Why is there a time delay to reconnect to OpenVPN???

SAYERS42

I have openvpn running on a Amazon EC2 server which i connect to through port 443 on a Windows 10 pc. I am able to connect without issue. Though if i disconnect from my wifi network without first disconnecting from the OpenVPN server when i try to reconnect to it. it just says "soft reset" and loops without connecting. Only after some time (under an hour) can i connect to it again. Why? and how can i fix it?

TinCanTech

Please see:
HOWTO: Request Help !

SAYERS42

1.CLIENT CONFIG:
[oconf=client]
proto tcp-client
remote   number.number.number.number
port 443                   
dev tun                   
secret "C:\\Program Files\\OpenVPN\\config\\ovpn.key"            
redirect-gateway def1       
ifconfig 10.4.0.2 10.4.0.1

SAYERS42

1. 
[log=client]
ov 28 07:04:14 ip-xxx-xx-xx-xxx openvpn[6017]: TCP connection established with [AF_INET]xxx.xx.xx.xxx:42487
Nov 28 07:04:14 ip-xxx-xx-xx-xxx openvpn[6017]: TCPv4_SERVER link local (bound): [undef]
Nov 28 07:04:14 ip-xxx-xx-xx-xxx openvpn[6017]: TCPv4_SERVER link remote: [AF_INET]185.43.209.164:42487
Nov 28 07:04:14 ip-xxx-xx-xx-xxx openvpn[6017]: WARNING: Bad encapsulated packet length from peer (5635), which must be > 0 and <= 1549 -- please ensure that --tun-mtu or --link-mtu is equal on both peers -- this condition could also indicate a possible active attack on the TCP link -- [Attempting restart...]
Nov 28 07:04:14 ip-xxx-xx-xx-xxx openvpn[6017]: Connection reset, restarting [0]
Nov 28 07:04:14 ip-xxx-xx-xx-xxx openvpn[6017]: Closing TUN/TAP interface
Nov 28 07:04:14 ip-xxx-xx-xx-xxx openvpn[6017]: /sbin/ip addr del dev tun1 local 10.4.0.1 peer 10.4.0.2
Nov 28 07:04:14 ip-xxx-xx-xx-xxx openvpn[6017]: SIGUSR1[soft,connection-reset] received, process restarting
Nov 28 07:04:14 ip-xxx-xx-xx-xxx openvpn[6017]: Restart pause, 1 second(s)
Nov 28 07:04:15 ip-xxx-xx-xx-xxx openvpn[6017]: WARNING: file 'ovpn.key' is group or others accessible
Nov 28 07:04:15 ip-xxx-xx-xx-xxx openvpn[6017]: Static Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 28 07:04:15 ip-xxx-xx-xx-xxx openvpn[6017]: WARNING: this cipher's block size is less than 128 bit (64 bit).  Consider using a --cipher with a larger block size.
Nov 28 07:04:15 ip-xxx-xx-xx-xxx openvpn[6017]: Static Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 28 07:04:15 ip-xxx-xx-xx-xxx openvpn[6017]: Static Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Nov 28 07:04:15 ip-xxx-xx-xx-xxx openvpn[6017]: WARNING: this cipher's block size is less than 128 bit (64 bit).  Consider using a --cipher with a larger block size.
Nov 28 07:04:15 ip-xxx-xx-xx-xxx openvpn[6017]: Static Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Nov 28 07:04:15 ip-xxx-xx-xx-xxx openvpn[6017]: Socket Buffers: R=[87380->87380] S=[20480->20480]
Nov 28 07:04:15 ip-xxx-xx-xx-xxx openvpn[6017]: TUN/TAP device tun1 opened
Nov 28 07:04:15 ip-xxx-xx-xx-xxx openvpn[6017]: TUN/TAP TX queue length set to 100
Nov 28 07:04:15 ip-xxx-xx-xx-xxx openvpn[6017]: do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Nov 28 07:04:15 ip-xxx-xx-xx-xxx openvpn[6017]: /sbin/ip link set dev tun1 up mtu 1500
Nov 28 07:04:15 ip-xxx-xx-xx-xxx openvpn[6017]: /sbin/ip addr add dev tun1 local 10.4.0.1 peer 10.4.0.2
Nov 28 07:04:15 ip-xxx-xx-xx-xxx openvpn[6017]: Listening for incoming TCP connection on [undef]
Nov 28 07:05:07 ip-xxx-xx-xx-xxx dhclient[2142]: XMT: Solicit on eth0, interval 114160ms.
Nov 28 07:07:02 ip-xxx-xx-xx-xxx dhclient[2142]: XMT: Solicit on eth0, interval 111630ms.
Nov 28 07:08:53 ip-xxx-xx-xx-xxx dhclient[2142]: XMT: Solicit on eth0, interval 129400ms.
Nov 28 07:11:03 ip-xxx-xx-xx-xxx dhclient[2142]: XMT: Solicit on eth0, interval 125890ms.
Nov 28 07:11:08 ip-xxx-xx-xx-xxx openvpn[6017]: TCP connection established with [AF_INET]xx.xxx.xxx.xx:47388

2.
[oconf=server]
port 443
proto tcp-server
dev tun1
ifconfig 10.4.0.1 10.4.0.2
status server-tcp.log
verb 3
secret  ovpn.key

mwandelaar

I guess you have multiple issues together:
First of all you're connected via wifi to the network. This means that the router gives you an internal IP-address AND keeps a state-table for your sockets and network-address-translation (NAT) in memory. Due to the disconnection, the router drops this state-table. As your pc and the server are not aware of this, they keep sending packets to each other, but they are not valid anymore or do not arrive there destination. (Bad encapsulation error on the server)

Second is OpenVPN. As you are using a static key, there is no need to do a crypto-handshake and openvpn (client and server) keeps sending packets to each other, so the process will not notify if there's an error on the crypto-layer. After a while the socket on the ip-layer reaches a time-out and the process will restart and you can setup a connection again. This can take a serious amount of time.

Solutions:
The easy way: Correctly disconnect openvpn before disconnection from wifi
The "hard" way: Start using certificates where openvpn needs to renegotiate session-keys and set the --reneg-sec and --keepalive options to usefull values.
See the manpage for more info on that.

TinCanTech

mwandelaar wroteSecond is OpenVPN. As you are using a static key, there is no need to do a crypto-handshake and openvpn (client and server) keeps sending packets to each other, so the process will not notify if there's an error on the crypto-layer. After a while the socket on the ip-layer reaches a time-out and the process will restart and you can setup a connection again. This can take a serious amount of time.

However:

SAYERS42 wroteproto tcp-server

With TCP a disconnection via time out should be less than a minute ..

TinCanTech

mwandelaar wroteThe "hard" way: Start using certificates

I would also recommend this.

SAYERS42

First of all, thank you very much for the help! But how exactly would I go about doing this?

SAYERS42

Update: I tried to use the command

$ --keepalive 5 10

but it tells me that I have to define a tun/tap device. What am I missing?

SAYERS42

Update again. I have figured out how to put the keepalive option in the config file and I set it so I wait a max of 150 seconds. Thanks for the help. For those who are looking at this. This is my new conf file for the server. As you can see I put the keepalive option after the dev tun1, making it send a ping every 50 seconds and waits 100 seconds for a response. If it does not answer the ping within that time it will reset the connection, allowing me to reconnect.

[oconf=server]
port 443
proto tcp-server
dev tun1
keepalive 50 100
ifconfig 10.4.0.1 10.4.0.2
status server-tcp.log
verb 3
secret  ovpn.key