Hi all, This is a proof of concept test using fixed ip's and a static key. It's point to point only using udp across the internet. I control both client and server machines (both Win7 64bit), as well as the routers between both end points. No VM's are in use. No software firewall's are in place. I am using non standard ports and (in this case) 10.8.30.1 and .2 for server and client respectfully. With apologies I'm posting almost full logs with privacy edits only. With this exact configuration I periodically receive replay warnings and/or Connection reset by peer (WSAECONNRESET) (code=10054). I appreciate the prior could be caused by udp and a virtual box, but I'm not using one for this test. I also (believe) the connection reset is caused by a firewall - so I've made sure there are non in place here. I don't understand why there are ping-restarts though... I'm guessing I've screwed up, but I don't see where. The only thing I can think of is my non-standard porting ot IP's are causing issues. I'm honestly just not sure. In order I'm supplying: Server, Client configs, then server, client logs. Again, my apologies for the lengthy logs, but I didn't want miss anything that might be relevant. [oconf=server]port 11154 proto udp dev tun ifconfig 10.8.30.1 10.8.30.2 secret "C:\\Program Files\\OpenVPN\\config\\static.key" cipher AES-256-CBC auth-nocache keepalive 5 30 ; persist-key persist-tun status openvpn-status.log verb 4 mute 5 explicit-exit-notify 1[/oconf] [oconf=client]dev tun proto udp remote xxx.xxx.xxx.xxx 11154 ifconfig 10.8.30.2 10.8.30.1 secret "C:\\Program Files\\OpenVPN\\config\\static.key" auth-nocache cipher AES-256-CBC resolv-retry infinite persist-tun verb 4[/oconf] server log: Tue Oct 24 16:22:54 2017 us=229779 disabling NCP mode (--ncp-disable) because not in P2MP client or server mode Tue Oct 24 16:22:54 2017 us=231279 Current Parameter Settings: Tue Oct 24 16:22:54 2017 us=231279 config = 'C:\Program Files\OpenVPN\config\server-xxx.ovpn' Tue Oct 24 16:22:54 2017 us=231279 mode = 0 Tue Oct 24 16:22:54 2017 us=231279 show_ciphers = DISABLED Tue Oct 24 16:22:54 2017 us=231279 show_digests = DISABLED Tue Oct 24 16:22:54 2017 us=231279 NOTE: --mute triggered... Tue Oct 24 16:22:54 2017 us=231279 286 variation(s) on previous 5 message(s) suppressed by --mute Tue Oct 24 16:22:54 2017 us=231279 OpenVPN 2.4.4 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Sep 26 2017 Tue Oct 24 16:22:54 2017 us=231279 Windows version 6.1 (Windows 7) 64bit Tue Oct 24 16:22:54 2017 us=231279 library versions: OpenSSL 1.0.2l 25 May 2017, LZO 2.10 Tue Oct 24 16:22:54 2017 us=231779 Outgoing Static Key Encryption: Cipher 'AES-256-CBC' initialized with 256 bit key Tue Oct 24 16:22:54 2017 us=231779 Outgoing Static Key Encryption: Using 160 bit message hash 'SHA1' for HMAC authentication Tue Oct 24 16:22:54 2017 us=231779 Incoming Static Key Encryption: Cipher 'AES-256-CBC' initialized with 256 bit key Tue Oct 24 16:22:54 2017 us=231779 Incoming Static Key Encryption: Using 160 bit message hash 'SHA1' for HMAC authentication Tue Oct 24 16:22:54 2017 us=235780 interactive service msg_channel=0 Tue Oct 24 16:22:54 2017 us=235780 open_tun Tue Oct 24 16:22:54 2017 us=236780 TAP-WIN32 device [Local Area Connection 2] opened: \\.\Global\{52A1289D-6653-4AC0-8173-81CADB9E070C}.tap Tue Oct 24 16:22:54 2017 us=236780 TAP-Windows Driver Version 9.21 Tue Oct 24 16:22:54 2017 us=236780 TAP-Windows MTU=1500 Tue Oct 24 16:22:54 2017 us=241780 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.30.1/255.255.255.252 on interface {52A1289D-6653-4AC0-8173-81CADB9E070C} [DHCP-serv: 10.8.30.2, lease-time: 31536000] Tue Oct 24 16:22:54 2017 us=241780 Successful ARP Flush on interface [17] {52A1289D-6653-4AC0-8173-81CADB9E070C} Tue Oct 24 16:22:54 2017 us=247281 do_ifconfig, tt->did_ifconfig_ipv6_setup=0 Tue Oct 24 16:22:54 2017 us=247281 Data Channel MTU parms [ L:1560 D:1450 EF:60 EB:396 ET:0 EL:3 ] Tue Oct 24 16:22:54 2017 us=247281 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1560,tun-mtu 1500,proto UDPv4,ifconfig 10.8.30.2 10.8.30.1,cipher AES-256-CBC,auth SHA1,keysize 256,secret' Tue Oct 24 16:22:54 2017 us=247281 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1560,tun-mtu 1500,proto UDPv4,ifconfig 10.8.30.1 10.8.30.2,cipher AES-256-CBC,auth SHA1,keysize 256,secret' Tue Oct 24 16:22:54 2017 us=247281 Could not determine IPv4/IPv6 protocol. Using AF_INET6 Tue Oct 24 16:22:54 2017 us=247281 Socket Buffers: R=[8192->8192] S=[8192->8192] Tue Oct 24 16:22:54 2017 us=247781 setsockopt(IPV6_V6ONLY=0) Tue Oct 24 16:22:54 2017 us=247781 UDPv6 link local (bound): [AF_INET6][undef]:11154 Tue Oct 24 16:22:54 2017 us=247781 UDPv6 link remote: [AF_UNSPEC] [b]Tue Oct 24 16:23:24 2017 us=789159 Inactivity timeout (--ping-restart), restarting Tue Oct 24 16:23:24 2017 us=789159 TCP/UDP: Closing socket Tue Oct 24 16:23:24 2017 us=789159 SIGUSR1[soft,ping-restart] received, process restarting Tue Oct 24 16:23:24 2017 us=789159 Restart pause, 5 second(s) [/b]Tue Oct 24 16:23:29 2017 us=789294 Outgoing Static Key Encryption: Cipher 'AES-256-CBC' initialized with 256 bit key Tue Oct 24 16:23:29 2017 us=789294 Outgoing Static Key Encryption: Using 160 bit message hash 'SHA1' for HMAC authentication Tue Oct 24 16:23:29 2017 us=789294 Incoming Static Key Encryption: Cipher 'AES-256-CBC' initialized with 256 bit key Tue Oct 24 16:23:29 2017 us=789294 Incoming Static Key Encryption: Using 160 bit message hash 'SHA1' for HMAC authentication Tue Oct 24 16:23:29 2017 us=789794 Preserving previous TUN/TAP instance: Local Area Connection 2 Tue Oct 24 16:23:29 2017 us=789794 Data Channel MTU parms [ L:1560 D:1450 EF:60 EB:396 ET:0 EL:3 ] Tue Oct 24 16:23:29 2017 us=789794 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1560,tun-mtu 1500,proto UDPv4,ifconfig 10.8.30.2 10.8.30.1,cipher AES-256-CBC,auth SHA1,keysize 256,secret' Tue Oct 24 16:23:29 2017 us=789794 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1560,tun-mtu 1500,proto UDPv4,ifconfig 10.8.30.1 10.8.30.2,cipher AES-256-CBC,auth SHA1,keysize 256,secret' Tue Oct 24 16:23:29 2017 us=789794 Could not determine IPv4/IPv6 protocol. Using AF_INET6 Tue Oct 24 16:23:29 2017 us=789794 Socket Buffers: R=[8192->8192] S=[8192->8192] Tue Oct 24 16:23:29 2017 us=789794 setsockopt(IPV6_V6ONLY=0) Tue Oct 24 16:23:29 2017 us=789794 UDPv6 link local (bound): [AF_INET6][undef]:11154 Tue Oct 24 16:23:29 2017 us=789794 UDPv6 link remote: [AF_UNSPEC] [b]Tue Oct 24 16:23:31 2017 us=62456 Peer Connection Initiated with [AF_INET6]::ffff:60.241.224.65:39673 Tue Oct 24 16:23:31 2017 us=62456 Initialization Sequence Completed Tue Oct 24 16:24:57 2017 us=459427 Inactivity timeout (--ping-restart), restarting Tue Oct 24 16:24:57 2017 us=459427 TCP/UDP: Closing socket Tue Oct 24 16:24:57 2017 us=459427 SIGUSR1[soft,ping-restart] received, process restarting Tue Oct 24 16:24:57 2017 us=459427 Restart pause, 5 second(s)[/b] Tue Oct 24 16:25:02 2017 us=459562 Outgoing Static Key Encryption: Cipher 'AES-256-CBC' initialized with 256 bit key Tue Oct 24 16:25:02 2017 us=459562 Outgoing Static Key Encryption: Using 160 bit message hash 'SHA1' for HMAC authentication Tue Oct 24 16:25:02 2017 us=459562 Incoming Static Key Encryption: Cipher 'AES-256-CBC' initialized with 256 bit key Tue Oct 24 16:25:02 2017 us=459562 Incoming Static Key Encryption: Using 160 bit message hash 'SHA1' for HMAC authentication Tue Oct 24 16:25:02 2017 us=459562 Preserving previous TUN/TAP instance: Local Area Connection 2 Tue Oct 24 16:25:02 2017 us=460062 Data Channel MTU parms [ L:1560 D:1450 EF:60 EB:396 ET:0 EL:3 ] Tue Oct 24 16:25:02 2017 us=460062 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1560,tun-mtu 1500,proto UDPv4,ifconfig 10.8.30.2 10.8.30.1,cipher AES-256-CBC,auth SHA1,keysize 256,secret' Tue Oct 24 16:25:02 2017 us=460062 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1560,tun-mtu 1500,proto UDPv4,ifconfig 10.8.30.1 10.8.30.2,cipher AES-256-CBC,auth SHA1,keysize 256,secret' Tue Oct 24 16:25:02 2017 us=460062 Could not determine IPv4/IPv6 protocol. Using AF_INET6 Tue Oct 24 16:25:02 2017 us=460062 Socket Buffers: R=[8192->8192] S=[8192->8192] Tue Oct 24 16:25:02 2017 us=460062 setsockopt(IPV6_V6ONLY=0) Tue Oct 24 16:25:02 2017 us=460062 UDPv6 link local (bound): [AF_INET6][undef]:11154 Tue Oct 24 16:25:02 2017 us=460062 UDPv6 link remote: [AF_UNSPEC] [b]Tue Oct 24 16:25:32 2017 us=46319 Inactivity timeout (--ping-restart), restarting Tue Oct 24 16:25:32 2017 us=46319 TCP/UDP: Closing socket Tue Oct 24 16:25:32 2017 us=46319 SIGUSR1[soft,ping-restart] received, process restarting Tue Oct 24 16:25:32 2017 us=46319 Restart pause, 5 second[/b] Client log: Tue Oct 24 16:23:33 2017 us=789103 OpenVPN 2.4.2 i686-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on May 11 2017 Tue Oct 24 16:23:33 2017 us=789103 Windows version 6.1 (Windows 7) 32bit Tue Oct 24 16:23:33 2017 us=789103 library versions: OpenSSL 1.0.2k 26 Jan 2017, LZO 2.10 Enter Management Password: Tue Oct 24 16:23:33 2017 us=793986 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25347 Tue Oct 24 16:23:33 2017 us=794962 Need hold release from management interface, waiting... Tue Oct 24 16:23:34 2017 us=99662 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25347 Tue Oct 24 16:23:34 2017 us=203181 MANAGEMENT: CMD 'state on' Tue Oct 24 16:23:34 2017 us=204158 MANAGEMENT: CMD 'log all on' Tue Oct 24 16:23:34 2017 us=592845 MANAGEMENT: CMD 'echo all on' Tue Oct 24 16:23:34 2017 us=608470 MANAGEMENT: CMD 'hold off' Tue Oct 24 16:23:34 2017 us=612377 MANAGEMENT: CMD 'hold release' Tue Oct 24 16:23:34 2017 us=614330 Outgoing Static Key Encryption: Cipher 'AES-256-CBC' initialized with 256 bit key Tue Oct 24 16:23:34 2017 us=614330 Outgoing Static Key Encryption: Using 160 bit message hash 'SHA1' for HMAC authentication Tue Oct 24 16:23:34 2017 us=614330 Incoming Static Key Encryption: Cipher 'AES-256-CBC' initialized with 256 bit key Tue Oct 24 16:23:34 2017 us=614330 Incoming Static Key Encryption: Using 160 bit message hash 'SHA1' for HMAC authentication Tue Oct 24 16:23:34 2017 us=616283 interactive service msg_channel=0 Tue Oct 24 16:23:34 2017 us=616283 open_tun Tue Oct 24 16:23:34 2017 us=621166 TAP-WIN32 device [Local Area Connection 2] opened: \\.\Global\{8E91DAA7-93B4-46EC-9AA8-64B74C82322D}.tap Tue Oct 24 16:23:34 2017 us=621166 TAP-Windows Driver Version 9.21 Tue Oct 24 16:23:34 2017 us=621166 TAP-Windows MTU=1500 Tue Oct 24 16:23:34 2017 us=629955 Notified TAP-Windows driver to set a DHCP IP/netmask of 10.8.30.2/255.255.255.252 on interface {8E91DAA7-93B4-46EC-9AA8-64B74C82322D} [DHCP-serv: 10.8.30.1, lease-time: 31536000] Tue Oct 24 16:23:34 2017 us=656324 Successful ARP Flush on interface [18] {8E91DAA7-93B4-46EC-9AA8-64B74C82322D} Tue Oct 24 16:23:34 2017 us=664136 do_ifconfig, tt->did_ifconfig_ipv6_setup=0 Tue Oct 24 16:23:34 2017 us=664136 MANAGEMENT: >STATE:1508822614,ASSIGN_IP,,10.8.30.2,,,, Tue Oct 24 16:23:34 2017 us=664136 Data Channel MTU parms [ L:1560 D:1450 EF:60 EB:396 ET:0 EL:3 ] Tue Oct 24 16:23:34 2017 us=664136 Local Options String (VER=V4): 'V4,dev-type tun,link-mtu 1560,tun-mtu 1500,proto UDPv4,ifconfig 10.8.30.1 10.8.30.2,cipher AES-256-CBC,auth SHA1,keysize 256,secret' Tue Oct 24 16:23:34 2017 us=664136 Expected Remote Options String (VER=V4): 'V4,dev-type tun,link-mtu 1560,tun-mtu 1500,proto UDPv4,ifconfig 10.8.30.2 10.8.30.1,cipher AES-256-CBC,auth SHA1,keysize 256,secret' Tue Oct 24 16:23:34 2017 us=664136 TCP/UDP: Preserving recently used remote address: [AF_INET]xxipxx:11154 Tue Oct 24 16:23:34 2017 us=664136 Socket Buffers: R=[8192->8192] S=[8192->8192] Tue Oct 24 16:23:34 2017 us=664136 UDP link local (bound): [AF_INET][undef]:1194 Tue Oct 24 16:23:34 2017 us=664136 UDP link remote: [AF_INET]xxipxx:11154 Tue Oct 24 16:23:36 2017 us=340959 read UDP: Connection reset by peer (WSAECONNRESET) (code=10054) Tue Oct 24 16:23:44 2017 us=81490 Peer Connection Initiated with [AF_INET]xxipxx:11154 Tue Oct 24 16:23:49 2017 us=107074 TEST ROUTES: 0/0 succeeded len=0 ret=1 a=0 u/d=up Tue Oct 24 16:23:49 2017 us=107074 Initialization Sequence Completed Tue Oct 24 16:23:49 2017 us=107074 MANAGEMENT: >STATE:1508822629,CONNECTED,SUCCESS,10.8.30.2,xxipxx,11154,, I am getting s connection *most times*, but sometimes it will continually try to connect unsuccessfully. Many thanks in advance.

[quote=net.admin post_id=73696 time=1508825932 user_id=41981] It's point to point [/quote]No .. in fact, you are using --[b]topology net30[/b] (the default) See --[b]topology[/b] in [url=https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage]The Manual v24x[/url] Note: Windows does not support a true point-to-point tunnel which is why net30 is the default. Hint: You cannot use the ifconfig parameters you have chosen. I would use the example config files, read the howto and set up the standard tunnel. As you are using 2.4 you can use all the new features, like: --tls-cipher and --ncp-ciphers .. 8-)

Hi TCT, I called it point to point because I have a single client and server interface - sorry, I was trying to explain the usage, but appreciate my terminology was incorrect. I actually get that it's /30 by default, and I'm using Windows clients, which is why I used .1 & .2 in the 10.8.30.0 network (being the only usable ip's). I thought that actually was correct usage, instead of (for example) using 10.8.30.100 which is outside the usable clients for a /30. I wasn't aware I had to use 10.8.0.1 (or 10.1.0.1) and .2 exclusively..? This was the example I started with: # Sample OpenVPN configuration file for # using a pre-shared static key. dev tun # Our remote peer remote mypeer.mydomain # 10.1.0.1 is our local VPN endpoint # 10.1.0.2 is our remote VPN endpoint ifconfig 10.1.0.1 10.1.0.2 # Our pre-shared static key secret static.key I expanded from there with the keepalive, auth-nocache and increased cipher just from reading the warnings and messages in the logs as I went along. The persist-tun was added to help keep the connection active and to reconnect if it dropped out. I changed the ip (but stayed in a /30) and the port after I had it working with the default config. I have read a little about tls-cipher, but didn't want to experiment further until I had a stable bases to do so - which is why I thought I had used a very simple setup to test with. So, as you can see I'm quite confused as to what I've done wrong despite trying to actually solve my own problem. When you say I cannot use the ifconfig parameters I have chosen, are you referring to the ip endpoints I have used? If I switch back to 10.1.0.0 or 10.8.0.0 (/30) will that make my connections less prone to the issues I'm reporting? Cheers for your help.

What you are trying to do is "classic point-to-point" which Windows cannot do. Therefore, you must adhere to --[b]topology net30[/b] or the more user friendly --[b]topology subnet[/b]. [b]ifconfig parameters[/b]: [list]NET30 [list=2]Server : ifconfig 10.8.0.1 10.8.0.2 [*]Client : ifconfig 10.8.0.6 10.8.0.5 (this is the recommended way though it [i]looks[/i] backward) Each VPN node (server or client) uses it's own NET30 subnet eg. (S) 10.8.0.0/30 vs (C) 10.8.0.4/30[/list] [*]SUBNET [list=2]Server : ifconfig 10.8.0.1 255.255.255.0 [*]Client : ifconfig 10.8.0.2 255.255.255.0 Each VPN node (server or client) uses the same subnet (as specified by the netmask) eg. (S) 10.8.0.1/24 vs (C) 10.8.0.2/24[/list] [/list] Once again, I recommend you start with the example config files.

Thanks TCT, Yay windows... I didn't realise it couldn't do it. I'll changed back to 10.8.0.1 and 2 to adhere to net30. I'll read up on topology subnet after I get it working properly. Is there any issue with using port numbers as I have done? Cheers

[quote=TinCanTech post_id=73716 time=1508857217 user_id=37053] [b]ifconfig parameters[/b]: [list]NET30 [list=2]Server : ifconfig 10.8.0.1 10.8.0.2 [*]Client : ifconfig 10.8.0.6 10.8.0.5 (this is the recommended way though it [i]looks[/i] backward) Each VPN node (server or client) uses it's own NET30 subnet eg. (S) 10.8.0.0/30 vs (C) 10.8.0.4/30[/list] [/quote] Just to clarify; if I'm using 10.8.0.1 for the server and 10.8.0.2 for the client, the correct server config is ifconfig 10.8.0.1 10.8.0.2 and the client is the same except in the reverse order of 10.8.0.2 10.8.0.1 (showing local first). I just want to make sure I'm not supposed to be using ifconfig 10.8.0.1 10.8.0.2 on the server & ifconfig 10.8.0.6 10.8.0.5 on the client.

Was I not explicit enough ? [quote=net.admin post_id=73718 time=1508859294 user_id=41981] I'm using 10.8.0.1 for the server and 10.8.0.2 for the client [/quote]Wrong. [quote=net.admin post_id=73718 time=1508859294 user_id=41981] I'm not supposed to be using ifconfig 10.8.0.1 10.8.0.2 on the server & ifconfig 10.8.0.6 10.8.0.5 on the client [/quote]Yes you are ! :o Why waste your time on this setup when most of the new features are unavailable to you ? Start with the example configs !

Okay. I've clearly misunderstood the syntax for ifconfig in a simple point to point tunnel. I thought it to be ifconfig 'local endpoint' 'remote endpoint' on the sever, with the reverse on the client.

[quote="Quoth the Raven"]--[b]topology mode[/b] [list] Configure virtual addressing topology when running in --dev tun mode. This directive has no meaning in --dev tap mode, which always uses a subnet topology. If you set this directive on the server, the --server and --server-bridge directives will automatically push your chosen topology setting to clients as well. This directive can also be manually pushed to clients. Like the --dev directive, this directive must always be compatible between client and server. mode can be one of: [b]net30[/b] -- Use a point-to-point topology, by allocating one /30 subnet per client. This is designed to allow point-to-point semantics [b]when some or all of the connecting clients might be Windows systems[/b]. This is the default on OpenVPN 2.0. [b]p2p[/b] -- Use a point-to-point topology where the remote endpoint of the client's tun interface always points to the local endpoint of the server's tun interface. This mode allocates a single IP address per connecting client. [b]Only use when ** [i]none[/i] ** of the connecting clients are Windows systems[/b]. This mode is functionally equivalent to the --ifconfig-pool-linear directive which is available in OpenVPN 2.0, is deprecated and will be removed in OpenVPN 2.5 [b]subnet[/b] -- Use a subnet rather than a point-to-point topology by configuring the tun interface with a local IP address and subnet mask, similar to the topology used in --dev tap and ethernet bridging mode. This mode allocates a single IP address per connecting client and works on Windows as well. Only available when server and clients are OpenVPN 2.1 or higher, or OpenVPN 2.0.x which has been manually patched with the --topology directive code. When used on Windows, requires version 8.2 or higher of the TAP-Win32 driver. When used on *nix, requires that the tun driver supports an ifconfig(8) command which sets a subnet instead of a remote endpoint IP address. This option exists in OpenVPN 2.1 or higher. Note: Using --topology subnet changes the interpretation of the arguments of --ifconfig to mean "address netmask", no longer "local remote". [/list][/quote]

Does that mean this howto is now outdated? https://openvpn.net/index.php/open-source/documentation/miscellaneous/78-static-key-mini-howto.html It's the example I started with, which included: "Server configuration file dev tun ifconfig 10.8.0.1 10.8.0.2 secret static.key Client configuration file remote myremote.mydomain dev tun ifconfig 10.8.0.2 10.8.0.1 secret static.key"

I never actually tried this in Windows .. but it does say it will work, so maybe I am wrong.

[Resolved] Connection issues with point to point test.

net.admin

Turns out the issue was the router and an inability to handle udp packets when it was busy. An interim solution was to switch from udp to tcp as the protocol. ie:

change: proto udp
to: proto tcp-client (and tcp-server respectfully).

I've read there are reasons not to use tcp if possible, but in this case I had to. Doing so resolved the connection issues. The tunnel has been up for days, disconnected and reconnected - all without issue. Also, I've noted the packet loss with udp was around 0.5% in my case. With tcp it's less than 0.1%. I can leave a ping running overnight and have zero timeouts with tcp, the same wasn't the case with udp. My plan is to swap out the tplink router with something that can handle more throughput. The one that's in place now isn't bad, just not up to the task.

If there's anything else to note in this thread I'll add it - or if an admin wants to close it I'm good with that to 🙂

« Previous Page