I have a setup with multiple clients (running Arch and Debian) connecting to multiple servers (also running Arch and Debian). Arch machines are running 2.3.9 or git head. Debian machines are running 2.3.4. Everything works fine except for a problem with one of the clients, one of the Arch machines. Sometimes (50/50 almost, no patter discernible) it fails to set an IP on the tunnel interface.
- - It happens with Arch servers and Debian servers.
- It happens with subnet topology and /30 topology.
- It happens with mtu-settings and without.
- It doesn't happen with any other client (some also running Arch with the exact same OpenVPN version) to any other server, using almost identical config files.
Here is one client config for this particular machine. Other machines use the exact same config file(s), just changing the X in the cert and key lines.
remote X.X.X.X
port 1194
proto udp
dev-type tun
dev h1
ns-cert-type server
ca /etc/openvpn/h1.crt
cert /etc/openvpn/h1.X.crt
key /etc/openvpn/h1.X.key
tls-auth h1.ta.key 1
cipher AES-128-CBC
client
nobind
#comp-lzo
#user nobody
#group nobody
persist-key
persist-tun
route-metric 1010
link-mtu 1472
Here is the failure to set the IP address:
# openvpn --config h1.conf
Thu Mar 3 09:45:05 2016 OpenVPN 2.3.9 x86_64-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Dec 24 2015
Thu Mar 3 09:45:05 2016 library versions: OpenSSL 1.0.2f 28 Jan 2016, LZO 2.09
Thu Mar 3 09:45:05 2016 Control Channel Authentication: using 'h1.ta.key' as a OpenVPN static key file
Thu Mar 3 09:45:05 2016 WARNING: normally if you use --mssfix and/or --fragment, you should also set --tun-mtu 1500 (currently it is 1415)
Thu Mar 3 09:45:05 2016 UDPv4 link local: [undef]
Thu Mar 3 09:45:05 2016 UDPv4 link remote: [AF_INET]X.X.X.X:1194
Thu Mar 3 09:45:05 2016 [h1] Peer Connection Initiated with [AF_INET]X.X.X.X:1194
Thu Mar 3 09:45:07 2016 OPTIONS IMPORT: WARNING: peer-id set, but link-mtu fixed by config - reducing tun-mtu to 1412, expect MTU problems
Thu Mar 3 09:45:07 2016 TUN/TAP device h1 opened
Thu Mar 3 09:45:07 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Thu Mar 3 09:45:07 2016 /usr/bin/ip link set dev h1 up mtu 1412
Thu Mar 3 09:45:07 2016 /usr/bin/ip addr add dev h1 10.192.2.2/24 broadcast 10.192.2.255
RTNETLINK answers: Network is unreachable
Thu Mar 3 09:45:07 2016 ERROR: Linux route add command failed: external program exited with error status: 2
Thu Mar 3 09:45:07 2016 Initialization Sequence Completed
Note the "RTNETLINK answers: Network is unreachable" error in ip addr add. Sometimes there is no error and the interface does not get an address. Sometimes (when the particular server has a subnet behind it) the "ip addr add..." command exits successfully and the "ip route add ..." fails because the interface did not get the IP. Setting the IP with the exact same command does work afterwards:
[root@host ~]# ping -M do -c 1 -s 1300 10.192.2.1
PING 10.192.2.1 (10.192.2.1) 1300(1328) bytes of data.
^C
--- 10.192.2.1 ping statistics ---
1 packets transmitted, 0 received, 100% packet loss, time 0ms
[root@host ~]# ifconfig h1
h1: flags=4305<UP,POINTOPOINT,RUNNING,NOARP,MULTICAST> mtu 1412
unspec 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 txqueuelen 100 (UNSPEC)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
[root@host ~]# ip addr show h1
42: h1: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1412 qdisc noqueue state UNKNOWN group default qlen 100
link/none
[root@host ~]# ip addr add dev h1 10.192.2.2/24 broadcast 10.192.2.255
[root@host ~]# ip addr show h1
43: h1: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1412 qdisc noqueue state UNKNOWN group default qlen 100
link/none
inet 10.192.2.2/24 brd 10.192.2.255 scope global h1
valid_lft forever preferred_lft forever
[root@host ~]#
Here you can see consecutive connections to a different server succeeding then failing:
[root@host openvpn]# openvpn --config strn.conf
Thu Mar 3 11:58:16 2016 OpenVPN 2.3.9 x86_64-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Dec 24 2015
Thu Mar 3 11:58:16 2016 library versions: OpenSSL 1.0.2f 28 Jan 2016, LZO 2.09
Thu Mar 3 11:58:16 2016 UDPv4 link local: [undef]
Thu Mar 3 11:58:16 2016 UDPv4 link remote: [AF_INET]X.X.X.X:PORT
Thu Mar 3 11:58:16 2016 [saturn] Peer Connection Initiated with [AF_INET]X.X.X.X:PORT
Thu Mar 3 11:58:19 2016 TUN/TAP device strn opened
Thu Mar 3 11:58:19 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Thu Mar 3 11:58:19 2016 /usr/bin/ip link set dev strn up mtu 1500
Thu Mar 3 11:58:19 2016 /usr/bin/ip addr add dev strn local 10.192.0.22 peer 10.192.0.21
Thu Mar 3 11:58:19 2016 Initialization Sequence Completed
^CThu Mar 3 11:58:23 2016 event_wait : Interrupted system call (code=4)
Thu Mar 3 11:58:23 2016 /usr/bin/ip addr del dev strn local 10.192.0.22 peer 10.192.0.21
Thu Mar 3 11:58:23 2016 SIGINT[hard,] received, process exiting
[root@host openvpn]# openvpn --config strn.conf
Thu Mar 3 11:58:24 2016 OpenVPN 2.3.9 x86_64-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Dec 24 2015
Thu Mar 3 11:58:24 2016 library versions: OpenSSL 1.0.2f 28 Jan 2016, LZO 2.09
Thu Mar 3 11:58:24 2016 UDPv4 link local: [undef]
Thu Mar 3 11:58:24 2016 UDPv4 link remote: [AF_INET]X.X.X.X:PORT
Thu Mar 3 11:58:24 2016 [saturn] Peer Connection Initiated with [AF_INET]X.X.X.X:PORT
Thu Mar 3 11:58:26 2016 TUN/TAP device strn opened
Thu Mar 3 11:58:26 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Thu Mar 3 11:58:26 2016 /usr/bin/ip link set dev strn up mtu 1500
Thu Mar 3 11:58:26 2016 /usr/bin/ip addr add dev strn local 10.192.0.22 peer 10.192.0.21
Thu Mar 3 11:58:26 2016 Initialization Sequence Completed
^CThu Mar 3 11:58:28 2016 event_wait : Interrupted system call (code=4)
Thu Mar 3 11:58:28 2016 /usr/bin/ip addr del dev strn local 10.192.0.22 peer 10.192.0.21
Thu Mar 3 11:58:28 2016 SIGINT[hard,] received, process exiting
[root@host openvpn]# openvpn --config strn.conf
Thu Mar 3 11:58:28 2016 OpenVPN 2.3.9 x86_64-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Dec 24 2015
Thu Mar 3 11:58:28 2016 library versions: OpenSSL 1.0.2f 28 Jan 2016, LZO 2.09
Thu Mar 3 11:58:28 2016 UDPv4 link local: [undef]
Thu Mar 3 11:58:28 2016 UDPv4 link remote: [AF_INET]X.X.X.X:PORT
Thu Mar 3 11:58:29 2016 [saturn] Peer Connection Initiated with [AF_INET]X.X.X.X:PORT
Thu Mar 3 11:58:31 2016 TUN/TAP device strn opened
Thu Mar 3 11:58:31 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Thu Mar 3 11:58:31 2016 /usr/bin/ip link set dev strn up mtu 1500
Thu Mar 3 11:58:31 2016 /usr/bin/ip addr add dev strn local 10.192.0.22 peer 10.192.0.21
RTNETLINK answers: Network is unreachable
Thu Mar 3 11:58:31 2016 ERROR: Linux route add command failed: external program exited with error status: 2
RTNETLINK answers: Network is unreachable
Thu Mar 3 11:58:31 2016 ERROR: Linux route add command failed: external program exited with error status: 2
RTNETLINK answers: Network is unreachable
Thu Mar 3 11:58:31 2016 ERROR: Linux route add command failed: external program exited with error status: 2
Thu Mar 3 11:58:31 2016 Initialization Sequence Completed
On another console, after each connection to the server...
[root@host ~]# ip addr show strn
45: strn: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default qlen 100
link/none
inet 10.192.0.22 peer 10.192.0.21/32 scope global strn
valid_lft forever preferred_lft forever
[root@host ~]# ip addr show strn
46: strn: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default qlen 100
link/none
inet 10.192.0.22 peer 10.192.0.21/32 scope global strn
valid_lft forever preferred_lft forever
[root@host ~]# ip addr show strn
47: strn: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN group default qlen 100
link/none
[root@host ~]#
Again, (almost)exact same config file works 100% for other machines.
Any idea why the "ip addr add" command (sometimes) fails while run by the openvpn process?
