)
Feb 17 21:26:29 mydomain ovpn-vpn[28550]: 88.152.***.***:57030 [peter] Peer Connection Initiated with [AF_INET]88.152.***.***:57030
Feb 17 21:26:29 mydomain ovpn-vpn[28550]: MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=8f3:****:****:0:****:****:5043:29b8
Feb 17 21:26:31 mydomain ovpn-vpn[28550]: peter/88.152.***.***:57030 send_push_reply(): safe_cap=960
Feb 17 21:27:02 mydomain ovpn-vpn[28550]: 88.152.***.***:57031 Re-using SSL/TLS context
Feb 17 21:27:02 mydomain ovpn-vpn[28550]: 88.152.***.***:57031 WARNING: normally if you use --mssfix and/or --fragment, you should also set --tun-mtu 1500 (currently it is 1400)
Feb 17 21:27:03 mydomain ovpn-vpn[28550]: 88.152.***.***:57031 [peter] Peer Connection Initiated with [AF_INET]88.152.***.***:57031
Feb 17 21:27:03 mydomain ovpn-vpn[28550]: MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=8f3:****:****:0:****:****:48cb:2cb8
Feb 17 21:27:05 mydomain ovpn-vpn[28550]: peter/88.152.***.***:57031 send_push_reply(): safe_cap=960
Feb 17 21:27:36 mydomain ovpn-vpn[28550]: 88.152.***.***:57032 Re-using SSL/TLS context
Feb 17 21:27:36 mydomain ovpn-vpn[28550]: 88.152.***.***:57032 WARNING: normally if you use --mssfix and/or --fragment, you should also set --tun-mtu 1500 (currently it is 1400)
Feb 17 21:27:37 mydomain ovpn-vpn[28550]: 88.152.***.***:57032 [peter] Peer Connection Initiated with [AF_INET]88.152.***.***:57032
Feb 17 21:27:37 mydomain ovpn-vpn[28550]: MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=8f3:****:****:0:****:****:5043:29b8
Feb 17 21:27:39 mydomain ovpn-vpn[28550]: peter/88.152.***.***:57032 send_push_reply(): safe_cap=960

Server config file:

local 85.214.***.***
server 10.8.0.0 255.255.255.0
port ****
ca ca.crt
cert vpn.mydomain.net.crt
key vpn.mydomain.net.key
dh dh1024.pem
cipher AES-256-CBC
auth SHA512
tls-auth ta.key 0
dev tun
proto udp
client-to-client
tun-mtu 1400
#keepalive 5 30
client-config-dir ccd
user nobody
group nogroup
persist-key
persist-tun

Client config file:

client
tls-client
remote vpn.mydomain.net ****
dev tun
proto udp
tun-mtu 1400
# Gesamten Traffic tunneln
#redirect-gateway
cipher AES-256-CBC
auth SHA512
pkcs12 E:\\pm\\vpn\\peter.p12
tls-auth E:\\pm\\vpn\\ta.key 1
ns-cert-type server
tls-remote vpn.****.net
persist-tun
persist-key
keepalive 5 30
verb 4

Office's internet connection is provided by Germanys Unitymedia cable provider with a static IPv4.
There is a gateway with ipfire which manages all network traffic.

Internet connection at home is provided by same cable company but there I have got a dynamic IPv6 with dual stack light.
Til now I have spend a lot of time with this issue but currently I am not able to solve it.

So any clue is very appreciated.

If desired I will add server and client config file.

Best regards
Peter

Traffic

PistolenPeter wroteServer config file:
Code:

#keepalive 5 30

Your --keepalive is disabled ... why :?:

PistolenPeter

Hello Traffic

AFAIK it is sufficient to enable keepalive on one side.

A) Client lose connection (by timeout) to server so connection will be restarted.
B) If server lose connection to client case A comes into effect.

In any case even if keepalive is enable at both sides the issue is still present.

Please correct me if I am wrong.

Best regards
Peter

Traffic

PistolenPeter wroteAFAIK it is sufficient to enable keepalive on one side.

If you deliberately use the wrong directives then expect things not to work .. :shock:

PistolenPeter

Hello Traffic

VPN connection is stable from office even if keepalive is disabled.
If I take to home my laptop then connection gets lost through timeout.

Nevertheless I will check the effect of enabling keepalive at server side.
Result follows.

Best regards
Peter

PistolenPeter

Dear community

Finally I've solved the issue myself:
The key to success is --link-mtu. After setting this value to 1400 everything works as expected.
This issue seems to be cable provider related.

So --keep-alive was not responsible as already supposed.

Best regards
Peter

Traffic

PistolenPeter wroteThe key to success is --link-mtu. After setting this value to 1400 everything works as expected.
This issue seems to be cable provider related.

Thanks for letting us know 8-)