I have two OpenVPN servers set up in two locations. And I have one Raspbian client with two client.conf files (one for each server). And they each connect to their respective server and create their respective tunnels (tun0 and tun1). However, whichever tun connects first always gets all the traffic, even if it starts dropping packets or the connects just dies. It never seems to switch over to the other tun. I'm thinking I've got something set wrong in my configs - or maybe it just doesn't' work that way? Here are my two server.conf files: ServerA [code]dev tun server 10.8.0.0 255.255.255.0 ifconfig 10.8.0.1 10.8.0.2 push "route 10.8.0.1 255.255.255.255" push "route 10.8.0.0 255.255.255.0" push "route 192.168.1.246 255.255.255.0" push "dhcp-option DNS 192.168.1.1" push "redirect-gateway def1" client-to-client duplicate-cn keepalive 10 120 tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0 persist-key persist-tun user nobody group nogroup cipher AES-256-CBC tls-version-min 1.2 auth sha512[/code] ServerB [code]dev tun server 10.10.0.0 255.255.255.0 ifconfig 10.10.0.1 10.10.0.2 push "route 10.10.0.1 255.255.255.255" push "route 10.10.0.0 255.255.255.0" push "route 192.168.1.241 255.255.255.0" push "dhcp-option DNS 192.168.1.1" push "redirect-gateway def1" client-to-client duplicate-cn keepalive 10 120 tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0 persist-key persist-tun user nobody group nogroup cipher AES-256-CBC tls-version-min 1.2 auth sha512 [/code] And the two client.conf files on Rasbian: ClientA [code]client remote ServerA verb 1 nobind mute 20 dev tun0 persist-tun persist-key key-direction 1 cipher AES-256-CBC tls-version-min 1.2 auth sha512 ns-cert-type server mute-replay-warnings resolv-retry 60[/code] ClientB [code]client remote ServerB verb 1 nobind mute 20 dev tun1 persist-tun persist-key key-direction 1 cipher AES-256-CBC tls-version-min 1.2 auth sha512 ns-cert-type server mute-replay-warnings resolv-retry 60[/code] Any pointers or sites to read to fix this? Thanks!

Discovered the issue was the default route OpenVPN creates was overridding all my other routing statements: [code]0.0.0.0.0/1 via 10.10.0.6 dev tun0[/code] Once I deleted that, load balancing works beautifully using all openvpn client simultaniously.

Multiple Tun(s) with automatic failover?

NiMing8

I have two OpenVPN servers set up in two locations.
And I have one Raspbian client with two client.conf files (one for each server). And they each connect to their respective server and create their respective tunnels (tun0 and tun1).
However, whichever tun connects first always gets all the traffic, even if it starts dropping packets or the connects just dies. It never seems to switch over to the other tun.
I'm thinking I've got something set wrong in my configs - or maybe it just doesn't' work that way?
Here are my two server.conf files:

ServerA

dev tun
server 10.8.0.0 255.255.255.0
ifconfig 10.8.0.1 10.8.0.2
push "route 10.8.0.1 255.255.255.255"
push "route 10.8.0.0 255.255.255.0"
push "route 192.168.1.246 255.255.255.0"
push "dhcp-option DNS 192.168.1.1"
push "redirect-gateway def1"
client-to-client
duplicate-cn
keepalive 10 120
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
persist-key
persist-tun
user nobody
group nogroup
cipher AES-256-CBC
tls-version-min 1.2
auth sha512

ServerB

dev tun
server 10.10.0.0 255.255.255.0
ifconfig 10.10.0.1 10.10.0.2
push "route 10.10.0.1 255.255.255.255"
push "route 10.10.0.0 255.255.255.0"
push "route 192.168.1.241 255.255.255.0"
push "dhcp-option DNS 192.168.1.1"
push "redirect-gateway def1"
client-to-client
duplicate-cn
keepalive 10 120
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
persist-key
persist-tun
user nobody
group nogroup
cipher AES-256-CBC
tls-version-min 1.2
auth sha512

And the two client.conf files on Rasbian:

ClientA

client
remote ServerA
verb 1
nobind
mute 20
dev tun0
persist-tun
persist-key
key-direction 1
cipher AES-256-CBC
tls-version-min 1.2
auth sha512
ns-cert-type server
mute-replay-warnings
resolv-retry 60

ClientB

client
remote ServerB
verb 1
nobind
mute 20
dev tun1
persist-tun
persist-key
key-direction 1
cipher AES-256-CBC
tls-version-min 1.2
auth sha512
ns-cert-type server
mute-replay-warnings
resolv-retry 60

Any pointers or sites to read to fix this?
Thanks!

TinCanTech

See <connection> blocks in the manual.

NiMing8

TinCanTech wrote See <connection> blocks in the manual.

I had tried something similar by just using multiple remote commands in a single client.conf file:

client
remote ServerA
remote ServerB
verb 1
...

And that does sorta work as a round-robin failover. But, again, it really wants to stick with whatever the current remote server its connected to, no matter how poor the connection (dropped packets).

Maybe my issue is how to get OpenVPN to more readily abandon a poor connection and try the next one - over which methodology to use: Multiple Clients and Tuns v. Multiple 'remote' (s) in a single client.

Thanks

NiMing8

Terribly sorry. I forgot to include this ip route command I am using for fail-over. Not sure its correct, or even if its working. Documentation on nexthop is sparse (that I've been able to find):

/bin/ip route replace default proto static scope global nexthop dev tun0 weight 3 nexthop dev tun1 weight 2

NiMing8

Discovered the issue was the default route OpenVPN creates was overridding all my other routing statements:

0.0.0.0.0/1 via 10.10.0.6 dev tun0

Once I deleted that, load balancing works beautifully using all openvpn client simultaniously.