Hello,
I got a problem concerning the configuration of an openVpn Client and am asking for your help.
I'd like to establish a VPN connection to a server using OpenVPN.
Here is the content of my config:
client
dev tun
proto tcp
remote <url> <port>
resolv-retry infinite
nobind
persist-key
persist-tun
pkcs12 <name>.p12
comp-lzo
verb 3
remote-cert-tls server
This config was created by the server (a vpn router). Unfortunately I neither have the possibility to see the server.config nor have access to the server logs.
The connection can be established, but after 1-10 minutes, the connection drops. After some time, an inactivity timeout in the log occurs and the connection is being reestablished (which suceeds). During the timeframes the connection is established, everything is fine, but it drops after minutes.
The client log file does not include warnings at all:
Wed Mar 18 20:22:48 2015 OpenVPN 2.3.6 i686-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Dec 1 2014
Wed Mar 18 20:22:48 2015 library versions: OpenSSL 1.0.1j 15 Oct 2014, LZO 2.08
Enter Management Password:
Wed Mar 18 20:22:48 2015 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Wed Mar 18 20:22:48 2015 Need hold release from management interface, waiting...
Wed Mar 18 20:22:48 2015 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Wed Mar 18 20:22:48 2015 MANAGEMENT: CMD 'state on'
Wed Mar 18 20:22:48 2015 MANAGEMENT: CMD 'log all on'
Wed Mar 18 20:22:48 2015 MANAGEMENT: CMD 'hold off'
Wed Mar 18 20:22:48 2015 MANAGEMENT: CMD 'hold release'
Wed Mar 18 20:22:53 2015 MANAGEMENT: CMD 'password [...]'
Wed Mar 18 20:22:53 2015 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Wed Mar 18 20:22:53 2015 Socket Buffers: R=[8192->8192] S=[8192->8192]
Wed Mar 18 20:22:53 2015 MANAGEMENT: >STATE:1426706573,RESOLVE,,,
Wed Mar 18 20:22:53 2015 Attempting to establish TCP connection with [AF_INET]94.216.126.136:1194 [nonblock]
Wed Mar 18 20:22:53 2015 MANAGEMENT: >STATE:1426706573,TCP_CONNECT,,,
Wed Mar 18 20:22:54 2015 TCP connection established with [AF_INET]94.216.126.136:1194
Wed Mar 18 20:22:54 2015 TCPv4_CLIENT link local: [undef]
Wed Mar 18 20:22:54 2015 TCPv4_CLIENT link remote: [AF_INET]94.216.126.136:1194
Wed Mar 18 20:22:54 2015 MANAGEMENT: >STATE:1426706574,WAIT,,,
Wed Mar 18 20:22:54 2015 MANAGEMENT: >STATE:1426706574,AUTH,,,
Wed Mar 18 20:22:54 2015 TLS: Initial packet from [AF_INET]94.216.126.136:1194, sid=138b0d35 c7e5eae0
Wed Mar 18 20:22:57 2015 VERIFY OK: depth=1, C=DE, O=EasyBox, OU=R4474543649, CN=EasyBox Certificate Authority
Wed Mar 18 20:22:57 2015 Validating certificate key usage
Wed Mar 18 20:22:57 2015 ++ Certificate has key usage 00a0, expects 00a0
Wed Mar 18 20:22:57 2015 VERIFY KU OK
Wed Mar 18 20:22:57 2015 Validating certificate extended key usage
Wed Mar 18 20:22:57 2015 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Wed Mar 18 20:22:57 2015 VERIFY EKU OK
Wed Mar 18 20:22:57 2015 VERIFY OK: depth=0, C=DE, O=EasyBox, OU=OpenVPN, CN=OpenVPN server
Wed Mar 18 20:23:00 2015 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Mar 18 20:23:00 2015 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Mar 18 20:23:00 2015 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Mar 18 20:23:00 2015 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Mar 18 20:23:00 2015 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Wed Mar 18 20:23:00 2015 [OpenVPN server] Peer Connection Initiated with [AF_INET]94.216.126.136:1194
Wed Mar 18 20:23:02 2015 MANAGEMENT: >STATE:1426706582,GET_CONFIG,,,
Wed Mar 18 20:23:03 2015 SENT CONTROL [OpenVPN server]: 'PUSH_REQUEST' (status=1)
Wed Mar 18 20:23:03 2015 PUSH: Received control message: 'PUSH_REPLY,route 192.168.178.0 255.255.255.0,route 192.168.4.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 192.168.4.6 192.168.4.5'
Wed Mar 18 20:23:03 2015 OPTIONS IMPORT: timers and/or timeouts modified
Wed Mar 18 20:23:03 2015 OPTIONS IMPORT: --ifconfig/up options modified
Wed Mar 18 20:23:03 2015 OPTIONS IMPORT: route options modified
Wed Mar 18 20:23:03 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Mar 18 20:23:03 2015 MANAGEMENT: >STATE:1426706583,ASSIGN_IP,,192.168.4.6,
Wed Mar 18 20:23:03 2015 open_tun, tt->ipv6=0
Wed Mar 18 20:23:03 2015 TAP-WIN32 device [LAN-Verbindung 2] opened: \\.\Global\{53DF8446-F11B-41A7-AD8C-57D9D1CE4BA3}.tap
Wed Mar 18 20:23:03 2015 TAP-Windows Driver Version 9.9
Wed Mar 18 20:23:03 2015 Notified TAP-Windows driver to set a DHCP IP/netmask of 192.168.4.6/255.255.255.252 on interface {53DF8446-F11B-41A7-AD8C-57D9D1CE4BA3} [DHCP-serv: 192.168.4.5, lease-time: 31536000]
Wed Mar 18 20:23:03 2015 Successful ARP Flush on interface [20] {53DF8446-F11B-41A7-AD8C-57D9D1CE4BA3}
Wed Mar 18 20:23:08 2015 TEST ROUTES: 2/2 succeeded len=2 ret=1 a=0 u/d=up
Wed Mar 18 20:23:08 2015 MANAGEMENT: >STATE:1426706588,ADD_ROUTES,,,
Wed Mar 18 20:23:08 2015 C:\Windows\system32\route.exe ADD 192.168.178.0 MASK 255.255.255.0 192.168.4.5
Wed Mar 18 20:23:08 2015 ROUTE: route addition failed using CreateIpForwardEntry: Das Objekt ist bereits vorhanden. [status=5010 if_index=20]
Wed Mar 18 20:23:08 2015 Route addition via IPAPI failed [adaptive]
Wed Mar 18 20:23:08 2015 Route addition fallback to route.exe
Wed Mar 18 20:23:08 2015 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Wed Mar 18 20:23:08 2015 C:\Windows\system32\route.exe ADD 192.168.4.0 MASK 255.255.255.0 192.168.4.5
Wed Mar 18 20:23:08 2015 ROUTE: route addition failed using CreateIpForwardEntry: Das Objekt ist bereits vorhanden. [status=5010 if_index=20]
Wed Mar 18 20:23:08 2015 Route addition via IPAPI failed [adaptive]
Wed Mar 18 20:23:08 2015 Route addition fallback to route.exe
Wed Mar 18 20:23:08 2015 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Wed Mar 18 20:23:08 2015 Initialization Sequence Completed
Wed Mar 18 20:23:08 2015 MANAGEMENT: >STATE:1426706588,CONNECTED,SUCCESS,192.168.4.6,94.216.126.136
Wed Mar 18 20:25:34 2015 [OpenVPN server] Inactivity timeout (--ping-restart), restarting
Wed Mar 18 20:25:34 2015 SIGUSR1[soft,ping-restart] received, process restarting
Wed Mar 18 20:25:34 2015 MANAGEMENT: >STATE:1426706734,RECONNECTING,ping-restart,,
Wed Mar 18 20:25:34 2015 Restart pause, 5 second(s)
Wed Mar 18 20:25:39 2015 Socket Buffers: R=[8192->8192] S=[8192->8192]
Wed Mar 18 20:25:39 2015 MANAGEMENT: >STATE:1426706739,RESOLVE,,,
Wed Mar 18 20:25:39 2015 Attempting to establish TCP connection with [AF_INET]94.216.126.136:1194 [nonblock]
Wed Mar 18 20:25:39 2015 MANAGEMENT: >STATE:1426706739,TCP_CONNECT,,,
Wed Mar 18 20:25:41 2015 TCP connection established with [AF_INET]94.216.126.136:1194
I really tried everything, but didn't find a solution. Here are my parameters:
- administrator rights granted
- firewall disabled
- the certificate is used only once
- tried different network adapters
- changed mtu size to 1300
- even tried securepoint vpn client
I thought about setting a low reconnect value (keepalive 5 10) but it didn't affect the a faster reconnect (why?).
I really don't know what to do anymore. Can anyone help?
Thank you in advance.
