connection ok, forwarding gets lost

xundeenergie

Hi there!

Hello, I'm new to this forum. I have a small vpn-network between some servers for rent in a datacenter, two laptops, a small homenetwork with a rock64 (somthing similar to a raspi), on which the openvpn-client is the entrypoint to this homenet. The homenet is connected throug a fritzbox to the internet.
The homenet has it's own DNS-Server on the fritzbox with domain "fritz.box" and the ip-range 192.168.178.0/24.

My vpn has 10.0.100.0/24. In my vpn is also a bind9 dns-server in the datacenter for the own domain mydomain.example.

From my laptop i can reach over vpn my printer and pc in my homenet with printer.fritz.box and even printer.mydomain.example (so i can print from elsewhere secured everytime on my homeprinter).

Everything workes fine.

But there is a problem. Sometimes the connection breaks down. That means, i cannot reach the computers/printers in my homenet, or can't reach my dns, ldap... from my homenet over vpn.

Checking the ip on the rock64 shows me a correct vpn-ip. On the rock64 i can reach my hosts in the datacenter over vpn and the hosts/printers in my homenet. It looks like, the forwarding on the rock64 breaks down. In the logs is really nothing extraordinary. No firewall-changes, no routing-changes, no ip-changes... nothing.

when i restart openvpn-client on my rock64, all the hosts can reacht every other host in vpn and homenet.

My setup allows to reach a news-server in the datacenter (leafnode) from the wlan at home without openvpn-connection from the hosts. To reach this newsserver from work or in the train (mobile internet), i have to start the openvpn-connection.

The breakdown happens sometimes after a few mintues or it takes 2 days... but it comes.

What can i do?

The config on this client is (this clients ip is fixed with 10.0.100.6):

client
dev tun
proto udp
remote *.*.*.178 443
resolv-retry infinite
nobind
persist-key
persist-tun
mute-replay-warnings
remote-cert-tls server
tls-auth ta.key 1
key-direction 1
reneg-sec 0
link-mtu 1472
mssfix
auth-user-pass vpn-creds
cipher AES-256-CBC
auth SHA256
verb 3
mute 20
keepalive 3 10
script-security 2
up /etc/openvpn/update-systemd-resolved
down /etc/openvpn/update-systemd-resolved
down-pre
<ca>
-----BEGIN CERTIFICATE-----
....

The openvpn-servers config is:

port 443
proto udp
dev tun
link-mtu 1472
mssfix 1500
ca ca.crt
cert server.crt
key server.key # This file should be kept secret
dh dh2048.pem
topology subnet
server 10.0.100.0 255.255.255.0
ifconfig-pool-persist ipp.txt
route 192.168.178.0 255.255.255.0 10.0.100.6
route 10.0.100.0 255.255.255.0
push "route 10.1.100.0 255.255.255.0"
push "route 192.168.178.0 255.255.255.0"
client-config-dir ccd
push "dhcp-option DNS 10.0.100.2"
push "dhcp-option DNS 10.0.100.1"
push "dhcp-option DOMAIN mydomain.example"
push "dhcp-option DOMAIN vpn"
client-to-client
keepalive 300 1200
tls-auth ta.key 0 # This file is secret
reneg-sec 0
cipher AES-256-CBC
auth SHA256
compress lz4-v2
push "compress lz4-v2"
persist-key
persist-tun
status openvpn-status.log
push "explicit-exit-notify 3"
verb 1
explicit-exit-notify 1
script-security 2
client-connect "/etc/openvpn/update-dns add"
client-disconnect "/etc/openvpn/update-dns remove"
auth-user-pass-verify /etc/openvpn/auth-ldap.py via-file

For this client is a config in the ccd (client config directory):

iroute 192.168.178.0 255.255.255.0

Does someone has any idea, where i can start my search?

xundeenergie

TinCanTech

xundeenergie wrote Does someone has any idea, where i can start my search?

Your log files .. set --verb 4

xundeenergie

That is all from the log with verb 4.

I started the openvpn-client. Than it worked the whole day long (even after this PID_ERR.
Now in the evening the forwarding stopped working.

Apr 05 15:41:16 virgo systemd[1]: Started OpenVPN tunnel for virgo.
Apr 06 06:29:46 virgo openvpn[24930]: PID_ERR replay-window backtrack occurred [5] [SSL-0] [000___0000000000000000000000000000000000000000000000000000000000] 0:1846481 0:1846476 t=1554524986[0] r=[-4,64,15,5,1]

I tried a dig in my home-lan on my dns in the vpn for a host in the vpn. The dns is not reachable.
Restarted openvpn-client on the rock64, and the dig delivers a correct result. The dns in the vpn is reachable.

In the logs is nothing, The same as i told you before.

bg

waltonpeter88

when we are printing something with the connection of devices. suddenly printer not printing. many times I faced these issues than so that for resolving this issue I used to take help from Hp tech support they help me to resolve these issues.