OpenVPN stability issues

TodoTi

Hello All
Could anyone tell me how to get my openVPN service to restart when my WAN interface restarts. When my WAN connection restarts it seems like the openvpn service losses connectivity and wont reengage until i manually restart it.

My set up is below

My set up is a modem set to bridge mode connected to the router. The router handles the WAN, WIFI and VPN.
you'll see that there is a command in my set up file that reads: mv /etc/config/firewall /etc/config/firewall.old but this produces an error listed as : root@OpenWrt:~# mv /etc/config/firewall /etc/config/firewall.old mv: can't rename '/etc/config/firewall': Invalid argument)
So i deleted the firewall settings manually and then continued to set new ones using the commands below. I also set the DNS to openDNS.
I have tried updating the firmware to a newer one (now current) and either using or not using a DNS but this issue has remained.

The VPN set up is as follows:
cat >> /etc/config/openvpn << EOF
config openvpn 'Hide'
option dev 'tun314'
option proto 'udp'
option dev_type 'tun'
option enabled '0'
option nobind '1'
option client '1'
option reneg_sec '0'
option remote 'au-1.hide.me'
option persist_tun '1'
option persist_key '1'
option port '3478'
option verb '3'
option ca '/etc/openvpn/TrustedRoot.pem'
list auth_user_pass '/etc/openvpn/login.auth'
option cipher 'AES-128-CBC'
option reneg_sec '0'
EOF

cat >> /etc/openvpn/TrustedRoot.pem << EOF
-----BEGIN CERTIFICATE-----
security certificate withheld.
-----END CERTIFICATE-----
EOF

cat >> /etc/openvpn/login.auth << EOF
User name withheld
Password withheld
EOF
cat >> /etc/config/network << EOF
config interface 'Hide'
option proto 'none'
option ifname 'tun314'
EOF
mv /etc/config/firewall /etc/config/firewall.old (dont paste this error root@OpenWrt:~# mv /etc/config/firewall /etc/config/firewall.old mv: can't rename '/etc/config/firewall': Invalid argument)
cat >> /etc/config/firewall << EOF
config defaults
option syn_flood '1'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
config zone
option name 'lan'
option network 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
config zone
option name 'wan'
option output 'ACCEPT'
option forward 'REJECT'
option network 'wan'
option input 'ACCEPT'
config zone
option name 'hide'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
option network 'Hide'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option src_ip 'fe80::/10'
option src_port '547'
option dest_ip 'fe80::/10'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config include
option path '/etc/firewall.user'
config forwarding
option dest 'hide'
option src 'lan'
EOF

Traffic

Have you asked the OpenWRT support team ?

TodoTi

I've posted in their forums with no response. Is there a particular place i could go to ask the support team?

Traffic

TodoTi wroteWhen my WAN connection restarts it seems like the openvpn service losses connectivity

When your "WAN connection restarts" does your router get a new Internet address ?

TodoTi

the modem (bridge mode) sticks with 10.0.0.138 and the router sticks with 192.168.1.1 or do you mean gets assigned a new one by the ISP?

Traffic

TodoTi wroteor do you mean gets assigned a new one by the ISP?

^^ That ..

TodoTi

I'm not sure but the problem reoccurs frequently some times evceryfew minutes sometimes once a day or so.
Here is a copy of the log:
Sun Aug 16 13:01:02 2015 daemon.info dnsmasq-dhcp[1402]: DHCPINFORM(br-lan) 192.168.1.191 00:22:b0:be:66:2b
Sun Aug 16 13:01:02 2015 daemon.info dnsmasq-dhcp[1402]: DHCPACK(br-lan) 192.168.1.191 00:22:b0:be:66:2b Tim-PC
Sun Aug 16 13:01:51 2015 daemon.info hostapd: wlan0: STA 00:22:b0:be:66:2b WPA: group key handshake completed (RSN)
Sun Aug 16 13:01:51 2015 daemon.info hostapd: wlan0: STA 1c:65:9d:be:fd:24 WPA: group key handshake completed (RSN)
Sun Aug 16 13:01:51 2015 daemon.info hostapd: wlan0: STA 14:32:d1:b9:0d:4a WPA: group key handshake completed (RSN)
Sun Aug 16 13:01:51 2015 daemon.info hostapd: wlan0: STA 1c:7b:21:8f:96:42 WPA: group key handshake completed (RSN)
Sun Aug 16 13:01:51 2015 daemon.info hostapd: wlan0: STA 60:21:c0:07:0c:1d WPA: group key handshake completed (RSN)
Sun Aug 16 13:03:32 2015 daemon.notice openvpn(Hide)[1633]: [*.hide.me] Inactivity timeout (--ping-restart), restarting
Sun Aug 16 13:03:32 2015 daemon.notice openvpn(Hide)[1633]: SIGUSR1[soft,ping-restart] received, process restarting
Sun Aug 16 13:03:32 2015 daemon.notice openvpn(Hide)[1633]: Restart pause, 2 second(s)
Sun Aug 16 13:03:34 2015 daemon.warn openvpn(Hide)[1633]: WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Sun Aug 16 13:03:34 2015 daemon.notice openvpn(Hide)[1633]: Socket Buffers: R=[163840->131072] S=[163840->131072]
Sun Aug 16 13:03:49 2015 daemon.err openvpn(Hide)[1633]: RESOLVE: Cannot resolve host address: au-1.hide.me: Name or service not known
Sun Aug 16 13:04:04 2015 daemon.err openvpn(Hide)[1633]: RESOLVE: Cannot resolve host address: au-1.hide.me: Name or service not known

thanks for the assistance this has been really annoying me.

Traffic

You did not answer this:

Traffic wroteTodoTi wrote:
or do you mean gets assigned a new one by the ISP?
^^ That ..

Does your internet IP address change ?