Webserver not reachable after unknown connection from China Ip-Address

mahone

Hi there,

i have a problem since 2 weeks ago.

I use the OpenVPN AS Virtual Appliance for testing.
I got my certificate from let's encrypt.

Every few hours a chinese IP-Address connects to the webinterface on port 443.
Right after that the webinterface isnt responding anymore. No admin and no user connection to the webinterface possible.
But openvpn connection through Android and iOS is still possible while the Windows Client can not connect to the OpenVPN AS through the Windows client software.

Anybody has any idea, to look further into this problem?

./sacli status indicates no problem. Everything is "on".

I have a wireshark capture which shows some Retransmission.
92. is me and 60. china
https://imgur.com/a/dgeRl

I allways have to restart openvpnas.

Maybe somebody can help or point me in the right direction where to look.

Regards

mahone

PS: i am not a native english speaker... 😉

The Johan

I doubt the problem is with Let's Encrypt. But we have seen some issues when using PolarSSL as the library, so if you use that, switch to OpenSSL. One other thing, if your amount of OpenVPN daemons is set too high this leads to stability problems. Go to the SSL/TLS Settings page in the Admin UI and set the library to OpenSSL. Go to Server Network Settings and set the amount of UDP daemons to 4 if you have 4 CPU cores. Set the amount of TCP daemon to 4 as well if you have 4 CPU cores. If you have more or fewer CPU cores, adjust the number as needed. Do not set it higher than the amount of CPU cores your system has available.

mahone

Thx novaflash.

I will have a try with openssl.
Number of TCP/UDP daemons was already 2 with 2 cpu cores.

mahone

It looks like it was polarssl.
No problem so far after switching to openssl.

But i think this should be addressed, because you can select polarssl and run into problems like me under special circumstances.

The Johan

We've already got a build lined up with mbed TLS. Newer version, same project, different name.