Hello everyone.
To connect to our LAN, remote clients are using OpenVPN 2.4.6 x86_64-w64-mingw32. They need client certs and user authentication (with openvpn-auth-ldap on the server). They can connect and use the VPN normally, routes are added as expected and everything is fine.
The problem is that when they quit the VPN by clicking on "disconnect", either the server doesn't receive the termination signaling or the client doesn't send it at all. I'm gessing it's the latter, because when using the mobile app OpenVPN Connect (v3.0.5) the disconnecting client is logged with SIGTERM and right on time.
Disconnected Windows clients will be logged by the server only after 240 seconds with:
Wed Nov 14 10:01:27 2018 mike.miller/1.2.3.4:1194 [mike.miller] Inactivity timeout (--ping-restart), restarting
Wed Nov 14 10:01:27 2018 mike.miller/1.2.3.4:1194 SIGUSR1[soft,ping-restart] received, client-instance restarting
Is this caused by any misconfiguration on either side?
The server config:
dev tun
local xx.xx.xx.xx
port 1194
proto udp
mode server
tls-server
topology subnet
push "topology subnet"
ifconfig 10.120.1.1 255.255.255.0
ifconfig-pool 10.120.1.2 10.120.1.254
route-gateway 10.120.1.1
push "route-gateway 10.120.1.1"
dh /etc/openvpn/dh4096.pem
ca /etc/openvpn/cacert.pem
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key
cipher AES-256-CBC
script-security 2
username-as-common-name
plugin /usr/lib64/openvpn/plugins/openvpn-auth-ldap.so "/etc/openvpn/ldap-auth.config"
client-config-dir /etc/openvpn/ccd
push "dhcp-option DNS 192.168.120.10"
client-to-client
keepalive 10 120
comp-lzo
persist-key
persist-tun
resolv-retry infinite
user nobody
group nobody
verb 3
status /var/log/openvpn/server-status.log
log-append /var/log/openvpn/server.log
push "route 192.168.120.0 255.255.255.0"
The clients config:
dev tun
remote vpn.mydomain.com
port 1194
proto udp
tls-client
ca cacert.pem
cert client.crt
key client.key
cipher AES-256-CBC
auth-user-pass
pull
keepalive 10 120
comp-lzo
persist-key
persist-tun
resolv-retry infinite
Thanks for the help!
