I have a Linux machine (OpenVPN 2.4.4) placed behind the router with DD-WRT firmware (OpenVPN 2.3.6). The router used to connect with no problem until recently. Now, there is a "ping-restart" error:
client
dev tun
proto udp
remote 185.242.6.4 1194
remote-random
resolv-retry infinite
nobind
cipher AES-256-CBC
auth SHA512
comp-lzo no
verb 3
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
persist-key
persist-tun
reneg-sec 0
remote-cert-tls server
auth-user-pass
pull
fast-io
Clientlog:
19700101 01:00:11 I OpenVPN 2.3.6 mipsel-unknown-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [MH] [IPv6] built on Jan 20 2015
19700101 01:00:11 I library versions: OpenSSL 1.0.1k 8 Jan 2015 LZO 2.08
19700101 01:00:11 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:16
19700101 01:00:11 W WARNING: file '/tmp/openvpncl/credentials' is group or others accessible
19700101 01:00:11 W NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
19700101 01:00:11 W WARNING: file '/tmp/openvpncl/ta.key' is group or others accessible
19700101 01:00:11 I Control Channel Authentication: using '/tmp/openvpncl/ta.key' as a OpenVPN static key file
19700101 01:00:11 Outgoing Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
19700101 01:00:11 Incoming Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
19700101 01:00:11 Socket Buffers: R=[114688->131072] S=[114688->131072]
19700101 01:00:11 I UDPv4 link local: [undef]
19700101 01:00:11 I UDPv4 link remote: [AF_INET]185.242.6.4:1194
19700101 01:00:16 TLS: Initial packet from [AF_INET]185.242.6.4:1194 sid=d2c1891e d8978ae4
19700101 01:00:16 W WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
20200825 16:10:12 I [UNDEF] Inactivity timeout (--ping-restart) restarting
20200825 16:10:12 I SIGUSR1[soft ping-restart] received process restarting
20200825 16:10:12 Restart pause 2 second(s)
20200825 16:10:14 W NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
However, the same config works with no problem on Linux machine:
Tue Aug 25 17:40:45 2020 OpenVPN 2.4.4 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Sep 5 2018
Tue Aug 25 17:40:45 2020 library versions: OpenSSL 1.1.1 11 Sep 2018, LZO 2.08
Enter Auth Username: ***
Enter Auth Password: ************
Tue Aug 25 17:40:59 2020 Outgoing Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Tue Aug 25 17:40:59 2020 Incoming Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Tue Aug 25 17:40:59 2020 TCP/UDP: Preserving recently used remote address: [AF_INET]185.242.6.4:1194
Tue Aug 25 17:40:59 2020 Socket Buffers: R=[212992->212992] S=[212992->212992]
Tue Aug 25 17:40:59 2020 UDP link local: (not bound)
Tue Aug 25 17:40:59 2020 UDP link remote: [AF_INET]185.242.6.4:1194
Tue Aug 25 17:40:59 2020 TLS: Initial packet from [AF_INET]185.242.6.4:1194, sid=8f38476f 8f8bcb54
Tue Aug 25 17:40:59 2020 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Tue Aug 25 17:40:59 2020 VERIFY OK: depth=2, C=CH, O=ProtonVPN AG, CN=ProtonVPN Root CA
Tue Aug 25 17:40:59 2020 VERIFY OK: depth=1, C=CH, O=ProtonVPN AG, CN=ProtonVPN Intermediate CA 1
Tue Aug 25 17:40:59 2020 VERIFY KU OK
Tue Aug 25 17:40:59 2020 Validating certificate extended key usage
Tue Aug 25 17:40:59 2020 ++ Certificate has EKU (str) TLS Web Client Authentication, expects TLS Web Server Authentication
Tue Aug 25 17:40:59 2020 ++ Certificate has EKU (oid) 1.3.6.1.5.5.7.3.2, expects TLS Web Server Authentication
Tue Aug 25 17:40:59 2020 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Tue Aug 25 17:40:59 2020 VERIFY EKU OK
Tue Aug 25 17:40:59 2020 VERIFY OK: depth=0, CN=cz-02.protonvpn.com
Tue Aug 25 17:41:02 2020 Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 4096 bit RSA
Tue Aug 25 17:41:02 2020 [cz-02.protonvpn.com] Peer Connection Initiated with [AF_INET]185.242.6.4:1194
Tue Aug 25 17:41:03 2020 SENT CONTROL [cz-02.protonvpn.com]: 'PUSH_REQUEST' (status=1)
Tue Aug 25 17:41:03 2020 PUSH: Received control message: 'PUSH_REPLY,dhcp-option DNS 10.50.0.1,redirect-gateway def1,sndbuf 524288,rcvbuf 524288,explicit-exit-notify,comp-lzo no,route-gateway 10.50.0.1,topology subnet,ping 10,ping-restart 60,ifconfig 10.50.0.30 255.255.0.0,peer-id 29,cipher AES-256-GCM'
Tue Aug 25 17:41:03 2020 Option 'explicit-exit-notify' in [PUSH-OPTIONS]:5 is ignored by previous <connection> blocks
Tue Aug 25 17:41:03 2020 OPTIONS IMPORT: timers and/or timeouts modified
Tue Aug 25 17:41:03 2020 OPTIONS IMPORT: explicit notify parm(s) modified
Tue Aug 25 17:41:03 2020 OPTIONS IMPORT: compression parms modified
Tue Aug 25 17:41:03 2020 OPTIONS IMPORT: --sndbuf/--rcvbuf options modified
Tue Aug 25 17:41:03 2020 Socket Buffers: R=[212992->425984] S=[212992->425984]
Tue Aug 25 17:41:03 2020 OPTIONS IMPORT: --ifconfig/up options modified
Tue Aug 25 17:41:03 2020 OPTIONS IMPORT: route options modified
Tue Aug 25 17:41:03 2020 OPTIONS IMPORT: route-related options modified
Tue Aug 25 17:41:03 2020 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Tue Aug 25 17:41:03 2020 OPTIONS IMPORT: peer-id set
Tue Aug 25 17:41:03 2020 OPTIONS IMPORT: adjusting link_mtu to 1657
Tue Aug 25 17:41:03 2020 OPTIONS IMPORT: data channel crypto options modified
Tue Aug 25 17:41:03 2020 Data Channel: using negotiated cipher 'AES-256-GCM'
Tue Aug 25 17:41:03 2020 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Tue Aug 25 17:41:03 2020 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Tue Aug 25 17:41:03 2020 ROUTE_GATEWAY 192.168.99.1/255.255.255.0 IFACE=enp2s0 HWADDR=50:3e:aa:05:82:7c
Tue Aug 25 17:41:03 2020 TUN/TAP device tun0 opened
Tue Aug 25 17:41:03 2020 TUN/TAP TX queue length set to 100
Tue Aug 25 17:41:03 2020 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Tue Aug 25 17:41:03 2020 /sbin/ip link set dev tun0 up mtu 1500
Tue Aug 25 17:41:03 2020 /sbin/ip addr add dev tun0 10.50.0.30/16 broadcast 10.50.255.255
Tue Aug 25 17:41:03 2020 /sbin/ip route add 185.242.6.4/32 via 192.168.99.1
Tue Aug 25 17:41:03 2020 /sbin/ip route add 0.0.0.0/1 via 10.50.0.1
Tue Aug 25 17:41:03 2020 /sbin/ip route add 128.0.0.0/1 via 10.50.0.1
Tue Aug 25 17:41:03 2020 Initialization Sequence Completed
Could it be the OpenVPN (or OpenSSL) version mismatch that causes the problem?
