I am seeing a strange behaviour where openvpn refuses new connections with the following error:
Fri Mar 20 07:42:46 2020 [12080] ::ffff:192.168.11.2 MULTI: new incoming connection would exceed maximum number of clients (5000)
My total no. of clients have not reached 5000. They were only ~2700 but somehow openvpn thought it has reached 5000 even when its own stats showed it reached only ~2700 (ovpnsh is a shell utility that interacts with the openvpn management interface):
ovpnsh> load-stats
SUCCESS: nclients=2679,bytesin=34224456,bytesout=33445544
ovpnsh>
Also, on restarting the openvpn server (with the ~2700 connections still up), it fails to accept any connections, throwing the same error. Its own stats showed the no. of client connections were zero:
ovpnsh> load-stats
SUCCESS: nclients=0,bytesin=54265478,bytesout=54045532
ovpnsh>
How does openvpn count the no. of connections ? Why it thinks there are 5000 connections when in reality there are only ~2700 connections ?
Below is my server config:
dev tun0
tun-ipv6
proto udp6
port 8443
multihome
max-clients 5000
mode server
tls-server
tls-version-min 1.2
selective_ip 1
ifconfig 10.81.200.5 255.255.0.0
ifconfig-ipv6 2001:db8::1:0 2001:db8::1:0
ifconfig-pool 10.81.200.6 10.81.234.55 255.255.0.0
ifconfig-ipv6-pool 2001:db8::1:0/64
push 'tun-ipv6'
topology subnet
ccd-exclusive
duplicate-cn
cipher AES-128-CBC
auth SHA256
comp-lzo no
persist-key
persist-tun
reneg-sec 28800
keepalive 45 180
verb 3
down-pre
username-as-common-name
capath /conf/certificate/openvpn
cert "/conf/certificate/ApplianceCertificate.pem"
key "/conf/certificate/private/ApplianceCertificate.key"
dh /static/sslvpn/openvpn/dh2048.pem
client-config-dir /tmp/openvpn/conf.d
status-version 2
status /log/openvpn-status.log 15
ifconfig-pool-persist /tmp/openvpn-ipp.txt
management /tmp/openvpn_mgmt unix
management-client-user root
script-security 2
client-connect /scripts/vpn/sslvpn/clientconnect.sh
client-disconnect /scripts/vpn/sslvpn/clientdisconnect.sh
plugin /lib/openvpn-plugin-utm.so
