Connection works for only few seconds

smfe

Hello everyone,

I have openVPN server (OpenVPN 2.1.3) running on Debian 6.0. My clients (version 2.2) run on windows 7. When I try to connect my client to the server, I get connection, IP, and I can ping a machine that is located behind the server. My problem is that this connection does not last for more than few seconds (3-15). This I can no longer access machines that are behind the server. After sometime, my client try again to establish connection and the connection works again but only for few seconds. I increased the log verbosity but could not see any "fail" or "error" message. I have no clue. It used to work in the past.

I tried to check the web but no help:
http://openvpn.net/archive/openvpn-users/2007-05/msg00008.html
https://forums.openvpn.net/topic7467-15.html
https://forums.openvpn.net/topic7502.html
https://forums.openvpn.net/topic7820.html

Client configuration:

client
dev tap
proto udp
remote 91.113.188.10 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
tls-auth ta.key
auth-user-pass
reneg-sec 0
cipher AES-128-CBC
comp-lzo
verb 3

Client log:

Fri May 13 12:45:45 2011 OpenVPN 2.0.9 Win32-MinGW [SSL] [LZO] built on Oct  1 2006

Fri May 13 12:45:52 2011 IMPORTANT: OpenVPN's default port number is now 1194, based on an official port number assignment by IANA.  OpenVPN 2.0-beta16 and earlier used 5000 as the default port.

Fri May 13 12:45:52 2011 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.

Fri May 13 12:45:52 2011 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file

Fri May 13 12:45:52 2011 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication

Fri May 13 12:45:52 2011 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication

Fri May 13 12:45:52 2011 LZO compression initialized

Fri May 13 12:45:52 2011 Control Channel MTU parms [ L:1590 D:166 EF:66 EB:0 ET:0 EL:0 ]

Fri May 13 12:45:52 2011 Data Channel MTU parms [ L:1590 D:1450 EF:58 EB:135 ET:32 EL:0 AF:3/1 ]

Fri May 13 12:45:52 2011 Local Options hash (VER=V4): 'c926f1a3'

Fri May 13 12:45:52 2011 Expected Remote Options hash (VER=V4): 'ab8abf9c'

Fri May 13 12:45:52 2011 UDPv4 link local: [undef]

Fri May 13 12:45:52 2011 UDPv4 link remote: 91.113.188.10:1194

Fri May 13 12:45:52 2011 TLS: Initial packet from 91.113.188.10:1194, sid=bdd49ac3 e3d24a15

Fri May 13 12:45:54 2011 VERIFY OK: depth=1, /C=AT/ST=Salzburg/L=Salzburg/O=smartmachine_Forschung___Entwicklung_GmbH/OU=IT/CN=smartmachine_Forschung___Entwicklung_GmbH_CA/emailAddress=support@smartmachine.net

Fri May 13 12:45:54 2011 VERIFY OK: depth=0, /C=AT/ST=Salzburg/L=Salzburg/O=smartmachine_Forschung___Entwicklung_GmbH/OU=IT/CN=mtan.smartmachine.int_server/emailAddress=support@smartmachine.net

Fri May 13 12:45:55 2011 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key

Fri May 13 12:45:55 2011 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication

Fri May 13 12:45:55 2011 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key

Fri May 13 12:45:55 2011 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication

Fri May 13 12:45:55 2011 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA

Fri May 13 12:45:55 2011 [mtan.smartmachine.int_server] Peer Connection Initiated with 91.113.188.10:1194

Fri May 13 12:45:57 2011 SENT CONTROL [mtan.smartmachine.int_server]: 'PUSH_REQUEST' (status=1)

Fri May 13 12:45:57 2011 PUSH: Received control message: 'PUSH_REPLY,dhcp-option DNS 192.168.1.251,route-gateway 192.168.1.0,ping 10,ping-restart 120,ifconfig 192.168.1.106 255.255.255.0'

Fri May 13 12:45:57 2011 OPTIONS IMPORT: timers and/or timeouts modified

Fri May 13 12:45:57 2011 OPTIONS IMPORT: --ifconfig/up options modified

Fri May 13 12:45:57 2011 OPTIONS IMPORT: route options modified

Fri May 13 12:45:57 2011 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified

Fri May 13 12:45:57 2011 TAP-WIN32 device [LAN-Verbindung 2] opened: \\.\Global\{B93EBFE5-1953-4BD3-9CC1-316FA706985F}.tap

Fri May 13 12:45:57 2011 TAP-Win32 Driver Version 8.4 

Fri May 13 12:45:57 2011 TAP-Win32 MTU=1500

Fri May 13 12:45:57 2011 Notified TAP-Win32 driver to set a DHCP IP/netmask of 192.168.1.106/255.255.255.0 on interface {B93EBFE5-1953-4BD3-9CC1-316FA706985F} [DHCP-serv: 192.168.1.0, lease-time: 31536000]

Fri May 13 12:45:57 2011 NOTE: FlushIpNetTable failed on interface [13] {B93EBFE5-1953-4BD3-9CC1-316FA706985F} (status=5) : Zugriff verweigert  

Fri May 13 12:45:57 2011 TEST ROUTES: 0/0 succeeded len=-1 ret=1 a=0 u/d=up

Fri May 13 12:45:57 2011 Initialization Sequence Completed

Thanks for your help.

smfe

port 1194
proto udp
dev tap

script-security 2
up /etc/openvpn/bridge-start.sh
down /etc/openvpn/bridge-stop.sh

ca ca.crt
cert mtan.smartmachine.int_server.crt
key mtan.smartmachine.int_server.key
dh dh2048.pem
tls-auth ta.key
client-cert-not-required
username-as-common-name
plugin /etc/openvpn/radiusplugin.so /etc/openvpn/radiusplugin.cnf

cipher AES-128-CBC
ifconfig-pool-persist ipp.txt
server-bridge 192.168.1.0 255.255.255.0 192.168.1.102 192.168.1.125
client-to-client

#push "redirect-gateway"
push "dhcp-option DNS 192.168.1.251"

keepalive 10 120
comp-lzo
max-clients 40
user  nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
status /var/log/openvpn/status.log 1
log-append  openvpn.log
verb 4
mute 20

reneg-sec 86400

janjust

your client log shows that you're running openvpn 2.0.9 with tap-driver 8.04 - that will not work on windows 7. Can you upgrade your clients to 2.2 and verify that they are actually running openvpn 2.2?

smfe

Hello janjust,

Thank you for your help. I updated the client and now it shows in logs that it uses TAP-driver version 9.8. Still I experience the same behaviour. I tried this also on XP machine and I have the same problem. Your efforts are appreciated.

Peace!

Mon May 16 09:17:18 2011 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables

Mon May 16 09:17:18 2011 Re-using SSL/TLS context

Mon May 16 09:17:18 2011 LZO compression initialized

Mon May 16 09:17:18 2011 Control Channel MTU parms [ L:1590 D:166 EF:66 EB:0 ET:0 EL:0 ]

Mon May 16 09:17:18 2011 Socket Buffers: R=[128000->128000] S=[32768->32768]

Mon May 16 09:17:18 2011 Data Channel MTU parms [ L:1590 D:1450 EF:58 EB:135 ET:32 EL:0 AF:3/1 ]

Mon May 16 09:17:18 2011 Local Options hash (VER=V4): 'c926f1a3'

Mon May 16 09:17:18 2011 Expected Remote Options hash (VER=V4): 'ab8abf9c'

Mon May 16 09:17:18 2011 UDPv4 link local: [undef]

Mon May 16 09:17:18 2011 UDPv4 link remote: 91.113.188.10:1194

Mon May 16 09:17:19 2011 TLS: Initial packet from 91.113.188.10:1194, sid=e9e2de3a caef8232

Mon May 16 09:17:20 2011 VERIFY OK: depth=1, /C=AT/ST=Salzburg/L=Salzburg/O=smartmachine_Forschung___Entwicklung_GmbH/OU=IT/CN=smartmachine_Forschung___Entwicklung_GmbH_CA/emailAddress=support@smartmachine.net

Mon May 16 09:17:20 2011 VERIFY OK: depth=0, /C=AT/ST=Salzburg/L=Salzburg/O=smartmachine_Forschung___Entwicklung_GmbH/OU=IT/CN=mtan.smartmachine.int_server/emailAddress=support@smartmachine.net

Mon May 16 09:17:21 2011 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key

Mon May 16 09:17:21 2011 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication

Mon May 16 09:17:21 2011 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key

Mon May 16 09:17:21 2011 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication

Mon May 16 09:17:21 2011 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA

Mon May 16 09:17:21 2011 [mtan.smartmachine.int_server] Peer Connection Initiated with 91.113.188.10:1194

Mon May 16 09:17:23 2011 SENT CONTROL [mtan.smartmachine.int_server]: 'PUSH_REQUEST' (status=1)

Mon May 16 09:17:23 2011 PUSH: Received control message: 'PUSH_REPLY,dhcp-option DNS 192.168.1.251,route-gateway 192.168.1.0,ping 10,ping-restart 120,ifconfig 192.168.1.106 255.255.255.0'

Mon May 16 09:17:23 2011 OPTIONS IMPORT: timers and/or timeouts modified

Mon May 16 09:17:23 2011 OPTIONS IMPORT: --ifconfig/up options modified

Mon May 16 09:17:23 2011 OPTIONS IMPORT: route-related options modified

Mon May 16 09:17:23 2011 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified

Mon May 16 09:17:23 2011 Preserving previous TUN/TAP instance: LAN-Verbindung 2

Mon May 16 09:17:23 2011 Initialization Sequence Completed

Mon May 16 09:18:55 2011 TCP/UDP: Closing socket

Mon May 16 09:18:55 2011 Closing TUN/TAP interface

Mon May 16 09:18:55 2011 SIGTERM[hard,] received, process exiting

Mon May 16 09:18:55 2011 OpenVPN 2.2.0 Win32-MSVC++ [SSL] [LZO2] built on Apr 26 2011

Mon May 16 09:19:01 2011 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.

Mon May 16 09:19:01 2011 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables

Mon May 16 09:19:02 2011 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file

Mon May 16 09:19:02 2011 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication

Mon May 16 09:19:02 2011 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication

Mon May 16 09:19:02 2011 LZO compression initialized

Mon May 16 09:19:02 2011 Control Channel MTU parms [ L:1590 D:166 EF:66 EB:0 ET:0 EL:0 ]

Mon May 16 09:19:02 2011 Socket Buffers: R=[128000->128000] S=[32768->32768]

Mon May 16 09:19:02 2011 Data Channel MTU parms [ L:1590 D:1450 EF:58 EB:135 ET:32 EL:0 AF:3/1 ]

Mon May 16 09:19:02 2011 Local Options hash (VER=V4): 'c926f1a3'

Mon May 16 09:19:02 2011 Expected Remote Options hash (VER=V4): 'ab8abf9c'

Mon May 16 09:19:02 2011 UDPv4 link local: [undef]

Mon May 16 09:19:02 2011 UDPv4 link remote: 91.113.188.10:1194

Mon May 16 09:19:03 2011 TLS: Initial packet from 91.113.188.10:1194, sid=6341933a e796b163

Mon May 16 09:19:03 2011 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this

Mon May 16 09:19:04 2011 VERIFY OK: depth=1, /C=AT/ST=Salzburg/L=Salzburg/O=smartmachine_Forschung___Entwicklung_GmbH/OU=IT/CN=smartmachine_Forschung___Entwicklung_GmbH_CA/emailAddress=support@smartmachine.net

Mon May 16 09:19:04 2011 VERIFY OK: depth=0, /C=AT/ST=Salzburg/L=Salzburg/O=smartmachine_Forschung___Entwicklung_GmbH/OU=IT/CN=mtan.smartmachine.int_server/emailAddress=support@smartmachine.net

Mon May 16 09:19:05 2011 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key

Mon May 16 09:19:05 2011 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication

Mon May 16 09:19:05 2011 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key

Mon May 16 09:19:05 2011 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication

Mon May 16 09:19:05 2011 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA

Mon May 16 09:19:05 2011 [mtan.smartmachine.int_server] Peer Connection Initiated with 91.113.188.10:1194

Mon May 16 09:19:07 2011 SENT CONTROL [mtan.smartmachine.int_server]: 'PUSH_REQUEST' (status=1)

Mon May 16 09:19:07 2011 PUSH: Received control message: 'PUSH_REPLY,dhcp-option DNS 192.168.1.251,route-gateway 192.168.1.0,ping 10,ping-restart 120,ifconfig 192.168.1.106 255.255.255.0'

Mon May 16 09:19:07 2011 OPTIONS IMPORT: timers and/or timeouts modified

Mon May 16 09:19:07 2011 OPTIONS IMPORT: --ifconfig/up options modified

Mon May 16 09:19:07 2011 OPTIONS IMPORT: route-related options modified

Mon May 16 09:19:07 2011 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified

Mon May 16 09:19:07 2011 TAP-WIN32 device [LAN-Verbindung 2] opened: \\.\Global\{97FB3A26-6BBB-418B-A662-2B2951905439}.tap

Mon May 16 09:19:07 2011 TAP-Win32 Driver Version 9.8 

Mon May 16 09:19:07 2011 TAP-Win32 MTU=1500

Mon May 16 09:19:07 2011 Notified TAP-Win32 driver to set a DHCP IP/netmask of 192.168.1.106/255.255.255.0 on interface {97FB3A26-6BBB-418B-A662-2B2951905439} [DHCP-serv: 192.168.1.0, lease-time: 31536000]

Mon May 16 09:19:07 2011 NOTE: FlushIpNetTable failed on interface [13] {97FB3A26-6BBB-418B-A662-2B2951905439} (status=5) : Zugriff verweigert  

Mon May 16 09:19:07 2011 TEST ROUTES: 0/0 succeeded len=-1 ret=0 a=0 u/d=down

Mon May 16 09:19:07 2011 Route: Waiting for TUN/TAP interface to come up...

Mon May 16 09:19:08 2011 TEST ROUTES: 0/0 succeeded len=-1 ret=1 a=0 u/d=up

Mon May 16 09:19:08 2011 Initialization Sequence Completed

janjust

hmmm the server seems to be pushing

route-gateway 192.168.1.0

that can't be right; most likely it should be pusing 192.168.1.1. What's the server config?

smfe

Hi again,

There server config is posted in the second post. It is located behind a NAT. The public IP is 91.113.188.10 and the internal IP is 192.168.1.233. I expect the problem to be Windows related because I use the same client config file with Mac 10.6 without problem.

Peace!

janjust

ah, I missed the second post before 😉
hmmm if the same config works with MacOS then indeed it's a windows issue; try adding

route-methode exe
route-delay 2

to the client config file; also, increase the verbosity to 5 and reconnect.

After the client connects which IP does the tap-win32 interface have? what does 'ipconfig /all' show in a CMD window?

smfe

Hallo Jan,

Thanks for taking the time. I have done what you asked for. I still experience the same problem after adding the two parameters and increasing verbosity. I attach here the outcome of ipconfig /all

Windows-IP-Konfiguration



   Hostname  . . . . . . . . . . . . : LT-Edward2

   Primres DNS-Suffix . . . . . . . : smartmachine.int

   Knotentyp . . . . . . . . . . . . : Hybrid

   IP-Routing aktiviert  . . . . . . : Nein

   WINS-Proxy aktiviert  . . . . . . : Nein

   DNS-Suffixsuchliste . . . . . . . : smartmachine.int



PPP-Adapter HUAWEI3G.YESS Standard:



   Verbindungsspezifisches DNS-Suffix: 

   Beschreibung. . . . . . . . . . . : HUAWEI3G.YESS Standard

   Physikalische Adresse . . . . . . : 

   DHCP aktiviert. . . . . . . . . . : Nein

   Autokonfiguration aktiviert . . . : Ja

   IPv4-Adresse  . . . . . . . . . . : 10.115.128.63(Bevorzugt) 

   Subnetzmaske  . . . . . . . . . . : 255.255.255.255

   Standardgateway . . . . . . . . . : 0.0.0.0

   DNS-Server  . . . . . . . . . . . : 194.24.128.100

                                       81.3.216.100

   Primrer WINS-Server. . . . . . . : 10.11.12.13

   Sekundrer WINS-Server. . . . . . : 10.11.12.14

   NetBIOS ber TCP/IP . . . . . . . : Deaktiviert



Ethernet-Adapter LAN-Verbindung 2:



   Verbindungsspezifisches DNS-Suffix: 

   Beschreibung. . . . . . . . . . . : TAP-Win32 Adapter V9

   Physikalische Adresse . . . . . . : 00-FF-97-FB-3A-26

   DHCP aktiviert. . . . . . . . . . : Ja

   Autokonfiguration aktiviert . . . : Ja

   Verbindungslokale IPv6-Adresse  . : fe80::382a:7c81:ac90:4a72%32(Bevorzugt) 

   IPv4-Adresse  . . . . . . . . . . : 192.168.1.106(Bevorzugt) 

   Subnetzmaske  . . . . . . . . . . : 255.255.255.0

   Lease erhalten. . . . . . . . . . : Montag, 16. Mai 2011 11:08:44

   Lease luft ab. . . . . . . . . . : Dienstag, 15. Mai 2012 11:08:43

   Standardgateway . . . . . . . . . : 

   DHCP-Server . . . . . . . . . . . : 192.168.1.0

   DHCPv6-IAID . . . . . . . . . . . : 218169239

   DHCPv6-Client-DUID. . . . . . . . : 00-01-00-01-12-EA-2A-46-00-14-22-E4-7E-27

   DNS-Server  . . . . . . . . . . . : 192.168.1.251

   NetBIOS ber TCP/IP . . . . . . . : Aktiviert

janjust

I still don't like this part

server-bridge 192.168.1.0 255.255.255.0 192.168.1.102 192.168.1.125

what is the address of the bridge interface on the server? please use that IP address for the 'server-bridge' and try again.

smfe

Hi,

I changed to become

server-bridge 192.168.1.233 255.255.255.0 192.168.1.102 192.168.1.125

unfortionatly that did not help. Thanks for your efforts

janjust

but is the correct gateway now pushed? can you ping this bridge address from the client? what happens if you ping it - is there any activity on the server side?

smfe

Hallo,

My openVPN server has two NICs:
eth0: 192.168.1.233
eth1: 192.168.1.229
br0: joint of eth1 and tap0 and curries the IP of eth1.

I dont know which IP I should be using with server-bridge and push "route 192.168.1.xxx 255.255.255.0". I think it should be eth1.

going back to your last post, the bridge IP responses only for few seconds after establishing the connection. Then I lose connection for about two min. and the auto-reconnect kicks and I get again connection for few seconds and then I lose it and so on. I see that pushing route is working fine as show in the attached logs from client.

route.exe ADD 192.168.1.0 MASK 255.255.255.0 192.168.1.229 OK!

And this is ipconfig

PPP-Adapter HUAWEI3G.YESS Standard:



   Verbindungsspezifisches DNS-Suffix: 

   Beschreibung. . . . . . . . . . . : HUAWEI3G.YESS Standard

   Physikalische Adresse . . . . . . : 

   DHCP aktiviert. . . . . . . . . . : Nein

   Autokonfiguration aktiviert . . . : Ja

   IPv4-Adresse  . . . . . . . . . . : 10.115.128.63(Bevorzugt) 

   Subnetzmaske  . . . . . . . . . . : 255.255.255.255

   Standardgateway . . . . . . . . . : 0.0.0.0

   DNS-Server  . . . . . . . . . . . : 194.24.128.100

                                       81.3.216.100

   Primrer WINS-Server. . . . . . . : 10.11.12.13

   Sekundrer WINS-Server. . . . . . : 10.11.12.14

   NetBIOS ber TCP/IP . . . . . . . : Deaktiviert



Ethernet-Adapter LAN-Verbindung 2:



   Verbindungsspezifisches DNS-Suffix: 

   Beschreibung. . . . . . . . . . . : TAP-Win32 Adapter V9

   Physikalische Adresse . . . . . . : 00-FF-97-FB-3A-26

   DHCP aktiviert. . . . . . . . . . : Ja

   Autokonfiguration aktiviert . . . : Ja

   Verbindungslokale IPv6-Adresse  . : fe80::382a:7c81:ac90:4a72%32(Bevorzugt) 

   IPv4-Adresse  . . . . . . . . . . : 192.168.1.106(Bevorzugt) 

   Subnetzmaske  . . . . . . . . . . : 255.255.255.0

   Lease erhalten. . . . . . . . . . : Montag, 16. Mai 2011 13:32:06

   Lease luft ab. . . . . . . . . . : Dienstag, 15. Mai 2012 13:32:05

   Standardgateway . . . . . . . . . : 

   DHCP-Server . . . . . . . . . . . : 192.168.1.0

   DHCPv6-IAID . . . . . . . . . . . : 218169239

   DHCPv6-Client-DUID. . . . . . . . : 00-01-00-01-12-EA-2A-46-00-14-22-E4-7E-27

   DNS-Server  . . . . . . . . . . . : 192.168.1.251

   NetBIOS ber TCP/IP . . . . . . . : Aktiviert

I dont think its a routing problem at the VPN server. I tried with XP box and no problem. My question is: why I get connection for only few seconds and then I lose again ...

Thanks for your patience!

smfe

I noticed that when the connection is ok, I see this

RwWrWrWRwrWWWRwrWRwrWWWRwrWWWWWWWWWWWWWWWRwrWWWRwrWrWRwRwrWWWRwrWWWRwrWWWRwr

When the connection is lost, I get this kind of secquence alot

WWWWWWRWWWWWWWWWWWWWWWWWWWWWWWWRWWWWWWWWWWWWWWWWWWWWWWWWWWWWRWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW

The difference is that I see more often the letter R when it works.

My server config is:

port 1194
proto udp
dev tap0

script-security 2
up /etc/openvpn/bridge-start.sh
down /etc/openvpn/bridge-stop.sh

ca ca.crt
cert mtan.smartmachine.int_server.crt
key mtan.smartmachine.int_server.key
dh dh2048.pem
tls-auth ta.key
client-cert-not-required
username-as-common-name
plugin /etc/openvpn/radiusplugin.so /etc/openvpn/radiusplugin.cnf

cipher AES-128-CBC
ifconfig-pool-persist ipp.txt

#server-bridge   network     netmask             IPrange
server-bridge 192.168.1.229 255.255.255.0 192.168.1.102 192.168.1.125
push "route 192.168.1.0  255.255.255.0"
client-to-client
#push "redirect-gateway"
push "dhcp-option DNS 192.168.1.251"

keepalive 10 120
comp-lzo
max-clients 40
user  nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
status /var/log/openvpn/status.log 1
log-append  openvpn.log
verb 5
mute 20
reneg-sec 86400

janjust

hmmm indeed, the .229 address is the correct address to use; it's odd that the connection only works for a few seconds - almost looks like the client stops receiving info (W = write data; R = Read data).
Do you see anything similar on the server side? is the firewall on the tap-win32 interface disabled? can you, just to test, disable the firewall completely?

smfe

Hi again,

I noticed this error frequently reoccuring:

us=573344 TLS Error: incoming packet authentication failed from [AF_INET]81.3.214.111

Does this ring a bill?

I added your suggestion to the server config file but that did not help 🙁
Firewall is disabled on windows 7 and XP and VPN server, did not help.

janjust

that message suggests the incoming is not encrypted (or decrypted) properly ; try adding

fragment 1400
mssfix

to both client and server ; there's something funny going on at quite a low level.

smfe

Hallo JanJust,

Thanks for taking the time. There are two situations.

A- When only client has fragment 1400 mssfix, then I get good connection and the logs at the server look like this:

Tue May 17 12:42:34 2011 us=483572 PO_CTL rwflags=0x0001 ev=7 arg=0x080c574c
Tue May 17 12:42:34 2011 us=483591 PO_CTL rwflags=0x0001 ev=8 arg=0x080c56a8
Tue May 17 12:42:34 2011 us=483607 I/O WAIT TR|Tw|SR|Sw [1/5925]
Tue May 17 12:42:34 2011 us=805145 PO_WAIT[0,0] fd=7 rev=0x00000001 rwflags=0x0001 arg=0x080c574c
Tue May 17 12:42:34 2011 us=805229 I/O WAIT status=0x0001
Tue May 17 12:42:34 2011 us=805267 GET INST BY REAL: 213.162.68.99:32958 [succeeded]
Tue May 17 12:42:34 2011 us=805290 mohammad/213.162.68.99:32958 UDPv4 READ [149] from [AF_INET]213.162.68.99:32958: P_DATA_V1 kid=0 DATA len=148
Tue May 17 12:42:34 2011 us=805309 mohammad/213.162.68.99:32958 TLS: tls_pre_decrypt, key_id=0, IP=[AF_INET]213.162.68.99:32958
Tue May 17 12:42:34 2011 us=805348 mohammad/213.162.68.99:32958 FRAG_IN error flags=0xfaffffff: FRAG_TEST not implemented
Tue May 17 12:42:34 2011 us=805371 PO_CTL rwflags=0x0001 ev=7 arg=0x080c574c
Tue May 17 12:42:34 2011 us=805385 PO_CTL rwflags=0x0001 ev=8 arg=0x080c56a8
Tue May 17 12:42:34 2011 us=805437 I/O WAIT TR|Tw|SR|Sw [1/5925]
Tue May 17 12:42:35 2011 us=361275 PO_WAIT[1,0] fd=8 rev=0x00000001 rwflags=0x0001 arg=0x080c56a8
Tue May 17 12:42:35 2011 us=361360 I/O WAIT status=0x0004
Tue May 17 12:42:35 2011 us=361378 MULTI: REAP range 48 -> 64
Tue May 17 12:42:35 2011 us=361477 PO_CTL rwflags=0x0002 ev=7 arg=0x080c574c
Tue May 17 12:42:35 2011 us=361493 PO_CTL rwflags=0x0000 ev=8 arg=0x080c56a8
Tue May 17 12:42:35 2011 us=361511 I/O WAIT Tr|Tw|Sr|SW [0/5925]
Tue May 17 12:42:35 2011 us=361530 PO_WAIT[0,0] fd=7 rev=0x00000004 rwflags=0x0002 arg=0x080c574c
Tue May 17 12:42:35 2011 us=361544 I/O WAIT status=0x0002
Tue May 17 12:42:35 2011 us=361572 mohammad/213.162.68.99:32958 FRAG_OUT len=164 type=0 seq_id=0 frag_id=0 frag_size=0 flags=0x00000000
Tue May 17 12:42:35 2011 us=361587 mohammad/213.162.68.99:32958 TLS: tls_pre_encrypt: key_id=0
Tue May 17 12:42:35 2011 us=361631 mohammad/213.162.68.99:32958 MULTI: C2C/MCAST/BCAST
Tue May 17 12:42:35 2011 us=361653 mohammad/213.162.68.99:32958 UDPv4 WRITE [213] to [AF_INET]213.162.68.99:32958: P_DATA_V1 kid=0 DATA len=212
Tue May 17 12:42:35 2011 us=361886 mohammad/213.162.68.99:32958 STATE S_NORMAL_OP
Tue May 17 12:42:35 2011 us=361906 mohammad/213.162.68.99:32958 ACK reliable_can_send active=0 current=0 : [48]
Tue May 17 12:42:35 2011 us=361933 mohammad/213.162.68.99:32958 ACK reliable_send_timeout 604800 [48]
Tue May 17 12:42:35 2011 us=361953 mohammad/213.162.68.99:32958 RANDOM USEC=39987
Tue May 17 12:42:35 2011 us=361974 mohammad/213.162.68.99:32958 SCHEDULE: schedule_add_modify wakeup=[Tue May 17 12:42:41 2011 us=33092] pri=1459470525
Tue May 17 12:42:35 2011 us=361994 SCHEDULE: schedule_find_least wakeup=[Tue May 17 12:42:41 2011 us=33092] pri=1783362272
Tue May 17 12:42:35 2011 us=362009 PO_CTL rwflags=0x0001 ev=7 arg=0x080c574c
Tue May 17 12:42:35 2011 us=362022 PO_CTL rwflags=0x0001 ev=8 arg=0x080c56a8
Tue May 17 12:42:35 2011 us=362039 I/O WAIT TR|Tw|SR|Sw [5/39987]
Tue May 17 12:42:35 2011 us=590808 PO_WAIT[0,0] fd=7 rev=0x00000001 rwflags=0x0001 arg=0x080c574c
Tue May 17 12:42:35 2011 us=590892 I/O WAIT status=0x0001
Tue May 17 12:42:35 2011 us=590931 GET INST BY REAL: 213.162.68.99:32958 [succeeded]
Tue May 17 12:42:35 2011 us=590955 mohammad/213.162.68.99:32958 UDPv4 READ [149] from [AF_INET]213.162.68.99:32958: P_DATA_V1 kid=0 DATA len=148
Tue May 17 12:42:35 2011 us=590975 mohammad/213.162.68.99:32958 TLS: tls_pre_decrypt, key_id=0, IP=[AF_INET]213.162.68.99:32958
Tue May 17 12:42:35 2011 us=591023 mohammad/213.162.68.99:32958 FRAG_IN error flags=0xfaffffff: FRAG_TEST not implemented
Tue May 17 12:42:35 2011 us=591048 PO_CTL rwflags=0x0001 ev=7 arg=0x080c574c
Tue May 17 12:42:35 2011 us=591062 PO_CTL rwflags=0x0001 ev=8 arg=0x080c56a8
Tue May 17 12:42:35 2011 us=591081 I/O WAIT TR|Tw|SR|Sw [5/39987]
Tue May 17 12:42:35 2011 us=791066 PO_WAIT[1,0] fd=8 rev=0x00000001 rwflags=0x0001 arg=0x080c56a8
Tue May 17 12:42:35 2011 us=791153 I/O WAIT status=0x0004
Tue May 17 12:42:35 2011 us=791188 GET INST BY VIRT: 00:21:5a:d4:ce:55 [failed]
Tue May 17 12:42:35 2011 us=791208 PO_CTL rwflags=0x0001 ev=7 arg=0x080c574c
Tue May 17 12:42:35 2011 us=791222 PO_CTL rwflags=0x0001 ev=8 arg=0x080c56a8
Tue May 17 12:42:35 2011 us=791240 I/O WAIT TR|Tw|SR|Sw [5/39987]
Tue May 17 12:42:36 2011 us=301949 PO_WAIT[0,0] fd=7 rev=0x00000001 rwflags=0x0001 arg=0x080c574c
Tue May 17 12:42:36 2011 us=302030 I/O WAIT status=0x0001
Tue May 17 12:42:36 2011 us=302046 MULTI: REAP range 64 -> 80
Tue May 17 12:42:36 2011 us=302148 GET INST BY REAL: 213.162.68.99:32958 [succeeded]
Tue May 17 12:42:36 2011 us=302172 mohammad/213.162.68.99:32958 UDPv4 READ [149] from [AF_INET]213.162.68.99:32958: P_DATA_V1 kid=0 DATA len=148
Tue May 17 12:42:36 2011 us=302192 mohammad/213.162.68.99:32958 TLS: tls_pre_decrypt, key_id=0, IP=[AF_INET]213.162.68.99:32958
Tue May 17 12:42:36 2011 us=302231 mohammad/213.162.68.99:32958 FRAG_IN error flags=0xfaffffff: FRAG_TEST not implemented
Tue May 17 12:42:36 2011 us=302254 PO_CTL rwflags=0x0001 ev=7 arg=0x080c574c
Tue May 17 12:42:36 2011 us=302302 PO_CTL rwflags=0x0001 ev=8 arg=0x080c56a8
Tue May 17 12:42:36 2011 us=302321 I/O WAIT TR|Tw|SR|Sw [4/39987]
Tue May 17 12:42:36 2011 us=496461 PO_WAIT[1,0] fd=8 rev=0x00000001 rwflags=0x0001 arg=0x080c56a8
Tue May 17 12:42:36 2011 us=496529 I/O WAIT status=0x0004
Tue May 17 12:42:36 2011 us=496562 PO_CTL rwflags=0x0002 ev=7 arg=0x080c574c
Tue May 17 12:42:36 2011 us=496576 PO_CTL rwflags=0x0000 ev=8 arg=0x080c56a8
Tue May 17 12:42:36 2011 us=496594 I/O WAIT Tr|Tw|Sr|SW [4/39987]
Tue May 17 12:42:36 2011 us=496612 PO_WAIT[0,0] fd=7 rev=0x00000004 rwflags=0x0002 arg=0x080c574c
Tue May 17 12:42:36 2011 us=496668 I/O WAIT status=0x0002
Tue May 17 12:42:36 2011 us=496686 mohammad/213.162.68.99:32958 FRAG_OUT len=61 type=0 seq_id=0 frag_id=0 frag_size=0 flags=0x00000000
Tue May 17 12:42:36 2011 us=496700 mohammad/213.162.68.99:32958 TLS: tls_pre_encrypt: key_id=0
Tue May 17 12:42:36 2011 us=496739 mohammad/213.162.68.99:32958 MULTI: C2C/MCAST/BCAST
Tue May 17 12:42:36 2011 us=496763 mohammad/213.162.68.99:32958 UDPv4 WRITE [117] to [AF_INET]213.162.68.99:32958: P_DATA_V1 kid=0 DATA len=116
Tue May 17 12:42:36 2011 us=496975 PO_CTL rwflags=0x0001 ev=7 arg=0x080c574c
Tue May 17 12:42:36 2011 us=496993 PO_CTL rwflags=0x0001 ev=8 arg=0x080c56a8
Tue May 17 12:42:36 2011 us=497009 I/O WAIT TR|Tw|SR|Sw [4/39987]
Tue May 17 12:42:36 2011 us=568067 PO_WAIT[1,0] fd=8 rev=0x00000001 rwflags=0x0001 arg=0x080c56a8
Tue May 17 12:42:36 2011 us=568135 I/O WAIT status=0x0004
Tue May 17 12:42:36 2011 us=568167 PO_CTL rwflags=0x0002 ev=7 arg=0x080c574c
Tue May 17 12:42:36 2011 us=568181 PO_CTL rwflags=0x0000 ev=8 arg=0x080c56a8
Tue May 17 12:42:36 2011 us=568199 I/O WAIT Tr|Tw|Sr|SW [4/39987]
Tue May 17 12:42:36 2011 us=568217 PO_WAIT[0,0] fd=7 rev=0x00000004 rwflags=0x0002 arg=0x080c574c
Tue May 17 12:42:36 2011 us=568231 I/O WAIT status=0x0002
Tue May 17 12:42:36 2011 us=568260 mohammad/213.162.68.99:32958 FRAG_OUT len=165 type=0 seq_id=0 frag_id=0 frag_size=0 flags=0x00000000
Tue May 17 12:42:36 2011 us=568275 mohammad/213.162.68.99:32958 TLS: tls_pre_encrypt: key_id=0
Tue May 17 12:42:36 2011 us=568315 mohammad/213.162.68.99:32958 MULTI: C2C/MCAST/BCAST
Tue May 17 12:42:36 2011 us=568338 mohammad/213.162.68.99:32958 UDPv4 WRITE [213] to [AF_INET]213.162.68.99:32958: P_DATA_V1 kid=0 DATA len=212
Tue May 17 12:42:36 2011 us=568552 PO_CTL rwflags=0x0001 ev=7 arg=0x080c574c
Tue May 17 12:42:36 2011 us=568571 PO_CTL rwflags=0x0001 ev=8 arg=0x080c56a8
Tue May 17 12:42:36 2011 us=568587 I/O WAIT TR|Tw|SR|Sw [4/39987]
Tue May 17 12:42:37 2011 us=74223 PO_WAIT[0,0] fd=7 rev=0x00000001 rwflags=0x0001 arg=0x080c574c
Tue May 17 12:42:37 2011 us=74307 I/O WAIT status=0x0001
Tue May 17 12:42:37 2011 us=74324 MULTI: REAP range 80 -> 96
Tue May 17 12:42:37 2011 us=74425 GET INST BY REAL: 213.162.68.99:32958 [succeeded]
Tue May 17 12:42:37 2011 us=74449 mohammad/213.162.68.99:32958 UDPv4 READ [149] from [AF_INET]213.162.68.99:32958: P_DATA_V1 kid=0 DATA len=148
Tue May 17 12:42:37 2011 us=74468 mohammad/213.162.68.99:32958 TLS: tls_pre_decrypt, key_id=0, IP=[AF_INET]213.162.68.99:32958
Tue May 17 12:42:37 2011 us=74508 mohammad/213.162.68.99:32958 FRAG_IN error flags=0xfaffffff: FRAG_TEST not implemented
Tue May 17 12:42:37 2011 us=74530 PO_CTL rwflags=0x0001 ev=7 arg=0x080c574c
Tue May 17 12:42:37 2011 us=74545 PO_CTL rwflags=0x0001 ev=8 arg=0x080c56a8
Tue May 17 12:42:37 2011 us=74563 I/O WAIT TR|Tw|SR|Sw [3/39987]
Tue May 17 12:42:37 2011 us=821636 PO_WAIT[0,0] fd=7 rev=0x00000001 rwflags=0x0001 arg=0x080c574c
Tue May 17 12:42:37 2011 us=821722 I/O WAIT status=0x0001
Tue May 17 12:42:37 2011 us=821761 GET INST BY REAL: 213.162.68.99:32958 [succeeded]
Tue May 17 12:42:37 2011 us=821785 mohammad/213.162.68.99:32958 UDPv4 READ [149] from [AF_INET]213.162.68.99:32958: P_DATA_V1 kid=0 DATA len=148
Tue May 17 12:42:37 2011 us=821804 mohammad/213.162.68.99:32958 TLS: tls_pre_decrypt, key_id=0, IP=[AF_INET]213.162.68.99:32958
Tue May 17 12:42:37 2011 us=821844 mohammad/213.162.68.99:32958 FRAG_IN error flags=0xfaffffff: FRAG_TEST not implemented
Tue May 17 12:42:37 2011 us=821901 PO_CTL rwflags=0x0001 ev=7 arg=0x080c574c
Tue May 17 12:42:37 2011 us=821917 PO_CTL rwflags=0x0001 ev=8 arg=0x080c56a8
Tue May 17 12:42:37 2011 us=821936 I/O WAIT TR|Tw|SR|Sw [3/39987]
Tue May 17 12:42:38 2011 us=241435 PO_WAIT[1,0] fd=8 rev=0x00000001 rwflags=0x0001 arg=0x080c56a8
Tue May 17 12:42:38 2011 us=241521 I/O WAIT status=0x0004
Tue May 17 12:42:38 2011 us=241537 MULTI: REAP range 96 -> 112
Tue May 17 12:42:38 2011 us=241638 PO_CTL rwflags=0x0002 ev=7 arg=0x080c574c
Tue May 17 12:42:38 2011 us=241654 PO_CTL rwflags=0x0000 ev=8 arg=0x080c56a8
Tue May 17 12:42:38 2011 us=241672 I/O WAIT Tr|Tw|Sr|SW [2/39987]
Tue May 17 12:42:38 2011 us=241691 PO_WAIT[0,0] fd=7 rev=0x00000004 rwflags=0x0002 arg=0x080c574c
Tue May 17 12:42:38 2011 us=241704 I/O WAIT status=0x0002
Tue May 17 12:42:38 2011 us=241743 mohammad/213.162.68.99:32958 FRAG_OUT len=342 type=0 seq_id=0 frag_id=0 frag_size=0 flags=0x00000000
Tue May 17 12:42:38 2011 us=241758 mohammad/213.162.68.99:32958 TLS: tls_pre_encrypt: key_id=0
Tue May 17 12:42:38 2011 us=241803 mohammad/213.162.68.99:32958 MULTI: C2C/MCAST/BCAST
Tue May 17 12:42:38 2011 us=241826 mohammad/213.162.68.99:32958 UDPv4 WRITE [389] to [AF_INET]213.162.68.99:32958: P_DATA_V1 kid=0 DATA len=388
Tue May 17 12:42:38 2011 us=242070 PO_CTL rwflags=0x0001 ev=7 arg=0x080c574c
Tue May 17 12:42:38 2011 us=242088 PO_CTL rwflags=0x0001 ev=8 arg=0x080c56a8
Tue May 17 12:42:38 2011 us=242105 I/O WAIT TR|Tw|SR|Sw [2/39987]
Tue May 17 12:42:38 2011 us=509780 PO_WAIT[1,0] fd=8 rev=0x00000001 rwflags=0x0001 arg=0x080c56a8
Tue May 17 12:42:38 2011 us=509860 I/O WAIT status=0x0004
Tue May 17 12:42:38 2011 us=509893 PO_CTL rwflags=0x0002 ev=7 arg=0x080c574c
Tue May 17 12:42:38 2011 us=509908 PO_CTL rwflags=0x0000 ev=8 arg=0x080c56a8
Tue May 17 12:42:38 2011 us=509927 I/O WAIT Tr|Tw|Sr|SW [2/39987]
Tue May 17 12:42:38 2011 us=509946 PO_WAIT[0,0] fd=7 rev=0x00000004 rwflags=0x0002 arg=0x080c574c
Tue May 17 12:42:38 2011 us=509960 I/O WAIT status=0x0002
Tue May 17 12:42:38 2011 us=509976 mohammad/213.162.68.99:32958 FRAG_OUT len=61 type=0 seq_id=0 frag_id=0 frag_size=0 flags=0x00000000
Tue May 17 12:42:38 2011 us=509991 mohammad/213.162.68.99:32958 TLS: tls_pre_encrypt: key_id=0
Tue May 17 12:42:38 2011 us=510033 mohammad/213.162.68.99:32958 MULTI: C2C/MCAST/BCAST
Tue May 17 12:42:38 2011 us=510057 mohammad/213.162.68.99:32958 UDPv4 WRITE [117] to [AF_INET]213.162.68.99:32958: P_DATA_V1 kid=0 DATA len=116
Tue May 17 12:42:38 2011 us=510279 PO_CTL rwflags=0x0001 ev=7 arg=0x080c574c
Tue May 17 12:42:38 2011 us=510297 PO_CTL rwflags=0x0001 ev=8 arg=0x080c56a8
Tue May 17 12:42:38 2011 us=510314 I/O WAIT TR|Tw|SR|Sw [2/39987]
Tue May 17 12:42:38 2011 us=609264 PO_WAIT[0,0] fd=7 rev=0x00000001 rwflags=0x0001 arg=0x080c574c
Tue May 17 12:42:38 2011 us=609346 I/O WAIT status=0x0001
Tue May 17 12:42:38 2011 us=609386 GET INST BY REAL: 213.162.68.99:32958 [succeeded]
Tue May 17 12:42:38 2011 us=609411 mohammad/213.162.68.99:32958 UDPv4 READ [149] from [AF_INET]213.162.68.99:32958: P_DATA_V1 kid=0 DATA len=148
Tue May 17 12:42:38 2011 us=609430 mohammad/213.162.68.99:32958 TLS: tls_pre_decrypt, key_id=0, IP=[AF_INET]213.162.68.99:32958
Tue May 17 12:42:38 2011 us=609482 mohammad/213.162.68.99:32958 FRAG_IN error flags=0xfaffffff: FRAG_TEST not implemented
Tue May 17 12:42:38 2011 us=609505 PO_CTL rwflags=0x0001 ev=7 arg=0x080c574c
Tue May 17 12:42:38 2011 us=609520 PO_CTL rwflags=0x0001 ev=8 arg=0x080c56a8
Tue May 17 12:42:38 2011 us=609538 I/O WAIT TR|Tw|SR|Sw [2/39987]
Tue May 17 12:42:39 2011 us=319415 PO_WAIT[0,0] fd=7 rev=0x00000001 rwflags=0x0001 arg=0x080c574c
Tue May 17 12:42:39 2011 us=319500 I/O WAIT status=0x0001
Tue May 17 12:42:39 2011 us=319518 MULTI: REAP range 112 -> 128
Tue May 17 12:42:39 2011 us=319619 GET INST BY REAL: 213.162.68.99:32958 [succeeded]
Tue May 17 12:42:39 2011 us=319642 mohammad/213.162.68.99:32958 UDPv4 READ [149] from [AF_INET]213.162.68.99:32958: P_DATA_V1 kid=0 DATA len=148
Tue May 17 12:42:39 2011 us=319662 mohammad/213.162.68.99:32958 TLS: tls_pre_decrypt, key_id=0, IP=[AF_INET]213.162.68.99:32958
Tue May 17 12:42:39 2011 us=319745 mohammad/213.162.68.99:32958 FRAG_IN error flags=0xfaffffff: FRAG_TEST not implemented
Tue May 17 12:42:39 2011 us=319769 PO_CTL rwflags=0x0001 ev=7 arg=0x080c574c
Tue May 17 12:42:39 2011 us=319783 PO_CTL rwflags=0x0001 ev=8 arg=0x080c56a8
Tue May 17 12:42:39 2011 us=319801 I/O WAIT TR|Tw|SR|Sw [1/39987]

B- When both (server and client) operate with fragment 1400 mssfix, then I dont get stable connection and the logs at server side look like this

Tue May 17 12:46:25 2011 us=499881 mohammad/213.162.68.99:32960 TLS: tls_pre_decrypt, key_id=0, IP=[AF_INET]213.162.68.99:32960
Tue May 17 12:46:25 2011 us=500141 mohammad/213.162.68.99:32960 GET INST BY VIRT: 00:0c:29:0f:47:df [failed]
Tue May 17 12:46:25 2011 us=500538 PO_CTL rwflags=0x0000 ev=7 arg=0x080c574c
Tue May 17 12:46:25 2011 us=500806 PO_CTL rwflags=0x0002 ev=8 arg=0x080c56a8
Tue May 17 12:46:25 2011 us=500862 I/O WAIT Tr|TW|Sr|Sw [1/114365]
Tue May 17 12:46:25 2011 us=501041 PO_WAIT[1,0] fd=8 rev=0x00000004 rwflags=0x0002 arg=0x080c56a8
Tue May 17 12:46:25 2011 us=501058 I/O WAIT status=0x0008
Tue May 17 12:46:25 2011 us=501073 mohammad/213.162.68.99:32960 TUN WRITE [74]
Tue May 17 12:46:25 2011 us=501199 PO_CTL rwflags=0x0001 ev=7 arg=0x080c574c
Tue May 17 12:46:25 2011 us=501289 PO_CTL rwflags=0x0001 ev=8 arg=0x080c56a8
Tue May 17 12:46:25 2011 us=501310 I/O WAIT TR|Tw|SR|Sw [1/114365]
Tue May 17 12:46:25 2011 us=501328 PO_WAIT[1,0] fd=8 rev=0x00000001 rwflags=0x0001 arg=0x080c56a8
Tue May 17 12:46:25 2011 us=501342 I/O WAIT status=0x0004
Tue May 17 12:46:25 2011 us=501376 GET INST BY VIRT: 00:ff:97:fb:3a:26 -> mohammad/213.162.68.99:32960 via 00:ff:97:fb:3a:26
Tue May 17 12:46:25 2011 us=501392 mohammad/213.162.68.99:32960 TUN READ [74]
Tue May 17 12:46:25 2011 us=501407 mohammad/213.162.68.99:32960 TLS: tls_pre_encrypt: key_id=0
Tue May 17 12:46:25 2011 us=501443 PO_CTL rwflags=0x0002 ev=7 arg=0x080c574c
Tue May 17 12:46:25 2011 us=501457 PO_CTL rwflags=0x0000 ev=8 arg=0x080c56a8
Tue May 17 12:46:25 2011 us=501474 I/O WAIT Tr|Tw|Sr|SW [1/114365]
Tue May 17 12:46:25 2011 us=501490 PO_WAIT[0,0] fd=7 rev=0x00000004 rwflags=0x0002 arg=0x080c574c
Tue May 17 12:46:25 2011 us=501504 I/O WAIT status=0x0002
Tue May 17 12:46:25 2011 us=501523 mohammad/213.162.68.99:32960 UDPv4 WRITE [117] to [AF_INET]213.162.68.99:32960: P_DATA_V1 kid=0 DATA len=116
Tue May 17 12:46:25 2011 us=501706 PO_CTL rwflags=0x0001 ev=7 arg=0x080c574c
Tue May 17 12:46:25 2011 us=501723 PO_CTL rwflags=0x0001 ev=8 arg=0x080c56a8
Tue May 17 12:46:25 2011 us=501739 I/O WAIT TR|Tw|SR|Sw [1/114365]
Tue May 17 12:46:25 2011 us=957362 PO_WAIT[0,0] fd=7 rev=0x00000001 rwflags=0x0001 arg=0x080c574c
Tue May 17 12:46:25 2011 us=957446 I/O WAIT status=0x0001
Tue May 17 12:46:25 2011 us=957484 GET INST BY REAL: 213.162.68.99:32960 [succeeded]
Tue May 17 12:46:25 2011 us=957508 mohammad/213.162.68.99:32960 UDPv4 READ [149] from [AF_INET]213.162.68.99:32960: P_DATA_V1 kid=0 DATA len=148
Tue May 17 12:46:25 2011 us=957529 mohammad/213.162.68.99:32960 TLS: tls_pre_decrypt, key_id=0, IP=[AF_INET]213.162.68.99:32960
Tue May 17 12:46:25 2011 us=957581 PO_CTL rwflags=0x0000 ev=7 arg=0x080c574c
Tue May 17 12:46:25 2011 us=957596 PO_CTL rwflags=0x0002 ev=8 arg=0x080c56a8
Tue May 17 12:46:25 2011 us=957615 I/O WAIT Tr|TW|Sr|Sw [1/62610]
Tue May 17 12:46:25 2011 us=957634 PO_WAIT[1,0] fd=8 rev=0x00000004 rwflags=0x0002 arg=0x080c56a8
Tue May 17 12:46:25 2011 us=957649 I/O WAIT status=0x0008
Tue May 17 12:46:25 2011 us=957664 mohammad/213.162.68.99:32960 TUN WRITE [92]
Tue May 17 12:46:25 2011 us=958007 PO_CTL rwflags=0x0001 ev=7 arg=0x080c574c
Tue May 17 12:46:25 2011 us=958061 PO_CTL rwflags=0x0001 ev=8 arg=0x080c56a8
Tue May 17 12:46:25 2011 us=958078 I/O WAIT TR|Tw|SR|Sw [1/62184]
Tue May 17 12:46:26 2011 us=46301 PO_WAIT[1,0] fd=8 rev=0x00000001 rwflags=0x0001 arg=0x080c56a8
Tue May 17 12:46:26 2011 us=46374 I/O WAIT status=0x0004
Tue May 17 12:46:26 2011 us=46392 MULTI: REAP range 64 -> 80
Tue May 17 12:46:26 2011 us=46511 PO_CTL rwflags=0x0002 ev=7 arg=0x080c574c
Tue May 17 12:46:26 2011 us=46528 PO_CTL rwflags=0x0000 ev=8 arg=0x080c56a8
Tue May 17 12:46:26 2011 us=46547 I/O WAIT Tr|Tw|Sr|SW [0/62184]
Tue May 17 12:46:26 2011 us=46566 PO_WAIT[0,0] fd=7 rev=0x00000004 rwflags=0x0002 arg=0x080c574c
Tue May 17 12:46:26 2011 us=46580 I/O WAIT status=0x0002
Tue May 17 12:46:26 2011 us=46596 mohammad/213.162.68.99:32960 TLS: tls_pre_encrypt: key_id=0
Tue May 17 12:46:26 2011 us=46639 mohammad/213.162.68.99:32960 MULTI: C2C/MCAST/BCAST
Tue May 17 12:46:26 2011 us=46662 mohammad/213.162.68.99:32960 UDPv4 WRITE [117] to [AF_INET]213.162.68.99:32960: P_DATA_V1 kid=0 DATA len=116
Tue May 17 12:46:26 2011 us=46876 mohammad/213.162.68.99:32960 TIMER: coarse timer wakeup 10 seconds
Tue May 17 12:46:26 2011 us=46904 mohammad/213.162.68.99:32960 SCHEDULE: schedule_add_modify wakeup=[Tue May 17 12:46:32 2011 us=126612] pri=922054742
Tue May 17 12:46:26 2011 us=46924 SCHEDULE: schedule_find_least wakeup=[Tue May 17 12:46:32 2011 us=126612] pri=1174053497
Tue May 17 12:46:26 2011 us=46938 PO_CTL rwflags=0x0001 ev=7 arg=0x080c574c
Tue May 17 12:46:26 2011 us=46952 PO_CTL rwflags=0x0001 ev=8 arg=0x080c56a8
Tue May 17 12:46:26 2011 us=46968 I/O WAIT TR|Tw|SR|Sw [5/168609]
Tue May 17 12:46:26 2011 us=566663 PO_WAIT[0,0] fd=7 rev=0x00000001 rwflags=0x0001 arg=0x080c574c
Tue May 17 12:46:26 2011 us=566748 I/O WAIT status=0x0001
Tue May 17 12:46:26 2011 us=566787 GET INST BY REAL: 213.162.68.99:32960 [succeeded]
Tue May 17 12:46:26 2011 us=566810 mohammad/213.162.68.99:32960 UDPv4 READ [229] from [AF_INET]213.162.68.99:32960: P_DATA_V1 kid=0 DATA len=228
Tue May 17 12:46:26 2011 us=566830 mohammad/213.162.68.99:32960 TLS: tls_pre_decrypt, key_id=0, IP=[AF_INET]213.162.68.99:32960
Tue May 17 12:46:26 2011 us=566883 PO_CTL rwflags=0x0000 ev=7 arg=0x080c574c
Tue May 17 12:46:26 2011 us=566899 PO_CTL rwflags=0x0002 ev=8 arg=0x080c56a8
Tue May 17 12:46:26 2011 us=566918 I/O WAIT Tr|TW|Sr|Sw [5/168609]
Tue May 17 12:46:26 2011 us=566936 PO_WAIT[1,0] fd=8 rev=0x00000004 rwflags=0x0002 arg=0x080c56a8
Tue May 17 12:46:26 2011 us=566951 I/O WAIT status=0x0008
Tue May 17 12:46:26 2011 us=566966 mohammad/213.162.68.99:32960 TUN WRITE [175]
Tue May 17 12:46:26 2011 us=567160 PO_CTL rwflags=0x0001 ev=7 arg=0x080c574c
Tue May 17 12:46:26 2011 us=567177 PO_CTL rwflags=0x0001 ev=8 arg=0x080c56a8
Tue May 17 12:46:26 2011 us=567194 I/O WAIT TR|Tw|SR|Sw [5/168609]
Tue May 17 12:46:26 2011 us=604888 PO_WAIT[0,0] fd=7 rev=0x00000001 rwflags=0x0001 arg=0x080c574c
Tue May 17 12:46:26 2011 us=604972 I/O WAIT status=0x0001
Tue May 17 12:46:26 2011 us=605010 GET INST BY REAL: 213.162.68.99:32960 [succeeded]
Tue May 17 12:46:26 2011 us=605034 mohammad/213.162.68.99:32960 UDPv4 READ [117] from [AF_INET]213.162.68.99:32960: P_DATA_V1 kid=0 DATA len=116
Tue May 17 12:46:26 2011 us=605054 mohammad/213.162.68.99:32960 TLS: tls_pre_decrypt, key_id=0, IP=[AF_INET]213.162.68.99:32960
Tue May 17 12:46:26 2011 us=605103 mohammad/213.162.68.99:32960 GET INST BY VIRT: 00:0c:29:0f:47:df [failed]
Tue May 17 12:46:26 2011 us=605125 PO_CTL rwflags=0x0000 ev=7 arg=0x080c574c
Tue May 17 12:46:26 2011 us=605139 PO_CTL rwflags=0x0002 ev=8 arg=0x080c56a8
Tue May 17 12:46:26 2011 us=605158 I/O WAIT Tr|TW|Sr|Sw [5/168609]
Tue May 17 12:46:26 2011 us=605177 PO_WAIT[1,0] fd=8 rev=0x00000004 rwflags=0x0002 arg=0x080c56a8
Tue May 17 12:46:26 2011 us=605191 I/O WAIT status=0x0008
Tue May 17 12:46:26 2011 us=605206 mohammad/213.162.68.99:32960 TUN WRITE [74]
Tue May 17 12:46:26 2011 us=605349 PO_CTL rwflags=0x0001 ev=7 arg=0x080c574c
Tue May 17 12:46:26 2011 us=605366 PO_CTL rwflags=0x0001 ev=8 arg=0x080c56a8
Tue May 17 12:46:26 2011 us=605506 I/O WAIT TR|Tw|SR|Sw [5/168609]
Tue May 17 12:46:26 2011 us=605526 PO_WAIT[1,0] fd=8 rev=0x00000001 rwflags=0x0001 arg=0x080c56a8
Tue May 17 12:46:26 2011 us=605540 I/O WAIT status=0x0004
Tue May 17 12:46:26 2011 us=605574 GET INST BY VIRT: 00:ff:97:fb:3a:26 -> mohammad/213.162.68.99:32960 via 00:ff:97:fb:3a:26
Tue May 17 12:46:26 2011 us=605589 mohammad/213.162.68.99:32960 TUN READ [74]
Tue May 17 12:46:26 2011 us=605605 mohammad/213.162.68.99:32960 TLS: tls_pre_encrypt: key_id=0
Tue May 17 12:46:26 2011 us=605639 PO_CTL rwflags=0x0002 ev=7 arg=0x080c574c
Tue May 17 12:46:26 2011 us=605654 PO_CTL rwflags=0x0000 ev=8 arg=0x080c56a8
Tue May 17 12:46:26 2011 us=605670 I/O WAIT Tr|Tw|Sr|SW [5/168609]
Tue May 17 12:46:26 2011 us=605686 PO_WAIT[0,0] fd=7 rev=0x00000004 rwflags=0x0002 arg=0x080c574c
Tue May 17 12:46:26 2011 us=605700 I/O WAIT status=0x0002
Tue May 17 12:46:26 2011 us=605718 mohammad/213.162.68.99:32960 UDPv4 WRITE [117] to [AF_INET]213.162.68.99:32960: P_DATA_V1 kid=0 DATA len=116
Tue May 17 12:46:26 2011 us=605923 PO_CTL rwflags=0x0001 ev=7 arg=0x080c574c
Tue May 17 12:46:26 2011 us=605940 PO_CTL rwflags=0x0001 ev=8 arg=0x080c56a8
Tue May 17 12:46:26 2011 us=605956 I/O WAIT TR|Tw|SR|Sw [5/168609]
Tue May 17 12:46:26 2011 us=655386 PO_WAIT[0,0] fd=7 rev=0x00000001 rwflags=0x0001 arg=0x080c574c
Tue May 17 12:46:26 2011 us=655458 I/O WAIT status=0x0001
Tue May 17 12:46:26 2011 us=655544 GET INST BY REAL: 213.162.68.99:32960 [succeeded]
Tue May 17 12:46:26 2011 us=655569 mohammad/213.162.68.99:32960 UDPv4 READ [149] from [AF_INET]213.162.68.99:32960: P_DATA_V1 kid=0 DATA len=148
Tue May 17 12:46:26 2011 us=655589 mohammad/213.162.68.99:32960 TLS: tls_pre_decrypt, key_id=0, IP=[AF_INET]213.162.68.99:32960
Tue May 17 12:46:26 2011 us=655639 PO_CTL rwflags=0x0000 ev=7 arg=0x080c574c
Tue May 17 12:46:26 2011 us=655654 PO_CTL rwflags=0x0002 ev=8 arg=0x080c56a8
Tue May 17 12:46:26 2011 us=655673 I/O WAIT Tr|TW|Sr|Sw [5/168609]
Tue May 17 12:46:26 2011 us=655691 PO_WAIT[1,0] fd=8 rev=0x00000004 rwflags=0x0002 arg=0x080c56a8
Tue May 17 12:46:26 2011 us=655705 I/O WAIT status=0x0008
Tue May 17 12:46:26 2011 us=655720 mohammad/213.162.68.99:32960 TUN WRITE [92]
Tue May 17 12:46:26 2011 us=656038 PO_CTL rwflags=0x0001 ev=7 arg=0x080c574c
Tue May 17 12:46:26 2011 us=656056 PO_CTL rwflags=0x0001 ev=8 arg=0x080c56a8
Tue May 17 12:46:26 2011 us=656073 I/O WAIT TR|Tw|SR|Sw [5/168609]

What do you think?

Peace!

janjust

what happens if you use

fragment 1496

(or fragment 1500) on the server side and

fragment 1400

on the client side?

another thing to test is to use only 'mssfix' on the client side .

smfe

Hallo JanJust,

I have two machines, wind7 and XP.

When I use only mssfix at client, windows7 connects without a problem but XP doesnt.

When I use fragment 1496 OR 1500 @server while fragment 1400 @clients; again windows7 works but XP not.

I double checked that ta.key file is identical. Is there a methodical way to troubleshoot openVPN? should I simplify my configuration at server or client. I think my configuration is not complicated. What do you think my problem is?

Peace

janjust

I don't think there's a methodical way to troubleshoot this 😉

If I understand this thread-post thus far you have:

- win xp works if 'fragment' and 'mssfix' are not specified
- win 7 does not work if 'fragment' and 'mssfix' are not specified

If 'fragment' or 'mssfix' are specified on both client and server you have

- win xp no longer works (you must use 'fragment' here too!)
- win 7 does work if 'fragment' and 'mssfix' are specified on the client side

am I missing something? what error does the winXP client show when connecting?