openvpn server with 300 connections

bhandari_nikhil

I have an openvpn server with 300 active client connections. If I bringup the 300 connections one by one, they are happily coming up. But when I reboot the server machine and it comes back up, not all the clients are able to connect back. I keep seeing authentication failure messages (could not authenticate in 60 seconds). I see that most of the clients are sending requestes at once which the server might not be able to reply. Is there a way of exponential backoff on client or something like that ? Or how else this problem can be solved ?

Pippin

Please see:
https://engineering.freeagent.com/2017/05/22/external-authentication-scripts-in-openvpn-the-right-way/
https://github.com/fac/auth-script-openvpn
https://github.com/mozilla-it/openvpn_defer_auth

TinCanTech

Also see --connect-freq in the manual.

bhandari_nikhil

TinCanTech wrote Also see --connect-freq in the manual.

Thanks for the information. I tried connect-freq option on my server and all the connections came up slowly (as slowly as I initiated them earlier. I kept the frequency as 2 per second). What are the default values if we do not use connect-freq ?

bhandari_nikhil

Pippin wrote Please see:
https://engineering.freeagent.com/2017/05/22/external-authentication-scripts-in-openvpn-the-right-way/
https://github.com/fac/auth-script-openvpn
https://github.com/mozilla-it/openvpn_defer_auth

I am not using any external user-password kind of script to authenticate. It is just tls based authentication.

Pippin

Also take a look at

--connect-retry n [max]

TinCanTech

bhandari_nikhil wrote What are the default values if we do not use connect-freq ?

Too many for you. Probably "as many as try" ..

bhandari_nikhil

I tried increasing/decreasing connect-retry and connect-freq parameters but they do not seem to make any difference. Does the underlying hardware matter ? I am running openvpn on a VM instance. But I believe 300 should be achievable.