Hi experts, I am using openvpn community 2.5 GA on client side (windows) and want to work with wintun as a virtual interface. openvpn being run from command line with system elevation. In part of the cases openvpn closing the connection at the second the connection is established with ping-restart If connection is not closed at the second it is open, or in case of tap driver/interface is used there are no such disconnects. It happens a lot on my laptop, but still haven't seen it even once on my stationary machine connected to the same ISP (although wired). ping-restart defined as 10 seconds, ping as 3, so the first ping-restart disconnect is expected to be 10 seconds after connecting. In any case tried to redefine to 60 and 10, it didn't resolve the issue too. Log below is with verb 6 Client Debug [code] 2020-12-23 14:39:52 us=143977 [x.x.x.x] Peer Connection Initiated with [AF_INET]x.x.x.x:1194 2020-12-23 14:39:53 us=191192 SENT CONTROL [x.x.x.x]: 'PUSH_REQUEST' (status=1) 2020-12-23 14:39:53 us=191192 UDP WRITE [128] to [AF_INET]x.x.x.x:1194: P_CONTROL_V1 kid=0 pid=[ #11 ] [ ] pid=6 DATA len=42 2020-12-23 14:39:53 us=198174 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:9999 2020-12-23 14:39:55 us=70203 UDP READ [94] from [AF_INET]x.x.x.x:1194: P_ACK_V1 kid=0 pid=[ #9 ] [ 6 ] 2020-12-23 14:39:55 us=72190 UDP READ [358] from [AF_INET]x.x.x.x:1194: P_CONTROL_V1 kid=0 pid=[ #10 ] [ ] pid=6 DATA len=272 2020-12-23 14:39:55 us=72190 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,sndbuf 2097152,rcvbuf 2097152,route 100.124.4.1,topology net30,ping 3,ping-restart 10,ifconfig 100.124.4.42 100.124.4.41,peer-id 1,cipher AES-256-GCM' 2020-12-23 14:39:55 us=72190 OPTIONS IMPORT: timers and/or timeouts modified 2020-12-23 14:39:55 us=72190 OPTIONS IMPORT: --sndbuf/--rcvbuf options modified 2020-12-23 14:39:55 us=72190 Socket Buffers: R=[65536->2097152] S=[64512->2097152] 2020-12-23 14:39:55 us=72190 OPTIONS IMPORT: --ifconfig/up options modified 2020-12-23 14:39:55 us=72190 OPTIONS IMPORT: route options modified 2020-12-23 14:39:55 us=72190 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified 2020-12-23 14:39:55 us=72190 OPTIONS IMPORT: peer-id set 2020-12-23 14:39:55 us=72190 OPTIONS IMPORT: adjusting link_mtu to 1625 2020-12-23 14:39:55 us=72190 OPTIONS IMPORT: data channel crypto options modified 2020-12-23 14:39:55 us=72190 Data Channel: using negotiated cipher 'AES-256-GCM' 2020-12-23 14:39:55 us=72190 Data Channel MTU parms [ L:1553 D:1350 EF:53 EB:406 ET:0 EL:3 ] 2020-12-23 14:39:55 us=72190 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key 2020-12-23 14:39:55 us=72190 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key 2020-12-23 14:39:55 us=72190 interactive service msg_channel=0 2020-12-23 14:39:55 us=105104 ROUTE_GATEWAY 192.168.1.1/255.255.255.0 I=19 HWADDR=e4:a4:71:01:dd:67 2020-12-23 14:39:55 us=155967 open_tun 2020-12-23 14:39:55 us=171925 wintun device [Local Area Connection] opened 2020-12-23 14:39:55 us=172921 do_ifconfig, ipv4=1, ipv6=0 2020-12-23 14:39:56 us=175258 NETSH: C:\WINDOWS\system32\netsh.exe interface ip set address 16 static 100.124.4.42 255.255.255.252 2020-12-23 14:39:58 us=491100 NETSH: C:\WINDOWS\system32\netsh.exe interface ip delete dns 16 all 2020-12-23 14:40:00 us=720172 NETSH: C:\WINDOWS\system32\netsh.exe interface ip set dns 16 static 8.8.8.8 validate=no 2020-12-23 14:40:03 us=268392 NETSH: C:\WINDOWS\system32\netsh.exe interface ip add dns 16 8.8.4.4 validate=no 2020-12-23 14:40:05 us=501451 NETSH: C:\WINDOWS\system32\netsh.exe interface ip delete wins 16 all 2020-12-23 14:40:06 us=376123 IPv4 MTU set to 1500 on interface 16 using SetIpInterfaceEntry() 2020-12-23 14:40:06 us=376123 C:\WINDOWS\system32\route.exe ADD x.x.x.x MASK 255.255.255.255 192.168.1.1 2020-12-23 14:40:06 us=393079 ROUTE: route addition failed using CreateIpForwardEntry: The object already exists. [status=5010 if_index=19] 2020-12-23 14:40:06 us=393079 Route addition via IPAPI failed [adaptive] 2020-12-23 14:40:06 us=393079 Route addition fallback to route.exe 2020-12-23 14:40:06 us=394075 env_block: add PATH=C:\WINDOWS\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem 2020-12-23 14:40:07 us=359508 C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 100.124.4.41 2020-12-23 14:40:07 us=377460 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=5 and dwForwardType=4 2020-12-23 14:40:07 us=377460 Route addition via IPAPI succeeded [adaptive] 2020-12-23 14:40:07 us=377460 C:\WINDOWS\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 100.124.4.41 2020-12-23 14:40:07 us=409374 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=5 and dwForwardType=4 2020-12-23 14:40:07 us=409374 Route addition via IPAPI succeeded [adaptive] 2020-12-23 14:40:07 us=409374 C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 0.0.0.0 100.124.4.41 2020-12-23 14:40:07 us=438298 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=5 and dwForwardType=4 2020-12-23 14:40:07 us=438298 Route addition via IPAPI succeeded [adaptive] 2020-12-23 14:40:07 us=438298 C:\WINDOWS\system32\route.exe ADD 100.124.4.1 MASK 255.255.255.255 100.124.4.41 2020-12-23 14:40:07 us=445280 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=5 and dwForwardType=4 2020-12-23 14:40:07 us=445280 Route addition via IPAPI succeeded [adaptive] 2020-12-23 14:40:07 us=445280 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this 2020-12-23 14:40:07 us=445280 Initialization Sequence Completed 2020-12-23 14:40:07 us=446276 UDP WRITE [94] to [AF_INET]x.x.x.x:1194: P_ACK_V1 kid=0 pid=[ #12 ] [ 6 ] 2020-12-23 14:40:07 us=446276 [x.x.x.x] Inactivity timeout (--ping-restart), restarting 2020-12-23 14:40:07 us=446276 TCP/UDP: Closing socket 2020-12-23 14:40:07 us=446276 C:\WINDOWS\system32\route.exe DELETE 0.0.0.0 MASK 0.0.0.0 100.124.4.41 2020-12-23 14:40:07 us=453258 Route deletion via IPAPI succeeded [adaptive] 2020-12-23 14:40:07 us=453258 C:\WINDOWS\system32\route.exe DELETE 100.124.4.1 MASK 255.255.255.255 100.124.4.41 2020-12-23 14:40:07 us=523073 Route deletion via IPAPI succeeded [adaptive] 2020-12-23 14:40:07 us=523073 C:\WINDOWS\system32\route.exe DELETE x.x.x.x MASK 255.255.255.255 192.168.1.1 2020-12-23 14:40:07 us=531051 Route deletion via IPAPI succeeded [adaptive] 2020-12-23 14:40:07 us=531051 C:\WINDOWS\system32\route.exe DELETE 0.0.0.0 MASK 128.0.0.0 100.124.4.41 [/code] [oconf=Client Config] client dev tun key "private_key.pem" tls-version-min 1.2 tls-cipher TLS-ECDHE-RSA-WITH-AES-128-GCM-SHA256:TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256:TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384:TLS-DHE-RSA-WITH-AES-256-CBC-SHA256 auth SHA512 cipher AES-256-CBC resolv-retry infinite auth-retry none nobind persist-key ns-cert-type server comp-lzo verb 4 windows-driver wintun tls-client up-delay management 127.0.0.1 9999 connect-retry-max 3 mssfix 1350 route 0.0.0.0 0.0.0.0 [/oconf] Any ideas what can be wrong?

by the way here is a successful log with the same wintun and same configuration and even same failed route addition: Client log: [code] 2020-12-24 15:46:19 us=541190 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,sndbuf 2097152,rcvbuf 2097152,route 100.124.4.1,topology net30,ping 3,ping-restart 10,ifconfig 100.124.4.42 100.124.4.41,peer-id 0,cipher AES-256-GCM' 2020-12-24 15:46:19 us=542187 OPTIONS IMPORT: timers and/or timeouts modified 2020-12-24 15:46:19 us=542187 OPTIONS IMPORT: --sndbuf/--rcvbuf options modified 2020-12-24 15:46:19 us=542187 Socket Buffers: R=[65536->2097152] S=[64512->2097152] 2020-12-24 15:46:19 us=542187 OPTIONS IMPORT: --ifconfig/up options modified 2020-12-24 15:46:19 us=542187 OPTIONS IMPORT: route options modified 2020-12-24 15:46:19 us=542187 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified 2020-12-24 15:46:19 us=542187 OPTIONS IMPORT: peer-id set 2020-12-24 15:46:19 us=542187 OPTIONS IMPORT: adjusting link_mtu to 1625 2020-12-24 15:46:19 us=542187 OPTIONS IMPORT: data channel crypto options modified 2020-12-24 15:46:19 us=542187 Data Channel: using negotiated cipher 'AES-256-GCM' 2020-12-24 15:46:19 us=542187 Data Channel MTU parms [ L:1553 D:1350 EF:53 EB:406 ET:0 EL:3 ] 2020-12-24 15:46:19 us=542187 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key 2020-12-24 15:46:19 us=542187 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key 2020-12-24 15:46:19 us=542187 interactive service msg_channel=0 2020-12-24 15:46:19 us=547173 ROUTE_GATEWAY 192.168.1.1/255.255.255.0 I=19 HWADDR=e4:a4:71:01:dd:67 2020-12-24 15:46:19 us=612000 open_tun 2020-12-24 15:46:19 us=627957 wintun device [Local Area Connection] opened 2020-12-24 15:46:19 us=628955 do_ifconfig, ipv4=1, ipv6=0 2020-12-24 15:46:20 us=631274 NETSH: C:\WINDOWS\system32\netsh.exe interface ip set address 15 static 100.124.4.42 255.255.255.252 2020-12-24 15:46:23 us=126601 NETSH: C:\WINDOWS\system32\netsh.exe interface ip delete dns 15 all 2020-12-24 15:46:24 us=731310 NETSH: C:\WINDOWS\system32\netsh.exe interface ip set dns 15 static 8.8.8.8 validate=no 2020-12-24 15:46:26 us=573380 NETSH: C:\WINDOWS\system32\netsh.exe interface ip add dns 15 8.8.4.4 validate=no 2020-12-24 15:46:28 us=7547 NETSH: C:\WINDOWS\system32\netsh.exe interface ip delete wins 15 all 2020-12-24 15:46:28 us=438394 IPv4 MTU set to 1500 on interface 15 using SetIpInterfaceEntry() 2020-12-24 15:46:28 us=440388 C:\WINDOWS\system32\route.exe ADD x.x.x.x MASK 255.255.255.255 192.168.1.1 2020-12-24 15:46:28 us=446371 ROUTE: route addition failed using CreateIpForwardEntry: The object already exists. [status=5010 if_index=19] 2020-12-24 15:46:28 us=446371 Route addition via IPAPI failed [adaptive] 2020-12-24 15:46:28 us=446371 Route addition fallback to route.exe 2020-12-24 15:46:28 us=446371 env_block: add PATH=C:\WINDOWS\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem 2020-12-24 15:46:28 us=884201 C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 128.0.0.0 100.124.4.41 2020-12-24 15:46:28 us=888191 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=2 and dwForwardType=4 2020-12-24 15:46:28 us=888191 Route addition via IPAPI succeeded [adaptive] 2020-12-24 15:46:28 us=888191 C:\WINDOWS\system32\route.exe ADD 128.0.0.0 MASK 128.0.0.0 100.124.4.41 2020-12-24 15:46:28 us=892180 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=2 and dwForwardType=4 2020-12-24 15:46:28 us=892180 Route addition via IPAPI succeeded [adaptive] 2020-12-24 15:46:28 us=894175 C:\WINDOWS\system32\route.exe ADD 0.0.0.0 MASK 0.0.0.0 100.124.4.41 2020-12-24 15:46:28 us=898164 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=2 and dwForwardType=4 2020-12-24 15:46:28 us=898164 Route addition via IPAPI succeeded [adaptive] 2020-12-24 15:46:28 us=898164 C:\WINDOWS\system32\route.exe ADD 100.124.4.1 MASK 255.255.255.255 100.124.4.41 2020-12-24 15:46:28 us=925091 ROUTE: CreateIpForwardEntry succeeded with dwForwardMetric1=2 and dwForwardType=4 2020-12-24 15:46:28 us=925091 Route addition via IPAPI succeeded [adaptive] 2020-12-24 15:46:28 us=925091 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this 2020-12-24 15:46:28 us=925091 Initialization Sequence Completed 2020-12-24 15:46:28 us=925091 UDP WRITE [94] to [AF_INET]x.x.x.x:1194: P_ACK_V1 kid=0 pid=[ #12 ] [ 6 ] 2020-12-24 15:46:28 us=926089 TUN READ [96] 2020-12-24 15:46:28 us=926089 UDP WRITE [121] to [AF_INET]x.x.x.x:1194: P_DATA_V2 kid=0 DATA len=120 2020-12-24 15:46:28 us=926089 TUN READ [96] 2020-12-24 15:46:28 us=926089 UDP WRITE [121] to [AF_INET]x.x.x.x:1194: P_DATA_V2 kid=0 DATA len=120 2020-12-24 15:46:28 us=926089 TUN READ [96] [/code]

Your log is at --verb 6 but your config is --verb 4 .. are you using the right config ? Please don't use "route 0.0.0.0 0.0.0.0"

[quote=TinCanTech post_id=96491 time=1608818113 user_id=37053] Your log is at --verb 6 but your config is --verb 4 .. are you using the right config ? Please don't use "route 0.0.0.0 0.0.0.0" [/quote] Regarding verb, I have changed it to get higher resolution debug, but the config is the same. For 'route 0.0.0.0 0.0.0.0' can you explain a little bit, why is it not recommended? Also do you mean that it can be a reason (as also wintun is able to connect with such configuration, just not always), or it is a bad practice in general? What should be used instead?

route 0.0.0.0 0.0.0.0 causes recursive routing .. which breaks the VPN. Use --redirect-gateway def1

[quote=TinCanTech post_id=96496 time=1608819167 user_id=37053] route 0.0.0.0 0.0.0.0 causes recursive routing .. which breaks the VPN. Use --redirect-gateway def1 [/quote] So, it is a general bad practice. Thanks, I'll implement! In any case it doesn't explain the specific issue as it is working most of the time and there are no recursive routing drops which would appear if this was an issue here. Any ideas specifically regarding the ping-restart?

[quote=stvitaly post_id=96499 time=1608819614 user_id=52441] Any ideas specifically regarding the ping-restart? [/quote][quote=stvitaly post_id=96490 time=1608817967 user_id=52441] ping-restart defined as 10 seconds, ping as 3, so the first ping-restart disconnect is expected to be 10 seconds after connecting. In any case tried to redefine to 60 and 10, it didn't resolve the issue too. [/quote]Just use the default ..

[quote=TinCanTech post_id=96501 time=1608819714 user_id=37053] [quote=stvitaly post_id=96499 time=1608819614 user_id=52441] Any ideas specifically regarding the ping-restart? [/quote][quote=stvitaly post_id=96490 time=1608817967 user_id=52441] ping-restart defined as 10 seconds, ping as 3, so the first ping-restart disconnect is expected to be 10 seconds after connecting. In any case tried to redefine to 60 and 10, it didn't resolve the issue too. [/quote]Just use the default .. [/quote] I meant the issue of disconnecting because of ping-restart at the second of connecting. [code] 2020-12-23 14:40:07 us=445280 Initialization Sequence Completed 2020-12-23 14:40:07 us=446276 UDP WRITE [94] to [AF_INET]x.x.x.x:1194: P_ACK_V1 kid=0 pid=[ #12 ] [ 6 ] 2020-12-23 14:40:07 us=446276 [x.x.x.x] Inactivity timeout (--ping-restart), restarting 2020-12-23 14:40:07 us=446276 TCP/UDP: Closing socket [/code] It is not related to the actual values of ping-restart as it happens on the same second when the client is connected. Also it does not happen always and it also doesn't happen with tap.

According to what [b]you[/b] have posted your --keepalive values are now broken because the timeout is lower than the ping. If you want further help please post full details as per: https://forums.openvpn.net/viewtopic.php?f=30&t=22603#p68963

Just to help other people who can come across the same issue, the problem was relevant to really long connection time for wintun. The reason for long connection time is a default way used by OpenVPN to configure wintun interface. The default method for wintun is using netsh which can take a very long time on user machines, specifically I have seen cases where a single command taken 30 seconds and it needs to run 5 of them, so at the moment it connects it already reaches ping-restart (or possibly negotiation) timeout, so it disconnects right away. The way I have found to resolve the issue was to use --ip-win32 ipapi which decreased connection times greatly and allowed to stay within ping-restart timeouts. Additional possibility could be to use –up-delay, but I haven't tried it as connection time of minutes does not provide good enough user experience in any case.

Maybe you should not be using --up-delay ..

OpenVpn 2.5 wintun closing connection intermittently right after connect

TinCanTech

You also used --up-delay .. so your connection will take longer.

You have problem X which you are trying to solve with solution Y..

man1ck

Oh look another post where TinCanTech is being a total dick while trying to "help" man fuck these forums. Cant get a straight answer as to why an error is thrown and what configuration components actually cause the error

« Previous Page