MULTI: new incoming connection would exceed maximum number o

gemal

We are seeing this in our log at the OpenVPN server:
"MULTI: new incoming connection would exceed maximum number of clients (60)"

in my server config I have:
# Max number of clients
max-clients 1000

I'm running on a Windows 2003 and dont know how to get rid of this error

OpenVPN 2.1_rc19 i686-pc-mingw32 [SSL] [LZO2] [PKCS11] built on Jul 16 2009

Is there a limit of 60 clients if the OpenVPN server is running in TCP mode?

krzee

have you solved this yet? if not upgrade to 2.1.1 at http://openvpn.net/download and report back

gemal

krzee wrotehave you solved this yet? if not upgrade to 2.1.1 at http://openvpn.net/download and report back

I tried to upgrade to 2.1.1 and still got the same problem.

According to some sources it's a limitation in OpenVPN when it's running in TCP mode on Windows.

My solution was to add a second OpenVPN interface running on a different port.

So basically you can only have 60 clients connecting to your OpenVPN server if you are running TCP on Windows. So
60 clients connecting to 10.4.0.0 on port 1194
60 clients connecting to 10.5.0.0 on port 1195
60 clients connecting to 10.6.0.0 on port 1196

If you have found a better solution I like to hear from you.

[deleted]

gemal wrote
krzee wrotehave you solved this yet? if not upgrade to 2.1.1 at http://openvpn.net/download and report back
I tried to upgrade to 2.1.1 and still got the same problem.

According to some sources it's a limitation in OpenVPN when it's running in TCP mode on Windows.

My solution was to add a second OpenVPN interface running on a different port.

So basically you can only have 60 clients connecting to your OpenVPN server if you are running TCP on Windows. So
60 clients connecting to 10.4.0.0 on port 1194
60 clients connecting to 10.5.0.0 on port 1195
60 clients connecting to 10.6.0.0 on port 1196

If you have found a better solution I like to hear from you.

I have never heard of this before, I will check into this some more.

gemal

Douglas wrote
gemal wrote
krzee wrotehave you solved this yet? if not upgrade to 2.1.1 at http://openvpn.net/download and report back
I tried to upgrade to 2.1.1 and still got the same problem.

According to some sources it's a limitation in OpenVPN when it's running in TCP mode on Windows.

My solution was to add a second OpenVPN interface running on a different port.

So basically you can only have 60 clients connecting to your OpenVPN server if you are running TCP on Windows. So
60 clients connecting to 10.4.0.0 on port 1194
60 clients connecting to 10.5.0.0 on port 1195
60 clients connecting to 10.6.0.0 on port 1196

If you have found a better solution I like to hear from you.
I have never heard of this before, I will check into this some more.

From:
http://readlist.com/lists/lists.sourceforge.net/openvpn-users/0/2383.html:

It looks like the 2000 max_clients setting is getting overridden in we_init and
getting set to WSA_MAXIMUM_WAIT_EVENTS, which is 64, minus 4. My understanding
is this is a hardcoded limit built into the windows kernel. The 60 client limit
is determined by subtracting extra_events (set to BASE_N_EVENTS, or 4) from it.

krzee

me and dougy just heard back from the openvpn team, and they believe that post you gave is still valid.
It is a windows problem, so nothing openvpn can do to fix it.
It is because Windows has an internal limit on the maximum number of events that can be waited on by one process.

just a side-note:
**Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. Why TCP Over TCP Is A Bad Idea: http://sites.inka.de/~bigred/devel/tcp-tcp.html

gemal

krzee wroteme and dougy just heard back from the openvpn team, and they believe that post you gave is still valid.
It is a windows problem, so nothing openvpn can do to fix it.
It is because Windows has an internal limit on the maximum number of events that can be waited on by one process.

just a side-note:
**Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. Why TCP Over TCP Is A Bad Idea: http://sites.inka.de/~bigred/devel/tcp-tcp.html

So how do I convert my setup to something different?

My main thing is that I need the client to specify their own IP addresses. Help 🙂

My setup/need is very basic. I need to connect a bunch of clients to the openvpn server. All clients needs to be able to specify their own VPN IP address.

Help 🙂 ?

ecrist

Simply change TCP to UDP in your configs. If you have a firewall, correct the protocol there, as well.

That's all you need.

[deleted]

gemal wrote
krzee wroteme and dougy just heard back from the openvpn team, and they believe that post you gave is still valid.
It is a windows problem, so nothing openvpn can do to fix it.
It is because Windows has an internal limit on the maximum number of events that can be waited on by one process.

just a side-note:
**Sometimes you cannot avoid tunneling over tcp, but if you can avoid it, DO. Why TCP Over TCP Is A Bad Idea: http://sites.inka.de/~bigred/devel/tcp-tcp.html
So how do I convert my setup to something different?

My main thing is that I need the client to specify their own IP addresses. Help 🙂

My setup/need is very basic. I need to connect a bunch of clients to the openvpn server. All clients needs to be able to specify their own VPN IP address.

Help 🙂 ?

Static NAT IP is easily achievable via a ccd entry.

krzee

Douglas wrote Static NAT IP is easily achievable via a ccd entry.

Dougy means a static VPN ip. use --ifconfig-push in a ccd entry for a static ip for the vpn client
example: ifconfig-push 10.8.0.6 255.255.255.0

"ccd" is entries that are basically included into server.conf, but only for the specified client based on common-name. use --client-config-dir <dir> to enable it, then put the config options for the client in <dir>/common-name

krzee

ecrist wroteSimply change TCP to UDP in your configs. If you have a firewall, correct the protocol there, as well.

That's all you need.

ecrist, this means that that limitation is only for TCP?

rutdan

is this a problem on all windows based servers, on windows 2008R2 also?