client-cert-not-required - expanding for multi-user

kamaradski

Hi all,

Unfortunately my first post on this forum is a request for help but anyway thanks for having me!

I had a working openvpn server for a single user (PAM based non-certificate) for a long time now, and it works just fine for this one user.
Now i have added a new user to the mix, and this new user is disconnected every 5 minutes from the server, and i cannot seem to find the reason for this.

In the hope that someone can help me, i will be posting my setup below, however all external ip-addresses and ports have been replaced by placeholders. Also the posted password-hash in the client configs are fake.

Server:
Ubuntu 14.10
OpenVPN 2.3.2 x86_64-pc-linux-gnu build:1-dec-2014

Clients:
1x Synology NAS - local network 10.0.0.0 255.255.255.0 - ip: 10.0.0.5
1x Synology NAS - local network 10.0.0.0 255.255.255.192 - ip: 10.0.0.150

Note-1: Both NAS are in different countries, behind total different external IP's
Note-2: Both NAS are exposed hosts, and to be sure have UDP 1194 forwarded to them in addition
Note-3: The default vpn-client interface on the synology does not support client certificates. I can hack this manually, but would have to re-do it after every update.
I decided that the better solution was to build a OpenVPN server that uses PAM for authentication instead.

server config:

proto udp
port 1194

dev tun
persist-tun
persist-key
keepalive 10 60
max-clients 4

status /var/log/openvpn-status.log
status-version 2

server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
client-config-dir /etc/openvpn/ccd
push "redirect-gateway def1 bypass-dhcp"
push "route 10.8.0.0 255.255.255.0"
#push "route 10.0.0.0 255.255.255.0"
#push "route 10.0.0.0 255.255.255.192"

verb 4
log-append /var/log/openvpn.log

ca /etc/openvpn/ca.crt
cert /etc/openvpn/KamaVPN.crt
key /etc/openvpn/KamaVPN.key
dh /etc/openvpn/dh2048.pem

reneg-sec 0
plugin /usr/lib/openvpn/openvpn-plugin-auth-pam.so login
client-cert-not-required
username-as-common-name
client-to-client

NAS-1 config:

[o1420398295]
nat=no
protocol=udp
redirect-gateway=yes
comp-lzo=no
pass=+8jNluHVXJ31y4X8H1sdrgOuUlVAf3XZMOg==
port=1194
reconnect=yes
conf_name=kamaradski
user=vpn-client
remote=999.888.777.666

NAS-2 config:

[o1433760640]
nat=no
protocol=udp
redirect-gateway=yes
comp-lzo=no
pass=49etKNnNSFrhKvGZdjTjlp/Uv5w=
port=1194
reconnect=yes
conf_name=kamaradskivpn
user=cobes
remote=999.888.777.666

Start-up log vpn server:

Fri Jun 12 10:39:44 2015 us=699940 Current Parameter Settings:
Fri Jun 12 10:39:44 2015 us=700003   config = '/etc/openvpn/server.conf'
Fri Jun 12 10:39:44 2015 us=700018   mode = 1
Fri Jun 12 10:39:44 2015 us=700029   persist_config = DISABLED
Fri Jun 12 10:39:44 2015 us=700039   persist_mode = 1
Fri Jun 12 10:39:44 2015 us=700049   show_ciphers = DISABLED
Fri Jun 12 10:39:44 2015 us=700059   show_digests = DISABLED
Fri Jun 12 10:39:44 2015 us=700069   show_engines = DISABLED
Fri Jun 12 10:39:44 2015 us=700078   genkey = DISABLED
Fri Jun 12 10:39:44 2015 us=700088   key_pass_file = '[UNDEF]'
Fri Jun 12 10:39:44 2015 us=700097   show_tls_ciphers = DISABLED
Fri Jun 12 10:39:44 2015 us=700108 Connection profiles [default]:
Fri Jun 12 10:39:44 2015 us=700118   proto = udp
Fri Jun 12 10:39:44 2015 us=700128   local = '[UNDEF]'
Fri Jun 12 10:39:44 2015 us=700137   local_port = 1194
Fri Jun 12 10:39:44 2015 us=700147   remote = '[UNDEF]'
Fri Jun 12 10:39:44 2015 us=700157   remote_port = 1194
Fri Jun 12 10:39:44 2015 us=700166   remote_float = DISABLED
Fri Jun 12 10:39:44 2015 us=700175   bind_defined = DISABLED
Fri Jun 12 10:39:44 2015 us=700185   bind_local = ENABLED
Fri Jun 12 10:39:44 2015 us=700195   connect_retry_seconds = 5
Fri Jun 12 10:39:44 2015 us=700204   connect_timeout = 10
Fri Jun 12 10:39:44 2015 us=700214   connect_retry_max = 0
Fri Jun 12 10:39:44 2015 us=700224   socks_proxy_server = '[UNDEF]'
Fri Jun 12 10:39:44 2015 us=700233   socks_proxy_port = 0
Fri Jun 12 10:39:44 2015 us=700243   socks_proxy_retry = DISABLED
Fri Jun 12 10:39:44 2015 us=700252   tun_mtu = 1500
Fri Jun 12 10:39:44 2015 us=700262   tun_mtu_defined = ENABLED
Fri Jun 12 10:39:44 2015 us=700271   link_mtu = 1500
Fri Jun 12 10:39:44 2015 us=700281   link_mtu_defined = DISABLED
Fri Jun 12 10:39:44 2015 us=700290   tun_mtu_extra = 0
Fri Jun 12 10:39:44 2015 us=700300   tun_mtu_extra_defined = DISABLED
Fri Jun 12 10:39:44 2015 us=700309   mtu_discover_type = -1
Fri Jun 12 10:39:44 2015 us=700318   fragment = 0
Fri Jun 12 10:39:44 2015 us=700328   mssfix = 1450
Fri Jun 12 10:39:44 2015 us=700337   explicit_exit_notification = 0
Fri Jun 12 10:39:44 2015 us=700347 Connection profiles END
Fri Jun 12 10:39:44 2015 us=700356   remote_random = DISABLED
Fri Jun 12 10:39:44 2015 us=700366   ipchange = '[UNDEF]'
Fri Jun 12 10:39:44 2015 us=700375   dev = 'tun'
Fri Jun 12 10:39:44 2015 us=700385   dev_type = '[UNDEF]'
Fri Jun 12 10:39:44 2015 us=700394   dev_node = '[UNDEF]'
Fri Jun 12 10:39:44 2015 us=700403   lladdr = '[UNDEF]'
Fri Jun 12 10:39:44 2015 us=700413   topology = 1
Fri Jun 12 10:39:44 2015 us=700422   tun_ipv6 = DISABLED
Fri Jun 12 10:39:44 2015 us=700432   ifconfig_local = '10.8.0.1'
Fri Jun 12 10:39:44 2015 us=700441   ifconfig_remote_netmask = '10.8.0.2'
Fri Jun 12 10:39:44 2015 us=700451   ifconfig_noexec = DISABLED
Fri Jun 12 10:39:44 2015 us=700460   ifconfig_nowarn = DISABLED
Fri Jun 12 10:39:44 2015 us=700470   ifconfig_ipv6_local = '[UNDEF]'
Fri Jun 12 10:39:44 2015 us=700479   ifconfig_ipv6_netbits = 0
Fri Jun 12 10:39:44 2015 us=700488   ifconfig_ipv6_remote = '[UNDEF]'
Fri Jun 12 10:39:44 2015 us=700498   shaper = 0
Fri Jun 12 10:39:44 2015 us=700508   mtu_test = 0
Fri Jun 12 10:39:44 2015 us=700517   mlock = DISABLED
Fri Jun 12 10:39:44 2015 us=700526   keepalive_ping = 0
Fri Jun 12 10:39:44 2015 us=700536   keepalive_timeout = 0
Fri Jun 12 10:39:44 2015 us=700545   inactivity_timeout = 0
Fri Jun 12 10:39:44 2015 us=700555   ping_send_timeout = 0
Fri Jun 12 10:39:44 2015 us=700564   ping_rec_timeout = 0
Fri Jun 12 10:39:44 2015 us=700573   ping_rec_timeout_action = 0
Fri Jun 12 10:39:44 2015 us=700582   ping_timer_remote = DISABLED
Fri Jun 12 10:39:44 2015 us=700592   remap_sigusr1 = 0
Fri Jun 12 10:39:44 2015 us=700601   persist_tun = ENABLED
Fri Jun 12 10:39:44 2015 us=700611   persist_local_ip = DISABLED
Fri Jun 12 10:39:44 2015 us=700620   persist_remote_ip = DISABLED
Fri Jun 12 10:39:44 2015 us=700629   persist_key = ENABLED
Fri Jun 12 10:39:44 2015 us=700652   passtos = DISABLED
Fri Jun 12 10:39:44 2015 us=700665   resolve_retry_seconds = 1000000000
Fri Jun 12 10:39:44 2015 us=700676   username = '[UNDEF]'
Fri Jun 12 10:39:44 2015 us=700686   groupname = '[UNDEF]'
Fri Jun 12 10:39:44 2015 us=700695   chroot_dir = '[UNDEF]'
Fri Jun 12 10:39:44 2015 us=700705   cd_dir = '/etc/openvpn'
Fri Jun 12 10:39:44 2015 us=700714   writepid = '/run/openvpn/server.pid'
Fri Jun 12 10:39:44 2015 us=700724   up_script = '[UNDEF]'
Fri Jun 12 10:39:44 2015 us=700733   down_script = '[UNDEF]'
Fri Jun 12 10:39:44 2015 us=700742   down_pre = DISABLED
Fri Jun 12 10:39:44 2015 us=700751   up_restart = DISABLED
Fri Jun 12 10:39:44 2015 us=700761   up_delay = DISABLED
Fri Jun 12 10:39:44 2015 us=700770   daemon = ENABLED
Fri Jun 12 10:39:44 2015 us=700779   inetd = 0
Fri Jun 12 10:39:44 2015 us=700789   log = ENABLED
Fri Jun 12 10:39:44 2015 us=700798   suppress_timestamps = DISABLED
Fri Jun 12 10:39:44 2015 us=700807   nice = 0
Fri Jun 12 10:39:44 2015 us=700817   verbosity = 6
Fri Jun 12 10:39:44 2015 us=700826   mute = 0
Fri Jun 12 10:39:44 2015 us=700836   gremlin = 0
Fri Jun 12 10:39:44 2015 us=700845   status_file = '/var/log/openvpn-status.log'
Fri Jun 12 10:39:44 2015 us=700855   status_file_version = 2
Fri Jun 12 10:39:44 2015 us=700864   status_file_update_freq = 60
Fri Jun 12 10:39:44 2015 us=700874   occ = ENABLED
Fri Jun 12 10:39:44 2015 us=700883   rcvbuf = 65536
Fri Jun 12 10:39:44 2015 us=700893   sndbuf = 65536
Fri Jun 12 10:39:44 2015 us=700902   mark = 0
Fri Jun 12 10:39:44 2015 us=700911   sockflags = 0
Fri Jun 12 10:39:44 2015 us=700921   fast_io = DISABLED
Fri Jun 12 10:39:44 2015 us=700930   lzo = 0
Fri Jun 12 10:39:44 2015 us=700939   route_script = '[UNDEF]'
Fri Jun 12 10:39:44 2015 us=700949   route_default_gateway = '[UNDEF]'
Fri Jun 12 10:39:44 2015 us=700959   route_default_metric = 0
Fri Jun 12 10:39:44 2015 us=700968   route_noexec = DISABLED
Fri Jun 12 10:39:44 2015 us=700978   route_delay = 0
Fri Jun 12 10:39:44 2015 us=700988   route_delay_window = 30
Fri Jun 12 10:39:44 2015 us=700997   route_delay_defined = DISABLED
Fri Jun 12 10:39:44 2015 us=701007   route_nopull = DISABLED
Fri Jun 12 10:39:44 2015 us=701016   route_gateway_via_dhcp = DISABLED
Fri Jun 12 10:39:44 2015 us=701026   max_routes = 100
Fri Jun 12 10:39:44 2015 us=701035   allow_pull_fqdn = DISABLED
Fri Jun 12 10:39:44 2015 us=701046   route 10.8.0.0/255.255.255.0/nil/nil
Fri Jun 12 10:39:44 2015 us=701055   management_addr = '[UNDEF]'
Fri Jun 12 10:39:44 2015 us=701065   management_port = 0
Fri Jun 12 10:39:44 2015 us=701074   management_user_pass = '[UNDEF]'
Fri Jun 12 10:39:44 2015 us=701084   management_log_history_cache = 250
Fri Jun 12 10:39:44 2015 us=701093   management_echo_buffer_size = 100
Fri Jun 12 10:39:44 2015 us=701103   management_write_peer_info_file = '[UNDEF]'
Fri Jun 12 10:39:44 2015 us=701113   management_client_user = '[UNDEF]'
Fri Jun 12 10:39:44 2015 us=701122   management_client_group = '[UNDEF]'
Fri Jun 12 10:39:44 2015 us=701132   management_flags = 0
Fri Jun 12 10:39:44 2015 us=701151   plugin[0] /usr/lib/openvpn/openvpn-plugin-auth-pam.so '[/usr/lib/openvpn/openvpn-plugin-auth-pam.so] [login]'
Fri Jun 12 10:39:44 2015 us=701162   shared_secret_file = '[UNDEF]'
Fri Jun 12 10:39:44 2015 us=701173   key_direction = 0
Fri Jun 12 10:39:44 2015 us=701183   ciphername_defined = ENABLED
Fri Jun 12 10:39:44 2015 us=701192   ciphername = 'BF-CBC'
Fri Jun 12 10:39:44 2015 us=701202   authname_defined = ENABLED
Fri Jun 12 10:39:44 2015 us=701211   authname = 'SHA1'
Fri Jun 12 10:39:44 2015 us=701221   prng_hash = 'SHA1'
Fri Jun 12 10:39:44 2015 us=701231   prng_nonce_secret_len = 16
Fri Jun 12 10:39:44 2015 us=701240   keysize = 0
Fri Jun 12 10:39:44 2015 us=701250   engine = DISABLED
Fri Jun 12 10:39:44 2015 us=701259   replay = ENABLED
Fri Jun 12 10:39:44 2015 us=701269   mute_replay_warnings = DISABLED
Fri Jun 12 10:39:44 2015 us=701278   replay_window = 64
Fri Jun 12 10:39:44 2015 us=701288   replay_time = 15
Fri Jun 12 10:39:44 2015 us=701304   packet_id_file = '[UNDEF]'
Fri Jun 12 10:39:44 2015 us=701314   use_iv = ENABLED
Fri Jun 12 10:39:44 2015 us=701324   test_crypto = DISABLED
Fri Jun 12 10:39:44 2015 us=701333   tls_server = ENABLED
Fri Jun 12 10:39:44 2015 us=701343   tls_client = DISABLED
Fri Jun 12 10:39:44 2015 us=701352   key_method = 2
Fri Jun 12 10:39:44 2015 us=701362   ca_file = '/etc/openvpn/ca.crt'
Fri Jun 12 10:39:44 2015 us=701371   ca_path = '[UNDEF]'
Fri Jun 12 10:39:44 2015 us=701381   dh_file = '/etc/openvpn/dh2048.pem'
Fri Jun 12 10:39:44 2015 us=701390   cert_file = '/etc/openvpn/KamaVPN.crt'
Fri Jun 12 10:39:44 2015 us=701400   priv_key_file = '/etc/openvpn/KamaVPN.key'
Fri Jun 12 10:39:44 2015 us=701409   pkcs12_file = '[UNDEF]'
Fri Jun 12 10:39:44 2015 us=701419   cipher_list = '[UNDEF]'
Fri Jun 12 10:39:44 2015 us=701428   tls_verify = '[UNDEF]'
Fri Jun 12 10:39:44 2015 us=701437   tls_export_cert = '[UNDEF]'
Fri Jun 12 10:39:44 2015 us=701447   verify_x509_type = 0
Fri Jun 12 10:39:44 2015 us=701456   verify_x509_name = '[UNDEF]'
Fri Jun 12 10:39:44 2015 us=701465   crl_file = '[UNDEF]'
Fri Jun 12 10:39:44 2015 us=701475   ns_cert_type = 0
Fri Jun 12 10:39:44 2015 us=701484   remote_cert_ku[i] = 0
Fri Jun 12 10:39:44 2015 us=701493   remote_cert_ku[i] = 0
Fri Jun 12 10:39:44 2015 us=701502   remote_cert_ku[i] = 0
Fri Jun 12 10:39:44 2015 us=701511   remote_cert_ku[i] = 0
Fri Jun 12 10:39:44 2015 us=701520   remote_cert_ku[i] = 0
Fri Jun 12 10:39:44 2015 us=701530   remote_cert_ku[i] = 0
Fri Jun 12 10:39:44 2015 us=701539   remote_cert_ku[i] = 0
Fri Jun 12 10:39:44 2015 us=701548   remote_cert_ku[i] = 0
Fri Jun 12 10:39:44 2015 us=701557   remote_cert_ku[i] = 0
Fri Jun 12 10:39:44 2015 us=701566   remote_cert_ku[i] = 0
Fri Jun 12 10:39:44 2015 us=701575   remote_cert_ku[i] = 0
Fri Jun 12 10:39:44 2015 us=701584   remote_cert_ku[i] = 0
Fri Jun 12 10:39:44 2015 us=701594   remote_cert_ku[i] = 0
Fri Jun 12 10:39:44 2015 us=701603   remote_cert_ku[i] = 0
Fri Jun 12 10:39:44 2015 us=701612   remote_cert_ku[i] = 0
Fri Jun 12 10:39:44 2015 us=701621   remote_cert_ku[i] = 0
Fri Jun 12 10:39:44 2015 us=701631   remote_cert_eku = '[UNDEF]'
Fri Jun 12 10:39:44 2015 us=701640   ssl_flags = 3
Fri Jun 12 10:39:44 2015 us=701649   tls_timeout = 2
Fri Jun 12 10:39:44 2015 us=701658   renegotiate_bytes = 0
Fri Jun 12 10:39:44 2015 us=701668   renegotiate_packets = 0
Fri Jun 12 10:39:44 2015 us=701677   renegotiate_seconds = 0
Fri Jun 12 10:39:44 2015 us=701686   handshake_window = 60
Fri Jun 12 10:39:44 2015 us=701695   transition_window = 3600
Fri Jun 12 10:39:44 2015 us=701704   single_session = DISABLED
Fri Jun 12 10:39:44 2015 us=701714   push_peer_info = DISABLED
Fri Jun 12 10:39:44 2015 us=701723   tls_exit = DISABLED
Fri Jun 12 10:39:44 2015 us=701732   tls_auth_file = '[UNDEF]'
Fri Jun 12 10:39:44 2015 us=701742   pkcs11_protected_authentication = DISABLED
Fri Jun 12 10:39:44 2015 us=701751   pkcs11_protected_authentication = DISABLED
Fri Jun 12 10:39:44 2015 us=701761   pkcs11_protected_authentication = DISABLED
Fri Jun 12 10:39:44 2015 us=701771   pkcs11_protected_authentication = DISABLED
Fri Jun 12 10:39:44 2015 us=701780   pkcs11_protected_authentication = DISABLED
Fri Jun 12 10:39:44 2015 us=701790   pkcs11_protected_authentication = DISABLED
Fri Jun 12 10:39:44 2015 us=701799   pkcs11_protected_authentication = DISABLED
Fri Jun 12 10:39:44 2015 us=701809   pkcs11_protected_authentication = DISABLED
Fri Jun 12 10:39:44 2015 us=701818   pkcs11_protected_authentication = DISABLED
Fri Jun 12 10:39:44 2015 us=701828   pkcs11_protected_authentication = DISABLED
Fri Jun 12 10:39:44 2015 us=701837   pkcs11_protected_authentication = DISABLED
Fri Jun 12 10:39:44 2015 us=701846   pkcs11_protected_authentication = DISABLED
Fri Jun 12 10:39:44 2015 us=701856   pkcs11_protected_authentication = DISABLED
Fri Jun 12 10:39:44 2015 us=701865   pkcs11_protected_authentication = DISABLED
Fri Jun 12 10:39:44 2015 us=701875   pkcs11_protected_authentication = DISABLED
Fri Jun 12 10:39:44 2015 us=701884   pkcs11_protected_authentication = DISABLED
Fri Jun 12 10:39:44 2015 us=701901   pkcs11_private_mode = 00000000
Fri Jun 12 10:39:44 2015 us=701911   pkcs11_private_mode = 00000000
Fri Jun 12 10:39:44 2015 us=701921   pkcs11_private_mode = 00000000
Fri Jun 12 10:39:44 2015 us=701930   pkcs11_private_mode = 00000000
Fri Jun 12 10:39:44 2015 us=701940   pkcs11_private_mode = 00000000
Fri Jun 12 10:39:44 2015 us=701949   pkcs11_private_mode = 00000000
Fri Jun 12 10:39:44 2015 us=701959   pkcs11_private_mode = 00000000
Fri Jun 12 10:39:44 2015 us=701968   pkcs11_private_mode = 00000000
Fri Jun 12 10:39:44 2015 us=701978   pkcs11_private_mode = 00000000
Fri Jun 12 10:39:44 2015 us=701987   pkcs11_private_mode = 00000000
Fri Jun 12 10:39:44 2015 us=701996   pkcs11_private_mode = 00000000
Fri Jun 12 10:39:44 2015 us=702006   pkcs11_private_mode = 00000000
Fri Jun 12 10:39:44 2015 us=702015   pkcs11_private_mode = 00000000
Fri Jun 12 10:39:44 2015 us=702025   pkcs11_private_mode = 00000000
Fri Jun 12 10:39:44 2015 us=702034   pkcs11_private_mode = 00000000
Fri Jun 12 10:39:44 2015 us=702044   pkcs11_private_mode = 00000000
Fri Jun 12 10:39:44 2015 us=702053   pkcs11_cert_private = DISABLED
Fri Jun 12 10:39:44 2015 us=702062   pkcs11_cert_private = DISABLED
Fri Jun 12 10:39:44 2015 us=702072   pkcs11_cert_private = DISABLED
Fri Jun 12 10:39:44 2015 us=702081   pkcs11_cert_private = DISABLED
Fri Jun 12 10:39:44 2015 us=702091   pkcs11_cert_private = DISABLED
Fri Jun 12 10:39:44 2015 us=702100   pkcs11_cert_private = DISABLED
Fri Jun 12 10:39:44 2015 us=702109   pkcs11_cert_private = DISABLED
Fri Jun 12 10:39:44 2015 us=702119   pkcs11_cert_private = DISABLED
Fri Jun 12 10:39:44 2015 us=702128   pkcs11_cert_private = DISABLED
Fri Jun 12 10:39:44 2015 us=702137   pkcs11_cert_private = DISABLED
Fri Jun 12 10:39:44 2015 us=702147   pkcs11_cert_private = DISABLED
Fri Jun 12 10:39:44 2015 us=702156   pkcs11_cert_private = DISABLED
Fri Jun 12 10:39:44 2015 us=702165   pkcs11_cert_private = DISABLED
Fri Jun 12 10:39:44 2015 us=702174   pkcs11_cert_private = DISABLED
Fri Jun 12 10:39:44 2015 us=702184   pkcs11_cert_private = DISABLED
Fri Jun 12 10:39:44 2015 us=702193   pkcs11_cert_private = DISABLED
Fri Jun 12 10:39:44 2015 us=702203   pkcs11_pin_cache_period = -1
Fri Jun 12 10:39:44 2015 us=702212   pkcs11_id = '[UNDEF]'
Fri Jun 12 10:39:44 2015 us=702221   pkcs11_id_management = DISABLED
Fri Jun 12 10:39:44 2015 us=702232   server_network = 10.8.0.0
Fri Jun 12 10:39:44 2015 us=702243   server_netmask = 255.255.255.0
Fri Jun 12 10:39:44 2015 us=702255   server_network_ipv6 = ::
Fri Jun 12 10:39:44 2015 us=702264   server_netbits_ipv6 = 0
Fri Jun 12 10:39:44 2015 us=702275   server_bridge_ip = 0.0.0.0
Fri Jun 12 10:39:44 2015 us=702286   server_bridge_netmask = 0.0.0.0
Fri Jun 12 10:39:44 2015 us=702296   server_bridge_pool_start = 0.0.0.0
Fri Jun 12 10:39:44 2015 us=702307   server_bridge_pool_end = 0.0.0.0
Fri Jun 12 10:39:44 2015 us=702317   push_entry = 'redirect-gateway def1 bypass-dhcp'
Fri Jun 12 10:39:44 2015 us=702327   push_entry = 'route 10.8.0.0 255.255.255.0'
Fri Jun 12 10:39:44 2015 us=702337   push_entry = 'route 10.8.0.0 255.255.255.0'
Fri Jun 12 10:39:44 2015 us=702346   push_entry = 'topology net30'
Fri Jun 12 10:39:44 2015 us=702356   ifconfig_pool_defined = ENABLED
Fri Jun 12 10:39:44 2015 us=702366   ifconfig_pool_start = 10.8.0.4
Fri Jun 12 10:39:44 2015 us=702377   ifconfig_pool_end = 10.8.0.251
Fri Jun 12 10:39:44 2015 us=702387   ifconfig_pool_netmask = 0.0.0.0
Fri Jun 12 10:39:44 2015 us=702397   ifconfig_pool_persist_filename = 'ipp.txt'
Fri Jun 12 10:39:44 2015 us=702407   ifconfig_pool_persist_refresh_freq = 600
Fri Jun 12 10:39:44 2015 us=702417   ifconfig_ipv6_pool_defined = DISABLED
Fri Jun 12 10:39:44 2015 us=702427   ifconfig_ipv6_pool_base = ::
Fri Jun 12 10:39:44 2015 us=702437   ifconfig_ipv6_pool_netbits = 0
Fri Jun 12 10:39:44 2015 us=702446   n_bcast_buf = 256
Fri Jun 12 10:39:44 2015 us=702456   tcp_queue_limit = 64
Fri Jun 12 10:39:44 2015 us=702465   real_hash_size = 256
Fri Jun 12 10:39:44 2015 us=702474   virtual_hash_size = 256
Fri Jun 12 10:39:44 2015 us=702490   client_connect_script = '[UNDEF]'
Fri Jun 12 10:39:44 2015 us=702500   learn_address_script = '[UNDEF]'
Fri Jun 12 10:39:44 2015 us=702510   client_disconnect_script = '[UNDEF]'
Fri Jun 12 10:39:44 2015 us=702519   client_config_dir = '/etc/openvpn/ccd'
Fri Jun 12 10:39:44 2015 us=702529   ccd_exclusive = DISABLED
Fri Jun 12 10:39:44 2015 us=702538   tmp_dir = '/tmp'
Fri Jun 12 10:39:44 2015 us=702548   push_ifconfig_defined = DISABLED
Fri Jun 12 10:39:44 2015 us=702559   push_ifconfig_local = 0.0.0.0
Fri Jun 12 10:39:44 2015 us=702570   push_ifconfig_remote_netmask = 0.0.0.0
Fri Jun 12 10:39:44 2015 us=702579   push_ifconfig_ipv6_defined = DISABLED
Fri Jun 12 10:39:44 2015 us=702590   push_ifconfig_ipv6_local = ::/0
Fri Jun 12 10:39:44 2015 us=702600   push_ifconfig_ipv6_remote = ::
Fri Jun 12 10:39:44 2015 us=702609   enable_c2c = ENABLED
Fri Jun 12 10:39:44 2015 us=702619   duplicate_cn = DISABLED
Fri Jun 12 10:39:44 2015 us=702628   cf_max = 0
Fri Jun 12 10:39:44 2015 us=702638   cf_per = 0
Fri Jun 12 10:39:44 2015 us=702647   max_clients = 4
Fri Jun 12 10:39:44 2015 us=702657   max_routes_per_client = 256
Fri Jun 12 10:39:44 2015 us=702666   auth_user_pass_verify_script = '[UNDEF]'
Fri Jun 12 10:39:44 2015 us=702676   auth_user_pass_verify_script_via_file = DISABLED
Fri Jun 12 10:39:44 2015 us=702686   port_share_host = '[UNDEF]'
Fri Jun 12 10:39:44 2015 us=702695   port_share_port = 0
Fri Jun 12 10:39:44 2015 us=702705   client = DISABLED
Fri Jun 12 10:39:44 2015 us=702714   pull = DISABLED
Fri Jun 12 10:39:44 2015 us=702723   auth_user_pass_file = '[UNDEF]'
Fri Jun 12 10:39:44 2015 us=702734 OpenVPN 2.3.2 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [eurephia] [MH] [IPv6] built on Dec  1 2014
AUTH-PAM: BACKGROUND: INIT service='login'
Fri Jun 12 10:39:44 2015 us=703339 PLUGIN_INIT: POST /usr/lib/openvpn/openvpn-plugin-auth-pam.so '[/usr/lib/openvpn/openvpn-plugin-auth-pam.so] [login]' intercepted=PLUGIN_AUTH_USER_PASS_VERIFY 
Fri Jun 12 10:39:44 2015 us=713229 Diffie-Hellman initialized with 2048 bit key
Fri Jun 12 10:39:44 2015 us=713253 WARNING: POTENTIALLY DANGEROUS OPTION --client-cert-not-required may accept clients which do not present a certificate
Fri Jun 12 10:39:44 2015 us=713510 WARNING: file '/etc/openvpn/KamaVPN.key' is group or others accessible
Fri Jun 12 10:39:44 2015 us=713742 TLS-Auth MTU parms [ L:1541 D:138 EF:38 EB:0 ET:0 EL:0 ]
Fri Jun 12 10:39:44 2015 us=713774 Socket Buffers: R=[212992->131072] S=[212992->131072]
Fri Jun 12 10:39:44 2015 us=713890 ROUTE_GATEWAY 176.9.93.225/255.255.255.224 IFACE=eth0 HWADDR=54:04:a6:7e:f3:d8
Fri Jun 12 10:39:44 2015 us=714243 TUN/TAP device tun0 opened
Fri Jun 12 10:39:44 2015 us=714274 TUN/TAP TX queue length set to 100
Fri Jun 12 10:39:44 2015 us=714300 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Fri Jun 12 10:39:44 2015 us=714332 /sbin/ip link set dev tun0 up mtu 1500
Fri Jun 12 10:39:44 2015 us=715357 /sbin/ip addr add dev tun0 local 10.8.0.1 peer 10.8.0.2
Fri Jun 12 10:39:44 2015 us=716410 /sbin/ip route add 10.8.0.0/24 via 10.8.0.2
Fri Jun 12 10:39:44 2015 us=717257 Data Channel MTU parms [ L:1541 D:1450 EF:41 EB:4 ET:0 EL:0 ]
Fri Jun 12 10:39:44 2015 us=717567 UDPv4 link local (bound): [undef]
Fri Jun 12 10:39:44 2015 us=717601 UDPv4 link remote: [undef]
Fri Jun 12 10:39:44 2015 us=717615 MULTI: multi_init called, r=256 v=256
Fri Jun 12 10:39:44 2015 us=717687 IFCONFIG POOL: base=10.8.0.4 size=62, ipv6=0
Fri Jun 12 10:39:44 2015 us=717718 ifconfig_pool_read(), in='vpn-client,10.8.0.4', TODO: IPv6
Fri Jun 12 10:39:44 2015 us=717745 succeeded -> ifconfig_pool_set()
Fri Jun 12 10:39:44 2015 us=717760 ifconfig_pool_read(), in='cobes,10.8.0.8', TODO: IPv6
Fri Jun 12 10:39:44 2015 us=717775 succeeded -> ifconfig_pool_set()
Fri Jun 12 10:39:44 2015 us=717792 IFCONFIG POOL LIST
Fri Jun 12 10:39:44 2015 us=717807 vpn-client,10.8.0.4
Fri Jun 12 10:39:44 2015 us=717820 cobes,10.8.0.8
Fri Jun 12 10:39:44 2015 us=717867 Initialization Sequence Completed

NAS-2 connecting:

Fri Jun 12 11:39:52 2015 us=786056 MULTI: multi_create_instance called
Fri Jun 12 11:39:52 2015 us=786127 111.222.333.444:52678 Re-using SSL/TLS context
Fri Jun 12 11:39:52 2015 us=786314 111.222.333.444:52678 Control Channel MTU parms [ L:1541 D:138 EF:38 EB:0 ET:0 EL:0 ]
Fri Jun 12 11:39:52 2015 us=786332 111.222.333.444:52678 Data Channel MTU parms [ L:1541 D:1450 EF:41 EB:4 ET:0 EL:0 ]
Fri Jun 12 11:39:52 2015 us=786372 111.222.333.444:52678 Local Options String: 'V4,dev-type tun,link-mtu 1541,tun-mtu 1500,proto UDPv4,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Fri Jun 12 11:39:52 2015 us=786384 111.222.333.444:52678 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1541,tun-mtu 1500,proto UDPv4,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Fri Jun 12 11:39:52 2015 us=786404 111.222.333.444:52678 Local Options hash (VER=V4): '239669a8'
Fri Jun 12 11:39:52 2015 us=786421 111.222.333.444:52678 Expected Remote Options hash (VER=V4): '3514370b'
Fri Jun 12 11:39:52 2015 us=786457 111.222.333.444:52678 TLS: Initial packet from [AF_INET]111.222.333.444:52678, sid=d840f13b 7206f192
AUTH-PAM: BACKGROUND: received command code: 0
AUTH-PAM: BACKGROUND: USER: cobes
AUTH-PAM: BACKGROUND: my_conv[0] query='Password: ' style=1
Fri Jun 12 11:39:53 2015 us=737171 111.222.333.444:52678 PLUGIN_CALL: POST /usr/lib/openvpn/openvpn-plugin-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=0
Fri Jun 12 11:39:53 2015 us=737238 111.222.333.444:52678 TLS: Username/Password authentication succeeded for username 'cobes' [CN SET]
Fri Jun 12 11:39:53 2015 us=737446 111.222.333.444:52678 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Fri Jun 12 11:39:53 2015 us=737463 111.222.333.444:52678 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Jun 12 11:39:53 2015 us=737546 111.222.333.444:52678 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Fri Jun 12 11:39:53 2015 us=737559 111.222.333.444:52678 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Jun 12 11:39:53 2015 us=789522 111.222.333.444:52678 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA
Fri Jun 12 11:39:53 2015 us=789568 111.222.333.444:52678 [cobes] Peer Connection Initiated with [AF_INET]111.222.333.444:52678
Fri Jun 12 11:39:53 2015 us=789615 cobes/111.222.333.444:52678 OPTIONS IMPORT: reading client specific options from: /etc/openvpn/ccd/cobes
Fri Jun 12 11:39:53 2015 us=789752 cobes/111.222.333.444:52678 MULTI: Learn: 10.8.0.8 -> cobes/111.222.333.444:52678
Fri Jun 12 11:39:53 2015 us=789769 cobes/111.222.333.444:52678 MULTI: primary virtual IP for cobes/111.222.333.444:52678: 10.8.0.8
Fri Jun 12 11:39:53 2015 us=789783 cobes/111.222.333.444:52678 MULTI: internal route 10.0.0.0/24 -> cobes/111.222.333.444:52678
Fri Jun 12 11:39:53 2015 us=789798 cobes/111.222.333.444:52678 MULTI: Learn: 10.0.0.0/24 -> cobes/111.222.333.444:52678
Fri Jun 12 11:39:55 2015 us=84879 cobes/111.222.333.444:52678 PUSH: Received control message: 'PUSH_REQUEST'
Fri Jun 12 11:39:55 2015 us=84915 cobes/111.222.333.444:52678 send_push_reply(): safe_cap=940
Fri Jun 12 11:39:55 2015 us=84945 cobes/111.222.333.444:52678 SENT CONTROL [cobes]: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,route 10.8.0.0 255.255.255.0,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 60,ifconfig 10.8.0.8 10.8.0.1' (status=1)
Fri Jun 12 11:39:56 2015 us=918384 cobes/111.222.333.444:52678 MULTI: Learn: 10.0.0.150 -> cobes/111.222.333.444:52678

NAS-1 connecting:

Fri Jun 12 11:39:58 2015 us=885216 MULTI: multi_create_instance called
Fri Jun 12 11:39:58 2015 us=885274 123.456.789.123:1194 Re-using SSL/TLS context
Fri Jun 12 11:39:58 2015 us=885376 123.456.789.123:1194 Control Channel MTU parms [ L:1541 D:138 EF:38 EB:0 ET:0 EL:0 ]
Fri Jun 12 11:39:58 2015 us=885393 123.456.789.123:1194 Data Channel MTU parms [ L:1541 D:1450 EF:41 EB:4 ET:0 EL:0 ]
Fri Jun 12 11:39:58 2015 us=885426 123.456.789.123:1194 Local Options String: 'V4,dev-type tun,link-mtu 1541,tun-mtu 1500,proto UDPv4,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-server'
Fri Jun 12 11:39:58 2015 us=885437 123.456.789.123:1194 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1541,tun-mtu 1500,proto UDPv4,cipher BF-CBC,auth SHA1,keysize 128,key-method 2,tls-client'
Fri Jun 12 11:39:58 2015 us=885471 123.456.789.123:1194 Local Options hash (VER=V4): '239669a8'
Fri Jun 12 11:39:58 2015 us=885488 123.456.789.123:1194 Expected Remote Options hash (VER=V4): '3514370b'
Fri Jun 12 11:39:58 2015 us=885517 123.456.789.123:1194 TLS: Initial packet from [AF_INET]123.456.789.123:1194, sid=dc1ae222 c87ff780
AUTH-PAM: BACKGROUND: received command code: 0
AUTH-PAM: BACKGROUND: USER: vpn-client
AUTH-PAM: BACKGROUND: my_conv[0] query='Password: ' style=1
Fri Jun 12 11:39:59 2015 us=731298 123.456.789.123:1194 PLUGIN_CALL: POST /usr/lib/openvpn/openvpn-plugin-auth-pam.so/PLUGIN_AUTH_USER_PASS_VERIFY status=0
Fri Jun 12 11:39:59 2015 us=731363 123.456.789.123:1194 TLS: Username/Password authentication succeeded for username 'vpn-client' [CN SET]
Fri Jun 12 11:39:59 2015 us=731560 123.456.789.123:1194 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Fri Jun 12 11:39:59 2015 us=731576 123.456.789.123:1194 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Jun 12 11:39:59 2015 us=731659 123.456.789.123:1194 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Fri Jun 12 11:39:59 2015 us=731671 123.456.789.123:1194 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Jun 12 11:39:59 2015 us=778115 123.456.789.123:1194 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA
Fri Jun 12 11:39:59 2015 us=778160 123.456.789.123:1194 [vpn-client] Peer Connection Initiated with [AF_INET]123.456.789.123:1194
Fri Jun 12 11:39:59 2015 us=778207 vpn-client/123.456.789.123:1194 OPTIONS IMPORT: reading client specific options from: /etc/openvpn/ccd/vpn-client
Fri Jun 12 11:39:59 2015 us=778322 vpn-client/123.456.789.123:1194 MULTI: Learn: 10.8.0.6 -> vpn-client/123.456.789.123:1194
Fri Jun 12 11:39:59 2015 us=778338 vpn-client/123.456.789.123:1194 MULTI: primary virtual IP for vpn-client/123.456.789.123:1194: 10.8.0.6
Fri Jun 12 11:39:59 2015 us=778352 vpn-client/123.456.789.123:1194 MULTI: internal route 10.0.0.0/26 -> vpn-client/123.456.789.123:1194
Fri Jun 12 11:39:59 2015 us=778366 vpn-client/123.456.789.123:1194 MULTI: Learn: 10.0.0.0/26 -> vpn-client/123.456.789.123:1194
Fri Jun 12 11:40:01 2015 us=138288 vpn-client/123.456.789.123:1194 PUSH: Received control message: 'PUSH_REQUEST'
Fri Jun 12 11:40:01 2015 us=138319 vpn-client/123.456.789.123:1194 send_push_reply(): safe_cap=940
Fri Jun 12 11:40:01 2015 us=138349 vpn-client/123.456.789.123:1194 SENT CONTROL [vpn-client]: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,route 10.8.0.0 255.255.255.0,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 60,ifconfig 10.8.0.6 10.8.0.1' (status=1)
Fri Jun 12 11:40:03 2015 us=368343 vpn-client/123.456.789.123:1194 MULTI: Learn: 10.0.0.5 -> vpn-client/123.456.789.123:1194

NAS-2 loosing connection:

Fri Jun 12 11:42:32 2015 us=625335 cobes/111.222.333.444:52678 MULTI: Learn: 10.0.0.150 -> cobes/111.222.333.444:52678
Fri Jun 12 11:47:22 2015 us=257790 cobes/111.222.333.444:52678 MULTI: Learn: 10.0.0.150 -> cobes/111.222.333.444:52678
Fri Jun 12 11:49:40 2015 us=92239 cobes/111.222.333.444:52678 [cobes] Inactivity timeout (--ping-restart), restarting
Fri Jun 12 11:49:40 2015 us=92276 cobes/111.222.333.444:52678 SIGUSR1[soft,ping-restart] received, client-instance restarting
[code]

Even with [b]verb 6[/b] i see no additional error messages. the connection works fine, both connected clients are reachable from outside and i see read and write traffic up until the moment the "cobes" user times-out, and the tun gets closed by the server.

The server has no outside firewall, masquerading is enabled, and the required ports are forwarded to the specific clients.

[b]iptable config:[/b]
[code]
# Generated by iptables-save v1.4.21 on Wed Jan  7 00:46:46 2015
*filter
:INPUT ACCEPT [16888434:4853938074]
:FORWARD ACCEPT [575821:417910567]
:OUTPUT ACCEPT [29671385:40793296830]
COMMIT
# Completed on Wed Jan  7 00:46:46 2015
# Generated by iptables-save v1.4.21 on Wed Jan  7 00:46:46 2015
*nat
:PREROUTING ACCEPT [2729:291460]
:INPUT ACCEPT [2677:255478]
:OUTPUT ACCEPT [1880:239060]
:POSTROUTING ACCEPT [30:2720]
-A PREROUTING -d 999.888.777.666/32 -p tcp -m tcp --dport 20001 -j DNAT --to-destination 10.8.0.6:20001
-A PREROUTING -d 999.888.777.666/32 -p udp -m udp --dport 5214 -j DNAT --to-destination 10.8.0.6:5214
-A PREROUTING -d 999.888.777.666/32 -p tcp -m tcp --dport 4424 -j DNAT --to-destination 10.8.0.6:4424
-A PREROUTING -d 999.888.777.666/32 -p tcp -m tcp --dport 8753 -j DNAT --to-destination 10.8.0.6:8753
-A PREROUTING -d 999.888.777.666/32 -p tcp -m tcp --dport 22611 -j DNAT --to-destination 10.8.0.6:22611
-A PREROUTING -d 999.888.777.666/32 -p tcp -m tcp --dport 344655 -j DNAT --to-destination 10.8.0.6:344655
-A PREROUTING -d 999.888.777.666/32 -p udp -m udp --dport 346595 -j DNAT --to-destination 10.8.0.6:346595
-A PREROUTING -d 999.888.777.666/32 -p tcp -m tcp --dport 67690 -j DNAT --to-destination 10.8.0.6:67690
-A PREROUTING -d 999.888.777.666/32 -p tcp -m tcp --dport 80508 -j DNAT --to-destination 10.8.0.6:80508
-A PREROUTING -d 999.888.777.666/32 -p tcp -m tcp --dport 52001 -j DNAT --to-destination 10.8.0.8:52001
-A PREROUTING -d 999.888.777.666/32 -p tcp -m tcp --dport 4442 -j DNAT --to-destination 10.8.0.8:4442
-A PREROUTING -d 999.888.777.666/32 -p tcp -m tcp --dport 76001 -j DNAT --to-destination 10.8.0.8:76001
-A PREROUTING -d 999.888.777.666/32 -p tcp -m tcp --dport 88091 -j DNAT --to-destination 10.8.0.8:88091
-A PREROUTING -d 999.888.777.666/32 -p tcp -m tcp --dport 99601 -j DNAT --to-destination 10.8.0.8:99601
-A PREROUTING -d 999.888.777.666/32 -p tcp -m tcp --dport 90108 -j DNAT --to-destination 10.8.0.8:90108
-A POSTROUTING -o eth0 -j MASQUERADE
COMMIT

Hopefully someone can point me in the right direction on where to find a solution to my problem, as after a full 2 days of troubleshooting this, i am at the end of my ideas.

Thanks in advance!
kamaradski

Traffic

kamaradski wroteNAS-2 connecting:
Code:

Fri Jun 12 11:39:53 2015 us=737238 111.222.333.444:52678 TLS: Username/Password authentication succeeded for username 'cobes' [CN SET]

Fri Jun 12 11:39:53 2015 us=789615 cobes/111.222.333.444:52678 OPTIONS IMPORT: reading client specific options from: /etc/openvpn/ccd/cobes

Fri Jun 12 11:39:53 2015 us=789783 cobes/111.222.333.444:52678 MULTI: internal route 10.0.0.0/24 -> cobes/111.222.333.444:52678

Fri Jun 12 11:39:55 2015 us=84945 cobes/111.222.333.444:52678 SENT CONTROL [cobes]: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,route 10.8.0.0 255.255.255.0,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 60,ifconfig 10.8.0.8 10.8.0.1' (status=1)

check your CCD file called cobes and make the correct --ifconfig parameter (typically: 10.8.0.6 10.8.0.5 .. not what you have).

kamaradski wroteNAS-1 connecting:
Code:

Fri Jun 12 11:39:59 2015 us=731363 123.456.789.123:1194 TLS: Username/Password authentication succeeded for username 'vpn-client' [CN SET]

Fri Jun 12 11:39:59 2015 us=778207 vpn-client/123.456.789.123:1194 OPTIONS IMPORT: reading client specific options from: /etc/openvpn/ccd/vpn-client

Fri Jun 12 11:39:59 2015 us=778352 vpn-client/123.456.789.123:1194 MULTI: internal route 10.0.0.0/26 -> vpn-client/123.456.789.123:1194

Fri Jun 12 11:40:01 2015 us=138349 vpn-client/123.456.789.123:1194 SENT CONTROL [vpn-client]: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,route 10.8.0.0 255.255.255.0,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 60,ifconfig 10.8.0.6 10.8.0.1' (status=1)

check your CCD file called vpn-client and make the correct --ifconfig parameter (typically: 10.8.0.10 10.8.0.9 .. not what you have).

See --topology and --show-valid-subnets* (* Windows only) in The Manual v23x

Also, I am not sure exactly what OpenVPN will make of your remote networks 10.0.0.0/x but I would make those unique for proper compatibility. (eg: 10.101.1.0/24 & 10.101.2.0/24)

kamaradski

Thanks for the reply Traffic.

After posting the above, in further attempts to fix (stabilize) the situation, several things changed in my configuration:

- The ccd files no are net30 compliant.
- The internal network of vpn-client (NAS-1) has changed to 192.168.0.xxx
- Unfortunately i have no physical access anymore to the other network, and am not able to take this out of the 10.0.0.xxx range 🙁

new ccd files:

cat /etc/openvpn/ccd/vpn-client
ifconfig-push 10.8.0.49 10.8.0.50
iroute 192.168.0.0 255.255.255.0

cat /etc/openvpn/ccd/cobes 
ifconfig-push 10.8.0.149 10.8.0.150
iroute 10.0.0.0 255.255.255.0

Also the server.conf file now looks like this:

plugin /usr/lib/openvpn/openvpn-plugin-auth-pam.so login

local xxx.xxx.xxx.xxx
server 10.8.0.0 255.255.255.0
push "route 10.8.0.0 255.255.255.0"
push "redirect-gateway def1 bypass-dhcp"

proto udp
port 1194
mssfix 1300

dev tun
persist-tun
persist-key

keepalive 3 20
reneg-sec 43200
ping-timer-rem

max-clients 4
client-cert-not-required
username-as-common-name
client-to-client

#ifconfig-pool-persist ipp.txt
client-config-dir /etc/openvpn/ccd

ca /etc/openvpn/ca.crt
cert /etc/openvpn/KamaVPN.crt
key /etc/openvpn/KamaVPN.key
dh /etc/openvpn/dh2048.pem

status /var/log/openvpn-status.log
status-version 2

verb 4
log-append /var/log/openvpn.log

The client configs also reflect the same mssfix and keepalive values.

mssfix and the verly low keepalive have been added since i start to suspect suspect that one of the NAT\Gateway boxes on the [cobes] side are somehow messing up the tunnel route or blocking fragmented packages. Unfortunately the configuration of the main gateway at that location is totally out of my control.

Just as before [vpn-client] has a stable connection, but [cobes] is still experiencing the same timeout as before. Though as long as the tunnel is there, it works just fine. It's hard to understand a timeout while heaps of traffic is being pushed over the tunnel with success and the data stream is being cut-off by the restart.

In addition i will try tonight if specifically stating "topology net30" on the server side will have any positive effect on the situation.

Thanks again for the reply, much appreciated.
Kamaradski

Traffic

Please post ifconfig of your server.