Hello everyone! Need some help with this so far weird issue here. I have an OpenVPN server on a pfsense box and a few remote users behind NAT. When connecting from the wired network everything works as expected, the problem arises when I connect from the wireless network. In the latter case, you would see logs like the following repeating over and over on my client: [code]2016-01-18 12:54:53 us=653826 UDPv4 READ [142] from [AF_INET]x.x.x.x:1197: P_CONTROL_V1 kid=0 sid=b325b4dd ff5a7ff7 tls_hmac=f9b32a6b 51cd70b0 02115739 e4274865 a672c2c1 pid=[ #15 / time = (1453150478) Mon Jan 18 12:54:38 2016 ] [ ] pid=12 DATA 65724341 2e637274 300c0603 551d1301 01ff0402 3000300d 06092a86 4886f70[more...] 2016-01-18 12:54:53 us=654202 event_wait returned 1 2016-01-18 12:54:53 us=656100 UDPv4 WRITE [50] to [AF_INET]x.x.x.x1197: P_ACK_V1 kid=0 sid=dfaed92a 164fba2d tls_hmac=8380fc7b 187f00cf 80deffce 0f9ba423 90013b7d pid=[ #17 / time = (1453150493) Mon Jan 18 12:54:53 2016 ] [ 12 sid=b325b4dd ff5a7ff7 ] 2016-01-18 12:54:53 us=656510 UDPv4 write returned 50 2016-01-18 12:54:53 us=657474 event_wait returned 1 2016-01-18 12:54:53 us=658530 UDPv4 read returned 142 2016-01-18 12:54:53 us=660506 UDPv4 READ [142] from [AF_INET]x.x.x.x:1197: P_CONTROL_V1 kid=0 sid=b325b4dd ff5a7ff7 tls_hmac=09b6a510 5fb5adc1 851e02d4 80e39ff9 890273c5 pid=[ #16 / time = (1453150478) Mon Jan 18 12:54:38 2016 ] [ ] pid=13 DATA 13447fd6 b500c448 e412b63f 401f5d53 f6ef438b 494c7ecc 6e9415ab 1647695[more...] 2016-01-18 12:54:53 us=660885 event_wait returned 1 2016-01-18 12:54:53 us=662804 UDPv4 WRITE [50] to [AF_INET]x.x.x.x:1197: P_ACK_V1 kid=0 sid=dfaed92a 164fba2d tls_hmac=3ffb7732 cf16d579 af50d176 e19ab358 ac0312d7 pid=[ #18 / time = (1453150493) Mon Jan 18 12:54:53 2016 ] [ 13 sid=b325b4dd ff5a7ff7 ] 2016-01-18 12:54:53 us=663120 UDPv4 write returned 50 2016-01-18 12:54:53 us=664168 event_wait returned 1 2016-01-18 12:54:53 us=665316 UDPv4 read returned 142[/code] This part usually appears before -- but only once: [code]2016-01-18 12:54:58 us=829560 UDPv4 READ [142] from [AF_INET]xxxxxxx:1197: P_CONTROL_V1 kid=0 sid=b325b4dd ff5a7ff7 tls_hmac=d90bf0fb eb3661a3 25a5b6c9 3e66d0be ee0bfd9c pid=[ #40 / time = (1453150478) Mon Jan 18 12:54:38 2016 ] [ ] pid=36 DATA 45bf50b9 a9f3eb98 0112adc8 88c69834 5f8d0a3c c6e9d595 956dde16 0301030[more...] 2016-01-18 12:54:58 us=831138 VERIFY OK: depth=2,some info here (CA DN) 2016-01-18 12:54:58 us=831820 VERIFY OK: depth=1,some info here (CA DN) 2016-01-18 12:54:58 us=832428 VERIFY X509NAME OK: some info here (certificate DN) 2016-01-18 12:54:58 us=832715 VERIFY OK: depth=0, some info here (certificate DN) [/code] I've performed packet captures on both the server and the client when this happens and the server is getting the packets without issues, just as when I connect from the wired network. There are no NAT problems as far as I can tell on the client side, translation entries seems to be the same as the IP subnet assigned to clients is the same on both wired and wireless (APs act as a simple gateway, they dont hand out IPs or perform any kind of traffic shaping, firewalling ,etc) The thing is that this problem seems to appear only from time to time, I can see no correlation with an actual wifi event (like high channel utilization etc) . There is no congestion or loss on the wireless channel that I can see (Meraki has very nice stats on this). And in any case I do see the packets getting to the server every single time. Client Config file: [code]dev tun persist-tun persist-key cipher AES-128-CBC auth SHA1 tls-client client resolv-retry infinite verb 11 lport 0 verify-x509-name "myserver.net" name auth-user-pass remote myserver.net 1197 udp pkcs12 Certificates.p12 [Security-related line(s) omitted] [Security-related line(s) omitted] key-direction 1[/code] Server config file [code]dev ovpns1 verb 1 dev-type tun tun-ipv6 dev-node /dev/tun1 writepid /var/run/openvpn_server1.pid script-security 3 daemon keepalive 10 60 ping-timer-rem persist-tun persist-key proto udp cipher AES-128-CBC auth SHA1 up /usr/local/sbin/ovpn-linkup down /usr/local/sbin/ovpn-linkdown local local_ip_xxxxx engine cryptodev tls-server server xxxxxxxxxx server-ipv6 yyyyyyy/64 client-config-dir /var/etc/openvpn-csc username-as-common-name auth-user-pass-verify "/usr/local/sbin/ovpn_auth_verify user 'XXXX' true xxxxx" via-env tls-verify "/usr/local/sbin/ovpn_auth_verify tls 'myserver.net' 2 " lport 1197 management /var/etc/openvpn/server1.sock unix push "route xxxxxxxxx" push "route xxxxxxxx" push "route xxxxxxx" ca file.ca cert file.cert key file.key dh dh-parameters.2048 crl-verify /var/etc/openvpn/server1.crl-verify tls-auth /var/etc/openvpn/server1.tls-auth 0 topology subnet inactive 43200 push "inactive 43200" push "dhcp-option DOMAIN-SEARCH domain.net" [/code] Server version: [code]/usr/local/sbin/openvpn --version OpenVPN 2.3.7 amd64-portbld-freebsd10.1 [SSL (OpenSSL)] [LZO] [MH] [IPv6] built on Jun 19 2015 library versions: OpenSSL 1.0.1l-freebsd 15 Jan 2015, LZO 2.09 Originally developed by James Yonan Copyright (C) 2002-2010 OpenVPN Technologies, Inc. Compile time defines: enable_crypto=yes enable_crypto_ofb_cfb=yes enable_debug=yes enable_def_auth=yes enable_dlopen=unknown enable_dlopen_self=unknown enable_dlopen_self_static=unknown enable_fast_install=needless enable_fragment=yes enable_http_proxy=yes enable_iproute2=no enable_libtool_lock=yes enable_lzo=yes enable_lzo_stub=no enable_management=yes enable_multi=yes enable_multihome=yes enable_pam_dlopen=no enable_password_save=yes enable_pedantic=no enable_pf=yes enable_pkcs11=no enable_plugin_auth_pam=yes enable_plugin_down_root=yes enable_plugins=yes enable_port_share=yes enable_selinux=no enable_server=yes enable_shared=yes enable_shared_with_static_runtimes=no enable_small=no enable_socks=yes enable_ssl=yes enable_static=yes enable_strict=no enable_strict_options=no enable_systemd=no enable_win32_dll=yes enable_x509_alt_username=no with_crypto_library=openssl with_gnu_ld=yes with_mem_check=no with_plugindir='$(libdir)/openvpn/plugins' with_sysroot=no[/code] Client version [code]OpenVPN 2.3.6 x86_64-apple-darwin [SSL (OpenSSL)] [LZO] [PKCS11] [MH] [IPv6] built on Dec 4 2015 library versions: OpenSSL 1.0.1q 3 Dec 2015, LZO 2.08 Originally developed by James Yonan Copyright (C) 2002-2010 OpenVPN Technologies, Inc. Compile time defines: enable_crypto=yes enable_crypto_ofb_cfb=yes enable_debug=no enable_def_auth=yes enable_dependency_tracking=no enable_dlopen=unknown enable_dlopen_self=unknown enable_dlopen_self_static=unknown enable_fast_install=needless enable_fragment=yes enable_http_proxy=yes enable_iproute2=no enable_libtool_lock=yes enable_lzo=yes enable_lzo_stub=no enable_management=yes enable_multi=yes enable_multihome=yes enable_pam_dlopen=no enable_password_save=no enable_pedantic=no enable_pf=yes enable_pkcs11=yes enable_plugin_auth_pam=no enable_plugin_down_root=yes enable_plugins=yes enable_port_share=yes enable_selinux=no enable_server=yes enable_shared=yes enable_shared_with_static_runtimes=no enable_small=no enable_socks=yes enable_ssl=yes enable_static=yes enable_strict=no enable_strict_options=no enable_systemd=no enable_win32_dll=yes enable_x509_alt_username=no with_crypto_library=openssl with_gnu_ld=no with_mem_check=no with_plugindir='$(libdir)/openvpn/plugins' with_sysroot=no[/code] Any ideas? Thanks!

[quote="vila"]weird issue here[/quote][quote="vila"]the problem arises when I connect from the wireless network[/quote][quote="vila"]see logs like the following repeating over and over on my client:[/quote][quote="vila"][code]Random log snippet ..[/code][/quote][quote="vila"]Client Config file: Code: verb 11[/quote]See [b]--verb[/b] in [url=https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage]The Manual v23x[/url]

[quote="vila"]In what way will -verb 6 work?[/quote]who said --[b]verb 6[/b] ? Try --[b]verb 4[/b] ..

P_ACK_V1 and P_CONTROL_V1 loop question

[deleted]

Hello everyone!

Need some help with this so far weird issue here.

I have an OpenVPN server on a pfsense box and a few remote users behind NAT. When connecting from the wired network everything works as expected, the problem arises when I connect
from the wireless network. In the latter case, you would see logs like the following repeating over and over on my client:

2016-01-18 12:54:53 us=653826 UDPv4 READ [142] from [AF_INET]x.x.x.x:1197: P_CONTROL_V1 kid=0 sid=b325b4dd ff5a7ff7 tls_hmac=f9b32a6b 51cd70b0 02115739 e4274865 a672c2c1 pid=[ #15 / time = (1453150478) Mon Jan 18 12:54:38 2016 ] [ ] pid=12 DATA 65724341 2e637274 300c0603 551d1301 01ff0402 3000300d 06092a86 4886f70[more...]
2016-01-18 12:54:53 us=654202  event_wait returned 1
2016-01-18 12:54:53 us=656100 UDPv4 WRITE [50] to [AF_INET]x.x.x.x1197: P_ACK_V1 kid=0 sid=dfaed92a 164fba2d tls_hmac=8380fc7b 187f00cf 80deffce 0f9ba423 90013b7d pid=[ #17 / time = (1453150493) Mon Jan 18 12:54:53 2016 ] [ 12 sid=b325b4dd ff5a7ff7 ]
2016-01-18 12:54:53 us=656510 UDPv4 write returned 50
2016-01-18 12:54:53 us=657474  event_wait returned 1
2016-01-18 12:54:53 us=658530 UDPv4 read returned 142
2016-01-18 12:54:53 us=660506 UDPv4 READ [142] from [AF_INET]x.x.x.x:1197: P_CONTROL_V1 kid=0 sid=b325b4dd ff5a7ff7 tls_hmac=09b6a510 5fb5adc1 851e02d4 80e39ff9 890273c5 pid=[ #16 / time = (1453150478) Mon Jan 18 12:54:38 2016 ] [ ] pid=13 DATA 13447fd6 b500c448 e412b63f 401f5d53 f6ef438b 494c7ecc 6e9415ab 1647695[more...]
2016-01-18 12:54:53 us=660885  event_wait returned 1
2016-01-18 12:54:53 us=662804 UDPv4 WRITE [50] to [AF_INET]x.x.x.x:1197: P_ACK_V1 kid=0 sid=dfaed92a 164fba2d tls_hmac=3ffb7732 cf16d579 af50d176 e19ab358 ac0312d7 pid=[ #18 / time = (1453150493) Mon Jan 18 12:54:53 2016 ] [ 13 sid=b325b4dd ff5a7ff7 ]
2016-01-18 12:54:53 us=663120 UDPv4 write returned 50
2016-01-18 12:54:53 us=664168  event_wait returned 1
2016-01-18 12:54:53 us=665316 UDPv4 read returned 142

This part usually appears before -- but only once:

2016-01-18 12:54:58 us=829560 UDPv4 READ [142] from [AF_INET]xxxxxxx:1197: P_CONTROL_V1 kid=0 sid=b325b4dd ff5a7ff7 tls_hmac=d90bf0fb eb3661a3 25a5b6c9 3e66d0be ee0bfd9c pid=[ #40 / time = (1453150478) Mon Jan 18 12:54:38 2016 ] [ ] pid=36 DATA 45bf50b9 a9f3eb98 0112adc8 88c69834 5f8d0a3c c6e9d595 956dde16 0301030[more...]
2016-01-18 12:54:58 us=831138 VERIFY OK: depth=2,some info here (CA DN)
2016-01-18 12:54:58 us=831820 VERIFY OK: depth=1,some info here (CA DN)
2016-01-18 12:54:58 us=832428 VERIFY X509NAME OK: some info here (certificate DN)
2016-01-18 12:54:58 us=832715 VERIFY OK: depth=0, some info here (certificate DN)

I've performed packet captures on both the server and the client when this happens and the server is getting the packets without issues, just as when I connect from the wired network.
There are no NAT problems as far as I can tell on the client side, translation entries seems to be the same as the IP subnet assigned to clients is the same on both wired and wireless (APs act as a simple gateway, they dont hand out IPs or perform any kind of traffic shaping, firewalling ,etc)

The thing is that this problem seems to appear only from time to time, I can see no correlation with an actual wifi event (like high channel utilization etc)
. There is no congestion or loss on the wireless channel that I can see (Meraki has very nice stats on this). And in any case I do see the packets getting to the server every single time.

Client Config file:

dev tun
persist-tun
persist-key
cipher AES-128-CBC
auth SHA1
tls-client
client
resolv-retry infinite
verb 11
lport 0
verify-x509-name "myserver.net" name
auth-user-pass
remote myserver.net 1197 udp
pkcs12 Certificates.p12
<ca>
[Security-related line(s) omitted]
</ca>
<tls-auth>
[Security-related line(s) omitted]
</tls-auth>
key-direction 1

Server config file

dev ovpns1
verb 1
dev-type tun
tun-ipv6
dev-node /dev/tun1
writepid /var/run/openvpn_server1.pid
script-security 3
daemon
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
proto udp
cipher AES-128-CBC
auth SHA1
up /usr/local/sbin/ovpn-linkup
down /usr/local/sbin/ovpn-linkdown
local local_ip_xxxxx
engine cryptodev
tls-server
server xxxxxxxxxx
server-ipv6 yyyyyyy/64
client-config-dir /var/etc/openvpn-csc
username-as-common-name
auth-user-pass-verify "/usr/local/sbin/ovpn_auth_verify user 'XXXX' true xxxxx" via-env
tls-verify "/usr/local/sbin/ovpn_auth_verify tls 'myserver.net' 2 "
lport 1197
management /var/etc/openvpn/server1.sock unix
push "route xxxxxxxxx"
push "route xxxxxxxx"
push "route xxxxxxx"

ca file.ca
cert file.cert 
key file.key 
dh dh-parameters.2048
crl-verify /var/etc/openvpn/server1.crl-verify 
tls-auth /var/etc/openvpn/server1.tls-auth 0
topology subnet
inactive 43200
 push "inactive 43200"
 push "dhcp-option DOMAIN-SEARCH domain.net"

Server version:

/usr/local/sbin/openvpn --version
OpenVPN 2.3.7 amd64-portbld-freebsd10.1 [SSL (OpenSSL)] [LZO] [MH] [IPv6] built on Jun 19 2015
library versions: OpenSSL 1.0.1l-freebsd 15 Jan 2015, LZO 2.09
Originally developed by James Yonan
Copyright (C) 2002-2010 OpenVPN Technologies, Inc. <sales@openvpn.net>
Compile time defines: enable_crypto=yes enable_crypto_ofb_cfb=yes enable_debug=yes enable_def_auth=yes enable_dlopen=unknown enable_dlopen_self=unknown enable_dlopen_self_static=unknown enable_fast_install=needless enable_fragment=yes enable_http_proxy=yes enable_iproute2=no enable_libtool_lock=yes enable_lzo=yes enable_lzo_stub=no enable_management=yes enable_multi=yes enable_multihome=yes enable_pam_dlopen=no enable_password_save=yes enable_pedantic=no enable_pf=yes enable_pkcs11=no enable_plugin_auth_pam=yes enable_plugin_down_root=yes enable_plugins=yes enable_port_share=yes enable_selinux=no enable_server=yes enable_shared=yes enable_shared_with_static_runtimes=no enable_small=no enable_socks=yes enable_ssl=yes enable_static=yes enable_strict=no enable_strict_options=no enable_systemd=no enable_win32_dll=yes enable_x509_alt_username=no with_crypto_library=openssl with_gnu_ld=yes with_mem_check=no with_plugindir='$(libdir)/openvpn/plugins' with_sysroot=no

Client version

OpenVPN 2.3.6 x86_64-apple-darwin [SSL (OpenSSL)] [LZO] [PKCS11] [MH] [IPv6] built on Dec  4 2015
library versions: OpenSSL 1.0.1q 3 Dec 2015, LZO 2.08
Originally developed by James Yonan
Copyright (C) 2002-2010 OpenVPN Technologies, Inc. <sales@openvpn.net>
Compile time defines: enable_crypto=yes enable_crypto_ofb_cfb=yes enable_debug=no enable_def_auth=yes enable_dependency_tracking=no enable_dlopen=unknown enable_dlopen_self=unknown enable_dlopen_self_static=unknown enable_fast_install=needless enable_fragment=yes enable_http_proxy=yes enable_iproute2=no enable_libtool_lock=yes enable_lzo=yes enable_lzo_stub=no enable_management=yes enable_multi=yes enable_multihome=yes enable_pam_dlopen=no enable_password_save=no enable_pedantic=no enable_pf=yes enable_pkcs11=yes enable_plugin_auth_pam=no enable_plugin_down_root=yes enable_plugins=yes enable_port_share=yes enable_selinux=no enable_server=yes enable_shared=yes enable_shared_with_static_runtimes=no enable_small=no enable_socks=yes enable_ssl=yes enable_static=yes enable_strict=no enable_strict_options=no enable_systemd=no enable_win32_dll=yes enable_x509_alt_username=no with_crypto_library=openssl with_gnu_ld=no with_mem_check=no with_plugindir='$(libdir)/openvpn/plugins' with_sysroot=no

Any ideas?

Thanks!

Traffic

vila wroteweird issue here

vila wrotethe problem arises when I connect from the wireless network

vila wrotesee logs like the following repeating over and over on my client:

vila wrote

Random log snippet ..

vila wroteClient Config file:

Code:
verb 11

See --verb in The Manual v23x

[deleted]

Hi,

In what way will -verb 6 work? The problem is not NAT related as far as I can tell. Do you have any specific idea in mind?

Thanks

Traffic

vila wroteIn what way will -verb 6 work?

who said --verb 6 ? Try --verb 4 ..