I have a OVPN client setup in pfsense, and it is constantly disconnecting then reconnecting. any idea what is causing this? Here are my logs, and my custom options are below.
Mar 26 12:53:57 openvpn 16767 OpenVPN 2.3.14 amd64-portbld-freebsd10.3 [SSL (OpenSSL)] [LZO] [MH] [IPv6] built on Feb 15 2017
Mar 26 12:53:57 openvpn 16767 library versions: OpenSSL 1.0.1s-freebsd 1 Mar 2016, LZO 2.09
Mar 26 12:53:57 openvpn 17008 MANAGEMENT: unix domain socket listening on /var/etc/openvpn/client3.sock
Mar 26 12:53:57 openvpn 17008 mlockall call succeeded
Mar 26 12:53:57 openvpn 17008 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Mar 26 12:53:57 openvpn 17008 Initializing OpenSSL support for engine 'rdrand'
Mar 26 12:53:57 openvpn 17008 Control Channel Authentication: using '/var/etc/openvpn/client3.tls-auth' as a OpenVPN static key file
Mar 26 12:53:57 openvpn 17008 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Mar 26 12:53:57 openvpn 17008 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Mar 26 12:53:57 openvpn 17008 Socket Buffers: R=[42080->42080] S=[57344->57344]
Mar 26 12:53:57 openvpn 17008 UDPv4 link local (bound): [AF_INET]203.XXX.XXX.XXX
Mar 26 12:53:57 openvpn 17008 UDPv4 link remote: [AF_INET]103.XXX.XXX.XXX:443
Mar 26 12:53:57 openvpn 17008 TLS: Initial packet from [AF_INET]103.XXX.XXX.XXX:443, sid=f1a7d26d 3ecec750
Mar 26 12:53:57 openvpn 17008 VERIFY OK: depth=1, C=IT, ST=IT, L=Perugia, O=airvpn.org, CN=airvpn.org CA, emailAddress=
Mar 26 12:53:57 openvpn 17008 Validating certificate key usage
Mar 26 12:53:57 openvpn 17008 ++ Certificate has key usage 00a0, expects 00a0
Mar 26 12:53:57 openvpn 17008 VERIFY KU OK
Mar 26 12:53:57 openvpn 17008 Validating certificate extended key usage
Mar 26 12:53:57 openvpn 17008 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Mar 26 12:53:57 openvpn 17008 VERIFY EKU OK
Mar 26 12:53:57 openvpn 17008 VERIFY OK: depth=0, C=IT, ST=IT, L=Perugia, O=airvpn.org, CN=Cebalrai, emailAddress=
Mar 26 12:53:58 openvpn 17008 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Mar 26 12:53:58 openvpn 17008 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mar 26 12:53:58 openvpn 17008 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Mar 26 12:53:58 openvpn 17008 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mar 26 12:53:58 openvpn 17008 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 4096 bit RSA
Mar 26 12:53:58 openvpn 17008 [Cebalrai] Peer Connection Initiated with [AF_INET]103.16.27.25:443
Mar 26 12:54:00 openvpn 17008 SENT CONTROL [Cebalrai]: 'PUSH_REQUEST' (status=1)
Mar 26 12:54:00 openvpn 17008 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 10.4.0.1,comp-lzo no,route-gateway 10.4.0.1,topology subnet,ping 10,ping-restart 60,ifconfig 10.4.2.215 255.255.0.0,peer-id 13'
Mar 26 12:54:00 openvpn 17008 Options error: option 'redirect-gateway' cannot be used in this context ([PUSH-OPTIONS])
Mar 26 12:54:00 openvpn 17008 Options error: option 'dhcp-option' cannot be used in this context ([PUSH-OPTIONS])
Mar 26 12:54:00 openvpn 17008 OPTIONS IMPORT: timers and/or timeouts modified
Mar 26 12:54:00 openvpn 17008 OPTIONS IMPORT: LZO parms modified
Mar 26 12:54:00 openvpn 17008 OPTIONS IMPORT: --ifconfig/up options modified
Mar 26 12:54:00 openvpn 17008 OPTIONS IMPORT: route-related options modified
Mar 26 12:54:00 openvpn 17008 OPTIONS IMPORT: peer-id set
Mar 26 12:54:00 openvpn 17008 OPTIONS IMPORT: adjusting link_mtu to 1561
Mar 26 12:54:00 openvpn 17008 TUN/TAP device ovpnc3 exists previously, keep at program end
Mar 26 12:54:00 openvpn 17008 TUN/TAP device /dev/tun3 opened
Mar 26 12:54:00 openvpn 17008 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Mar 26 12:54:00 openvpn 17008 /sbin/ifconfig ovpnc3 10.4.2.215 10.4.0.1 mtu 1500 netmask 255.255.0.0 up
Mar 26 12:54:00 openvpn 17008 /sbin/route add -net 10.4.0.0 10.4.0.1 255.255.0.0
Mar 26 12:54:00 openvpn 17008 /usr/local/sbin/ovpn-linkup ovpnc3 1500 1561 10.4.2.215 255.255.0.0 init
Mar 26 12:54:00 openvpn 17008 Initialization Sequence Completed
Mar 26 12:54:45 openvpn 17008 MANAGEMENT: Client connected from /var/etc/openvpn/client3.sock
Mar 26 12:54:45 openvpn 17008 MANAGEMENT: CMD 'state 1'
Mar 26 12:54:45 openvpn 17008 MANAGEMENT: CMD 'status 2'
Mar 26 12:54:45 openvpn 17008 MANAGEMENT: Client disconnected
Mar 26 12:54:55 openvpn 17008 MANAGEMENT: Client connected from /var/etc/openvpn/client3.sock
Mar 26 12:54:55 openvpn 17008 MANAGEMENT: CMD 'state 1'
Mar 26 12:54:55 openvpn 17008 MANAGEMENT: CMD 'status 2'
Mar 26 12:54:55 openvpn 17008 MANAGEMENT: Client disconnected
Mar 26 12:55:00 openvpn 17008 MANAGEMENT: Client connected from /var/etc/openvpn/client3.sock
Mar 26 12:55:00 openvpn 17008 MANAGEMENT: CMD 'state 1'
Mar 26 12:55:00 openvpn 17008 MANAGEMENT: CMD 'status 2'
Mar 26 12:55:00 openvpn 17008 MANAGEMENT: Client disconnected
Custom options:
##### CLIENT OPTIONS #####;
server-poll-timeout 10 ### When polling possible remote servers to connect to in a round-robin fashion, spend no more than n seconds waiting for a response before trying the next server. ###;
###explicit-exit-notify 5;
client;
##### TUNNEL OPTIONS #####;
### Use Multple "remote" entries with the according entry IP address of your favorite servers ###;
### other than the server entered in the "Server Host or Address" entry above and pfSense ###;
### will automatically recconnect in a round robin fashion if the server you are connected to ###;
### goes down or is having quality issues. Edit and uncomment the fake lines below or add your own. ###;
###remote XX.XX.XX.XX 443 ###AirVPN_US-Atlanta-Georgia_Kaus_UDP-443###;
###remote XXX.XX.XX.XXX 2018 ###AirVPN_US-Miami_Acamar_UDP-2018###;
###remote XXX.XX.XX.XXX 2018 ###AirVPN_US-Miami_Yildun_UDP-2018###;
###remote XX.XX.XX.XX 53 ###AirVPN_US-Miami_Cursa_UDP-53###;
###remote XXX.XX.XX.XX 443 ###AirVPN_CA-Dheneb_UDP-443###;
###remote XXX.XX.XXX.XXX 443 ###AirVPN_CA-Saiph_UDP-443###;
###rcvbuf 262144;
###sndbuf 262144;
mlock ### Using this option ensures that key material and tunnel data are never written to disk due to virtual memory paging operations which occur under most modern operating systems. ###;
fast-io ### Optimize TUN/TAP/UDP I/O writes by avoiding a call to poll/epoll/select prior to the write operation. ###;
###tun-mtu 1500;
###mssfix 1450;
###keepalive 5 15;
##### DATA CHANNEL ENCRYPTION OPTIONS #####;
key-direction 1;
keysize 256 ### Size of key from cipher ###;
###prng SHA512 64 ### (Pseudo-random number generator) ALG = SHA1,SHA256,SHA384,SHA512 | NONCE = 16-64 ###;
prng SHA1 64;
### replay-window n [t] ### Default = replay-window 64 15 ###;
### mute-replay-warnings;
cipher AES-256-CBC;
##### TLS MODE OPTIONS #####;
tls-version-min 1.2 ### set the minimum TLS version we will accept from the peer ###;
key-method 2 ### client generates a random key ###;
###tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384 ### Use TLS-DHE-RSA-WITH-AES-256-CBC-SHA if GCM fails. ###;
tls-cipher TLS-DHE-RSA-WITH-AES-256-CBC-SHA;
tls-timeout 2 ### Default = 2 ###;
###ns-cert-type server ### Require that peer certificate was signed with an explicit nsCertType designation of "client" or "server". ###;
remote-cert-tls server ###Require that peer certificate was signed with an explicit key usage and extended key usage based on RFC3280 TLS rules. ###;
### reneg-sec 3600;
