Issue after reboot

kazzaw

Hi,

I am having an odd issue. I can reboot my PiVPN server and it will allow me to connect fine. If I attempt to connect more than 6/7 hours later, it suddenly rejects my connection. If I reboot, I can connect again, rinse repeat. Log is below
May 27 19:54:34 tinkerboard ovpn-server[3397]: OpenVPN 2.4.0 arm-unknown-linux-gnueabihf [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Oct 14 2018
May 27 19:54:34 tinkerboard ovpn-server[3397]: library versions: OpenSSL 1.0.2u  20 Dec 2019, LZO 2.08
May 27 19:54:34 tinkerboard ovpn-server[3405]: NOTE: your local LAN uses the extremely common subnet address 192.168.0.x or 192.168.1.x.  Be aware that this might create routing conflicts if you connect to the VPN server from public locations such as internet cafes that use the same subnet.
May 27 19:54:34 tinkerboard ovpn-server[3405]: ECDH curve prime256v1 added
May 27 19:54:34 tinkerboard ovpn-server[3405]: Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
May 27 19:54:34 tinkerboard ovpn-server[3405]: Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
May 27 19:54:34 tinkerboard ovpn-server[3405]: Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
May 27 19:54:34 tinkerboard ovpn-server[3405]: Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
May 27 19:54:34 tinkerboard ovpn-server[3405]: TUN/TAP device tun0 opened
May 27 19:54:34 tinkerboard ovpn-server[3405]: TUN/TAP TX queue length set to 100
May 27 19:54:34 tinkerboard ovpn-server[3405]: do_ifconfig, tt->did_ifconfig_ipv6_setup=0
May 27 19:54:34 tinkerboard ovpn-server[3405]: /sbin/ip link set dev tun0 up mtu 1500
May 27 19:54:34 tinkerboard ovpn-server[3405]: /sbin/ip addr add dev tun0 10.8.0.1/24 broadcast 10.8.0.255
May 27 19:54:34 tinkerboard ovpn-server[3405]: Could not determine IPv4/IPv6 protocol. Using AF_INET
May 27 19:54:34 tinkerboard ovpn-server[3405]: Socket Buffers: R=[163840->163840] S=[163840->163840]
May 27 19:54:34 tinkerboard ovpn-server[3405]: UDPv4 link local (bound): [AF_INET][undef]:1194
May 27 19:54:34 tinkerboard ovpn-server[3405]: UDPv4 link remote: [AF_UNSPEC]
May 27 19:54:34 tinkerboard ovpn-server[3405]: GID set to openvpn
May 27 19:54:34 tinkerboard ovpn-server[3405]: UID set to openvpn
May 27 19:54:34 tinkerboard ovpn-server[3405]: MULTI: multi_init called, r=256 v=256
May 27 19:54:34 tinkerboard ovpn-server[3405]: IFCONFIG POOL: base=10.8.0.2 size=252, ipv6=0
May 27 19:54:34 tinkerboard ovpn-server[3405]: Initialization Sequence Completed
May 27 19:55:52 tinkerboard ovpn-server[473]: OpenVPN 2.4.0 arm-unknown-linux-gnueabihf [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Oct 14 2018
May 27 19:55:52 tinkerboard ovpn-server[473]: library versions: OpenSSL 1.0.2u  20 Dec 2019, LZO 2.08
May 27 19:55:52 tinkerboard ovpn-server[582]: ECDH curve prime256v1 added
May 27 19:55:52 tinkerboard ovpn-server[582]: Outgoing Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
May 27 19:55:52 tinkerboard ovpn-server[582]: Outgoing Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
May 27 19:55:52 tinkerboard ovpn-server[582]: Incoming Control Channel Encryption: Cipher 'AES-256-CTR' initialized with 256 bit key
May 27 19:55:52 tinkerboard ovpn-server[582]: Incoming Control Channel Encryption: Using 256 bit message hash 'SHA256' for HMAC authentication
May 27 19:55:52 tinkerboard ovpn-server[582]: TUN/TAP device tun0 opened
May 27 19:55:52 tinkerboard ovpn-server[582]: TUN/TAP TX queue length set to 100
May 27 19:55:52 tinkerboard ovpn-server[582]: do_ifconfig, tt->did_ifconfig_ipv6_setup=0
May 27 19:55:52 tinkerboard ovpn-server[582]: /sbin/ip link set dev tun0 up mtu 1500
May 27 19:55:52 tinkerboard ovpn-server[582]: /sbin/ip addr add dev tun0 10.8.0.1/24 broadcast 10.8.0.255
May 27 19:55:52 tinkerboard ovpn-server[582]: Could not determine IPv4/IPv6 protocol. Using AF_INET
May 27 19:55:52 tinkerboard ovpn-server[582]: Socket Buffers: R=[163840->163840] S=[163840->163840]
May 27 19:55:52 tinkerboard ovpn-server[582]: UDPv4 link local (bound): [AF_INET][undef]:1194
May 27 19:55:52 tinkerboard ovpn-server[582]: UDPv4 link remote: [AF_UNSPEC]
May 27 19:55:52 tinkerboard ovpn-server[582]: GID set to openvpn
May 27 19:55:52 tinkerboard ovpn-server[582]: UID set to openvpn
May 27 19:55:52 tinkerboard ovpn-server[582]: MULTI: multi_init called, r=256 v=256
May 27 19:55:52 tinkerboard ovpn-server[582]: IFCONFIG POOL: base=10.8.0.2 size=252, ipv6=0
May 27 19:55:52 tinkerboard ovpn-server[582]: Initialization Sequence Completed
May 27 20:00:35 tinkerboard ovpn-server[582]: EXTIP:45494 TLS: Initial packet from [AF_INET]EXTIP:45494, sid=09e15220 fdb258f9
May 27 20:00:35 tinkerboard ovpn-server[582]: EXTIP:45494 VERIFY OK: depth=1, CN=ChangeMe
May 27 20:00:35 tinkerboard ovpn-server[582]: EXTIP:45494 Validating certificate key usage
May 27 20:00:35 tinkerboard ovpn-server[582]: EXTIP:45494 ++ Certificate has key usage  0080, expects 0080
May 27 20:00:35 tinkerboard ovpn-server[582]: EXTIP:45494 VERIFY KU OK
May 27 20:00:35 tinkerboard ovpn-server[582]: EXTIP:45494 Validating certificate extended key usage
May 27 20:00:35 tinkerboard ovpn-server[582]: EXTIP:45494 ++ Certificate has EKU (str) TLS Web Client Authentication, expects TLS Web Client Authentication
May 27 20:00:35 tinkerboard ovpn-server[582]: EXTIP:45494 VERIFY EKU OK
May 27 20:00:35 tinkerboard ovpn-server[582]: EXTIP:45494 VERIFY OK: depth=0, CN=Galaxy105G
May 27 20:00:35 tinkerboard ovpn-server[582]: EXTIP:45494 peer info: IV_GUI_VER=OC30Android
May 27 20:00:35 tinkerboard ovpn-server[582]: EXTIP:45494 peer info: IV_VER=3.git::f225fcd0:Release
May 27 20:00:35 tinkerboard ovpn-server[582]: EXTIP:45494 peer info: IV_PLAT=android
May 27 20:00:35 tinkerboard ovpn-server[582]: EXTIP:45494 peer info: IV_NCP=2
May 27 20:00:35 tinkerboard ovpn-server[582]: EXTIP:45494 peer info: IV_TCPNL=1
May 27 20:00:35 tinkerboard ovpn-server[582]: EXTIP:45494 peer info: IV_PROTO=2
May 27 20:00:35 tinkerboard ovpn-server[582]: EXTIP:45494 peer info: IV_IPv6=1
May 27 20:00:35 tinkerboard ovpn-server[582]: EXTIP:45494 peer info: IV_AUTO_SESS=1
May 27 20:00:35 tinkerboard ovpn-server[582]: EXTIP:45494 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-ECDSA-AES256-GCM-SHA384
May 27 20:00:35 tinkerboard ovpn-server[582]: EXTIP:45494 [Galaxy105G] Peer Connection Initiated with [AF_INET]EXTIP:45494
May 27 20:00:35 tinkerboard ovpn-server[582]: Galaxy105G/EXTIP:45494 OPTIONS IMPORT: reading client specific options from: /etc/openvpn/ccd/Galaxy105G
May 27 20:00:35 tinkerboard ovpn-server[582]: Galaxy105G/EXTIP:45494 MULTI: Learn: 10.8.0.2 -> Galaxy105G/EXTIP:45494
May 27 20:00:35 tinkerboard ovpn-server[582]: Galaxy105G/EXTIP:45494 MULTI: primary virtual IP for Galaxy105G/EXTIP:45494: 10.8.0.2
May 27 20:00:35 tinkerboard ovpn-server[582]: Galaxy105G/EXTIP:45494 PUSH: Received control message: 'PUSH_REQUEST'
May 27 20:00:35 tinkerboard ovpn-server[582]: Galaxy105G/EXTIP:45494 SENT CONTROL [Galaxy105G]: 'PUSH_REPLY,dhcp-option DNS 10.8.0.1,block-outside-dns,redirect-gateway def1,route-gateway 10.8.0.1,topology subnet,ping 15,ping-restart 120,ifconfig 10.8.0.2 255.255.255.0,peer-id 0,cipher AES-256-GCM' (status=1)
May 27 20:00:35 tinkerboard ovpn-server[582]: Galaxy105G/EXTIP:45494 Data Channel Encrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
May 27 20:00:35 tinkerboard ovpn-server[582]: Galaxy105G/EXTIP:45494 Data Channel Decrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
May 27 20:01:06 tinkerboard ovpn-server[582]: Galaxy105G/EXTIP:45494 SIGTERM[soft,remote-exit] received, client-instance exiting
May 27 20:23:19 tinkerboard ovpn-server[582]: EXTIP:64651 TLS: Initial packet from [AF_INET]EXTIP:64651, sid=eb5b64e1 886db279
May 27 20:23:19 tinkerboard ovpn-server[582]: EXTIP:64651 VERIFY OK: depth=1, CN=ChangeMe
May 27 20:23:19 tinkerboard ovpn-server[582]: EXTIP:64651 Validating certificate key usage
May 27 20:23:19 tinkerboard ovpn-server[582]: EXTIP:64651 ++ Certificate has key usage  0080, expects 0080
May 27 20:23:19 tinkerboard ovpn-server[582]: EXTIP:64651 VERIFY KU OK
May 27 20:23:19 tinkerboard ovpn-server[582]: EXTIP:64651 Validating certificate extended key usage
May 27 20:23:19 tinkerboard ovpn-server[582]: EXTIP:64651 ++ Certificate has EKU (str) TLS Web Client Authentication, expects TLS Web Client Authentication
May 27 20:23:19 tinkerboard ovpn-server[582]: EXTIP:64651 VERIFY EKU OK
May 27 20:23:19 tinkerboard ovpn-server[582]: EXTIP:64651 VERIFY OK: depth=0, CN=Galaxy105G
May 27 20:23:19 tinkerboard ovpn-server[582]: EXTIP:64651 peer info: IV_GUI_VER=OC30Android
May 27 20:23:19 tinkerboard ovpn-server[582]: EXTIP:64651 peer info: IV_VER=3.git::f225fcd0:Release
May 27 20:23:19 tinkerboard ovpn-server[582]: EXTIP:64651 peer info: IV_PLAT=android
May 27 20:23:19 tinkerboard ovpn-server[582]: EXTIP:64651 peer info: IV_NCP=2
May 27 20:23:19 tinkerboard ovpn-server[582]: EXTIP:64651 peer info: IV_TCPNL=1
May 27 20:23:19 tinkerboard ovpn-server[582]: EXTIP:64651 peer info: IV_PROTO=2
May 27 20:23:19 tinkerboard ovpn-server[582]: EXTIP:64651 peer info: IV_IPv6=1
May 27 20:23:19 tinkerboard ovpn-server[582]: EXTIP:64651 peer info: IV_AUTO_SESS=1
May 27 20:23:19 tinkerboard ovpn-server[582]: EXTIP:64651 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-ECDSA-AES256-GCM-SHA384
May 27 20:23:19 tinkerboard ovpn-server[582]: EXTIP:64651 [Galaxy105G] Peer Connection Initiated with [AF_INET]EXTIP:64651
May 27 20:23:19 tinkerboard ovpn-server[582]: Galaxy105G/EXTIP:64651 OPTIONS IMPORT: reading client specific options from: /etc/openvpn/ccd/Galaxy105G
May 27 20:23:19 tinkerboard ovpn-server[582]: Galaxy105G/EXTIP:64651 MULTI: Learn: 10.8.0.2 -> Galaxy105G/EXTIP:64651
May 27 20:23:19 tinkerboard ovpn-server[582]: Galaxy105G/EXTIP:64651 MULTI: primary virtual IP for Galaxy105G/EXTIP:64651: 10.8.0.2
May 27 20:23:19 tinkerboard ovpn-server[582]: Galaxy105G/EXTIP:64651 PUSH: Received control message: 'PUSH_REQUEST'
May 27 20:23:19 tinkerboard ovpn-server[582]: Galaxy105G/EXTIP:64651 SENT CONTROL [Galaxy105G]: 'PUSH_REPLY,dhcp-option DNS 10.8.0.1,block-outside-dns,redirect-gateway def1,route-gateway 10.8.0.1,topology subnet,ping 15,ping-restart 120,ifconfig 10.8.0.2 255.255.255.0,peer-id 0,cipher AES-256-GCM' (status=1)
May 27 20:23:19 tinkerboard ovpn-server[582]: Galaxy105G/EXTIP:64651 Data Channel Encrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
May 27 20:23:19 tinkerboard ovpn-server[582]: Galaxy105G/EXTIP:64651 Data Channel Decrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
May 27 20:23:25 tinkerboard ovpn-server[582]: Galaxy105G/EXTIP:64651 SIGTERM[soft,remote-exit] received, client-instance exiting
May 27 21:17:21 tinkerboard ovpn-server[582]: EXTIP:46131 TLS: Initial packet from [AF_INET]EXTIP:46131, sid=4b864e0b 7b1217fd
May 27 21:17:21 tinkerboard ovpn-server[582]: EXTIP:46131 VERIFY OK: depth=1, CN=ChangeMe
May 27 21:17:22 tinkerboard ovpn-server[582]: EXTIP:46131 Validating certificate key usage
May 27 21:17:22 tinkerboard ovpn-server[582]: EXTIP:46131 ++ Certificate has key usage  0080, expects 0080
May 27 21:17:22 tinkerboard ovpn-server[582]: EXTIP:46131 VERIFY KU OK
May 27 21:17:22 tinkerboard ovpn-server[582]: EXTIP:46131 Validating certificate extended key usage
May 27 21:17:22 tinkerboard ovpn-server[582]: EXTIP:46131 ++ Certificate has EKU (str) TLS Web Client Authentication, expects TLS Web Client Authentication
May 27 21:17:22 tinkerboard ovpn-server[582]: EXTIP:46131 VERIFY EKU OK
May 27 21:17:22 tinkerboard ovpn-server[582]: EXTIP:46131 VERIFY OK: depth=0, CN=Galaxy105G
May 27 21:17:22 tinkerboard ovpn-server[582]: EXTIP:46131 peer info: IV_GUI_VER=OC30Android
May 27 21:17:22 tinkerboard ovpn-server[582]: EXTIP:46131 peer info: IV_VER=3.git::f225fcd0:Release
May 27 21:17:22 tinkerboard ovpn-server[582]: EXTIP:46131 peer info: IV_PLAT=android
May 27 21:17:22 tinkerboard ovpn-server[582]: EXTIP:46131 peer info: IV_NCP=2
May 27 21:17:22 tinkerboard ovpn-server[582]: EXTIP:46131 peer info: IV_TCPNL=1
May 27 21:17:22 tinkerboard ovpn-server[582]: EXTIP:46131 peer info: IV_PROTO=2
May 27 21:17:22 tinkerboard ovpn-server[582]: EXTIP:46131 peer info: IV_IPv6=1
May 27 21:17:22 tinkerboard ovpn-server[582]: EXTIP:46131 peer info: IV_AUTO_SESS=1
May 27 21:17:22 tinkerboard ovpn-server[582]: EXTIP:46131 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-ECDSA-AES256-GCM-SHA384
May 27 21:17:22 tinkerboard ovpn-server[582]: EXTIP:46131 [Galaxy105G] Peer Connection Initiated with [AF_INET]EXTIP:46131
May 27 21:17:22 tinkerboard ovpn-server[582]: Galaxy105G/EXTIP:46131 OPTIONS IMPORT: reading client specific options from: /etc/openvpn/ccd/Galaxy105G
May 27 21:17:22 tinkerboard ovpn-server[582]: Galaxy105G/EXTIP:46131 MULTI: Learn: 10.8.0.2 -> Galaxy105G/EXTIP:46131
May 27 21:17:22 tinkerboard ovpn-server[582]: Galaxy105G/EXTIP:46131 MULTI: primary virtual IP for Galaxy105G/EXTIP:46131: 10.8.0.2
May 27 21:17:22 tinkerboard ovpn-server[582]: Galaxy105G/EXTIP:46131 PUSH: Received control message: 'PUSH_REQUEST'
May 27 21:17:22 tinkerboard ovpn-server[582]: Galaxy105G/EXTIP:46131 SENT CONTROL [Galaxy105G]: 'PUSH_REPLY,dhcp-option DNS 10.8.0.1,block-outside-dns,redirect-gateway def1,route-gateway 10.8.0.1,topology subnet,ping 15,ping-restart 120,ifconfig 10.8.0.2 255.255.255.0,peer-id 0,cipher AES-256-GCM' (status=1)
May 27 21:17:22 tinkerboard ovpn-server[582]: Galaxy105G/EXTIP:46131 Data Channel Encrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
May 27 21:17:22 tinkerboard ovpn-server[582]: Galaxy105G/EXTIP:46131 Data Channel Decrypt: Cipher 'AES-256-GCM' initialized with 256 bit key
May 27 21:20:25 tinkerboard ovpn-server[582]: Galaxy105G/EXTIP:46131 SIGTERM[soft,remote-exit] received, client-instance exiting
May 28 07:34:41 tinkerboard ovpn-server[582]: 203.xxx.xx.xx:38327 TLS: Initial packet from [AF_INET]203.xxx.xx.xx:38327, sid=8b37a88e 74b3dd9e
May 28 07:34:42 tinkerboard ovpn-server[582]: 203.xxx.xx.xx:38327 tls-crypt unwrap error: bad packet ID (may be a replay): [ #1 / time = (1590615282) Thu May 28 07:34:42 2020 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
May 28 07:34:42 tinkerboard ovpn-server[582]: 203.xxx.xx.xx:38327 tls-crypt unwrap error: packet replay
May 28 07:34:42 tinkerboard ovpn-server[582]: 203.xxx.xx.xx:38327 TLS Error: tls-crypt unwrapping failed from [AF_INET]203.xxx.xx.xx:38327
May 28 07:34:43 tinkerboard ovpn-server[582]: 203.xxx.xx.xx:38327 tls-crypt unwrap error: bad packet ID (may be a replay): [ #1 / time = (1590615282) Thu May 28 07:34:42 2020 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
May 28 07:34:43 tinkerboard ovpn-server[582]: 203.xxx.xx.xx:38327 tls-crypt unwrap error: packet replay
May 28 07:34:43 tinkerboard ovpn-server[582]: 203.xxx.xx.xx:38327 TLS Error: tls-crypt unwrapping failed from [AF_INET]203.xxx.xx.xx:38327
May 28 07:34:44 tinkerboard ovpn-server[582]: 203.xxx.xx.xx:38327 tls-crypt unwrap error: bad packet ID (may be a replay): [ #1 / time = (1590615282) Thu May 28 07:34:42 2020 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
May 28 07:34:44 tinkerboard ovpn-server[582]: 203.xxx.xx.xx:38327 tls-crypt unwrap error: packet replay
May 28 07:34:44 tinkerboard ovpn-server[582]: 203.xxx.xx.xx:38327 TLS Error: tls-crypt unwrapping failed from [AF_INET]203.xxx.xx.xx:38327
May 28 07:34:45 tinkerboard ovpn-server[582]: 203.xxx.xx.xx:38327 tls-crypt unwrap error: bad packet ID (may be a replay): [ #1 / time = (1590615282) Thu May 28 07:34:42 2020 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
May 28 07:34:45 tinkerboard ovpn-server[582]: 203.xxx.xx.xx:38327 tls-crypt unwrap error: packet replay
May 28 07:34:45 tinkerboard ovpn-server[582]: 203.xxx.xx.xx:38327 TLS Error: tls-crypt unwrapping failed from [AF_INET]203.xxx.xx.xx:38327
May 28 07:34:46 tinkerboard ovpn-server[582]: 203.xxx.xx.xx:38327 tls-crypt unwrap error: bad packet ID (may be a replay): [ #1 / time = (1590615282) Thu May 28 07:34:42 2020 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
May 28 07:34:46 tinkerboard ovpn-server[582]: 203.xxx.xx.xx:38327 tls-crypt unwrap error: packet replay
May 28 07:34:46 tinkerboard ovpn-server[582]: 203.xxx.xx.xx:38327 TLS Error: tls-crypt unwrapping failed from [AF_INET]203.xxx.xx.xx:38327
May 28 07:35:41 tinkerboard ovpn-server[582]: 203.xxx.xx.xx:38327 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
May 28 07:35:41 tinkerboard ovpn-server[582]: 203.xxx.xx.xx:38327 TLS Error: TLS handshake failed
May 28 07:35:41 tinkerboard ovpn-server[582]: 203.xxx.xx.xx:38327 SIGUSR1[soft,tls-error] received, client-instance restarting
TinCanTech

You should report your bug to PiVPN.
kazzaw

Thank you for pointing me in the right direction