Adaptive does not work with OpenVPN Connect 3.0.2 on iOS 12.1

olafman1

The OpenVPN Connect 3.0.2 iOS client when set to adaptive does not switch from UDP to TCP like the OpenVPN Connect Mac client (2.5.0) does.

The client config for both the Mac and iOS client has two entries (priority to UDP) like this:

remote vpn.example.com 443 udp
remote vpn.example.com 8443 tcp

When the iOS client is set to UDP it works, when it is set to TCP it works. When I stop UDP on the OpenVPN server and set the iOS client to adaptive I see only UDP attempts looking at a packet capture in front of my server. Even with a 2 minute timeout, the iOS client never fails over from UDP to TCP while the Mac client does after about 10 seconds. When testing the client is in the same location where manually selecting TCP or UDP works and traffic is seen on the packet capture in front of the server, so nothing is blocked on the network.

Are there any tricks to make adaptive work here or is this a new/known issue?

TinCanTech

Please post your client log file.

olafman1

This is with the UDP service stopped on my server so only TCP is listening.

-------------------------------------------------

2018-12-06 10:04:51 1

2018-12-06 10:04:51 ----- OpenVPN Start -----
OpenVPN core 3.2 ios arm64 64-bit PT_PROXY built on Oct 3 2018 06:35:04

2018-12-06 10:04:51 Frame=512/2048/512 mssfix-ctrl=1250

2018-12-06 10:04:51 UNUSED OPTIONS
5 [resolv-retry] [infinite]
6 [nobind]
7 [user] [nobody]
8 [group] [nogroup]
9 [persist-key]
10 [persist-tun]
16 [verb] [3]

2018-12-06 10:04:51 EVENT: RESOLVE

2018-12-06 10:04:51 Contacting [w.x.y.z]:443/UDP via UDP

2018-12-06 10:04:51 EVENT: WAIT

2018-12-06 10:04:51 Connecting to [vpn.example.com]:443 (w.x.y.z) via UDPv4

2018-12-06 10:05:01 Server poll timeout, trying next remote entry...

2018-12-06 10:05:01 EVENT: RECONNECTING

2018-12-06 10:05:01 EVENT: RESOLVE

2018-12-06 10:05:01 Contacting [w.x.y.z]:443/UDP via UDP

2018-12-06 10:05:01 EVENT: WAIT

2018-12-06 10:05:01 Connecting to [vpn.example.com]:443 (w.x.y.z) via UDPv4

2018-12-06 10:05:11 Server poll timeout, trying next remote entry...

2018-12-06 10:05:11 EVENT: RECONNECTING

2018-12-06 10:05:11 EVENT: RESOLVE

2018-12-06 10:05:11 Contacting [w.x.y.z]:443/UDP via UDP

2018-12-06 10:05:11 EVENT: WAIT

2018-12-06 10:05:11 Connecting to [vpn.example.com]:443 (w.x.y.z) via UDPv4

2018-05-06 10:05:22 EVENT: CONNECTION_TIMEOUT [ERR]

2018-05-06 10:05:22 Raw stats on disconnect:
BYTES_OUT : 1620
PACKETS_OUT : 30
CONNECTION_TIMEOUT : 1
N_RECONNECT : 2

2018-05-06 10:05:22 Performance stats on disconnect:
CPU usage (microseconds): 63326
Network bytes per CPU second: 25581
Tunnel bytes per CPU second: 0

2018-05-06 10:05:22 EVENT: DISCONNECTED

2018-05-06 10:05:22 Raw stats on disconnect:
BYTES_OUT : 1620
PACKETS_OUT : 30
CONNECTION_TIMEOUT : 1
N_RECONNECT : 2

2018-05-06 10:05:22 Performance stats on disconnect:
CPU usage (microseconds): 64199
Network bytes per CPU second: 25234
Tunnel bytes per CPU second: 0

olafman1

This is with UDP stopped on the webserver so only TCP is listening.

2018-12-06 10:04:51 1

2018-12-06 10:04:51 ----- OpenVPN Start -----
OpenVPN core 3.2 ios arm64 64-bit PT_PROXY built on Oct  3 2018 06:35:04

2018-12-06 10:04:51 Frame=512/2048/512 mssfix-ctrl=1250

2018-12-06 10:04:51 UNUSED OPTIONS
5 [resolv-retry] [infinite] 
6 [nobind] 
7 [user] [nobody] 
8 [group] [nogroup] 
9 [persist-key] 
10 [persist-tun] 
16 [verb] [3] 

2018-12-06 10:04:51 EVENT: RESOLVE

2018-12-06 10:04:51 Contacting [x.x.x.x]:443/UDP via UDP

2018-12-06 10:04:51 EVENT: WAIT

2018-12-06 10:04:51 Connecting to [vpn.example.com]:443 (x.x.x.x) via UDPv4

2018-12-06 10:05:01 Server poll timeout, trying next remote entry...

2018-12-06 10:05:01 EVENT: RECONNECTING

2018-12-06 10:05:01 EVENT: RESOLVE

2018-12-06 10:05:01 Contacting [x.x.x.x]:443/UDP via UDP

2018-12-06 10:05:01 EVENT: WAIT

2018-12-06 10:05:01 Connecting to [vpn.example.com]:443 (x.x.x.x) via UDPv4

2018-12-06 10:05:11 Server poll timeout, trying next remote entry...

2018-12-06 10:05:11 EVENT: RECONNECTING

2018-12-06 10:05:11 EVENT: RESOLVE

2018-12-06 10:05:11 Contacting [x.x.x.x]:443/UDP via UDP

2018-12-06 10:05:11 EVENT: WAIT

2018-12-06 10:05:11 Connecting to [vpn.example.com]:443 (x.x.x.x) via UDPv4


2018-05-06 10:05:22 EVENT: CONNECTION_TIMEOUT [ERR]

2018-05-06 10:05:22 Raw stats on disconnect:
  BYTES_OUT : 1620
  PACKETS_OUT : 30
  CONNECTION_TIMEOUT : 1
  N_RECONNECT : 2

2018-05-06 10:05:22 Performance stats on disconnect:
  CPU usage (microseconds): 63326
  Network bytes per CPU second: 25581
  Tunnel bytes per CPU second: 0

2018-05-06 10:05:22 EVENT: DISCONNECTED

2018-05-06 10:05:22 Raw stats on disconnect:
  BYTES_OUT : 1620
  PACKETS_OUT : 30
  CONNECTION_TIMEOUT : 1
  N_RECONNECT : 2

2018-05-06 10:05:22 Performance stats on disconnect:
  CPU usage (microseconds): 64199
  Network bytes per CPU second: 25234
  Tunnel bytes per CPU second: 0

orbitarm

Try adding

server-poll-timeout 1

to your config file. It will try to connect to each remote sequentially for 1 second, which is a pseudo-adaptive setup. I've been using it for years and it works great.

TinCanTech

The problem here is not the time taken
but that openvpn is not transitioning to the next --remote
IE:

olafman1 wrote the iOS client never fails over from UDP to TCP while the Mac client does after about 10 seconds

This does sound like a bug .. but this is the only report so far and needs to be verified.

I wonder what happens if you change the --remote without changing the --proto ?
Try the same setup but with a second UDP port ..

olafman1

I tested with the same protocol different ports and the same result, only the first remote entry is ever tried while adaptive is selected.

##Partial OpenVPN client config
remote server.example.com 443 udp
remote server.example.com 1194 udp

I only see connection attempts to port 443, nothing ever to 1194. The client log also shows connection attempts only to port 443 which is the first remote entry.

TinCanTech

I recommend you raise this as a possible bug:
https://community.openvpn.net/openvpn/wiki/TitleIndex

olafman1

Thanks TinCanTech for the feedback. Opened https://community.openvpn.net/openvpn/ticket/1154#ticket.