multiple ROUTING_TABLE entries in status file

romaubou

Hello,
I need help about a problem encountered on my openvpn server. Only one client is connected to this server.

In our status file on my server, we have these lines:
TITLE,OpenVPN 2.3.4 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Nov 12 2015
TIME,Thu Oct 12 10:56:42 2017,1507798602
HEADER,CLIENT_LIST,Common Name,Real Address,Virtual Address,Bytes Received,Bytes Sent,Connected Since,Connected Since (time_t),Username
CLIENT_LIST,.....
HEADER,ROUTING_TABLE,Virtual Address,Common Name,Real Address,Last Ref,Last Ref (time_t)
ROUTING_TABLE,8e:78:b8:46:ce:fc,client_name,public_ip:port,Thu Oct 12 09:25:15 2017,1507793115
ROUTING_TABLE,96:ba:99:4c:fc:48,client_name,public_ip:port,Thu Oct 12 06:43:30,1507783517
GLOBAL_STATS,Max bcast/mcast queue length,1

We have two entries for the same client. And if we wait a long time, the ROUTING_TABLE increase, reach 256 entries and stop vpn connection. I must restart openvpn server to clear all ROUTING_TABLE entries.

A ROUTING_TABLE entry is added after we have a inactivity timeout on the client and a new connection is done:
Oct 12 06:43:20 linux client_name[2648]: [OpenVPN Server] Inactivity timeout (--ping-restart), restarting
Oct 12 06:43:20 linux client_name[2648]: TCP/UDP: Closing socket
Oct 12 06:43:20 linux client_name[2648]: /sbin/ip route del 10.x.x.x metric 20
Oct 12 06:43:20 linux client_name[2648]: Closing TUN/TAP interface
Oct 12 06:43:20 linux client_name[2648]: /sbin/ip addr del dev tap
Oct 12 06:43:20 linux client_name[2648]: SIGUSR1[soft,ping-restart] received,

My question is : why server keeps old entry ROUTING_TABLE when new connection is established after the timeout ??

My client configuration :
remote @public_ip
port @port
proto udp
pull
dev tap14
ping 10
comp-lzo
verb 4
mute 10
tls-client
pkcs12 client_name.p12

My server configuration:
local @local_ip
port @port
proto udp
dev tap1

# Certificats
cd /etc/openvpn
ca /etc/vpnusers/ca.crt
cert /etc/vpnusers/inter.crt
key /etc/vpnusers/inter.key
crl-verify /etc/vpnusers/crl.pem
dh /etc/vpnusers/dh1024.pem

mode server

server @IP @MASK
route @IP @MASK

;ifconfig 10.0.0.1 255.255.255.0
;ifconfig-pool 10.0.0.100 10.0.0.200
;ifconfig-pool-persist /etc/openvpn/ipp.txt

float

;learn-address /etc/openvpn/script

client-to-client

mtu-test
#tun-mtu 1500
#tun-mtu-extra 32
#mssfix 1450

tls-server
;tls-auth ta.key 0 # This file is secret

comp-lzo
max-clients 100

user root
group root
persist-key
persist-tun
keepalive 10 120

# Logs
status-version 2
status /var/log/server.status
log-append /var/log/server.log
verb 4
mute 20

client-config-dir /etc/openvpn/ccd/server
--script-security 3 system

client-connect /etc/Scripts/script.sh
client-disconnect /etc/Scripts/script.sh

Thank you for your help.

TinCanTech

Try adding to the client:

explicit-exit-notify 3

See --explicit-exit-notify in The Manual v24x

romaubou

I already tried with this option

explicit-exit-notify 1

But the problem was still present.

I will try with explicit-exit-notify 3 but i'm not sure it will be different from explicit-exit-notify 1

TinCanTech

romaubou wrote I will try with explicit-exit-notify 3 but i'm not sure it will be different from explicit-exit-notify 1

You have no --explicit-exit-notify, read the manual carefully ..
The default=1 is only enabled if --explicit-exit-notify is present in the config. (it is also pushable)

* Note: I do not know if this will help, it is just a hunch ..

romaubou

Ok, thank you.

I applied the parameter explicit-exit-notify 3 on the client and I will check if the problem will reappear.

For information, if I restart the client, it causes the same problem (additionnal ROUTING_TABLE entry on server without delete the old entry). So i don't know if the problem is tied with client configuration.

romaubou

I just check, the problem is still present with this option:

On the server : less /var/log/file.status

TITLE,OpenVPN 2.3.4 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Nov 12 2015
TIME,Thu Oct 12 17:43:40 2017,1507823020
HEADER,CLIENT_LIST,Common Name,Real Address,Virtual Address,Bytes Received,Bytes Sent,Connected Since,Connected Since (time_t),Username
CLIENT_LIST,...
HEADER,ROUTING_TABLE,Virtual Address,Common Name,Real Address,Last Ref,Last Ref (time_t)
ROUTING_TABLE,5e:a3:f0:97:2e:74,client_name,public_ip:port,Thu Oct 12 17:36:25 2017,1507822585
ROUTING_TABLE,1a:89:9b:55:77:3f,client_name,public_ip:port,Thu Oct 12 17:24:13 2017,1507821853
ROUTING_TABLE,06:a6:4c:bf:49:b1,client_name,public_ip:port,Thu Oct 12 17:29:38 2017,1507822178
GLOBAL_STATS,Max bcast/mcast queue length,0
END

TinCanTech

Can you please post your complete server log @ verb 4
(please remove any private information)

Let the server build up a couple of those routing entries.

romaubou

We encountered the problem last night at 00:10am.
We have a new entry on the /var/log/file.status on our server :

TITLE,OpenVPN 2.3.4 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Nov 12 2015
TIME,Wed Oct 25 09:32:43 2017,1508916763
HEADER,CLIENT_LIST,Common Name,Real Address,Virtual Address,Bytes Received,Bytes Sent,Connected Since,Connected Since (time_t),Username
CLIENT_LIST,
HEADER,ROUTING_TABLE,Virtual Address,Common Name,Real Address,Last Ref,Last Ref (time_t)
ROUTING_TABLE,@mac,@client_name,@client_public_ip:@port,Wed Oct 25 00:10:41 2017,1508883041
ROUTING_TABLE,@mac,@client_name,@client_public_ip:@port,Tue Oct 17 10:37:27 2017,1508229447
GLOBAL_STATS,Max bcast/mcast queue length,0
END

You will find also the log file :

Wed Oct 25 00:10:37 2017 us=645170 @client_name/@client_public_ip:@port 1759 variation(s) on previous 20 message(s) suppressed by --mute
Wed Oct 25 00:10:37 2017 us=645257 @client_name/@client_public_ip:@port TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Wed Oct 25 00:10:37 2017 us=645268 @client_name/@client_public_ip:@port TLS Error: TLS handshake failed
Wed Oct 25 00:10:39 2017 us=659933 @client_name/@client_public_ip:@port TLS: new session incoming connection from [AF_INET]@client_public_ip:@port
Wed Oct 25 00:10:39 2017 us=777294 @client_name/@client_public_ip:@port CRL CHECK OK: C=@C, ST=@ST, L=@L, O=@O, emailAddress=@mail
Wed Oct 25 00:10:39 2017 us=777362 @client_name/@client_public_ip:@port VERIFY OK: depth=1, C=@C, ST=@ST, L=@L, O=@O, emailAddress=@mail
Wed Oct 25 00:10:39 2017 us=777555 @client_name/@client_public_ip:@port CRL CHECK OK: C=@C, ST=@ST, O=@O, CN=@CN, emailAddress=@mail
Wed Oct 25 00:10:39 2017 us=777612 @client_name/@client_public_ip:@port VERIFY OK: depth=0, C=@C, ST=@ST, O=@O, CN=@CN, emailAddress=@mail
Wed Oct 25 00:10:39 2017 us=789129 @client_name/@client_public_ip:@port Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Oct 25 00:10:39 2017 us=789150 @client_name/@client_public_ip:@port Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Oct 25 00:10:39 2017 us=789202 @client_name/@client_public_ip:@port Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Wed Oct 25 00:10:39 2017 us=789214 @client_name/@client_public_ip:@port Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed Oct 25 00:10:39 2017 us=789236 @client_name/@client_public_ip:@port TLS: move_session: dest=TM_ACTIVE src=TM_UNTRUSTED reinit_src=1
Wed Oct 25 00:10:39 2017 us=789401 @client_name/@client_public_ip:@port TLS: tls_multi_process: untrusted session promoted to semi-trusted
Wed Oct 25 00:10:39 2017 us=800787 @client_name/@client_public_ip:@port Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 1024 bit RSA
Wed Oct 25 00:10:41 2017 us=884285 @client_name/@client_public_ip:@port PUSH: Received control message: 'PUSH_REQUEST'
Wed Oct 25 00:10:41 2017 us=884910 @client_name/@client_public_ip:@port send_push_reply(): safe_cap=940
Wed Oct 25 00:10:41 2017 us=884936 @client_name/@client_public_ip:@port SENT CONTROL [@client_name]: 'PUSH_REPLY,route-gateway @route-gw,ping 10,ping-restart 120,route @IP @NETMASK vpn_gateway 20,ifconfig @IP @NETMASK' (status=1)
Wed Oct 25 00:10:41 2017 us=903731 @client_name/@client_public_ip:@port MULTI: Learn: @mac -> @client_name/@client_public_ip:@port

TinCanTech

Try using --ccd-exclusive in your server config.