Changing ccd configs does not work without restarting the service

sv

Hi everyone,

I have openvpn configuration. And I would like a static ip for vpn clients. I use ccd to configure clients.This working.
But I have a problem. When I change ip for some client or add a new configuration for a new client.

These changes do not work. This only works after restarting the service.

server: centos7, openvpn-2.4.7-1.el7.x86_64
client: centos7, openvpn-2.4.7-1.el7.x86_64

port 1194
proto udp
dev tun
ca /etc/openvpn/server/ca.crt
cert /etc/openvpn/easy-rsa/pki/issued/server.crt
key /etc/openvpn/easy-rsa/pki/private/server.key  # This file should be kept secret
dh /etc/openvpn/server/dh.pem
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
client-config-dir /etc/openvpn/server/ccd
route 10.8.0.0 255.255.255.0
keepalive 10 120
tls-auth ta.key 0 # This file is secret
cipher AES-256-CBC
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
log         openvpn.log
log-append  openvpn.log
verb 3
explicit-exit-notify 1

I created config
/etc/openvpn/server/ccd/test123

ifconfig-push 10.8.0.11 255.255.255.0

And start openvpn

tail: openvpn.log: file truncated
/sbin/ip addr add dev tun0 10.8.0.1/24 broadcast 10.8.0.255
/sbin/ip route add 10.8.0.0/24 via 10.8.0.2
RTNETLINK answers: File exists
ERROR: Linux route add command failed: external program exited with error status: 2
Could not determine IPv4/IPv6 protocol. Using AF_INET
Socket Buffers: R=[212992->212992] S=[212992->212992]
UDPv4 link local (bound): [AF_INET][undef]:1194
UDPv4 link remote: [AF_UNSPEC]
GID set to nobody
UID set to nobody
MULTI: multi_init called, r=256 v=256
IFCONFIG POOL: base=10.8.0.2 size=252, ipv6=0
ifconfig_pool_read(), in='test2,10.8.0.3', TODO: IPv6
succeeded -> ifconfig_pool_set()
ifconfig_pool_read(), in='test123,10.8.0.55', TODO: IPv6
succeeded -> ifconfig_pool_set()
IFCONFIG POOL LIST
test2,10.8.0.3
test123,10.8.0.55
Initialization Sequence Completed

I start client

[root@vpn-02 ~]# openvpn --config test123.ovpn
Thu Feb 27 19:26:24 2020 OpenVPN 2.4.7 x86_64-redhat-linux-gnu [Fedora EPEL patched] [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Feb 20 2019
Thu Feb 27 19:26:24 2020 library versions: OpenSSL 1.0.2k-fips  26 Jan 2017, LZO 2.06
Thu Feb 27 19:26:24 2020 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Feb 27 19:26:24 2020 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Feb 27 19:26:24 2020 TCP/UDP: Preserving recently used remote address: [AF_INET]88.88.88.88:1194
Thu Feb 27 19:26:24 2020 Socket Buffers: R=[212992->212992] S=[212992->212992]
Thu Feb 27 19:26:24 2020 UDP link local (bound): [AF_INET][undef]:1194
Thu Feb 27 19:26:24 2020 UDP link remote: [AF_INET]88.88.88.88:1194
Thu Feb 27 19:26:24 2020 NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay
Thu Feb 27 19:26:24 2020 TLS: Initial packet from [AF_INET]88.88.88.88:1194, sid=34340553 83d40fdb
Thu Feb 27 19:26:24 2020 VERIFY OK: depth=1, CN=vpn-01
Thu Feb 27 19:26:24 2020 VERIFY KU OK
Thu Feb 27 19:26:24 2020 Validating certificate extended key usage
Thu Feb 27 19:26:24 2020 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Thu Feb 27 19:26:24 2020 VERIFY EKU OK
Thu Feb 27 19:26:24 2020 VERIFY OK: depth=0, CN=server
Thu Feb 27 19:26:24 2020 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1558', remote='link-mtu 1557'
Thu Feb 27 19:26:24 2020 WARNING: 'comp-lzo' is present in local config but missing in remote config, local='comp-lzo'
Thu Feb 27 19:26:24 2020 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Thu Feb 27 19:26:24 2020 [server] Peer Connection Initiated with [AF_INET]88.88.88.88:1194
Thu Feb 27 19:26:25 2020 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Thu Feb 27 19:26:25 2020 PUSH: Received control message: 'PUSH_REPLY,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.8.0.11 255.255.255.0,peer-id 0,cipher AES-256-GCM'
Thu Feb 27 19:26:25 2020 OPTIONS IMPORT: timers and/or timeouts modified
Thu Feb 27 19:26:25 2020 OPTIONS IMPORT: --ifconfig/up options modified
Thu Feb 27 19:26:25 2020 OPTIONS IMPORT: route-related options modified
Thu Feb 27 19:26:25 2020 OPTIONS IMPORT: peer-id set
Thu Feb 27 19:26:25 2020 OPTIONS IMPORT: adjusting link_mtu to 1625
Thu Feb 27 19:26:25 2020 OPTIONS IMPORT: data channel crypto options modified
Thu Feb 27 19:26:25 2020 Data Channel: using negotiated cipher 'AES-256-GCM'
Thu Feb 27 19:26:25 2020 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Thu Feb 27 19:26:25 2020 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Thu Feb 27 19:26:25 2020 TUN/TAP device tun0 opened
Thu Feb 27 19:26:25 2020 TUN/TAP TX queue length set to 100
Thu Feb 27 19:26:25 2020 /sbin/ip link set dev tun0 up mtu 1500
Thu Feb 27 19:26:25 2020 /sbin/ip addr add dev tun0 10.8.0.11/24 broadcast 10.8.0.255
Thu Feb 27 19:26:25 2020 UID set to nobody
Thu Feb 27 19:26:25 2020 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Thu Feb 27 19:26:25 2020 Initialization Sequence Completed

38: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN group default qlen 100
    link/none 
    inet 10.8.0.11/24 brd 10.8.0.255 scope global tun0
       valid_lft forever preferred_lft forever
    inet6 fe80::8b9a:c085:921a:62fc/64 scope link flags 800 
       valid_lft forever preferred_lft forever

I changed ip for test123 and restart client

Thu Feb 27 19:28:04 2020 TUN/TAP TX queue length set to 100
Thu Feb 27 19:28:04 2020 /sbin/ip link set dev tun0 up mtu 1500
Thu Feb 27 19:28:04 2020 /sbin/ip addr add dev tun0 10.8.0.11/24 broadcast 10.8.0.255
Thu Feb 27 19:28:04 2020 UID set to nobody
Thu Feb 27 19:28:04 2020 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Thu Feb 27 19:28:04 2020 Initialization Sequence Completed

After restart service

MULTI: multi_init called, r=256 v=256
IFCONFIG POOL: base=10.8.0.2 size=252, ipv6=0
ifconfig_pool_read(), in='test2,10.8.0.3', TODO: IPv6
succeeded -> ifconfig_pool_set()
ifconfig_pool_read(), in='test123,10.8.0.55', TODO: IPv6
succeeded -> ifconfig_pool_set()
IFCONFIG POOL LIST
test2,10.8.0.3
test123,10.8.0.55
Initialization Sequence Completed
99.99.99.99:1194 TLS: Initial packet from [AF_INET]99.99.99.99:1194, sid=3c7a3165 9d493abc
99.99.99.99:1194 VERIFY OK: depth=1, CN=vpn-01
99.99.99.99:1194 VERIFY OK: depth=0, CN=test123
99.99.99.99:1194 peer info: IV_VER=2.4.7
99.99.99.99:1194 peer info: IV_PLAT=linux
99.99.99.99:1194 peer info: IV_PROTO=2
99.99.99.99:1194 peer info: IV_NCP=2
99.99.99.99:1194 peer info: IV_LZ4=1
99.99.99.99:1194 peer info: IV_LZ4v2=1
99.99.99.99:1194 peer info: IV_LZO=1
99.99.99.99:1194 peer info: IV_COMP_STUB=1
99.99.99.99:1194 peer info: IV_COMP_STUBv2=1
99.99.99.99:1194 peer info: IV_TCPNL=1
99.99.99.99:1194 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1557', remote='link-mtu 1558'
99.99.99.99:1194 WARNING: 'comp-lzo' is present in remote config but missing in local config, remote='comp-lzo'
99.99.99.99:1194 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
99.99.99.99:1194 [test123] Peer Connection Initiated with [AF_INET]99.99.99.99:1194
test123/99.99.99.99:1194 OPTIONS IMPORT: reading client specific options from: /etc/openvpn/server/ccd/test123
test123/99.99.99.99:1194 MULTI: Learn: 10.8.0.22 -> test123/99.99.99.99:1194
test123/99.99.99.99:1194 MULTI: primary virtual IP for test123/99.99.99.99:1194: 10.8.0.22
test123/99.99.99.99:1194 PUSH: Received control message: 'PUSH_REQUEST'
test123/99.99.99.99:1194 SENT CONTROL [test123]: 'PUSH_REPLY,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.8.0.22 255.255.255.0,peer-id 0,cipher AES-256-GCM' (status=1)
test123/99.99.99.99:1194 Data Channel: using negotiated cipher 'AES-256-GCM'
test123/99.99.99.99:1194 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
test123/99.99.99.99:1194 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key

I connect client

Thu Feb 27 19:29:30 2020 TUN/TAP device tun0 opened
Thu Feb 27 19:29:30 2020 TUN/TAP TX queue length set to 100
Thu Feb 27 19:29:30 2020 /sbin/ip link set dev tun0 up mtu 1500
Thu Feb 27 19:29:30 2020 /sbin/ip addr add dev tun0 10.8.0.22/24 broadcast 10.8.0.255
Thu Feb 27 19:29:30 2020 UID set to nobody
Thu Feb 27 19:29:30 2020 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Thu Feb 27 19:29:30 2020 Initialization Sequence Completed

40: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN group default qlen 100
    link/none 
    inet 10.8.0.22/24 brd 10.8.0.255 scope global tun0
       valid_lft forever preferred_lft forever
    inet6 fe80::760d:e2a9:7155:e672/64 scope link flags 800 
       valid_lft forever preferred_lft forever

Also I would like to add a config for a new client. But it does not work

I connected as test2

Thu Feb 27 19:32:29 2020 /sbin/ip link set dev tun0 up mtu 1500
Thu Feb 27 19:32:29 2020 
/sbin/ip addr add dev tun0 10.8.0.3/24 broadcast 10.8.0.255

I create config for test2 client into ccd

ifconfig-push 10.8.0.33 255.255.255.0

I stop and start client

openvpn --config test2.ovpn

Thu Feb 27 19:35:50 2020 /sbin/ip link set dev tun0 up mtu 1500
Thu Feb 27 19:35:50 2020 /sbin/ip addr add dev tun0 10.8.0.3/24 broadcast 10.8.0.255

42: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN group default qlen 100
    link/none 
    inet 10.8.0.3/24 brd 10.8.0.255 scope global tun0
       valid_lft forever preferred_lft forever
    inet6 fe80::c99:aac0:2906:9bde/64 scope link flags 800 
       valid_lft forever preferred_lft forever

After restarting the service, the client will have the required ip

TinCanTech

I use this feature all the time and it works flawlessly .. you must be doing something else wrong.

sv

TinCanTech wrote I use this feature all the time and it works flawlessly .. you must be doing something else wrong.

App has strange behavior. For example.I have following configuration into ccd

[root@vpn-01 ccd]# cat test123
ifconfig-push 10.8.0.10 255.255.255.0

[root@vpn-01 ccd]# cat test2 
ifconfig-push 10.8.0.11 255.255.255.0

1. Start openvpn server

2. Connect test123 client

[root@vpn-02 ~]# openvpn --config test123.ovpn
Thu Feb 27 22:35:45 2020 OpenVPN 2.4.8 x86_64-redhat-linux-gnu [Fedora EPEL patched] [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Nov  1 2019
Thu Feb 27 22:35:45 2020 library versions: OpenSSL 1.0.2k-fips  26 Jan 2017, LZO 2.06
Thu Feb 27 22:35:45 2020 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Feb 27 22:35:45 2020 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Feb 27 22:35:45 2020 TCP/UDP: Preserving recently used remote address: [AF_INET]88.88.88.88:1194
Thu Feb 27 22:35:45 2020 Socket Buffers: R=[212992->212992] S=[212992->212992]
Thu Feb 27 22:35:45 2020 UDP link local (bound): [AF_INET][undef]:1194
Thu Feb 27 22:35:45 2020 UDP link remote: [AF_INET]88.88.88.88:1194
Thu Feb 27 22:35:45 2020 NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay
Thu Feb 27 22:35:45 2020 TLS: Initial packet from [AF_INET]88.88.88.88:1194, sid=f15433c8 860f3c09
Thu Feb 27 22:35:45 2020 VERIFY OK: depth=1, CN=vpn-01
Thu Feb 27 22:35:45 2020 VERIFY KU OK
Thu Feb 27 22:35:45 2020 Validating certificate extended key usage
Thu Feb 27 22:35:45 2020 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Thu Feb 27 22:35:45 2020 VERIFY EKU OK
Thu Feb 27 22:35:45 2020 VERIFY OK: depth=0, CN=server
Thu Feb 27 22:35:45 2020 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1558', remote='link-mtu 1557'
Thu Feb 27 22:35:45 2020 WARNING: 'comp-lzo' is present in local config but missing in remote config, local='comp-lzo'
Thu Feb 27 22:35:45 2020 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Thu Feb 27 22:35:45 2020 [server] Peer Connection Initiated with [AF_INET]88.88.88.88:1194
Thu Feb 27 22:35:46 2020 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Thu Feb 27 22:35:46 2020 PUSH: Received control message: 'PUSH_REPLY,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.8.0.10 255.255.255.0,peer-id 0,cipher AES-256-GCM'
Thu Feb 27 22:35:46 2020 OPTIONS IMPORT: timers and/or timeouts modified
Thu Feb 27 22:35:46 2020 OPTIONS IMPORT: --ifconfig/up options modified
Thu Feb 27 22:35:46 2020 OPTIONS IMPORT: route-related options modified
Thu Feb 27 22:35:46 2020 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Thu Feb 27 22:35:46 2020 OPTIONS IMPORT: peer-id set
Thu Feb 27 22:35:46 2020 OPTIONS IMPORT: adjusting link_mtu to 1625
Thu Feb 27 22:35:46 2020 OPTIONS IMPORT: data channel crypto options modified
Thu Feb 27 22:35:46 2020 Data Channel: using negotiated cipher 'AES-256-GCM'
Thu Feb 27 22:35:46 2020 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Thu Feb 27 22:35:46 2020 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Thu Feb 27 22:35:46 2020 TUN/TAP device tun0 opened
Thu Feb 27 22:35:46 2020 TUN/TAP TX queue length set to 100
Thu Feb 27 22:35:46 2020 /sbin/ip link set dev tun0 up mtu 1500
Thu Feb 27 22:35:46 2020 /sbin/ip addr add dev tun0 10.8.0.10/24 broadcast 10.8.0.255
Thu Feb 27 22:35:46 2020 UID set to nobody
Thu Feb 27 22:35:46 2020 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Thu Feb 27 22:35:46 2020 Initialization Sequence Completed

3. Shutdown test123 and start test2 client:

[root@vpn-02 ~]# openvpn --config test2.ovpn 
Thu Feb 27 22:36:44 2020 OpenVPN 2.4.8 x86_64-redhat-linux-gnu [Fedora EPEL patched] [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Nov  1 2019
Thu Feb 27 22:36:44 2020 library versions: OpenSSL 1.0.2k-fips  26 Jan 2017, LZO 2.06
Thu Feb 27 22:36:44 2020 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Feb 27 22:36:44 2020 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Feb 27 22:36:44 2020 TCP/UDP: Preserving recently used remote address: [AF_INET]88.88.88.88:1194
Thu Feb 27 22:36:44 2020 Socket Buffers: R=[212992->212992] S=[212992->212992]
Thu Feb 27 22:36:44 2020 UDP link local (bound): [AF_INET][undef]:1194
Thu Feb 27 22:36:44 2020 UDP link remote: [AF_INET]88.88.88.88:1194
Thu Feb 27 22:36:44 2020 NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay
Thu Feb 27 22:36:44 2020 TLS: Initial packet from [AF_INET]88.88.88.88:1194, sid=98c293d5 aa8aa2ba
Thu Feb 27 22:36:44 2020 VERIFY OK: depth=1, CN=vpn-01
Thu Feb 27 22:36:44 2020 VERIFY KU OK
Thu Feb 27 22:36:44 2020 Validating certificate extended key usage
Thu Feb 27 22:36:44 2020 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Thu Feb 27 22:36:44 2020 VERIFY EKU OK
Thu Feb 27 22:36:44 2020 VERIFY OK: depth=0, CN=server
Thu Feb 27 22:36:44 2020 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1558', remote='link-mtu 1557'
Thu Feb 27 22:36:44 2020 WARNING: 'comp-lzo' is present in local config but missing in remote config, local='comp-lzo'
Thu Feb 27 22:36:44 2020 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Thu Feb 27 22:36:44 2020 [server] Peer Connection Initiated with [AF_INET]88.88.88.88:1194
Thu Feb 27 22:36:46 2020 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Thu Feb 27 22:36:46 2020 AUTH: Received control message: AUTH_FAILED
Thu Feb 27 22:36:46 2020 SIGTERM[soft,auth-failure] received, process exiting

4. Client didn't start. Second try

[root@vpn-02 ~]# openvpn --config test2.ovpn 
Thu Feb 27 22:37:58 2020 OpenVPN 2.4.8 x86_64-redhat-linux-gnu [Fedora EPEL patched] [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Nov  1 2019
Thu Feb 27 22:37:58 2020 library versions: OpenSSL 1.0.2k-fips  26 Jan 2017, LZO 2.06
Thu Feb 27 22:37:58 2020 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Feb 27 22:37:58 2020 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Feb 27 22:37:58 2020 TCP/UDP: Preserving recently used remote address: [AF_INET]88.88.88.88:1194
Thu Feb 27 22:37:58 2020 Socket Buffers: R=[212992->212992] S=[212992->212992]
Thu Feb 27 22:37:58 2020 UDP link local (bound): [AF_INET][undef]:1194
Thu Feb 27 22:37:58 2020 UDP link remote: [AF_INET]88.88.88.88:1194
Thu Feb 27 22:37:58 2020 NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay
Thu Feb 27 22:37:58 2020 TLS: Initial packet from [AF_INET]88.88.88.88:1194, sid=153d8e58 5c0e20df
Thu Feb 27 22:37:58 2020 VERIFY OK: depth=1, CN=vpn-01
Thu Feb 27 22:37:58 2020 VERIFY KU OK
Thu Feb 27 22:37:58 2020 Validating certificate extended key usage
Thu Feb 27 22:37:58 2020 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Thu Feb 27 22:37:58 2020 VERIFY EKU OK
Thu Feb 27 22:37:58 2020 VERIFY OK: depth=0, CN=server
Thu Feb 27 22:37:58 2020 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1558', remote='link-mtu 1557'
Thu Feb 27 22:37:58 2020 WARNING: 'comp-lzo' is present in local config but missing in remote config, local='comp-lzo'
Thu Feb 27 22:37:58 2020 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Thu Feb 27 22:37:58 2020 [server] Peer Connection Initiated with [AF_INET]88.88.88.88:1194
Thu Feb 27 22:38:00 2020 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Thu Feb 27 22:38:00 2020 PUSH: Received control message: 'PUSH_REPLY,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.8.0.11 255.255.255.0,peer-id 0,cipher AES-256-GCM'
Thu Feb 27 22:38:00 2020 OPTIONS IMPORT: timers and/or timeouts modified
Thu Feb 27 22:38:00 2020 OPTIONS IMPORT: --ifconfig/up options modified
Thu Feb 27 22:38:00 2020 OPTIONS IMPORT: route-related options modified
Thu Feb 27 22:38:00 2020 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Thu Feb 27 22:38:00 2020 OPTIONS IMPORT: peer-id set
Thu Feb 27 22:38:00 2020 OPTIONS IMPORT: adjusting link_mtu to 1625
Thu Feb 27 22:38:00 2020 OPTIONS IMPORT: data channel crypto options modified
Thu Feb 27 22:38:00 2020 Data Channel: using negotiated cipher 'AES-256-GCM'
Thu Feb 27 22:38:00 2020 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Thu Feb 27 22:38:00 2020 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Thu Feb 27 22:38:00 2020 TUN/TAP device tun0 opened
Thu Feb 27 22:38:00 2020 TUN/TAP TX queue length set to 100
Thu Feb 27 22:38:00 2020 /sbin/ip link set dev tun0 up mtu 1500
Thu Feb 27 22:38:00 2020 /sbin/ip addr add dev tun0 10.8.0.11/24 broadcast 10.8.0.255
Thu Feb 27 22:38:00 2020 UID set to nobody
Thu Feb 27 22:38:00 2020 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Thu Feb 27 22:38:00 2020 Initialization Sequence Completed

5. I changed ip for test2 to 10.8.0.22

[root@vpn-02 ~]# openvpn --config test2.ovpn 
Thu Feb 27 22:39:01 2020 OpenVPN 2.4.8 x86_64-redhat-linux-gnu [Fedora EPEL patched] [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Nov  1 2019
Thu Feb 27 22:39:01 2020 library versions: OpenSSL 1.0.2k-fips  26 Jan 2017, LZO 2.06
Thu Feb 27 22:39:01 2020 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Feb 27 22:39:01 2020 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Feb 27 22:39:01 2020 TCP/UDP: Preserving recently used remote address: [AF_INET]88.88.88.88:1194
Thu Feb 27 22:39:01 2020 Socket Buffers: R=[212992->212992] S=[212992->212992]
Thu Feb 27 22:39:01 2020 UDP link local (bound): [AF_INET][undef]:1194
Thu Feb 27 22:39:01 2020 UDP link remote: [AF_INET]88.88.88.88:1194
Thu Feb 27 22:39:01 2020 NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay
Thu Feb 27 22:39:01 2020 TLS: Initial packet from [AF_INET]88.88.88.88:1194, sid=bdd35602 9ab03981
Thu Feb 27 22:39:01 2020 VERIFY OK: depth=1, CN=vpn-01
Thu Feb 27 22:39:01 2020 VERIFY KU OK
Thu Feb 27 22:39:01 2020 Validating certificate extended key usage
Thu Feb 27 22:39:01 2020 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Thu Feb 27 22:39:01 2020 VERIFY EKU OK
Thu Feb 27 22:39:01 2020 VERIFY OK: depth=0, CN=server
Thu Feb 27 22:39:01 2020 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1558', remote='link-mtu 1557'
Thu Feb 27 22:39:01 2020 WARNING: 'comp-lzo' is present in local config but missing in remote config, local='comp-lzo'
Thu Feb 27 22:39:01 2020 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Thu Feb 27 22:39:01 2020 [server] Peer Connection Initiated with [AF_INET]88.88.88.88:1194
Thu Feb 27 22:39:02 2020 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Thu Feb 27 22:39:02 2020 PUSH: Received control message: 'PUSH_REPLY,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.8.0.11 255.255.255.0,peer-id 0,cipher AES-256-GCM'
Thu Feb 27 22:39:02 2020 OPTIONS IMPORT: timers and/or timeouts modified
Thu Feb 27 22:39:02 2020 OPTIONS IMPORT: --ifconfig/up options modified
Thu Feb 27 22:39:02 2020 OPTIONS IMPORT: route-related options modified
Thu Feb 27 22:39:02 2020 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Thu Feb 27 22:39:02 2020 OPTIONS IMPORT: peer-id set
Thu Feb 27 22:39:02 2020 OPTIONS IMPORT: adjusting link_mtu to 1625
Thu Feb 27 22:39:02 2020 OPTIONS IMPORT: data channel crypto options modified
Thu Feb 27 22:39:02 2020 Data Channel: using negotiated cipher 'AES-256-GCM'
Thu Feb 27 22:39:02 2020 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Thu Feb 27 22:39:02 2020 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Thu Feb 27 22:39:02 2020 TUN/TAP device tun0 opened
Thu Feb 27 22:39:02 2020 TUN/TAP TX queue length set to 100
Thu Feb 27 22:39:02 2020 /sbin/ip link set dev tun0 up mtu 1500
Thu Feb 27 22:39:02 2020 /sbin/ip addr add dev tun0 10.8.0.11/24 broadcast 10.8.0.255
Thu Feb 27 22:39:02 2020 UID set to nobody
Thu Feb 27 22:39:02 2020 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Thu Feb 27 22:39:02 2020 Initialization Sequence Completed

It didn't work

6. I start test123

root@vpn-02 ~]# openvpn --config test123.ovpn
Thu Feb 27 22:39:57 2020 OpenVPN 2.4.8 x86_64-redhat-linux-gnu [Fedora EPEL patched] [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] b
uilt on Nov  1 2019
Thu Feb 27 22:39:57 2020 library versions: OpenSSL 1.0.2k-fips  26 Jan 2017, LZO 2.06
Thu Feb 27 22:39:57 2020 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Feb 27 22:39:57 2020 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Feb 27 22:39:57 2020 TCP/UDP: Preserving recently used remote address: [AF_INET]88.88.88.88:1194
Thu Feb 27 22:39:57 2020 Socket Buffers: R=[212992->212992] S=[212992->212992]
Thu Feb 27 22:39:57 2020 UDP link local (bound): [AF_INET][undef]:1194
Thu Feb 27 22:39:57 2020 UDP link remote: [AF_INET]88.88.88.88:1194
Thu Feb 27 22:39:57 2020 NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay
Thu Feb 27 22:39:57 2020 TLS: Initial packet from [AF_INET]88.88.88.88:1194, sid=74838ff0 9197cdfe
Thu Feb 27 22:39:57 2020 VERIFY OK: depth=1, CN=vpn-01
Thu Feb 27 22:39:57 2020 VERIFY KU OK
Thu Feb 27 22:39:57 2020 Validating certificate extended key usage
Thu Feb 27 22:39:57 2020 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Thu Feb 27 22:39:57 2020 VERIFY EKU OK
Thu Feb 27 22:39:57 2020 VERIFY OK: depth=0, CN=server
Thu Feb 27 22:39:57 2020 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1558', remote='link-mtu 1557'
Thu Feb 27 22:39:57 2020 WARNING: 'comp-lzo' is present in local config but missing in remote config, local='comp-lzo'
Thu Feb 27 22:39:57 2020 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Thu Feb 27 22:39:57 2020 [server] Peer Connection Initiated with [AF_INET]88.88.88.88:1194
Thu Feb 27 22:39:58 2020 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Thu Feb 27 22:40:04 2020 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Thu Feb 27 22:40:09 2020 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Thu Feb 27 22:40:14 2020 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Thu Feb 27 22:40:19 2020 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Thu Feb 27 22:40:24 2020 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Thu Feb 27 22:40:29 2020 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Thu Feb 27 22:40:34 2020 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Thu Feb 27 22:40:39 2020 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Thu Feb 27 22:40:44 2020 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Thu Feb 27 22:40:49 2020 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Thu Feb 27 22:40:54 2020 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Thu Feb 27 22:40:59 2020 No reply from server after sending 12 push requests
Thu Feb 27 22:40:59 2020 SIGUSR1[soft,no-push-reply] received, process restarting
Thu Feb 27 22:40:59 2020 Restart pause, 5 second(s)
Thu Feb 27 22:41:04 2020 TCP/UDP: Preserving recently used remote address: [AF_INET]88.88.88.88:1194
Thu Feb 27 22:41:04 2020 Socket Buffers: R=[212992->212992] S=[212992->212992]
Thu Feb 27 22:41:04 2020 UDP link local (bound): [AF_INET][undef]:1194
Thu Feb 27 22:41:04 2020 UDP link remote: [AF_INET]88.88.88.88:1194
Thu Feb 27 22:41:04 2020 TLS: Initial packet from [AF_INET]88.88.88.88:1194, sid=703e67bc a3d35567
Thu Feb 27 22:41:04 2020 VERIFY OK: depth=1, CN=vpn-01
Thu Feb 27 22:41:04 2020 VERIFY KU OK
Thu Feb 27 22:41:04 2020 Validating certificate extended key usage
Thu Feb 27 22:41:04 2020 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Thu Feb 27 22:41:04 2020 VERIFY EKU OK
Thu Feb 27 22:41:04 2020 VERIFY OK: depth=0, CN=server
Thu Feb 27 22:41:04 2020 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1558', remote='link-mtu 1557'
Thu Feb 27 22:41:04 2020 WARNING: 'comp-lzo' is present in local config but missing in remote config, local='comp-lzo'
Thu Feb 27 22:41:04 2020 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Thu Feb 27 22:41:04 2020 [server] Peer Connection Initiated with [AF_INET]88.88.88.88:1194
Thu Feb 27 22:41:05 2020 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Thu Feb 27 22:41:05 2020 PUSH: Received control message: 'PUSH_REPLY,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route-gateway 10.8.0.1,topology su
bnet,ping 10,ping-restart 120,ifconfig 10.8.0.10 255.255.255.0,peer-id 0,cipher AES-256-GCM'
Thu Feb 27 22:41:05 2020 OPTIONS IMPORT: timers and/or timeouts modified
Thu Feb 27 22:41:05 2020 OPTIONS IMPORT: --ifconfig/up options modified
Thu Feb 27 22:41:05 2020 OPTIONS IMPORT: route-related options modified
Thu Feb 27 22:41:05 2020 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Thu Feb 27 22:41:05 2020 OPTIONS IMPORT: peer-id set
Thu Feb 27 22:41:05 2020 OPTIONS IMPORT: adjusting link_mtu to 1625
Thu Feb 27 22:41:05 2020 OPTIONS IMPORT: data channel crypto options modified
Thu Feb 27 22:41:05 2020 Data Channel: using negotiated cipher 'AES-256-GCM'
Thu Feb 27 22:41:05 2020 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Thu Feb 27 22:41:05 2020 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Thu Feb 27 22:41:05 2020 TUN/TAP device tun0 opened
Thu Feb 27 22:41:05 2020 TUN/TAP TX queue length set to 100
Thu Feb 27 22:41:05 2020 /sbin/ip link set dev tun0 up mtu 1500
Thu Feb 27 22:41:05 2020 /sbin/ip addr add dev tun0 10.8.0.10/24 broadcast 10.8.0.255
Thu Feb 27 22:41:05 2020 UID set to nobody
Thu Feb 27 22:41:05 2020 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Thu Feb 27 22:41:05 2020 Initialization Sequence Completed
Thu Feb 27 22:41:15 2020 Bad LZO decompression header byte: 42
^CThu Feb 27 22:41:17 2020 event_wait : Interrupted system call (code=4)
Thu Feb 27 22:41:17 2020 Closing TUN/TAP interface
Thu Feb 27 22:41:17 2020 /sbin/ip addr del dev tun0 10.8.0.10/24
RTNETLINK answers: Operation not permitted
Thu Feb 27 22:41:17 2020 Linux ip addr del failed: external program exited with error status: 2
Thu Feb 27 22:41:17 2020 SIGINT[hard,] received, process exiting

7. Ok, I stopped test123 and started test2 client

[root@vpn-02 ~]# openvpn --config test2.ovpn 
Thu Feb 27 22:42:55 2020 OpenVPN 2.4.8 x86_64-redhat-linux-gnu [Fedora EPEL patched] [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Nov  1 2019
Thu Feb 27 22:42:55 2020 library versions: OpenSSL 1.0.2k-fips  26 Jan 2017, LZO 2.06
Thu Feb 27 22:42:55 2020 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Feb 27 22:42:55 2020 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Feb 27 22:42:55 2020 TCP/UDP: Preserving recently used remote address: [AF_INET]88.88.88.88:1194
Thu Feb 27 22:42:55 2020 Socket Buffers: R=[212992->212992] S=[212992->212992]
Thu Feb 27 22:42:55 2020 UDP link local (bound): [AF_INET][undef]:1194
Thu Feb 27 22:42:55 2020 UDP link remote: [AF_INET]88.88.88.88:1194
Thu Feb 27 22:42:55 2020 NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay
Thu Feb 27 22:42:55 2020 TLS: Initial packet from [AF_INET]88.88.88.88:1194, sid=96f195b3 431ab551
Thu Feb 27 22:42:55 2020 VERIFY OK: depth=1, CN=vpn-01
Thu Feb 27 22:42:55 2020 VERIFY KU OK
Thu Feb 27 22:42:55 2020 Validating certificate extended key usage
Thu Feb 27 22:42:55 2020 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Thu Feb 27 22:42:55 2020 VERIFY EKU OK
Thu Feb 27 22:42:55 2020 VERIFY OK: depth=0, CN=server
Thu Feb 27 22:42:55 2020 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1558', remote='link-mtu 1557'
Thu Feb 27 22:42:55 2020 WARNING: 'comp-lzo' is present in local config but missing in remote config, local='comp-lzo'
Thu Feb 27 22:42:55 2020 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Thu Feb 27 22:42:55 2020 [server] Peer Connection Initiated with [AF_INET]88.88.88.88:1194
Thu Feb 27 22:42:56 2020 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Thu Feb 27 22:42:56 2020 AUTH: Received control message: AUTH_FAILED
Thu Feb 27 22:42:56 2020 SIGTERM[soft,auth-failure] received, process exiting

Second start test2

[root@vpn-02 ~]# openvpn --config test2.ovpn 
Thu Feb 27 22:43:38 2020 OpenVPN 2.4.8 x86_64-redhat-linux-gnu [Fedora EPEL patched] [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Nov  1 2019
Thu Feb 27 22:43:38 2020 library versions: OpenSSL 1.0.2k-fips  26 Jan 2017, LZO 2.06
Thu Feb 27 22:43:38 2020 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Feb 27 22:43:38 2020 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Feb 27 22:43:38 2020 TCP/UDP: Preserving recently used remote address: [AF_INET]88.88.88.88:1194
Thu Feb 27 22:43:38 2020 Socket Buffers: R=[212992->212992] S=[212992->212992]
Thu Feb 27 22:43:38 2020 UDP link local (bound): [AF_INET][undef]:1194
Thu Feb 27 22:43:38 2020 UDP link remote: [AF_INET]88.88.88.88:1194
Thu Feb 27 22:43:38 2020 NOTE: UID/GID downgrade will be delayed because of --client, --pull, or --up-delay
Thu Feb 27 22:43:38 2020 TLS: Initial packet from [AF_INET]88.88.88.88:1194, sid=f6f6dd5c 8ef2f81b
Thu Feb 27 22:43:38 2020 VERIFY OK: depth=1, CN=vpn-01
Thu Feb 27 22:43:38 2020 VERIFY KU OK
Thu Feb 27 22:43:38 2020 Validating certificate extended key usage
Thu Feb 27 22:43:38 2020 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Thu Feb 27 22:43:38 2020 VERIFY EKU OK
Thu Feb 27 22:43:38 2020 VERIFY OK: depth=0, CN=server
Thu Feb 27 22:43:38 2020 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1558', remote='link-mtu 1557'
Thu Feb 27 22:43:38 2020 WARNING: 'comp-lzo' is present in local config but missing in remote config, local='comp-lzo'
Thu Feb 27 22:43:38 2020 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Thu Feb 27 22:43:38 2020 [server] Peer Connection Initiated with [AF_INET]88.88.88.88:1194
Thu Feb 27 22:43:39 2020 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Thu Feb 27 22:43:39 2020 PUSH: Received control message: 'PUSH_REPLY,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.8.0.22 255.255.255.0,peer-id 0,cipher AES-256-GCM'
Thu Feb 27 22:43:39 2020 OPTIONS IMPORT: timers and/or timeouts modified
Thu Feb 27 22:43:39 2020 OPTIONS IMPORT: --ifconfig/up options modified
Thu Feb 27 22:43:39 2020 OPTIONS IMPORT: route-related options modified
Thu Feb 27 22:43:39 2020 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Thu Feb 27 22:43:39 2020 OPTIONS IMPORT: peer-id set
Thu Feb 27 22:43:39 2020 OPTIONS IMPORT: adjusting link_mtu to 1625
Thu Feb 27 22:43:39 2020 OPTIONS IMPORT: data channel crypto options modified
Thu Feb 27 22:43:39 2020 Data Channel: using negotiated cipher 'AES-256-GCM'
Thu Feb 27 22:43:39 2020 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Thu Feb 27 22:43:39 2020 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Thu Feb 27 22:43:39 2020 TUN/TAP device tun0 opened
Thu Feb 27 22:43:39 2020 TUN/TAP TX queue length set to 100
Thu Feb 27 22:43:39 2020 /sbin/ip link set dev tun0 up mtu 1500
Thu Feb 27 22:43:39 2020 /sbin/ip addr add dev tun0 10.8.0.22/24 broadcast 10.8.0.255
Thu Feb 27 22:43:39 2020 UID set to nobody
Thu Feb 27 22:43:39 2020 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Thu Feb 27 22:43:39 2020 Initialization Sequence Completed

Finally I got the ip from ccd without restarting the openvpn server.

What am I doing wrong?

sv

I did the test above after updating openvpn to a new version from the repository - openvpn-2.4.8-1.el7.x86_64

Pippin

Looking at the timestamps, the --keepalive time out might be involved.
Server thinking client is still connected but is not.

At least add

explicit-exit-notify 1

to your client configs and wait at least 120 seconds before starting clients.

sv

Pippin wrote Looking at the timestamps, the --keepalive time out might be involved.
Server thinking client is still connected but is not.

At least add
explicit-exit-notify 1
to your client configs and wait at least 120 seconds before starting clients.

I added, but this did not solve the problem

client
tls-client
pull
dev tun
proto udp
remote 88.88.88.88 1194
user nobody
;group nogroup
persist-key
persist-tun
cipher AES-256-CBC
;auth SHA256
explicit-exit-notify 1
key-direction 1
remote-cert-tls server
comp-lzo
verb 3
<ca>
...

TinCanTech

Do you use s-systemd ?

sv

I found some problem. When I close the session, the session continues to hold on the server. For example:
I start server with profile for test123

ifconfig-push 10.8.0.10 255.255.255.0

[root@vpn-02 ~]# openvpn --config test123.ovpn

Fri Feb 28 11:21:27 2020 /sbin/ip addr add dev tun0 10.8.0.10/24 broadcast 10.8.0.255
Fri Feb 28 11:21:27 2020 UID set to nobody
Fri Feb 28 11:21:27 2020 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Fri Feb 28 11:21:27 2020 Initialization Sequence Completed

Fri Feb 28 11:21:37 2020 Bad LZO decompression header byte: 42
Fri Feb 28 11:21:47 2020 Bad LZO decompression header byte: 42
Fri Feb 28 11:21:57 2020 Bad LZO decompression header byte: 42
^CFri Feb 28 11:21:58 2020 event_wait : Interrupted system call (code=4)
Fri Feb 28 11:21:58 2020 SIGTERM received, sending exit notification to peer
Fri Feb 28 11:21:59 2020 Closing TUN/TAP interface
Fri Feb 28 11:21:59 2020 /sbin/ip addr del dev tun0 10.8.0.10/24
RTNETLINK answers: Operation not permitted
Fri Feb 28 11:21:59 2020 Linux ip addr del failed: external program exited with error status: 2
Fri Feb 28 11:21:59 2020 SIGTERM[soft,exit-with-notification] received, process exiting

I changed

cat test123 
ifconfig-push 10.8.0.22 255.255.255.0

[root@vpn-01 server]# nc localhost 7505
>INFO:OpenVPN Management Interface Version 1 -- type 'help' for more info
status
TITLE,OpenVPN 2.4.8 x86_64-redhat-linux-gnu [Fedora EPEL patched] [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Nov  1 2019
TIME,Fri Feb 28 11:24:18 2020,1582885458
HEADER,CLIENT_LIST,Common Name,Real Address,Virtual Address,Virtual IPv6 Address,Bytes Received,Bytes Sent,Connected Since,Connected Since (time_t),Username,Client ID,Peer ID
CLIENT_LIST,test123,99.99.99.99:1194,10.8.0.10,,3316,3706,Fri Feb 28 11:21:26 2020,1582885286,UNDEF,0,0
HEADER,ROUTING_TABLE,Virtual Address,Common Name,Real Address,Last Ref,Last Ref (time_t)
ROUTING_TABLE,10.8.0.10,test123,99.99.99.99:1194,Fri Feb 28 11:21:26 2020,1582885286
GLOBAL_STATS,Max bcast/mcast queue length,0

I connect client

[root@vpn-02 ~]# openvpn --config test123.ovpn
Fri Feb 28 11:25:40 2020 /sbin/ip addr add dev tun0 10.8.0.10/24 broadcast 10.8.0.255
Fri Feb 28 11:25:40 2020 UID set to nobody
Fri Feb 28 11:25:40 2020 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Fri Feb 28 11:25:40 2020 Initialization Sequence Completed

Disconnect and kill client on the server

status
TITLE,OpenVPN 2.4.8 x86_64-redhat-linux-gnu [Fedora EPEL patched] [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Nov  1 2019
TIME,Fri Feb 28 11:26:32 2020,1582885592
HEADER,CLIENT_LIST,Common Name,Real Address,Virtual Address,Virtual IPv6 Address,Bytes Received,Bytes Sent,Connected Since,Connected Since (time_t),Username,Client ID,Peer ID
CLIENT_LIST,test123,99.99.99.99:1194,10.8.0.10,,6673,7292,Fri Feb 28 11:21:26 2020,1582885286,UNDEF,0,0
HEADER,ROUTING_TABLE,Virtual Address,Common Name,Real Address,Last Ref,Last Ref (time_t)
ROUTING_TABLE,10.8.0.10,test123,99.99.99.99:1194,Fri Feb 28 11:21:26 2020,1582885286
GLOBAL_STATS,Max bcast/mcast queue length,0
END
kill test123
SUCCESS: common name 'test123' found, 1 client(s) killed

[root@vpn-02 ~]# openvpn --config test123.ovpn

Fri Feb 28 11:26:56 2020 /sbin/ip addr add dev tun0 10.8.0.22/24 broadcast 10.8.0.255
Fri Feb 28 11:26:56 2020 UID set to nobody
Fri Feb 28 11:26:56 2020 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Fri Feb 28 11:26:56 2020 Initialization Sequence Completed

Another test. Waiting for a server to end a session. But I waited about 4 minutes

MANAGEMENT: Client connected from [AF_INET6]::1:7505
MANAGEMENT: CMD 'status'
MANAGEMENT: CMD 'status'
MANAGEMENT: CMD 'status'
MANAGEMENT: CMD 'status'
test123/99.99.99.99:1194 [test123] Inactivity timeout (--ping-restart), restarting
test123/99.99.99.99:1194 SIGUSR1[soft,ping-restart] received, client-instance restarting
MANAGEMENT: CMD 'status

I changed

#keepalive 10 120
keepalive 5 10

This reduced waiting time.

Pippin

Pippin wrote Looking at the timestamps, the --keepalive time out might be involved.
Server thinking client is still connected but is not.

At least add
explicit-exit-notify 1
to your client configs and wait at least 120 seconds before starting clients.

😉

sv

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.

Pippin

This does not work, because you need to wait at least 4 minutes before starting the client.

keepalive 10 120

In that ^^^ case that would be correct.

Is your problem solved?

sv

Pippin wrote
This does not work, because you need to wait at least 4 minutes before starting the client.
keepalive 10 120
In that ^^^ case that would be correct.

Is your problem solved?

I found how I can get around the problem, tnx

TiTex

and is it to hard to also write down the solution for anybody else who might search for the same issue ? :evil:

Pippin

I think this was his "workaround".

sv wrote ...
...
I changed

#keepalive 10 120
keepalive 5 10

This reduced waiting time.

sv

TiTex wrote and is it to hard to also write down the solution for anybody else who might search for the same issue ? :evil:

I will kill the user session if it already exists

TinCanTech

The server will read the CCD file after the connecting client has been authenticated.

Otherwise, it will not be read. eg. --reneg-sec