Bug report - OpenVPN 2.4.0-I602 not stable !!

Babylonia

Bug report:
- OpenVPN-Server running on a Synology NAS (by Synology VPN-server package) ----- fibreglass WAN internet connection 100+ Mbps
- OpenVPN Client installed on a PC - Windows 8 ----- (75 km distance to server) ----- fibreglass WAN internet connection 100/100 Mbps

Lastly installed openvpn-install-2.4.0-I602.exe to my PC under Windows 8
Unfortunately this version is not stable. When connecting to VPN-server installed by a friend on his Synology NAS, downloading of heavy files (movie), after about 20-30 seconds the VPN-connection is lost and the VPN Client Login menu is pop-up again, to re-connect.
Every 20-30 seconds the connection is lost and I have to re-connect.

Went back to openvpn-install-2.3.14-I602-x86_64.exe
This version brings no problem.
Very stable connection and straight "fixed" download speed of 10.6 - 10.7 MegaBYTE p/s = about 84.8 - 85.6 Megabit p/s
(Also more previous OpenVPN versions I used before during about 1.5 year never got problems).

TinCanTech

Babylonia wroteOpenVPN-Server running on a Synology NAS

<s>

about 20-30 seconds the VPN-connection is lost

Please see:
HOWTO: Request Help !

** Originally Posted in Access Server **

Babylonia

I don't need help, as I have found the solution already just by using the previous OpenVPN package.
Only want to give report for this latest version as I think OpenVPN developers are fond to get such messages if software is not running as supposed.

Don't know which version (engine) Synology is using for OpenVPN. (At least Linux based).
Latest package see release notes of the Synology VPN-server package Version: 1.3.5-2757:
https://www.synology.com/en-us/releaseNote/VPNCenter

TinCanTech

If you set --verb 4 in your client config and read your log you will probably find the reason ..

It is a counter measure to SWEET32.

Pippin

As for Synology, they still did not do anything to mitigate SWEET32.
Babylonia can read on the Dutch forum 😉
OpenVPN version depends on combination type DS and version of VPN Center but is maximum 2.3.11 for a DS and 2.3.14 for Syno router, at least the last time I looked.

Check through SSH to be sure:

openvpn --version

If you set --verb 4 in your client config and read your log you will probably find the reason ..

Probably, yes.
This is their standard server config: dev tun

management 127.0.0.1 1195

server 10.8.0.0 255.255.255.0

push "route 10.8.0.0 255.255.255.0"

dh /var/packages/VPNCenter/target/etc/openvpn/keys/dh3072.pem
ca /var/packages/VPNCenter/target/etc/openvpn/keys/ca.crt
cert /var/packages/VPNCenter/target/etc/openvpn/keys/server.crt
key /var/packages/VPNCenter/target/etc/openvpn/keys/server.key

max-clients 5

comp-lzo

persist-tun
persist-key

verb 3

#log-append /var/log/openvpn.log

keepalive 10 60
reneg-sec 0

plugin /var/packages/VPNCenter/target/lib/radiusplugin.so /var/packages/VPNCenter/target/etc/openvpn/radiusplugin.cnf
client-cert-not-required
username-as-common-name
duplicate-cn

status /tmp/ovpn_status_2_result 30
status-version 2
proto udp6

TinCanTech

Pippin wroteAs for Synology, they still did not do anything to mitigate SWEET32

Openvpn 2.4.0 (or 2.3.14) will set --reneg-bytes 64000000 (~64MB) as the client regardless of the server version where cipher with small block size is detected. This overrides normal defaults ..

Pippin wroteThis is their standard server config:

server 10.8.0.0 255.255.255.0
push "route 10.8.0.0 255.255.255.0"

which simply means they have not read the manual .. :mrgreen:

Pippin

Yup, both correct :mrgreen: