Only can connrect to remote server when ping to the server

vantran

Dear All,
I use Open VPN for my two sites
When I check the turnel and connection is ok .
But I cannot remote desktop to the server.
When I ping it, it response ok and then I can remote to the server but I have to continue ping the server
Could you tell me the root cause the problem

Thanks you so much

TinCanTech

Please see the Forum rules (top of this page)

vantran

vantran wroteDear All,
I use Open VPN for my two sites
When I check the turnel and connection is ok .
But I cannot remote desktop to the server.
When I ping it, it response ok and then I can remote to the server but I have to continue ping the server
Could you tell me the root cause the problem

Thanks you so much

Server Config:
port xxxx
proto tcp
dev tun
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 172.17.1.0 255.255.255.0"
push "route 172.16.0.0 255.255.0.0"
push "route 192.168.100.0 255.255.255.0"
push "route 192.168.0.0 255.255.240.0"
client-config-dir ccd
route 192.168.0.0 255.255.240.0
route 172.16.0.0 255.255.0.0
route 192.168.100.0 255.255.255.0
client-to-client
tls-auth ta.key 0
cipher DES-EDE3-CBC # Triple-DES
comp-lzo
;max-clients 100
user nobody
group nogroup
status openvpn-status.log
log openvpn.log
verb 5
mute 30

Client Config:

client
dev tun
proto tcp
remote xxxxxx xxxxx
resolv-retry infinite
nobind
user nobody
group nogroup
ca ca.crt
cert BD.crt
key BD.key
ns-cert-type server
tls-auth ta.key 1
cipher DES-EDE3-CBC
comp-lzo
verb 3
mute 20
persist-tun
persist-key
ping-timer-rem

vantran

I give the config of client and server. And in serer site I have juniper srx 240 firewall

TinCanTech

Server: Add

keepalive 10 60

Client: Remove

persist-tun
persist-key

vantran

Thanks Tim for your quich reply, but I try this,it's not work. The bug occurs when I replace my router with the Juniper SRX 240.

vantran

May server Log:

Wed Aug 17 21:05:33 2016 us=386045 Current Parameter Settings:
Wed Aug 17 21:05:33 2016 us=386118 config = '/etc/openvpn/server.conf'
Wed Aug 17 21:05:33 2016 us=386131 mode = 1
Wed Aug 17 21:05:33 2016 us=386140 persist_config = DISABLED
Wed Aug 17 21:05:33 2016 us=386149 persist_mode = 1
Wed Aug 17 21:05:33 2016 us=386158 show_ciphers = DISABLED
Wed Aug 17 21:05:33 2016 us=386166 show_digests = DISABLED
Wed Aug 17 21:05:33 2016 us=386174 show_engines = DISABLED
Wed Aug 17 21:05:33 2016 us=386182 genkey = DISABLED
Wed Aug 17 21:05:33 2016 us=386191 key_pass_file = '[UNDEF]'
Wed Aug 17 21:05:33 2016 us=386199 show_tls_ciphers = DISABLED
Wed Aug 17 21:05:33 2016 us=386208 Connection profiles [default]:
Wed Aug 17 21:05:33 2016 us=386217 proto = tcp-server
Wed Aug 17 21:05:33 2016 us=386226 local = '[UNDEF]'
Wed Aug 17 21:05:33 2016 us=386234 local_port = 14484
Wed Aug 17 21:05:33 2016 us=386243 remote = '[UNDEF]'
Wed Aug 17 21:05:33 2016 us=386251 remote_port = 14484
Wed Aug 17 21:05:33 2016 us=386259 remote_float = DISABLED
Wed Aug 17 21:05:33 2016 us=386267 bind_defined = DISABLED
Wed Aug 17 21:05:33 2016 us=386275 bind_local = ENABLED
Wed Aug 17 21:05:33 2016 us=386283 connect_retry_seconds = 5
Wed Aug 17 21:05:33 2016 us=386291 connect_timeout = 10
Wed Aug 17 21:05:33 2016 us=386299 connect_retry_max = 0
Wed Aug 17 21:05:33 2016 us=386308 socks_proxy_server = '[UNDEF]'
Wed Aug 17 21:05:33 2016 us=386316 socks_proxy_port = 0
Wed Aug 17 21:05:33 2016 us=386324 socks_proxy_retry = DISABLED
Wed Aug 17 21:05:33 2016 us=386334 Connection profiles END
Wed Aug 17 21:05:33 2016 us=386343 remote_random = DISABLED
Wed Aug 17 21:05:33 2016 us=386351 ipchange = '[UNDEF]'
Wed Aug 17 21:05:33 2016 us=386359 dev = 'tun'
Wed Aug 17 21:05:33 2016 us=386367 NOTE: --mute triggered...
Wed Aug 17 21:05:33 2016 us=386382 243 variation(s) on previous 30 message(s) suppressed by --mute
Wed Aug 17 21:05:33 2016 us=386392 OpenVPN 2.1.3 i486-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [MH] [PF_INET6] [eurephia] built on Jun 6 2013
Wed Aug 17 21:05:33 2016 us=386486 WARNING: you are using user/group/chroot/setcon without persist-tun -- this may cause restarts to fail
Wed Aug 17 21:05:33 2016 us=386497 WARNING: you are using user/group/chroot/setcon without persist-key -- this may cause restarts to fail
Wed Aug 17 21:05:33 2016 us=386552 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Wed Aug 17 21:05:33 2016 us=423154 Diffie-Hellman initialized with 1024 bit key
Wed Aug 17 21:05:33 2016 us=424015 WARNING: file 'server.key' is group or others accessible
Wed Aug 17 21:05:33 2016 us=424845 /usr/bin/openssl-vulnkey -q -b 1024 -m <modulus omitted>
Wed Aug 17 21:05:33 2016 us=976067 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
Wed Aug 17 21:05:33 2016 us=976120 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Aug 17 21:05:33 2016 us=976134 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Aug 17 21:05:33 2016 us=976160 TLS-Auth MTU parms [ L:1544 D:168 EF:68 EB:0 ET:0 EL:0 ]
Wed Aug 17 21:05:33 2016 us=976190 Socket Buffers: R=[87380->131072] S=[16384->131072]
Wed Aug 17 21:05:33 2016 us=976310 ROUTE default_gateway=172.17.1.254
Wed Aug 17 21:05:33 2016 us=979269 TUN/TAP device tun0 opened
Wed Aug 17 21:05:33 2016 us=979297 TUN/TAP TX queue length set to 100
Wed Aug 17 21:05:33 2016 us=979325 /sbin/ifconfig tun0 10.8.0.1 pointopoint 10.8.0.2 mtu 1500
Wed Aug 17 21:05:33 2016 us=980340 /sbin/route add -net 192.168.0.0 netmask 255.255.240.0 gw 10.8.0.2
Wed Aug 17 21:05:33 2016 us=980957 /sbin/route add -net 172.16.0.0 netmask 255.255.0.0 gw 10.8.0.2
Wed Aug 17 21:05:33 2016 us=981575 /sbin/route add -net 192.168.100.0 netmask 255.255.255.0 gw 10.8.0.2
Wed Aug 17 21:05:33 2016 us=982593 /sbin/route add -net 10.8.0.0 netmask 255.255.255.0 gw 10.8.0.2
Wed Aug 17 21:05:33 2016 us=983171 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ]
Wed Aug 17 21:05:33 2016 us=983796 GID set to nogroup
Wed Aug 17 21:05:33 2016 us=983850 UID set to nobody
Wed Aug 17 21:05:33 2016 us=983874 Listening for incoming TCP connection on [undef]

TinCanTech

vantran wroteThe bug occurs when I replace my router with the Juniper SRX 240

vantran wroteWed Aug 17 21:05:33 2016 us=386486 WARNING: you are using user/group/chroot/setcon without persist-tun -- this may cause restarts to fail
Wed Aug 17 21:05:33 2016 us=386497 WARNING: you are using user/group/chroot/setcon without persist-key -- this may cause restarts to fail

Speak for themselves ..

vantran

Could you give me more detail ??

TinCanTech

TinCanTech wrote
vantran wroteThe bug occurs when I replace my router with the Juniper SRX 240

Sounds like your Juniper device is broken.

TinCanTech wrote
vantran wroteWed Aug 17 21:05:33 2016 us=386486 WARNING: you are using user/group/chroot/setcon without persist-tun -- this may cause restarts to fail
Wed Aug 17 21:05:33 2016 us=386497 WARNING: you are using user/group/chroot/setcon without persist-key -- this may cause restarts to fail
Speak for themselves ..

Reinstate:

TinCanTech wroteClient: Remove

persist-tun
persist-key

vantran

I'm going to crazzy about the bug 🙁 I add or remove "persist-tun persist-key" but it's not work

TinCanTech

vantran wroteI'm going to crazzy about the bug 🙁 I add or remove "persist-tun persist-key" but it's not work

Your bug has nothing to do with openvpn:

vantran wroteThe bug occurs when I replace my router with the Juniper SRX 240

Then that is the problem ..

Unless you can post adaquate proof that the problem is with openvpn we have to assume the problem is the Juniper SRX 240