Hello,
Yesterday i restart our openvpn-server with six server instances and 400 - 1200 Clients each.
The Problem: around 20% of the clients of one instance doesn't reconnect.
After inspect one server in our testlab (all others are not accessible at the moment) i see 11 times the same message in the logs on the client:
May 19 18:51:52 localhost ovpn-client[1374]: PUSH: Received control message: 'PUSH_REPLY,route 10.42.0.0 255.255.0.0,route 10.52.0.0 255.255.0.0,route 10.62.0.0 255.255.0.0,route 10.72.0.0 255.255.0.0,route 10.82.0.0 255.255.0.0,route 10.92.0.0 255.255.0.0,route 192.168.12.0 255.255.255.0,route x.x.x.x 255.255.255.255,route 10.42.0.0 255.255.0.0,topology net30,ping 10,ping-restart 120,ifconfig 10.42.0.178 10.42.0.177'
May 19 18:51:52 localhost ovpn-client[1374]: PUSH: Received control message: 'PUSH_REPLY,route 10.42.0.0 255.255.0.0,route 10.52.0.0 255.255.0.0,route 10.62.0.0 255.255.0.0,route 10.72.0.0 255.255.0.0,route 10.82.0.0 255.255.0.0,route 10.92.0.0 255.255.0.0,route 192.168.12.0 255.255.255.0,route x.x.x.x 255.255.255.255,route 10.42.0.0 255.255.0.0,topology net30,ping 10,ping-restart 120,ifconfig 10.42.0.178 10.42.0.177'
May 19 18:52:07 localhost ovpn-client[1374]: PUSH: Received control message: 'PUSH_REPLY,route 10.42.0.0 255.255.0.0,route 10.52.0.0 255.255.0.0,route 10.62.0.0 255.255.0.0,route 10.72.0.0 255.255.0.0,route 10.82.0.0 255.255.0.0,route 10.92.0.0 255.255.0.0,route 192.168.12.0 255.255.255.0,route x.x.x.x 255.255.255.255,route 10.42.0.0 255.255.0.0,topology net30,ping 10,ping-restart 120,ifconfig 10.42.0.178 10.42.0.177'
May 19 18:52:07 ovpn-client[1374]: last message repeated 8 times
May 19 18:52:07 localhost ovpn-client[1374]: OpenVPN ROUTE: cannot add more than 100 routes -- please increase the max-routes option in the client configuration file
May 19 18:52:07 localhost ovpn-client[1374]: Exiting
After this the openvpn-client process shut down. The config on server and clients are working for years.
Is this a known issue, fixed in an other version
Our quick solution is the roll out the same deb package with a new version to restart the clients, but i'm afraid of the next server restart.
Server:
--------
Debian 7 / Linux vpn 3.2.0-4-amd64 #1 SMP Debian 3.2.65-1+deb7u2 x86_64 GNU/Linux
OpenVPN 2.2.1 x86_64-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Dec 1 2014
Deb Version: 2.2.1-8+deb7u3
port 1191
proto udp
dev tun8
ca /etc/openvpn/terminal/ca.crt
cert /etc/openvpn/terminal/terminal.crt
key /etc/openvpn/terminal/terminal.key # This file should be kept secret
dh /etc/openssl/dh1024.pem
server 10.42.0.0 255.255.0.0
ifconfig-pool-persist ipp-marktserver-udp-ng.txt
learn-address /etc/openvpn/learn-address.sh
push "route 10.42.0.0 255.255.0.0"
push "route 10.52.0.0 255.255.0.0"
push "route 10.62.0.0 255.255.0.0"
push "route 10.72.0.0 255.255.0.0"
push "route 10.82.0.0 255.255.0.0"
push "route 10.92.0.0 255.255.0.0"
push "route 192.168.12.0 255.255.255.0"
push "route x.x.x.x 255.255.255.255"
client-to-client
keepalive 10 120
comp-lzo
persist-key
persist-tun
status openvpn-status-marktserver-udp-ng.log
log-append /etc/openvpn/openvpn.log
verb 0
script-security 2
management 127.0.0.1 21191
Client:
-------
Ubuntu 12.04.2 LTS / Linux acb-000070-a1 3.2.0-48-generic #74-Ubuntu SMP Thu Jun 6 19:43:26 UTC 2013 x86_64 x86_64 x86_64 GNU/Linux
OpenVPN 2.2.1 x86_64-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Feb 27 2013
Deb Version: 2.2.1-8ubuntu1.1
client
dev tun
proto udp
xxxx.xxxxxx.de 1191
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
comp-lzo
verb 3
Thanks to all
Moritz
