Hey there, I've ran into the following problem with OpenVPN client (OpenVPN 2.4.7 on Debian Buster)
I'm using systemd-networkd (mostly because of its built-in feature to rename network interfaces) to configure machine's network interfaces, using networkd's built-in DHCP client and connecting to a commercial VPN provider with OpenVPN. Connection gets established just fine and initially everything works but after some time VPN connection always hangs and never recovers, despite --ping-restart, with a log like this:
Mon Dec 23 21:29:18 2019 us=281436 Initialization Sequence Completed
Mon Dec 23 22:19:00 2019 us=811398 Recursive routing detected, drop tun packet to [AF_INET]XXX.XXX.XXX.XXX:1195
Mon Dec 23 22:19:00 2019 us=883427 Recursive routing detected, drop tun packet to [AF_INET]XXX.XXX.XXX.XXX:1195
Mon Dec 23 22:19:01 2019 us=131163 Recursive routing detected, drop tun packet to [AF_INET]XXX.XXX.XXX.XXX:1195
Mon Dec 23 22:19:01 2019 us=131231 Recursive routing detected, drop tun packet to [AF_INET]XXX.XXX.XXX.XXX:1195
... (a bunch more of recursive routing errors) ...
Mon Dec 23 22:20:00 2019 us=374879 Recursive routing detected, drop tun packet to [AF_INET]XXX.XXX.XXX.XXX:1195
Mon Dec 23 22:20:00 2019 us=374967 [server] Inactivity timeout (--ping-restart), restarting
Mon Dec 23 22:20:00 2019 us=375323 TCP/UDP: Closing socket
Mon Dec 23 22:20:00 2019 us=375392 SIGUSR1[soft,ping-restart] received, process restarting
Mon Dec 23 22:20:00 2019 us=375466 Restart pause, 5 second(s)
...
(client tries to reestablish connection but never succeeds)
Correlating with other system logs, the hang ups always happen precisely when DHCP lease gets renewed by networkd:
Dec 23 22:19:00 systemd-networkd[273]: eth0: DHCP lease lost
Dec 23 22:19:00 systemd-networkd[273]: eth0: DHCPv4 address 192.168.1.159/24 via 192.168.1.1
I've tried different OpenVPN configuration options, nothing helped. For reference last config I tried was like this:
client
dev tun
proto udp
remote XXX 1195
cipher AES-256-CBC
nobind
persist-key
persist-tun
remote-cert-tls server
sndbuf 524288
rcvbuf 524288
fast-io
auth-user-pass up
tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-256-CBC-SHA
comp-lzo no
ping 10
ping-restart 60
verb 4
<ca>
...
</ca>
Then I've switched to dhclient and the problem went away - DHCP lease renewals stopped breaking my VPN connection.
I suspect there's some bug in OpenVPN and/or systemd-netword here that prevents them from playing along with each other.
