dwfallin
i have a server (leaf bering router) running openvpn 2.4.4 and 2 clients, 1 running AdvancedTomato, ovpn: 2.4.1 and the other is DDWRT (didn't get the version - probably fairly dated). tunnels have been up for years, lan-to-lan, everything lovely. then my keys expired so i loaded up easyrsa and generated a new batch, but now - whenever one of those 2 clients tries to connect, it gets through proto negotiation and then stops responding (to local pings)? requires a power off/power on. seems bizarre, especially due to 2 different os/hardware devices. last bit of logs look like:
Client:
…
Mon May 7 23:35:29 2018 us=402259 UDP WRITE [22] to [AF_INET]A.B.C.D:1194: P_ACK_V1 kid=0 sid=18367ffa 4b36a227 [ 5 sid=febcb6a8 56a43725 ]
Mon May 7 23:35:29 2018 us=402836 UDP write returned 22
Mon May 7 23:35:29 2018 us=403401 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 1024 bit RSA
Mon May 7 23:35:29 2018 us=403908 [vpn.css1.net] Peer Connection Initiated with [AF_INET]A.B.C.D:1194
Server:
…
May 8 04:35:28 fwcss ovpn-server[30533]: UDPv4 read returned 22
May 8 04:35:28 fwcss ovpn-server[30533]: X.Y.Z.Q:47425 UDPv4 READ [22] from [AF_INET]X.Y.Z.Q:47425: P_ACK_V1 kid=0 sid=18367ffa 4b36a227 [ 5 sid=febcb6a8 56a43725 ]
May 8 04:35:28 fwcss ovpn-server[30533]: X.Y.Z.Q:47425 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 1024 bit RSA
May 8 04:35:28 fwcss ovpn-server[30533]: X.Y.Z.Q:47425 [brt.css1.net] Peer Connection Initiated with [AF_INET]X.Y.Z.Q:47425
May 8 04:35:28 fwcss ovpn-server[30533]: brt.css1.net/X.Y.Z.Q:47425 MULTI_sva: pool returned IPv4=10.8.0.6, IPv6=(Not enabled)
May 8 04:35:28 fwcss ovpn-server[30533]: brt.css1.net/X.Y.Z.Q:47425 MULTI: Learn: 10.8.0.6 -> brt.css1.net/X.Y.Z.Q:47425
May 8 04:35:28 fwcss ovpn-server[30533]: brt.css1.net/X.Y.Z.Q:47425 MULTI: primary virtual IP for brt.css1.net/X.Y.Z.Q:47425: 10.8.0.6
anything look outta whack there? time is off by close to a second, but i would thing negotiation would fail if that was significant. any help would be appreciated.
