asfak
Hello,
I am running openvpn 2.3.5. I have less than 100 clients connecting over GSM wireless connection.Here is my configurations.
tls-server
proto udp
dev tun
port 1194
management 127.0.0.1 1194
server 10.10.0.0 255.255.0.0
push "route 10.11.0.0 255.255.0.0"
max-clients 100
ca ca.crt
cert server.crt
key server.key
dh dh.pem
tls-auth ta.key 0
group nogroup
user nobody
comp-lzo
keepalive 55 180
persist-tun
persist-key
cipher BF-CBC
status /tmp/server-status.log 1
status-version 2
tls-client
pull
proto udp
dev tun
remote A.B.C.D 1194
remote-random
resolv-retry infinite
ca ca.crt
cert client1.crt
key client1.key
tls-auth ta.key 1
remote-cert-tls server
persist-key
persist-tun
nobind
comp-lzo
cipher BF-CBC
Usually, everything works okay. But every week 1-2 client's connections freeze. By freezing ,I mean that the openvpn routing table shows active route,though I can not ping the client.
server-status.log
--------------------
ROUTING_TABLE,10.10.1.234,client1,A.B.C.D:50698,Tue May 10 12:46:13 2016,1462873573
I used the management interface to check whats happening. My client sends packet every 1s to my local TCP server. I can see the packet is coming to the openvpn server and dropped by openvpn. I found that the client's ip addrress is different than in the openvpn's server routing table. No client/server reset happens based on keepalive.The connection just hangs there. Only way I can make a working connection is by killing the client from management interface.Is it a bug? why does openvpn client and server has different client's ip addresses ?? how to solve the issue ? thanks
management log window
-----------------------------
LOG:1462874994,,client1/A.B.C.D:50698 MULTI: bad source address from client [10.10.0.226], packet dropped
LOG:1462875010,,client1/A.B.C.D:50698 MULTI: bad source address from client [10.10.0.226], packet dropped
LOG:1462875011,,client1/A.B.C.D:50698 MULTI: bad source address from client [10.10.0.226], packet dropped
LOG:1462875012,,client1/A.B.C.D:50698 MULTI: bad source address from client [10.10.0.226], packet dropped
LOG:1462875013,,client1/A.B.C.D:50698 MULTI: bad source address from client [10.10.0.226], packet dropped
Traffic
As this address:
asfak wroteLOG:1462874994,,client1/A.B.C.D:50698 MULTI: bad source address from client [10.10.0.226], packet dropped
is part of your server subnet:
server 10.10.0.0 255.255.0.0
this should not happen ..
Somethings you can try:
keepalive 15 180
your setting of 55 can cause timeout errors ..
Also, --
topology subnet and --
server 10.10.0.0 255.255.255.0 may be easier for you to manage ..
See
--topology in
The Manual v23x
asfak
Thanks for the idea --topology subnet. I have used it in my server.conf.
but the problem remains the same. openvpn server is assigning one private ip_address to a client and it creates instance with another private ip_address.I got log information that verifies the situation.some logs are removed for simplicity.
log:
LOG:1462875705,D,GET INST BY REAL: A.B.C.D:50698 [succeeded]
LOG:1462875705,D,client1/A.B.C.D:50698 GET INST BY VIRT: 10.10.0.226 [failed]
routing:
ROUTING_TABLE,10.10.1.234,client1,A.B.C.D:50698,Tue May 10 12:46:13 2016,1462873573
I wonder , if openvpn is facing problems like Two Generals Paradox, the Two Armies Problem, or the Coordinated Attack Problem.
I am planning to check the private ip assigning part from the source code.
If someone has solution for this problem, please post a reply. thanks.
Traffic
asfak
I need bi-directional communications.my client and server are under the same network. My client does not have additional network that should be routed to the server.In that case the earlier solution is not relevant for me.Thanks.
here is the log with verb 7 :
>LOG:1462875705,D,GET INST BY REAL: A.B.C.D:50698 [succeeded]
>LOG:1462875705,D,client1/A.B.C.D:50698 UDPv4 READ [117] from [AF_INET]A.B.C.D:50698: P_DATA_V1 kid=5 DATA len=116
>LOG:1462875705,D,client1/A.B.C.D:50698 TLS: tls_pre_decrypt, key_id=5, IP=[AF_INET]A.B.C.D:50698
>LOG:1462875705,D,client1/A.B.C.D:50698 PID_TEST [0] [SSL-5] [>EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE] 0:121 0:122 t=1462875705[0] r=[0,64,15,0,1] sl=[7,64,64,528]
>LOG:1462875705,D,client1/A.B.C.D:50698 GET INST BY VIRT: 10.10.0.226 [failed]
>LOG:1462875705,,client1/A.B.C.D:50698 MULTI: bad source address from client [10.10.0.226], packet dropped
Traffic
Did you change your --keepalive settings ?
asfak
I haven't changed my --keepalive settings. frequent keepalive will increase my bandwidth consumption.
Is there any correlation between 2 keepalive values ?
Traffic
Change your --keepalive as advised for testing .. if it has no effect then change it back.
Your setting of 55 can cause NAT routers to timeout ..
