OpenVPN Renegotiate every hour even thou set to 36000

aboka

hi, could someone shed some light on how to fix this reneg-sec issue? i hv set 36000 on server and 0 on client, but on the client side when i check, it will renegotiate every hour. I want it to only renegotiate every 10 hours. The server is running Ubuntu 20.04 with OpenVPN 2.4.7-1ubuntu2. And the client is running Windows 7 64bit with OpenVPN GUI 11.15.0.0/2.4.9

Thank you very much,

.
.

Thu Jul 16 23:01:35 2020 Initialization Sequence Completed
Thu Jul 16 23:01:35 2020 MANAGEMENT: >STATE:1594911695,CONNECTED,SUCCESS,10.8.0.2,103.102.46.220,1194,,
Fri Jul 17 00:01:35 2020 MANAGEMENT: CMD 'username "Auth" "user1"'
Fri Jul 17 00:01:35 2020 MANAGEMENT: CMD 'password [...]'
Fri Jul 17 00:01:35 2020 VERIFY OK: depth=1, CN=ChangeMe
Fri Jul 17 00:01:35 2020 VERIFY KU OK
Fri Jul 17 00:01:35 2020 Validating certificate extended key usage
Fri Jul 17 00:01:35 2020 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Fri Jul 17 00:01:35 2020 VERIFY EKU OK
Fri Jul 17 00:01:35 2020 VERIFY OK: depth=0, CN=server
Fri Jul 17 00:01:35 2020 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Fri Jul 17 00:01:35 2020 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Fri Jul 17 00:01:35 2020 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA

local 103.102.46.220
port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh.pem
auth SHA512
tls-crypt tc.key
topology subnet
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1 bypass-dhcp"
ifconfig-pool-persist ipp.txt
push "dhcp-option DNS 10.8.0.1"
keepalive 10 120
cipher AES-256-CBC
reneg-sec 36000
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3
crl-verify crl.pem
explicit-exit-notify
plugin /usr/lib/x86_64-linux-gnu/openvpn/plugins/openvpn-plugin-auth-pam.so login

client
dev tun
proto udp
remote 103.102.46.220 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
auth SHA512
auth-nocache
cipher AES-256-CBC
reneg-sec 0
auth-user-pass
ignore-unknown-option block-outside-dns
block-outside-dns
verb 3
[oconf]

Pippin

It behaves as described in the manual, see --reneg-sec n:
https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage

Did you restart the server?

Edit:
Please use proper formatting for your posts, thanks.

aboka

Pippin wrote It behaves as described in the manual, see --reneg-sec n:
https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage

Did you restart the server?

Edit:
Please use proper formatting for your posts, thanks.

hi, i think i shld hv restart the server. but not 100% sure since the info i read did not specifically mention it need a reboot(or i hv miss that part). will do a reboot now and be back tomorrow since it will take like hours to know how it goes.

p/s - could you please point me on how to do proper formatting for a post? like separating the logs, server config, etc

p/ss - got it, by looking at your edit. will add 'code' and 'config' next time. thanks for pointing it out 🙂

thank you,

aboka

hi, here is the outcome - i did not test with my pc since its shut down at night, only test on my Android with OpenVPN Connect client. Connect since 03:08 and there is no renegotiation until now 14:30, when it should reneg after 10 hours(36000). but i think setting the client side to 36000 instead of 0 will fix the issue. do more research online and found this is quite common issue for some, and some of them has success by modifying these values keep-alive and also auth-user beside reneg-sec

anyone know where we could set this reneg-sec in Softether server? as got another Softether server installation hving the same issue.... its server.conf is different from OpenVPN and there is no reneg-sec in there :/

thank you,

aboka

Ok, its working as expected now. It 'dc' and reconnect on the 10th hour. Thanks a lot 🙂