Hi All,
I'm fairly new with openvpn, we are using this for our clients to connect to our network. Recently, one of our client wasn't able to reconnect on our openvpn server and saw this on our server logs:
Mon Nov 8 17:07:32 2021 us=596432 x.x.x.x:59230 [
xxxx@xxxxxx.com] Peer Connection Initiated with [AF_INET]x.x.x.x:59230
Mon Nov 8 17:07:32 2021 us=717324 x.x.x.x:59230 PUSH: Received control message: 'PUSH_REQUEST'
Mon Nov 8 17:07:33 2021 us=699481
xxxx@xxxxxx.com/x.x.x.x:59230 OPTIONS IMPORT: reading client specific options from: ccd_tcp/
xxxx@xxxxxx.com
Mon Nov 8 17:07:33 2021 us=762399
xxxx@xxxxxx.com/x.x.x.x:59230 MULTI: Learn: 10.248.37.214 ->
xxxx@xxxxxx.com/x.x.x.x:59230
Mon Nov 8 17:07:33 2021 us=762430
xxxx@xxxxxx.com/x.x.x.x:59230 MULTI: primary virtual IP for
xxxx@xxxxxx.com/x.x.x.x:59230: 10.248.37.214
Mon Nov 8 17:09:32 2021 us=862722
xxxx@xxxxxx.com/x.x.x.x:59230 [
xxxx@xxxxxx.com] Inactivity timeout (--ping-restart), restarting
Mon Nov 8 17:09:32 2021 us=862764
xxxx@xxxxxx.com/x.x.x.x:59230 SIGUSR1[soft,ping-restart] received, client-instance restarting
If the received control message: PUSH_REQUEST comes before the Learn-ip address, our server is not pushing any routes or doing "PUSH_REPLY". Is there any relevance? Should there be a sequence?n Because if the PUSH_REQUEST comes after the Learn-ip address, the server was able to do a "PUSH_REPLY" and the connection established afterwards:
Mon Nov 8 17:38:05 2021 us=937486 x.x.x.x:59244 [
xxxx@xxxxxx.com] Peer Connection Initiated with [AF_INET]x.x.x.x:59244
Mon Nov 8 17:38:06 2021 us=140945
xxxx@xxxxxx.com/x.x.x.x:59244 OPTIONS IMPORT: reading client specific options from: ccd_tcp/
xxxx@xxxxxx.com
Mon Nov 8 17:38:06 2021 us=203431
xxxx@xxxxxx.com/x.x.x.x:59244 MULTI: Learn: 10.248.37.214 ->
xxxx@xxxxxx.com/x.x.x.x:59244
Mon Nov 8 17:38:06 2021 us=203474
xxxx@xxxxxx.com/x.x.x.x:59244 MULTI: primary virtual IP for
xxxx@xxxxxx.com/x.x.x.x:59244: 10.248.37.214
Mon Nov 8 17:38:06 2021 us=203550
xxxx@xxxxxx.com/x.x.x.x:59244 PUSH: Received control message: 'PUSH_REQUEST'
Mon Nov 8 17:38:06 2021 us=203587
xxxx@xxxxxx.com/x.x.x.x:59244 SENT CONTROL [
xxxx@xxxxxx.com]: 'PUSH_REPLY,sndbuf 393216,rcvbuf 393216,route 10.240.0.1,topology net30,ping 10,ping-restart 60,route x.x.x.x 255.255.252.0,' (status=1)
Just adding the server config that we have for tcp connections:
port 1194
proto tcp
dev tun1
ncp-ciphers AES-256-GCM:BF-CBC:AES-256-CBC
ca /etc/openvpn/keys/ca.crt
cert /etc/openvpn/keys/server.crt
key /etc/openvpn/keys/server.key # This file should be kept secret
dh /etc/openvpn/keys/dh2048.pem
server 10.240.0.0 255.255.0.0 #subnet of server and clients
log-append /var/log/openvpn/server_tcp.log
duplicate-cn
keepalive 10 60
max-clients 500
user root
group nogroup
client-config-dir ccd_tcp
ccd-exclusive
persist-tun
status openvpn-status-tcp.log 10
# file verbosity.
# 0 is silent, except for fatal errors
# 4 is reasonable for general usage
# 5 and 6 can help to debug connection problems
# 9 is extremely verbose
verb 4
plugin /etc/openvpn/plugins/openvpn-plugin-auth-script.so /etc/openvpn/scripts/auth-script-plugin_tcp.pl
username-as-common-name
learn-address /etc/openvpn/scripts/update-iptables-plugin_tcp.pl
script-security 3
up /etc/openvpn/scripts/route_tcp.sh
sndbuf 0
rcvbuf 0
push "sndbuf 393216"
push "rcvbuf 393216"
txqueuelen 5000
Many thanks for the help.
