Client does not reconnect after server is restarted...

MatejKovacic

Hi,
I am using OpenVPN 2.2.1 on a Debian (as a server) and a client on RaspberryPi on Raspbian. Today I restarted server, and my client (Raspberry) does not connect to a server anymore, unless Raspberry is restarted.

I am not sure what the problem could be, but after reading this, it seems to me that maybe persist-key and especially persist-tun on a client side could be the problem. Is that correct?

Anyway, I am using user nobody and group nobody, can I safely remove persist-key/persist-tun on a client side??

This is my server config: port 443
port-share 127.0.0.1 4545
proto tcp
dev tun
ca ca.crt
cert Telefoncek.crt
key Telefoncek.key
dh dh4096.pem
tls-auth ta.key 0
crl-verify crl.pem
tls-cipher DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-CAMELLIA256-SHA:DHE-RSA-AES256-SHA:DHE-RSA-CAMELLIA128-SHA:DHE-RSA-AES128-SHA:CAMELLIA256-SHA:AES256-SHA:CAMELLIA128-SHA:AES128-SHA
server 10.10.7.0 255.255.255.0
persist-key
persist-tun
topology subnet
push "topology subnet"
push "redirect-gateway def1"
push "route 10.10.7.0 255.255.255.0"
push "route 10.10.8.0 255.255.255.0"
push "dhcp-option DNS 10.10.7.1"
persist-key
persist-tun
mtu-disc maybe
user nobody
group nogroup
client-config-dir ccd_tcp
comp-lzo yes
push "comp-lzo yes"
keepalive 10 120
verb 3
status /var/log/openvpn/status_tcp.log
log /var/log/openvpn/openvpn_tcp.log And this is my client config: client
dev tun
remote myserver.org 443
proto tcp
mute-replay-warnings
ca ca.crt
cert user.crt
key user.key
tls-auth ta.key 1
route-nopull
remote-cert-tls server
user nobody
group nogroup
comp-lzo
ping 10
ping-restart 60
verb 0 Just a little explanation. Some of the machines ignore default gateway, but I want them to be able to have a route not just to 10.10.7.0/24 network (which is default OpenVPN network for a given tun device), but also to 10.10.8.0/24 network.

TinCanTech

MatejKovacic wroteI am using OpenVPN 2.2.1 on a Debian (as a server)

https://openvpn.net/index.php/open-source/downloads.html

MatejKovacic wroteClient does not reconnect after server is restarted...

and the client is ?

MatejKovacic

In fact I do not know. That is because I cannot access RaspberryPi (VPN is not working, and I do not have a direct connection). I will have to go phisically to the machine which will happen in a few days.

But I am using default version from Raspbian repository. The same holds for Debian server - 2.2.1 is the current version in Debian 7.11 repositories.

So back to my question - should I use persist-tun and persist-key on a client config?

BTW: above is an error, in client I am still using persist-key
persist-tun ...but I pasted the wrong version.

So correct current client version (causing problems) is:
client
dev tun
remote myserver.org 443
proto tcp
mute-replay-warnings
ca ca.crt
cert user.crt
key user.key
tls-auth ta.key 1
route-nopull
remote-cert-tls server
persist-key
persist-tun
user nobody
group nogroup
comp-lzo
ping 10
ping-restart 60
verb 0 P. S. The whole setup was working smoothly for over a year...

TinCanTech

MatejKovacic wroteI am using user nobody and group nobody, can I safely remove persist-key/persist-tun on a client side??

Typically, you would want to use all these option together. If you do not then certain activities will cause the client to exit with a fatal error. EG: If the connection times out for some unknown problem then the client will exit with a fatal error if you use --user/group nobody/nogroup but not --persist-tun/key.

I would recommend that you do not use --user/group nobody/nogroup & --persist-tun/key on the client until you are more familiar with how they interact with the other parts of openvpn ..

I would also highly recommend you see the openvpon repo (my first link) and get your server up to date. Unless you are confident that Debian maintainers have patched Openvpn 2.2.1 for Heartbleed etc ..

MatejKovacic

Thank you for your answer. BTW, what are security risks NOT using user nobody / group nogroup (on a client)?

TinCanTech

I cannot offer any advice as to the security of your client device because I have no idea the circumstances it is installed under. However, I would imagine, you would prefer that your Openvpn client is not dead.