VPN dropping

vesoljc

Hi all,
I'm having a weird issue with my current setup. I'm using vpn to connect to company network. I think the issue started to appear after a big HW change (new motherboard + cpu), however since I'm not using vpn everyday, I didn't notice it for a while. Connection to vpn seems ok, but after a few seconds of actual usage (i.e. remote desktop) the vpn drops with the following message:

Wed Mar 24 09:24:57 2021 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #379 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings

I'll post ful log below.
my HW specs:

x570 tomahawk
ryzen 5950x
4x 16gb gskill neo 3600/16
nvme samsung 960 evo
acq 107 based 10gb NIC
pretty much latest drivers, latest win10pro updates
hw seems stable (tested via memtest, prime)

I kinda ruled out my LAN, since the issue stays even if I connect through usb tethering with mobile data. Also if I use the same vpn config on secondary laptop (connected via wifi on the same network), the vpn connection works. So, it has to be local to my pc (hw/sw issue).

vpn log:

Wed Mar 24 09:23:14 2021 Note: option tun-ipv6 is ignored because modern operating systems do not need special IPv6 tun handling anymore.
Wed Mar 24 09:23:14 2021 --cipher is not set. Previous OpenVPN version defaulted to BF-CBC as fallback when cipher negotiation failed in this case. If you need this fallback please add '--data-ciphers-fallback BF-CBC' to your configuration and/or add BF-CBC to --data-ciphers.
Wed Mar 24 09:23:14 2021 OpenVPN 2.5.1 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [AEAD] built on Feb 24 2021
Wed Mar 24 09:23:14 2021 Windows version 10.0 (Windows 10 or greater) 64bit
Wed Mar 24 09:23:14 2021 library versions: OpenSSL 1.1.1j  16 Feb 2021, LZO 2.10
Wed Mar 24 09:23:14 2021 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Wed Mar 24 09:23:14 2021 Need hold release from management interface, waiting...
Wed Mar 24 09:23:15 2021 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Wed Mar 24 09:23:15 2021 MANAGEMENT: CMD 'state on'
Wed Mar 24 09:23:15 2021 MANAGEMENT: CMD 'log all on'
Wed Mar 24 09:23:15 2021 MANAGEMENT: CMD 'echo all on'
Wed Mar 24 09:23:15 2021 MANAGEMENT: CMD 'bytecount 5'
Wed Mar 24 09:23:15 2021 MANAGEMENT: CMD 'hold off'
Wed Mar 24 09:23:15 2021 MANAGEMENT: CMD 'hold release'
Wed Mar 24 09:23:16 2021 MANAGEMENT: CMD 'username "Auth" XXXX
Wed Mar 24 09:23:16 2021 MANAGEMENT: CMD 'password [...]'
Wed Mar 24 09:23:16 2021 Outgoing Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Wed Mar 24 09:23:16 2021 Incoming Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Wed Mar 24 09:23:16 2021 MANAGEMENT: >STATE:1616574196,RESOLVE,,,,,,
Wed Mar 24 09:23:16 2021 TCP/UDP: Preserving recently used remote address: [AF_INET]XXXX:1194
Wed Mar 24 09:23:16 2021 Socket Buffers: R=[65536->65536] S=[65536->65536]
Wed Mar 24 09:23:16 2021 UDP link local: (not bound)
Wed Mar 24 09:23:16 2021 UDP link remote: [AF_INET]XXXX
Wed Mar 24 09:23:16 2021 MANAGEMENT: >STATE:1616574196,WAIT,,,,,,
Wed Mar 24 09:23:16 2021 MANAGEMENT: >STATE:1616574196,AUTH,,,,,,
Wed Mar 24 09:23:16 2021 TLS: Initial packet from [AF_INET]XXXX:1194, sid=4004f6d0 49a249ef
Wed Mar 24 09:23:16 2021 VERIFY OK: depth=2, C=ZZ, XXXX
Wed Mar 24 09:23:16 2021 VERIFY OK: depth=1, C=ZZ, XXXX
Wed Mar 24 09:23:16 2021 Validating certificate extended key usage
Wed Mar 24 09:23:16 2021 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Wed Mar 24 09:23:16 2021 VERIFY EKU OK
Wed Mar 24 09:23:16 2021 VERIFY X509NAME OK: C=ZZ, XXXX
Wed Mar 24 09:23:16 2021 VERIFY OK: depth=0, C=ZZ, XXXX
Wed Mar 24 09:23:16 2021 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1585', remote='link-mtu 1601'
Wed Mar 24 09:23:16 2021 WARNING: 'keysize' is used inconsistently, local='keysize 128', remote='keysize 256'
Wed Mar 24 09:23:16 2021 Control Channel: TLSv1.2, cipher TLSv1.2 DHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Wed Mar 24 09:23:16 2021 [vpn.outfit7.net] Peer Connection Initiated with [AF_INET]XXXX:1194
Wed Mar 24 09:23:17 2021 MANAGEMENT: >STATE:1616574197,GET_CONFIG,,,,,,
Wed Mar 24 09:23:17 2021 SENT CONTROL [vpn.outfit7.net]: 'PUSH_REQUEST' (status=1)
Wed Mar 24 09:23:17 2021 PUSH: Received control message: 'PUSH_REPLY,route XXXX
Wed Mar 24 09:23:17 2021 OPTIONS IMPORT: timers and/or timeouts modified
Wed Mar 24 09:23:17 2021 OPTIONS IMPORT: --ifconfig/up options modified
Wed Mar 24 09:23:17 2021 OPTIONS IMPORT: route options modified
Wed Mar 24 09:23:17 2021 OPTIONS IMPORT: route-related options modified
Wed Mar 24 09:23:17 2021 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Wed Mar 24 09:23:17 2021 Using peer cipher 'AES-256-CBC'
Wed Mar 24 09:23:17 2021 Data Channel: using negotiated cipher 'AES-256-CBC'
Wed Mar 24 09:23:17 2021 Outgoing Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Wed Mar 24 09:23:17 2021 Outgoing Data Channel: Using 512 bit message hash 'SHA512' for HMAC authentication
Wed Mar 24 09:23:17 2021 Incoming Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Wed Mar 24 09:23:17 2021 Incoming Data Channel: Using 512 bit message hash 'SHA512' for HMAC authentication
Wed Mar 24 09:23:17 2021 interactive service msg_channel=784
Wed Mar 24 09:23:17 2021 ROUTE_GATEWAY 10.1.1.1/255.255.255.0 I=20 HWADDR=00:1b:22:32:23:7e
Wed Mar 24 09:23:17 2021 open_tun
Wed Mar 24 09:23:17 2021 tap-windows6 device XXXX opened
Wed Mar 24 09:23:17 2021 TAP-Windows Driver Version 9.24 
Wed Mar 24 09:23:17 2021 Set TAP-Windows TUN subnet mode network/local/netmask = XXXX [SUCCEEDED]
Wed Mar 24 09:23:17 2021 Notified TAP-Windows driver to set a DHCP IP/netmask of XXXX on interface {XXXX} [DHCP-serv: XXXX, lease-time: 31536000]
Wed Mar 24 09:23:17 2021 Successful ARP Flush on interface [24] {XXXX}
Wed Mar 24 09:23:17 2021 MANAGEMENT: >STATE:1616574197,ASSIGN_IP,,XXXX,,,,
Wed Mar 24 09:23:17 2021 IPv4 MTU set to 1500 on interface 24 using service
Wed Mar 24 09:23:22 2021 TEST ROUTES: 3/3 succeeded len=3 ret=1 a=0 u/d=up
Wed Mar 24 09:23:22 2021 MANAGEMENT: >STATE:1616574202,ADD_ROUTES,,,,,,
Wed Mar 24 09:23:22 2021 C:\WINDOWS\system32\route.exe ADD 192.168.4.0 MASK 255.255.252.0 XXXX
Wed Mar 24 09:23:22 2021 Route addition via service succeeded
Wed Mar 24 09:23:22 2021 C:\WINDOWS\system32\route.exe ADD 10.200.30.0 MASK 255.255.255.0 XXXX
Wed Mar 24 09:23:22 2021 Route addition via service succeeded
Wed Mar 24 09:23:22 2021 C:\WINDOWS\system32\route.exe ADD 192.168.96.0 MASK 255.255.248.0 XXXX
Wed Mar 24 09:23:22 2021 Route addition via service succeeded
Wed Mar 24 09:23:22 2021 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Wed Mar 24 09:23:22 2021 Initialization Sequence Completed
Wed Mar 24 09:23:22 2021 MANAGEMENT: >STATE:1616574202,CONNECTED,SUCCESS,172.30.1.58,XXXX,1194,,
Wed Mar 24 09:24:57 2021 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #379 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Wed Mar 24 09:24:57 2021 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #380 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Wed Mar 24 09:24:57 2021 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #381 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Wed Mar 24 09:24:57 2021 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #382 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Wed Mar 24 09:24:57 2021 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #383 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings

any ideas what might be the issue?

on an another note, are there any debug builds available?

vesoljc

No hints/suggestions? Anything I can test?

TinCanTech

vesoljc wrote Wed Mar 24 09:24:57 2021 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #379 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings

This is not dropping your VPN.

300000

Maybe your client network not stable so sometime it lose connection . Running on UDP is cause this course on UDP there is no way to make sure every packet will be check and correct itself on the way to its client. only running on TCP will make it good on mobile network and you can add this line your your config but not sure it will happen again. this is narture when you run openvpn over UDP protocol . If you change it over TCP so everything will be correct itself.

mute-replay-warnings

vesoljc

TinCanTech wrote
vesoljc wrote Wed Mar 24 09:24:57 2021 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #379 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
This is not dropping your VPN.

what do you mean?
I get a huge spam of these error in a row, and then I get disconnected.

vesoljc

300000 wrote Maybe your client network not stable so sometime it lose connection . Running on UDP is cause this course on UDP there is no way to make sure every packet will be check and correct itself on the way to its client. only running on TCP will make it good on mobile network and you can add this line your your config but not sure it will happen again. this is narture when you run openvpn over UDP protocol . If you change it over TCP so everything will be correct itself.

mute-replay-warnings

My first thought was that it was a network issue. But since I get the same result even if I use usb tethering via mobile phone (and mobile data), and vpn on my other pc (laptop connected via wifi) works, I basically ruled out network as an issue.

300000

Can you try run on TCP . it is more stable on tcp than udp so let try it first.

TinCanTech

Replay errors are caused by broken networks or somebody trying to hijack your VPN packets.

The errors you posted do not cause any packets to be dropped.

But if you get a huge slew of them all at once then that could cause the VPN to malfunction and time out.