Hi all, For now this is my project : I have to make a migration of parameters and new security for a PKI et OpenVPN Server from version 1.0 to 2.3 I have a PKI who is working fine CA are OK, CERTS are OK, Signature are OK and a OpenVPN Connexion But I have a weird trouble on the connexion. The negociation with the Client and the Server are both OK, but when i'm connected and i make a SSH connexion or other, after somes minutes or sometimes I go take a pause and after 10 minute of innactivity the SSH connexion going Down. On LOG I right have a READ WRITE and PING SENT on log when my connexion SSH is going down and it's like when i put enter or a key on my keyboard, log is written with a READ WRITE and PING SENT. It's like I loose the renegociation with the server but the VPN Connexion steel Good. I loose all data transmission on the route but it's going up just after, and I can renew my ssh connexion. I don't know where can be the problem. I already play with theses option and more keepalive 10 60 | 10 600 | 10 3600 | reneg-sec 30 || 60. This is my conf Conf Server : [code]daemon port 1194 proto udp dev tun ca ca-crt.pem cert /etc/openvpn/openvpn-crt.pem key /etc/openvpn/openvpn-key.pem crl-verify /etc/openvpn/ca-crl.pem tls-auth /etc/openvpn/ta.pem 0 ;username-as-common-name client-config-dir /etc/openvpn/ccd dh /etc/openvpn/dh.pem ;auth-user-pass-verify auth-pam.pl via-file auth-user-pass-verify /etc/openvpn/ucn.pl via-env plugin /usr/lib64/openvpn/plugin/lib/openvpn-auth-pam.so ovpn server *********** *********** route *********** *********** route *********** *********** route *********** *********** ;route *********** *********** ;topology subnet ifconfig-pool-persist ipp.txt ;push "redirect-gateway" push "route *********** ***********" push "route *********** ***********" push "route *********** ***********" push "route *********** ***********" push "route *********** ***********" push "route *********** ***********" push "route *********** ***********" push "route ********* ***********" push "dhcp-option DNS **********" push "dhcp-option DNS **********" push "dhcp-option WINS *********" keepalive 10 3600 cipher AES-128-CBC comp-lzo max-clients 300 user openvpn group openvpn persist-key persist-tun status /var/log/openvpn/openvpn-status.log log-append /var/log/openvpn/openvpn.log log on all verb 15 tls-server ;mute 20 [/code] Conf Client [code]client dev tun proto udp remote DNSServer 1194 resolv-retry infinite nobind persist-key persist-tun ca ca-crt.pem cert crt.pem key key.pem ns-cert-type server tls-auth ta.pem 1 auth-nocache cipher AES-128-CBC auth-user-pass comp-lzo verb 7 route-method exe route-delay 2 tls-client ;replay-window 128 15 keepalive 10 3600 ;explicit-exit-notify 20 ;reneg-sec 30 ;mssfix 1450[/code] I would like to give you the openvpn log but i'm on verb 15 on the server and verb 7 on client. I already check a lot of forum to know where is my problem. I already check ack problems, tls problems. I already check the openssl FAQ and DOC. Routing problem ? [code]iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT all -- anywhere anywhere ACCEPT udp -- anywhere anywhere state NEW,ESTABLISHED udp dpt:53194 ACCEPT udp -- anywhere anywhere state NEW,ESTABLISHED udp dpt:53194 Chain FORWARD (policy ACCEPT) target prot opt source destination LOG_DROP all -- *****.130.0/24 *****.130.0/24 LOG_DROP all -- *****.130.0/24 *****.131.0/24 LOG_DROP all -- *****.130.0/24 *****.132.0/24 LOG_DROP all -- *****.130.0/24 *****.133.0/24 LOG_DROP all -- *****.131.0/24 *****.130.0/24 LOG_DROP all -- *****.131.0/24 *****.131.0/24 LOG_DROP all -- *****.131.0/24 *****.132.0/24 LOG_DROP all -- *****.131.0/24 *****.133.0/24 LOG_DROP all -- *****.132.0/24 *****.130.0/24 LOG_DROP all -- *****.132.0/24 *****.131.0/24 LOG_DROP all -- *****.132.0/24 *****.132.0/24 LOG_DROP all -- *****.132.0/24 *****.133.0/24 LOG_DROP all -- *****.133.0/24 *****.130.0/24 LOG_DROP all -- *****.133.0/24 *****.131.0/24 LOG_DROP all -- *****.133.0/24 *****.132.0/24 LOG_DROP all -- *****.133.0/24 *****.133.0/24 Chain OUTPUT (policy ACCEPT) target prot opt source destination ACCEPT all -- anywhere anywhere ACCEPT udp -- anywhere anywhere state NEW,ESTABLISHED udp dpt:53194 ACCEPT udp -- anywhere anywhere state NEW,ESTABLISHED udp dpt:53194 Chain LOG_ACCEPT (0 references) target prot opt source destination LOG all -- anywhere anywhere LOG level info prefix `[IPTABLES ACCEPT] :' ACCEPT all -- anywhere anywhere Chain LOG_DROP (16 references) target prot opt source destination LOG all -- anywhere anywhere LOG level info prefix `[IPTABLES DROP] :' DROP all -- anywhere anywhere[/code] The sys routes : [code]route Table de routage IP du noyau Destination Passerelle Genmask Indic Metric Ref Use Iface *****.130.2 * 255.255.255.255 UH 0 0 0 tun0 ********** * 255.255.255.240 U 0 0 0 eth0 *****.131.0 *****.130.2 255.255.255.0 UG 0 0 0 tun0 *****.130.0 *****.130.2 255.255.255.0 UG 0 0 0 tun0 *****.133.0 *****.130.2 255.255.255.0 UG 0 0 0 tun0 *****.132.0 *****.130.2 255.255.255.0 UG 0 0 0 tun0 default fw 0.0.0.0 UG 0 0 0 eth0[/code] Did you think that a part of my conf is bad ? I already test the connexion with Wifi - ADSL connexion and Fiber Channel connexion, still SSH or TSE or PING down after some minute. I think that the connexion it's be ok but after some time when he try to renegociated with the server the client loose the routes and try to reconnected them but i'm really not sure with that. Thanks for your help. Kind regards, MVA

[quote="mva"]I already [b]play[/b] with theses option and more keepalive 10 60 | 10 600 | 10 3600 | [b]reneg-sec 30 || 60[/b].[/quote][b]reneg-sec 30[/b] is a [i]very[/i] bad idea .. don't [i]play[/i] learn from the documentation. See [b]--reneg-sec[/b] in [url=https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage]The Manual v23x[/url] .. Read it carefully. Please see this: [url=https://forums.openvpn.net/viewtopic.php?f=30&t=22603]HOWTO: Request Help ![/url]

Your openvpn server and client log files at --[b]verb 4[/b]

SSH-TSE Disconnected after time connected

mva

Hi all,

For now this is my project :
I have to make a migration of parameters and new security for a PKI et OpenVPN Server from version 1.0 to 2.3
I have a PKI who is working fine CA are OK, CERTS are OK, Signature are OK and a OpenVPN Connexion
But I have a weird trouble on the connexion.

The negociation with the Client and the Server are both OK, but when i'm connected and i make a SSH connexion or other, after somes minutes or sometimes I go take a pause and after 10 minute of innactivity the SSH connexion going Down.

On LOG I right have a READ WRITE and PING SENT on log when my connexion SSH is going down and it's like when i put enter or a key on my keyboard, log is written with a READ WRITE and PING SENT. It's like I loose the renegociation with the server but the VPN Connexion steel Good.
I loose all data transmission on the route but it's going up just after, and I can renew my ssh connexion.

I don't know where can be the problem.
I already play with theses option and more keepalive 10 60 | 10 600 | 10 3600 |
reneg-sec 30 || 60.

This is my conf

Conf Server :

daemon
port 1194
proto udp
dev tun
ca ca-crt.pem
cert /etc/openvpn/openvpn-crt.pem
key /etc/openvpn/openvpn-key.pem
crl-verify /etc/openvpn/ca-crl.pem
tls-auth /etc/openvpn/ta.pem 0
;username-as-common-name
client-config-dir /etc/openvpn/ccd
dh /etc/openvpn/dh.pem
;auth-user-pass-verify auth-pam.pl via-file
auth-user-pass-verify /etc/openvpn/ucn.pl via-env
plugin /usr/lib64/openvpn/plugin/lib/openvpn-auth-pam.so ovpn
server *********** ***********
route *********** ***********
route *********** ***********
route *********** ***********
;route *********** ***********
;topology subnet
ifconfig-pool-persist ipp.txt
;push "redirect-gateway"
push "route *********** ***********"
push "route *********** ***********"
push "route *********** ***********"
push "route *********** ***********"
push "route *********** ***********"
push "route *********** ***********"
push "route *********** ***********"
push "route ********* ***********"
push "dhcp-option DNS **********"
push "dhcp-option DNS **********"
push "dhcp-option WINS *********"
keepalive 10 3600
cipher AES-128-CBC
comp-lzo
max-clients 300
user openvpn
group openvpn
persist-key
persist-tun
status /var/log/openvpn/openvpn-status.log
log-append /var/log/openvpn/openvpn.log
log on all
verb 15
tls-server
;mute 20

Conf Client

client
dev tun
proto udp
remote DNSServer 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca-crt.pem
cert crt.pem
key key.pem
ns-cert-type server
tls-auth ta.pem 1
auth-nocache
cipher AES-128-CBC
auth-user-pass
comp-lzo
verb 7
route-method exe
route-delay 2
tls-client
;replay-window 128 15
keepalive 10 3600
;explicit-exit-notify 20
;reneg-sec 30
;mssfix 1450

I would like to give you the openvpn log but i'm on verb 15 on the server and verb 7 on client. I already check a lot of forum to know where is my problem.
I already check ack problems, tls problems. I already check the openssl FAQ and DOC.
Routing problem ?

iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination 
ACCEPT all -- anywhere anywhere 
ACCEPT udp -- anywhere anywhere state NEW,ESTABLISHED udp dpt:53194 
ACCEPT udp -- anywhere anywhere state NEW,ESTABLISHED udp dpt:53194 

Chain FORWARD (policy ACCEPT)
target prot opt source destination 
LOG_DROP all -- *****.130.0/24 *****.130.0/24 
LOG_DROP all -- *****.130.0/24 *****.131.0/24 
LOG_DROP all -- *****.130.0/24 *****.132.0/24 
LOG_DROP all -- *****.130.0/24 *****.133.0/24 
LOG_DROP all -- *****.131.0/24 *****.130.0/24 
LOG_DROP all -- *****.131.0/24 *****.131.0/24 
LOG_DROP all -- *****.131.0/24 *****.132.0/24 
LOG_DROP all -- *****.131.0/24 *****.133.0/24 
LOG_DROP all -- *****.132.0/24 *****.130.0/24 
LOG_DROP all -- *****.132.0/24 *****.131.0/24 
LOG_DROP all -- *****.132.0/24 *****.132.0/24 
LOG_DROP all -- *****.132.0/24 *****.133.0/24 
LOG_DROP all -- *****.133.0/24 *****.130.0/24 
LOG_DROP all -- *****.133.0/24 *****.131.0/24 
LOG_DROP all -- *****.133.0/24 *****.132.0/24 
LOG_DROP all -- *****.133.0/24 *****.133.0/24 

Chain OUTPUT (policy ACCEPT)
target prot opt source destination 
ACCEPT all -- anywhere anywhere 
ACCEPT udp -- anywhere anywhere state NEW,ESTABLISHED udp dpt:53194 
ACCEPT udp -- anywhere anywhere state NEW,ESTABLISHED udp dpt:53194 

Chain LOG_ACCEPT (0 references)
target prot opt source destination 
LOG all -- anywhere anywhere LOG level info prefix `[IPTABLES ACCEPT] :' 
ACCEPT all -- anywhere anywhere 

Chain LOG_DROP (16 references)
target prot opt source destination 
LOG all -- anywhere anywhere LOG level info prefix `[IPTABLES DROP] :' 
DROP all -- anywhere anywhere

The sys routes :

route
Table de routage IP du noyau
Destination Passerelle Genmask Indic Metric Ref Use Iface
*****.130.2 * 255.255.255.255 UH 0 0 0 tun0
********** * 255.255.255.240 U 0 0 0 eth0
*****.131.0 *****.130.2 255.255.255.0 UG 0 0 0 tun0
*****.130.0 *****.130.2 255.255.255.0 UG 0 0 0 tun0
*****.133.0 *****.130.2 255.255.255.0 UG 0 0 0 tun0
*****.132.0 *****.130.2 255.255.255.0 UG 0 0 0 tun0
default fw 0.0.0.0 UG 0 0 0 eth0

Did you think that a part of my conf is bad ?
I already test the connexion with Wifi - ADSL connexion and Fiber Channel connexion, still SSH or TSE or PING down after some minute.

I think that the connexion it's be ok but after some time when he try to renegociated with the server the client loose the routes and try to reconnected them but i'm really not sure with that.

Thanks for your help.
Kind regards,
MVA

TinCanTech

mva wroteI already play with theses option and more keepalive 10 60 | 10 600 | 10 3600 |
reneg-sec 30 || 60.

reneg-sec 30 is a very bad idea .. don't play learn from the documentation.

See --reneg-sec in The Manual v23x .. Read it carefully.

Please see this:
HOWTO: Request Help !

mva

I know and the option is now commented, but first i'll have some TLS renegociation problems and it was a gracefull idea because it will gave me a nice log 🙂.

But now it's desactivated my problems is my disconnexion with all my route but the openVPN connexion is fine.
Did i miss something on my request :/ ?

TinCanTech

Your openvpn server and client log files at --verb 4