Hi,
I have a very strange issue with OpenVPN (a random packet loss with Ipv6 connectivity). I have set up an Ipv6 connectivity through OpenVPN. The connection itself seems to work if there is no less traffic. For example I am able ping google (with ipv6). The problem occurs once I have more traffic over the tunnel. I have tried to use TCP protocol instead of UDP. It didn't help. I have also tried to adjust mssfix 1400 (but it doesn't seems to work). This tunnel is for our external users (who I am not able to give static key).
Versions used:
Server (Ubuntu Linux LTS 14.04):
OpenVPN 2.3.2 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [eurephia] [MH] [IPv6] built on Dec 1 2014
Originally developed by James Yonan
Client (Windows 7):
OpenVPN 2.3.6 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Mar 19 2015
My server-side Configuration:
dev tap0
server 172.16.14.0 255.255.255.0
server-ipv6 XXXXXXXXX::/64
push tun-ipv6
push "redirect-gateway-ipv6 def1";
push "route-ipv6 2000::/3";
tun-ipv6
ifconfig-pool-persist /etc/openvpn/ipp.txt
push "route 10.1.0.0 255.255.0.0"
push "route 172.16.11.0 255.255.255.0"
push "route 172.16.12.0 255.255.255.0"
push "route 172.16.13.0 255.255.255.0"
push "route 172.16.128.0 255.255.128.0"
push "dhcp-option DNS 10.1.4.24"
push "dhcp-option DNS 10.1.4.3"
client-to-client
topology subnet
push "topology subnet"
comp-lzo
keepalive 10 120
max-clients 30
dh /etc/openvpn/dh2048.pem
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key
persist-tun
persist-key
plugin /usr/lib/openvpn/openvpn-auth-ldap.so "/etc/openvpn/ldap.conf"
port XXXX
user nobody
group users
verb 4
mssfix 1400
status /var/log/openvpn-client-status.log
log-append /var/log/openvpn-client.log
Client-Side-Configuration:
client
dev-node TAP
proto udp
remote XXXXXX YYYY
resolv-retry infinite
nobind
persist-key
persist-tun
ca C:\\VPN2\\ca.crt
cert C:\\VPN2\\client.crt
key C:\\VPN2\\client.key
ns-cert-type server
comp-lzo
verb 4
float
auth-user-pass
Here is an example, how it occurs. I started to google and opened
http://www.v6.facebook.com (which provides ipv6-services). Some time from I opened web-page the packet loss occurred. (I have tried to ping my gateway and the same packet loss occurs against it as well). So I am 100 % confident this problem occurs between client and server. Native connectivity from OpenVPN-server to outside world works perfectly.
C:\Users\mikam>ping -6 -t google.fi
Pinging google.fi [2a00:1450:400f:804::2003] with 32 bytes of data:
Reply from 2a00:1450:400f:804::2003: time=15ms
Reply from 2a00:1450:400f:804::2003: time=15ms
Reply from 2a00:1450:400f:804::2003: time=15ms
Reply from 2a00:1450:400f:804::2003: time=15ms
Reply from 2a00:1450:400f:804::2003: time=15ms
Reply from 2a00:1450:400f:804::2003: time=15ms
Reply from 2a00:1450:400f:804::2003: time=15ms
Reply from 2a00:1450:400f:804::2003: time=15ms
Reply from 2a00:1450:400f:804::2003: time=15ms
Reply from 2a00:1450:400f:804::2003: time=15ms
Reply from 2a00:1450:400f:804::2003: time=15ms
Reply from 2a00:1450:400f:804::2003: time=15ms
Reply from 2a00:1450:400f:804::2003: time=15ms
Reply from 2a00:1450:400f:804::2003: time=15ms
Request timed out.
Request timed out.
Reply from 2a00:1450:400f:804::2003: time=15ms
Request timed out.
Reply from 2a00:1450:400f:804::2003: time=16ms
Reply from 2a00:1450:400f:804::2003: time=15ms
Ping statistics for 2a00:1450:400f:804::2003:
Packets: Sent = 20, Received = 17, Lost = 3 (15% loss),
Approximate round trip times in milli-seconds:
Minimum = 15ms, Maximum = 16ms, Average = 15ms
I have also set up another tunnel between our two sites. It operates using tun0 interface, but the same connectivity. The only difference there is that I am using static key instead of RSA. This tunnel operates without packet loss.
Do you have any idea, what options I could adjust in order to get rid of this issue? All help is highly appreciated.
