That is the message I get from one of my servers which is in the same LAN as the OpenVPN server.
The vpn connection to the OpenVPN server itself is solid- in my system tray, the green desktop with a padlock is still there, and I can ssh right back into the disconnected server, because the client (my Windows 10 desktop) is still connected to the remote VPN server.
Configuration:
OpenVPN server (172.16.1.2) on top of CentOS 7 and a few other CentOS servers (172.16.1.3, 172.16.1.4, etc.) are in a local LAN, behind a router, whose WAN has a global IP. I have set up port forwarding (udp, 1194) and I also set up a static routing (dest network 10.8.0.0/24 via g/w 172.16.1.2, which is VPN server's IP) in that router for a return path.
I use OpenVPN client GUI to connect to the OpenVPN server (via the router) and get authenticated. Once I am connected to the VPN network, I can reach other servers in the same LAN (172.16.1.3, 172.16.1.4, etc.).
I have set up accounts and passwords for the servers, and say I ssh into the 172.16.1.3 server.
I do my things for a while, and leave it idle for a while.
I don't know the exact time, but when I came back to the terminal, I saw that message: client_loop: send disconnect: Connection reset by peer.
I was disconnected from 172.16.1.3.
Same thing happens with 172.16.1.4 as well.
Could it be OpenVPN server's problem? I don't remember setting a time out config either in server.conf or in client.ovpn or in the iptables.
Or is it purely ssh issue?
Or routing issue?
My /etc/ssh/sshd_config (on all servers) has these entries:
#ClientAliveInterval 0
#ClientAliveCountMax 3
My config files are as follows:
###### server.conf
local 172.16.1.2
port 1194
proto udp
dev tun
ca /etc/openvpn/server/cert/ca.crt
cert /etc/openvpn/server/cert/server.crt
key /etc/openvpn/server/cert/server.key
dh none
ecdh-curve ED25519
tls-version-min 1.2
cipher AES-256-GCM
ncp-ciphers AES-256-GCM
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384:TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384
reneg-sec 60
auth-nocache
auth SHA512
topology subnet
server 10.8.0.0 255.255.255.0
remote-cert-eku "TLS Web Client Authentication"
ifconfig-pool-persist ipp.txt
push "route 172.16.1.0 255.255.255.0"
keepalive 10 120
tls-crypt /etc/openvpn/server/cert/tls_crypt.key
max-clients 10
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
log /var/log/openvpn/openvpn.log
log-append /var/log/openvpn/openvpn.log
verb 6
explicit-exit-notify 1
############### client.ovpn
client
dev tun
proto udp
remote XXX.XXX.XXX.XXX 1194
nobind
;user nobody
;group nobody
persist-key
persist-tun
ca ca.crt
cert xxxx.crt
key xxxx.key
tls-version-min 1.2
cipher AES-256-GCM
ncp-ciphers AES-256-GCM
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384:TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384
reneg-sec 60
auth-nocache
persist-key
persist-tun
tls-crypt tls_crypt.key
remote-cert-eku "TLS Web Server Authentication"
verb 6
pull
float
(1)Someone suggested I use tcp rather than udp.
(2)I also noticed myself that on the client side, I have
;user nobody
;group nobody
but on the server side they are not commented out.
(3)On the client side, I have
persist-key
persist-tun
two time.
Such discrepancies- could they be a reason for the unstable connection?
If iptables could also be a suspect, I can post its contents.
Please let me know.
Thank you.
PS: I do have IP forwarding set up in the OpenVPN server.
(I think I do have a good set up, but something is still missing!)
