Hi everyone!.
Users complain about instability with openvpn..
We have 100 to 150 active VPN (right now, 135 connected users).
We base our configuration in an old Openvpn server, so maybe the config is obsolet or we need to modify/add some parameters.
Any help will be very appreciated.
Thanks a lot!!
SERVER
Server: Ubuntu 16.04.6 LTS
Openvpn version: 2.3.10-1ubuntu2.2
local xxx.xxx.xxx.xxx (
omitted for security reasons)
management 0.0.0.0 10005
cd /var/lib/openvpn
chroot /var/lib/openvpn
float
mlock
reneg-sec 36000
port 6005
proto udp
dev tun6005
ca /etc/openvpn/certs/vpn3/ca.crt
cert /etc/openvpn/certs/vpn3/VPN_Sever3.crt
key /etc/openvpn/certs/vpn3/VPN_Sever3.key
dh /etc/openvpn/certs/vpn-genexus3/dh2048.pem
server 10.10.0.0 255.255.0.0
push "route 172.16.0.0 255.255.0.0"
push "route 192.168.254.0 255.255.255.0"
push "dhcp-option DNS 172.16.0.61"
push "dhcp-option DNS 172.16.1.56"
push "dhcp-option DOMAIN xxxxxx.local"
keepalive 1000 2000
tls-auth /etc/openvpn/certs/vpn3/ta.key 0
key-direction 0
cipher AES-128-CBC
auth SHA256
comp-lzo
persist-key
persist-tun
status openvpn-status.log 30
log /var/log/openvpn2020.log
;log-append openvpn.log
verb 4
crl-verify crl.pem
CLIENT
Vpn Client windows: 2.4.9 (2.5 has troubles with our config..or I don't know)
client
proto udp
cipher AES-128-CBC
auth SHA256
dev tun
remote xxxxxx.xxxxxx.com
auth-user-pass
auth-nocache
remote-cert-tls server
tls-client
port 6005
resolv-retry infinite
compress lzo
persist-tun
persist-key
persist-remote-ip
verb 3
mute 10
key-direction 1
reneg-sec 36000
<ca>
-----BEGIN CERTIFICATE-----
xxxxxxxx
xxxxxxxxx
xxxxxxxx
-----END CERTIFICATE-----
</ca>
<cert>
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 4 (0x4)
Signature Algorithm: sha256WithRSAEncryption
Issuer: C=xx, ST=xxx, L=xxxx, O=xxxx SA, OU=xxx, CN=xxx SA CA/name=VPN_Sever2/emailAddress=
xxxxx@xxxx.com
Validity
Not Before: Jul 8 19:00:17 2019 GMT
Not After : Jul 5 19:00:17 2029 GMT
Subject: C=xx, ST=xxx, L=xxxx, O=xxxx SA, OU=xxx, CN=xxx/name=VPN_Sever2/emailAddress=
xxxxx@xxxx.com
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
xxxxxxxxxx
xxxxxxxxxx
xxxxxxxxxx
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Comment:
Easy-RSA Generated Certificate
X509v3 Subject Key Identifier:
xx:xx:xx:xx:xx:xx:xx
X509v3 Authority Key Identifier:
keyid:XX:XX:XX:XX:XX:XX:XX
DirName:C=xx, ST=xxx, L=xxxx, O=xxxx SA, OU=xxx, CN=xxx SA CA/name=VPN_Sever2/emailAddress=
xxxxx@xxxx.com
serial:XX:XX:XX:XX
X509v3 Extended Key Usage:
TLS Web Client Authentication
X509v3 Key Usage:
Digital Signature
X509v3 Subject Alternative Name:
DNS:sgauna3
Signature Algorithm: sha256WithRSAEncryption
XX:XX:XX:XX:XX
XX:XX:XX:XX:XX
XX:XX:XX:XX:XX
-----BEGIN CERTIFICATE-----
xxxxxxxxxx
xxxxxxxxxx
xxxxxxxxxx
xxxxxxxxxx
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
xxxxxx
xxxxxx
xxxxxx
xxxxxx
-----END PRIVATE KEY-----
</key>
<tls-auth>
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
XXXXXX
XXXXXX
XXXXXX
XXXXXX
-----END OpenVPN Static key V1-----
</tls-auth>
