OpenVPN connects and works for only a few seconds

smashedpumpkins

I'm new with setting up OpenVPN so I apologize for novice questions but but I'm a bit stumped. I setup OpenVPN on my Raspberry Pi B+ using the following tutorial.
http://www.bbc.com/news/technology-33548728

I can connect from my laptop using a hotspot but the connection only lasts 5 to 10 seconds. I ran a ping while connecting and on average only 5 to 10 requests make it through before it times out again. In that brief time I've successfully SSH into the Pi as well as full internet access. I read numerous threads of others with issues but none of their answers seemed to help.

Thank you!

Server config

local 192.168.46.50 # SWAP THIS NUMBER WITH YOUR RASPBERRY PI IP ADDRESS
dev tun
proto udp
port 1194
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/RaspVPN.crt # SWAP XX WITH YOUR SERVER NAME
key /etc/openvpn/easy-rsa/keys/RaspVPN.key # SWAP XX WITH YOUR SERVER NAME
dh /etc/openvpn/easy-rsa/keys/dh2048.pem # IF YOU CHANGED YOUR ENCRYPTION TO 2048, CHANGE THAT HERE
server 10.8.0.0 255.255.255.0
# server and remote endpoints
ifconfig 10.8.0.1 10.8.0.2
# Add route to Client routing table for the OpenVPN Server
push "route 10.8.0.1 255.255.255.255"
# Add route to Client routing table for the OpenVPN Subnet
push "route 10.8.0.0 255.255.255.0"
# your local subnet
push "route 192.168.46.0 255.255.255.0" # SWAP THE IP NUMBER WITH YOUR RASPBERRY PI IP ADDRESS
# Set primary domain name server address to the SOHO Router
# If your router does not do DNS, you can use Google DNS 8.8.8.8
push "dhcp-option DNS 8.8.8.8" # THIS SHOULD ALREADY MATCH YOUR OWN ROUTER ADDRESS AND SHOULD NOT NEED TO BE C$
# Override the Client default gateway by using 0.0.0.0/1 and
# 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of
# overriding but not wiping out the original default gateway.
push "redirect-gateway def1"
client-to-client
duplicate-cn
keepalive 10 120
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
cipher AES-128-CBC
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status /var/log/openvpn-status.log 20
log /var/log/openvpn.log
verb 1

OpenVPN Logs

Sun Sep 27 21:51:27 2015 OpenVPN 2.3.8 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Aug  4 2015
Sun Sep 27 21:51:27 2015 library versions: OpenSSL 1.0.1p 9 Jul 2015, LZO 2.08
Sun Sep 27 21:51:32 2015 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Sun Sep 27 21:51:32 2015 Control Channel Authentication: tls-auth using INLINE static key file
Sun Sep 27 21:51:32 2015 UDPv4 link local: [undef]
Sun Sep 27 21:51:32 2015 UDPv4 link remote: [AF_INET]73.41.163.22:1194
Sun Sep 27 21:51:34 2015 [RaspVPN] Peer Connection Initiated with [AF_INET]73.41.163.22:1194
Sun Sep 27 21:51:36 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Sun Sep 27 21:51:36 2015 open_tun, tt->ipv6=0
Sun Sep 27 21:51:36 2015 TAP-WIN32 device [Ethernet 2] opened: \\.\Global\{6DA298FB-906C-4582-94B2-C78869EB5FCC}.tap
Sun Sep 27 21:51:36 2015 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.6/255.255.255.252 on interface {6DA298FB-906C-4582-94B2-C78869EB5FCC} [DHCP-serv: 10.8.0.5, lease-time: 31536000]
Sun Sep 27 21:51:36 2015 Successful ARP Flush on interface [15] {6DA298FB-906C-4582-94B2-C78869EB5FCC}
Sun Sep 27 21:51:41 2015 ROUTE: route addition failed using CreateIpForwardEntry: The object already exists.   [status=5010 if_index=15]
Sun Sep 27 21:51:41 2015 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Sun Sep 27 21:51:41 2015 Initialization Sequence Completed

maikcat

for start use verb 4 and repost logs.

Michael.

smashedpumpkins

maikcat wrotefor start use verb 4 and repost logs.

Michael.

Thanks Michael. I changed the server conf to verb 4 and rebooted though the logs didn't much change.

Sun Sep 27 22:42:53 2015 OpenVPN 2.3.8 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Aug  4 2015
Sun Sep 27 22:42:53 2015 library versions: OpenSSL 1.0.1p 9 Jul 2015, LZO 2.08
Sun Sep 27 22:42:58 2015 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Sun Sep 27 22:42:58 2015 Control Channel Authentication: tls-auth using INLINE static key file
Sun Sep 27 22:42:58 2015 UDPv4 link local: [undef]
Sun Sep 27 22:42:58 2015 UDPv4 link remote: [AF_INET]73.41.163.22:1194
Sun Sep 27 22:43:00 2015 [RaspVPN] Peer Connection Initiated with [AF_INET]73.41.163.22:1194
Sun Sep 27 22:43:02 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Sun Sep 27 22:43:02 2015 open_tun, tt->ipv6=0
Sun Sep 27 22:43:02 2015 TAP-WIN32 device [Ethernet 2] opened: \\.\Global\{6DA298FB-906C-4582-94B2-C78869EB5FCC}.tap
Sun Sep 27 22:43:02 2015 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.10/255.255.255.252 on interface {6DA298FB-906C-4582-94B2-C78869EB5FCC} [DHCP-serv: 10.8.0.9, lease-time: 31536000]
Sun Sep 27 22:43:02 2015 Successful ARP Flush on interface [15] {6DA298FB-906C-4582-94B2-C78869EB5FCC}
Sun Sep 27 22:43:07 2015 ROUTE: route addition failed using CreateIpForwardEntry: The object already exists.   [status=5010 if_index=15]
Sun Sep 27 22:43:07 2015 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Sun Sep 27 22:43:07 2015 Initialization Sequence Completed

maikcat

which config did you edited?server or client?

Michael.

Traffic

maikcat wrotewhich config did you edited?server or client?

smashedpumpkins wroteThanks Michael. I changed the server conf to verb 4 and rebooted

Your Laptop client config and log (at --verb 4) will help.

These items are redundant and should be removed from your server config:

smashedpumpkins wrote# server and remote endpoints
ifconfig 10.8.0.1 10.8.0.2
# Add route to Client routing table for the OpenVPN Server
push "route 10.8.0.1 255.255.255.255"
# Add route to Client routing table for the OpenVPN Subnet
push "route 10.8.0.0 255.255.255.0"

smashedpumpkins

Traffic wrote
maikcat wrotewhich config did you edited?server or client?
smashedpumpkins wroteThanks Michael. I changed the server conf to verb 4 and rebooted
Your Laptop client config and log (at --verb 4) will help.

These items are redundant and should be removed from your server config:
smashedpumpkins wrote# server and remote endpoints
ifconfig 10.8.0.1 10.8.0.2
# Add route to Client routing table for the OpenVPN Server
push "route 10.8.0.1 255.255.255.255"
# Add route to Client routing table for the OpenVPN Subnet
push "route 10.8.0.0 255.255.255.0"

Silly me, you're right I updated the server config file. I've now updated the client config to verb 4 as well. I noticed my Verizon 4g hotspot connection was a bit choppy before so I held off replying until it was better. Well today it's smooth but my VPN connection still drops. (Though not perfect, it losses a ping to 8.8.8.8 ever 50 or so packets) I also removed the extra route configurations.

Tue Sep 29 16:06:40 2015 Current Parameter Settings:
Tue Sep 29 16:06:40 2015   config = 'Laptop.ovpn'
Tue Sep 29 16:06:40 2015   mode = 0
Tue Sep 29 16:06:40 2015   show_ciphers = DISABLED
Tue Sep 29 16:06:40 2015   show_digests = DISABLED
Tue Sep 29 16:06:40 2015   show_engines = DISABLED
Tue Sep 29 16:06:40 2015   genkey = DISABLED
Tue Sep 29 16:06:40 2015   key_pass_file = '[UNDEF]'
Tue Sep 29 16:06:40 2015   show_tls_ciphers = DISABLED
Tue Sep 29 16:06:40 2015 Connection profiles [default]:
Tue Sep 29 16:06:40 2015   proto = udp
Tue Sep 29 16:06:40 2015   local = '[UNDEF]'
Tue Sep 29 16:06:40 2015   local_port = 0
Tue Sep 29 16:06:40 2015   remote = 'domain.dynamic-dns.net'
Tue Sep 29 16:06:40 2015   remote_port = 1194
Tue Sep 29 16:06:40 2015   remote_float = DISABLED
Tue Sep 29 16:06:40 2015   bind_defined = DISABLED
Tue Sep 29 16:06:40 2015   bind_local = DISABLED
Tue Sep 29 16:06:40 2015   connect_retry_seconds = 5
Tue Sep 29 16:06:40 2015   connect_timeout = 10
Tue Sep 29 16:06:40 2015 NOTE: --mute triggered...
Tue Sep 29 16:06:40 2015 265 variation(s) on previous 20 message(s) suppressed by --mute
Tue Sep 29 16:06:40 2015 OpenVPN 2.3.8 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Aug  4 2015
Tue Sep 29 16:06:40 2015 library versions: OpenSSL 1.0.1p 9 Jul 2015, LZO 2.08
Tue Sep 29 16:06:40 2015 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Tue Sep 29 16:06:40 2015 Need hold release from management interface, waiting...
Tue Sep 29 16:06:41 2015 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Tue Sep 29 16:06:41 2015 MANAGEMENT: CMD 'state on'
Tue Sep 29 16:06:41 2015 MANAGEMENT: CMD 'log all on'
Tue Sep 29 16:06:41 2015 MANAGEMENT: CMD 'hold off'
Tue Sep 29 16:06:41 2015 MANAGEMENT: CMD 'hold release'
Tue Sep 29 16:06:45 2015 MANAGEMENT: CMD 'password [...]'
Tue Sep 29 16:06:45 2015 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Tue Sep 29 16:06:45 2015 Control Channel Authentication: tls-auth using INLINE static key file
Tue Sep 29 16:06:45 2015 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Sep 29 16:06:45 2015 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Sep 29 16:06:45 2015 LZO compression initialized
Tue Sep 29 16:06:45 2015 Control Channel MTU parms [ L:1558 D:166 EF:66 EB:0 ET:0 EL:3 ]
Tue Sep 29 16:06:45 2015 Socket Buffers: R=[65536->65536] S=[65536->65536]
Tue Sep 29 16:06:45 2015 MANAGEMENT: >STATE:1443568005,RESOLVE,,,
Tue Sep 29 16:06:45 2015 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:143 ET:0 EL:3 AF:3/1 ]
Tue Sep 29 16:06:45 2015 Local Options String: 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher AES-128-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-client'
Tue Sep 29 16:06:45 2015 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1558,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 0,cipher AES-128-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-server'
Tue Sep 29 16:06:45 2015 Local Options hash (VER=V4): '272f1b58'
Tue Sep 29 16:06:45 2015 Expected Remote Options hash (VER=V4): 'a2e63101'
Tue Sep 29 16:06:45 2015 UDPv4 link local: [undef]
Tue Sep 29 16:06:45 2015 UDPv4 link remote: [AF_INET]73.41.163.22:1194
Tue Sep 29 16:06:45 2015 MANAGEMENT: >STATE:1443568005,WAIT,,,
Tue Sep 29 16:06:45 2015 MANAGEMENT: >STATE:1443568005,AUTH,,,
Tue Sep 29 16:06:45 2015 TLS: Initial packet from [AF_INET]73.41.163.22:1194, sid=88bdccb3 be2586d8
Tue Sep 29 16:06:46 2015 VERIFY OK: depth=1, C=US, ST=CA, L=City, O=Org, OU=IT, CN=VPN, name=VPN, emailAddress=support@org.com
Tue Sep 29 16:06:46 2015 VERIFY OK: nsCertType=SERVER
Tue Sep 29 16:06:46 2015 VERIFY OK: depth=0, C=US, ST=CA, L=Tracy, O=Org, OU=IT, CN=RaspVPN, name=VPN, emailAddress=support@org.com
Tue Sep 29 16:06:47 2015 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Tue Sep 29 16:06:47 2015 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Sep 29 16:06:47 2015 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Tue Sep 29 16:06:47 2015 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Tue Sep 29 16:06:47 2015 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Tue Sep 29 16:06:47 2015 [RaspVPN] Peer Connection Initiated with [AF_INET]73.41.163.22:1194
Tue Sep 29 16:06:48 2015 MANAGEMENT: >STATE:1443568008,GET_CONFIG,,,
Tue Sep 29 16:06:49 2015 SENT CONTROL [RaspVPN]: 'PUSH_REQUEST' (status=1)
Tue Sep 29 16:06:49 2015 PUSH: Received control message: 'PUSH_REPLY,route 192.168.46.0 255.255.255.0,dhcp-option DNS 8.8.8.8,redirect-gateway def1,route 10.8.0.0 255.255.255.0,topology net30,ping 10,ping-restart 120,ifconfig 10.8.0.6 10.8.0.5'
Tue Sep 29 16:06:49 2015 OPTIONS IMPORT: timers and/or timeouts modified
Tue Sep 29 16:06:49 2015 OPTIONS IMPORT: --ifconfig/up options modified
Tue Sep 29 16:06:49 2015 OPTIONS IMPORT: route options modified
Tue Sep 29 16:06:49 2015 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Tue Sep 29 16:06:49 2015 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Tue Sep 29 16:06:49 2015 MANAGEMENT: >STATE:1443568009,ASSIGN_IP,,10.8.0.6,
Tue Sep 29 16:06:49 2015 open_tun, tt->ipv6=0
Tue Sep 29 16:06:49 2015 TAP-WIN32 device [Ethernet 2] opened: \\.\Global\{6DA298FB-906C-4582-94B2-C78869EB5FCC}.tap
Tue Sep 29 16:06:49 2015 TAP-Windows Driver Version 9.21 
Tue Sep 29 16:06:49 2015 TAP-Windows MTU=1500
Tue Sep 29 16:06:49 2015 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.0.6/255.255.255.252 on interface {6DA298FB-906C-4582-94B2-C78869EB5FCC} [DHCP-serv: 10.8.0.5, lease-time: 31536000]
Tue Sep 29 16:06:49 2015 DHCP option string: 06040808 0808
Tue Sep 29 16:06:49 2015 Successful ARP Flush on interface [15] {6DA298FB-906C-4582-94B2-C78869EB5FCC}
Tue Sep 29 16:06:54 2015 TEST ROUTES: 3/3 succeeded len=2 ret=1 a=0 u/d=up
Tue Sep 29 16:06:54 2015 C:\Windows\system32\route.exe ADD 73.41.163.22 MASK 255.255.255.255 192.168.43.1
Tue Sep 29 16:06:54 2015 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=25 and dwForwardType=4
Tue Sep 29 16:06:54 2015 Route addition via IPAPI succeeded [adaptive]
Tue Sep 29 16:06:54 2015 C:\Windows\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 10.8.0.5
Tue Sep 29 16:06:54 2015 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Tue Sep 29 16:06:54 2015 Route addition via IPAPI succeeded [adaptive]
Tue Sep 29 16:06:54 2015 C:\Windows\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 10.8.0.5
Tue Sep 29 16:06:54 2015 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Tue Sep 29 16:06:54 2015 Route addition via IPAPI succeeded [adaptive]
Tue Sep 29 16:06:54 2015 MANAGEMENT: >STATE:1443568014,ADD_ROUTES,,,
Tue Sep 29 16:06:54 2015 C:\Windows\system32\route.exe ADD 192.168.46.0 MASK 255.255.255.0 10.8.0.5
Tue Sep 29 16:06:54 2015 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Tue Sep 29 16:06:54 2015 Route addition via IPAPI succeeded [adaptive]
Tue Sep 29 16:06:54 2015 C:\Windows\system32\route.exe ADD 10.8.0.0 MASK 255.255.255.0 10.8.0.5
Tue Sep 29 16:06:54 2015 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=20 and dwForwardType=4
Tue Sep 29 16:06:54 2015 Route addition via IPAPI succeeded [adaptive]
Tue Sep 29 16:06:54 2015 Initialization Sequence Completed
Tue Sep 29 16:06:54 2015 MANAGEMENT: >STATE:1443568014,CONNECTED,SUCCESS,10.8.0.6,73.41.163.22

It's also worth noting that after a minute or so OpenVPN reconnects automatically.

Tue Sep 29 16:09:26 2015 [RaspVPN] Inactivity timeout (--ping-restart), restarting
Tue Sep 29 16:09:26 2015 TCP/UDP: Closing socket
Tue Sep 29 16:09:26 2015 SIGUSR1[soft,ping-restart] received, process restarting
Tue Sep 29 16:09:26 2015 MANAGEMENT: >STATE:1443568166,RECONNECTING,ping-restart,,
Tue Sep 29 16:09:26 2015 Restart pause, 2 second(s)
Tue Sep 29 16:09:28 2015 Re-using SSL/TLS context
Tue Sep 29 16:09:28 2015 LZO compression initialized
Tue Sep 29 16:09:28 2015 Control Channel MTU parms [ L:1558 D:166 EF:66 EB:0 ET:0 EL:3 ]
Tue Sep 29 16:09:28 2015 Socket Buffers: R=[65536->65536] S=[65536->65536]
Tue Sep 29 16:09:28 2015 MANAGEMENT: >STATE:1443568168,RESOLVE,,,

Traffic

smashedpumpkins wroteWell today it's smooth but my VPN connection still drops. (Though not perfect, it losses a ping to 8.8.8.8 ever 50 or so packets)

smashedpumpkins wroteIt's also worth noting that after a minute or so OpenVPN reconnects automatically.
Code:
Tue Sep 29 16:09:26 2015 [RaspVPN] Inactivity timeout (--ping-restart), restarting

smashedpumpkins wroteI noticed my Verizon 4g hotspot connection was a bit choppy before so I held off replying until it was better

These all sound related.

Try using --proto tcp for testing ... see if reliability improves.