Hello everyone, I have openVPN server (OpenVPN 2.1.3) running on Debian 6.0. My clients (version 2.2) run on windows 7. When I try to connect my client to the server, I get connection, IP, and I can ping a machine that is located behind the server. My problem is that this connection does not last for more than few seconds (3-15). This I can no longer access machines that are behind the server. After sometime, my client try again to establish connection and the connection works again but only for few seconds. I increased the log verbosity but could not see any "fail" or "error" message. I have no clue. It used to work in the past. I tried to check the web but no help: http://openvpn.net/archive/openvpn-users/2007-05/msg00008.html https://forums.openvpn.net/topic7467-15.html https://forums.openvpn.net/topic7502.html https://forums.openvpn.net/topic7820.html Client configuration: [code]client dev tap proto udp remote 91.113.188.10 1194 resolv-retry infinite nobind persist-key persist-tun ca ca.crt tls-auth ta.key auth-user-pass reneg-sec 0 cipher AES-128-CBC comp-lzo verb 3 [/code] Client log: [code]Fri May 13 12:45:45 2011 OpenVPN 2.0.9 Win32-MinGW [SSL] [LZO] built on Oct 1 2006 Fri May 13 12:45:52 2011 IMPORTANT: OpenVPN's default port number is now 1194, based on an official port number assignment by IANA. OpenVPN 2.0-beta16 and earlier used 5000 as the default port. Fri May 13 12:45:52 2011 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info. Fri May 13 12:45:52 2011 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file Fri May 13 12:45:52 2011 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication Fri May 13 12:45:52 2011 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication Fri May 13 12:45:52 2011 LZO compression initialized Fri May 13 12:45:52 2011 Control Channel MTU parms [ L:1590 D:166 EF:66 EB:0 ET:0 EL:0 ] Fri May 13 12:45:52 2011 Data Channel MTU parms [ L:1590 D:1450 EF:58 EB:135 ET:32 EL:0 AF:3/1 ] Fri May 13 12:45:52 2011 Local Options hash (VER=V4): 'c926f1a3' Fri May 13 12:45:52 2011 Expected Remote Options hash (VER=V4): 'ab8abf9c' Fri May 13 12:45:52 2011 UDPv4 link local: [undef] Fri May 13 12:45:52 2011 UDPv4 link remote: 91.113.188.10:1194 Fri May 13 12:45:52 2011 TLS: Initial packet from 91.113.188.10:1194, sid=bdd49ac3 e3d24a15 Fri May 13 12:45:54 2011 VERIFY OK: depth=1, /C=AT/ST=Salzburg/L=Salzburg/O=smartmachine_Forschung___Entwicklung_GmbH/OU=IT/CN=smartmachine_Forschung___Entwicklung_GmbH_CA/emailAddress=support@smartmachine.net Fri May 13 12:45:54 2011 VERIFY OK: depth=0, /C=AT/ST=Salzburg/L=Salzburg/O=smartmachine_Forschung___Entwicklung_GmbH/OU=IT/CN=mtan.smartmachine.int_server/emailAddress=support@smartmachine.net Fri May 13 12:45:55 2011 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key Fri May 13 12:45:55 2011 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication Fri May 13 12:45:55 2011 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key Fri May 13 12:45:55 2011 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication Fri May 13 12:45:55 2011 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA Fri May 13 12:45:55 2011 [mtan.smartmachine.int_server] Peer Connection Initiated with 91.113.188.10:1194 Fri May 13 12:45:57 2011 SENT CONTROL [mtan.smartmachine.int_server]: 'PUSH_REQUEST' (status=1) Fri May 13 12:45:57 2011 PUSH: Received control message: 'PUSH_REPLY,dhcp-option DNS 192.168.1.251,route-gateway 192.168.1.0,ping 10,ping-restart 120,ifconfig 192.168.1.106 255.255.255.0' Fri May 13 12:45:57 2011 OPTIONS IMPORT: timers and/or timeouts modified Fri May 13 12:45:57 2011 OPTIONS IMPORT: --ifconfig/up options modified Fri May 13 12:45:57 2011 OPTIONS IMPORT: route options modified Fri May 13 12:45:57 2011 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified Fri May 13 12:45:57 2011 TAP-WIN32 device [LAN-Verbindung 2] opened: \\.\Global\{B93EBFE5-1953-4BD3-9CC1-316FA706985F}.tap Fri May 13 12:45:57 2011 TAP-Win32 Driver Version 8.4 Fri May 13 12:45:57 2011 TAP-Win32 MTU=1500 Fri May 13 12:45:57 2011 Notified TAP-Win32 driver to set a DHCP IP/netmask of 192.168.1.106/255.255.255.0 on interface {B93EBFE5-1953-4BD3-9CC1-316FA706985F} [DHCP-serv: 192.168.1.0, lease-time: 31536000] Fri May 13 12:45:57 2011 NOTE: FlushIpNetTable failed on interface [13] {B93EBFE5-1953-4BD3-9CC1-316FA706985F} (status=5) : Zugriff verweigert Fri May 13 12:45:57 2011 TEST ROUTES: 0/0 succeeded len=-1 ret=1 a=0 u/d=up Fri May 13 12:45:57 2011 Initialization Sequence Completed[/code] Thanks for your help.

[code] port 1194 proto udp dev tap script-security 2 up /etc/openvpn/bridge-start.sh down /etc/openvpn/bridge-stop.sh ca ca.crt cert mtan.smartmachine.int_server.crt key mtan.smartmachine.int_server.key dh dh2048.pem tls-auth ta.key client-cert-not-required username-as-common-name plugin /etc/openvpn/radiusplugin.so /etc/openvpn/radiusplugin.cnf cipher AES-128-CBC ifconfig-pool-persist ipp.txt server-bridge 192.168.1.0 255.255.255.0 192.168.1.102 192.168.1.125 client-to-client #push "redirect-gateway" push "dhcp-option DNS 192.168.1.251" keepalive 10 120 comp-lzo max-clients 40 user nobody group nogroup persist-key persist-tun status openvpn-status.log status /var/log/openvpn/status.log 1 log-append openvpn.log verb 4 mute 20 reneg-sec 86400 [/code]

your client log shows that you're running openvpn 2.0.9 with tap-driver 8.04 - that will not work on windows 7. Can you upgrade your clients to 2.2 and verify that they are actually running openvpn 2.2?

Hello janjust, Thank you for your help. I updated the client and now it shows in logs that it uses TAP-driver version 9.8. Still I experience the same behaviour. I tried this also on XP machine and I have the same problem. Your efforts are appreciated. Peace! [code] Mon May 16 09:17:18 2011 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables Mon May 16 09:17:18 2011 Re-using SSL/TLS context Mon May 16 09:17:18 2011 LZO compression initialized Mon May 16 09:17:18 2011 Control Channel MTU parms [ L:1590 D:166 EF:66 EB:0 ET:0 EL:0 ] Mon May 16 09:17:18 2011 Socket Buffers: R=[128000->128000] S=[32768->32768] Mon May 16 09:17:18 2011 Data Channel MTU parms [ L:1590 D:1450 EF:58 EB:135 ET:32 EL:0 AF:3/1 ] Mon May 16 09:17:18 2011 Local Options hash (VER=V4): 'c926f1a3' Mon May 16 09:17:18 2011 Expected Remote Options hash (VER=V4): 'ab8abf9c' Mon May 16 09:17:18 2011 UDPv4 link local: [undef] Mon May 16 09:17:18 2011 UDPv4 link remote: 91.113.188.10:1194 Mon May 16 09:17:19 2011 TLS: Initial packet from 91.113.188.10:1194, sid=e9e2de3a caef8232 Mon May 16 09:17:20 2011 VERIFY OK: depth=1, /C=AT/ST=Salzburg/L=Salzburg/O=smartmachine_Forschung___Entwicklung_GmbH/OU=IT/CN=smartmachine_Forschung___Entwicklung_GmbH_CA/emailAddress=support@smartmachine.net Mon May 16 09:17:20 2011 VERIFY OK: depth=0, /C=AT/ST=Salzburg/L=Salzburg/O=smartmachine_Forschung___Entwicklung_GmbH/OU=IT/CN=mtan.smartmachine.int_server/emailAddress=support@smartmachine.net Mon May 16 09:17:21 2011 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key Mon May 16 09:17:21 2011 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication Mon May 16 09:17:21 2011 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key Mon May 16 09:17:21 2011 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication Mon May 16 09:17:21 2011 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA Mon May 16 09:17:21 2011 [mtan.smartmachine.int_server] Peer Connection Initiated with 91.113.188.10:1194 Mon May 16 09:17:23 2011 SENT CONTROL [mtan.smartmachine.int_server]: 'PUSH_REQUEST' (status=1) Mon May 16 09:17:23 2011 PUSH: Received control message: 'PUSH_REPLY,dhcp-option DNS 192.168.1.251,route-gateway 192.168.1.0,ping 10,ping-restart 120,ifconfig 192.168.1.106 255.255.255.0' Mon May 16 09:17:23 2011 OPTIONS IMPORT: timers and/or timeouts modified Mon May 16 09:17:23 2011 OPTIONS IMPORT: --ifconfig/up options modified Mon May 16 09:17:23 2011 OPTIONS IMPORT: route-related options modified Mon May 16 09:17:23 2011 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified Mon May 16 09:17:23 2011 Preserving previous TUN/TAP instance: LAN-Verbindung 2 Mon May 16 09:17:23 2011 Initialization Sequence Completed Mon May 16 09:18:55 2011 TCP/UDP: Closing socket Mon May 16 09:18:55 2011 Closing TUN/TAP interface Mon May 16 09:18:55 2011 SIGTERM[hard,] received, process exiting Mon May 16 09:18:55 2011 OpenVPN 2.2.0 Win32-MSVC++ [SSL] [LZO2] built on Apr 26 2011 Mon May 16 09:19:01 2011 WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info. Mon May 16 09:19:01 2011 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables Mon May 16 09:19:02 2011 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file Mon May 16 09:19:02 2011 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication Mon May 16 09:19:02 2011 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication Mon May 16 09:19:02 2011 LZO compression initialized Mon May 16 09:19:02 2011 Control Channel MTU parms [ L:1590 D:166 EF:66 EB:0 ET:0 EL:0 ] Mon May 16 09:19:02 2011 Socket Buffers: R=[128000->128000] S=[32768->32768] Mon May 16 09:19:02 2011 Data Channel MTU parms [ L:1590 D:1450 EF:58 EB:135 ET:32 EL:0 AF:3/1 ] Mon May 16 09:19:02 2011 Local Options hash (VER=V4): 'c926f1a3' Mon May 16 09:19:02 2011 Expected Remote Options hash (VER=V4): 'ab8abf9c' Mon May 16 09:19:02 2011 UDPv4 link local: [undef] Mon May 16 09:19:02 2011 UDPv4 link remote: 91.113.188.10:1194 Mon May 16 09:19:03 2011 TLS: Initial packet from 91.113.188.10:1194, sid=6341933a e796b163 Mon May 16 09:19:03 2011 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this Mon May 16 09:19:04 2011 VERIFY OK: depth=1, /C=AT/ST=Salzburg/L=Salzburg/O=smartmachine_Forschung___Entwicklung_GmbH/OU=IT/CN=smartmachine_Forschung___Entwicklung_GmbH_CA/emailAddress=support@smartmachine.net Mon May 16 09:19:04 2011 VERIFY OK: depth=0, /C=AT/ST=Salzburg/L=Salzburg/O=smartmachine_Forschung___Entwicklung_GmbH/OU=IT/CN=mtan.smartmachine.int_server/emailAddress=support@smartmachine.net Mon May 16 09:19:05 2011 Data Channel Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key Mon May 16 09:19:05 2011 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication Mon May 16 09:19:05 2011 Data Channel Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key Mon May 16 09:19:05 2011 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication Mon May 16 09:19:05 2011 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA Mon May 16 09:19:05 2011 [mtan.smartmachine.int_server] Peer Connection Initiated with 91.113.188.10:1194 Mon May 16 09:19:07 2011 SENT CONTROL [mtan.smartmachine.int_server]: 'PUSH_REQUEST' (status=1) Mon May 16 09:19:07 2011 PUSH: Received control message: 'PUSH_REPLY,dhcp-option DNS 192.168.1.251,route-gateway 192.168.1.0,ping 10,ping-restart 120,ifconfig 192.168.1.106 255.255.255.0' Mon May 16 09:19:07 2011 OPTIONS IMPORT: timers and/or timeouts modified Mon May 16 09:19:07 2011 OPTIONS IMPORT: --ifconfig/up options modified Mon May 16 09:19:07 2011 OPTIONS IMPORT: route-related options modified Mon May 16 09:19:07 2011 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified Mon May 16 09:19:07 2011 TAP-WIN32 device [LAN-Verbindung 2] opened: \\.\Global\{97FB3A26-6BBB-418B-A662-2B2951905439}.tap Mon May 16 09:19:07 2011 TAP-Win32 Driver Version 9.8 Mon May 16 09:19:07 2011 TAP-Win32 MTU=1500 Mon May 16 09:19:07 2011 Notified TAP-Win32 driver to set a DHCP IP/netmask of 192.168.1.106/255.255.255.0 on interface {97FB3A26-6BBB-418B-A662-2B2951905439} [DHCP-serv: 192.168.1.0, lease-time: 31536000] Mon May 16 09:19:07 2011 NOTE: FlushIpNetTable failed on interface [13] {97FB3A26-6BBB-418B-A662-2B2951905439} (status=5) : Zugriff verweigert Mon May 16 09:19:07 2011 TEST ROUTES: 0/0 succeeded len=-1 ret=0 a=0 u/d=down Mon May 16 09:19:07 2011 Route: Waiting for TUN/TAP interface to come up... Mon May 16 09:19:08 2011 TEST ROUTES: 0/0 succeeded len=-1 ret=1 a=0 u/d=up Mon May 16 09:19:08 2011 Initialization Sequence Completed[/code]

hmmm the server seems to be pushing [code]route-gateway 192.168.1.0[/code] that can't be right; most likely it should be pusing 192.168.1.1. What's the server config?

Hi again, There server config is posted in the second post. It is located behind a NAT. The public IP is 91.113.188.10 and the internal IP is 192.168.1.233. I expect the problem to be Windows related because I use the same client config file with Mac 10.6 without problem. Peace!

ah, I missed the second post before ;) hmmm if the same config works with MacOS then indeed it's a windows issue; try adding [code]route-methode exe route-delay 2[/code] to the client config file; also, increase the verbosity to 5 and reconnect. After the client connects which IP does the tap-win32 interface have? what does 'ipconfig /all' show in a CMD window?

Hallo Jan, Thanks for taking the time. I have done what you asked for. I still experience the same problem after adding the two parameters and increasing verbosity. I attach here the outcome of ipconfig /all [code]Windows-IP-Konfiguration Hostname . . . . . . . . . . . . : LT-Edward2 Primres DNS-Suffix . . . . . . . : smartmachine.int Knotentyp . . . . . . . . . . . . : Hybrid IP-Routing aktiviert . . . . . . : Nein WINS-Proxy aktiviert . . . . . . : Nein DNS-Suffixsuchliste . . . . . . . : smartmachine.int PPP-Adapter HUAWEI3G.YESS Standard: Verbindungsspezifisches DNS-Suffix: Beschreibung. . . . . . . . . . . : HUAWEI3G.YESS Standard Physikalische Adresse . . . . . . : DHCP aktiviert. . . . . . . . . . : Nein Autokonfiguration aktiviert . . . : Ja IPv4-Adresse . . . . . . . . . . : 10.115.128.63(Bevorzugt) Subnetzmaske . . . . . . . . . . : 255.255.255.255 Standardgateway . . . . . . . . . : 0.0.0.0 DNS-Server . . . . . . . . . . . : 194.24.128.100 81.3.216.100 Primrer WINS-Server. . . . . . . : 10.11.12.13 Sekundrer WINS-Server. . . . . . : 10.11.12.14 NetBIOS ber TCP/IP . . . . . . . : Deaktiviert Ethernet-Adapter LAN-Verbindung 2: Verbindungsspezifisches DNS-Suffix: Beschreibung. . . . . . . . . . . : TAP-Win32 Adapter V9 Physikalische Adresse . . . . . . : 00-FF-97-FB-3A-26 DHCP aktiviert. . . . . . . . . . : Ja Autokonfiguration aktiviert . . . : Ja Verbindungslokale IPv6-Adresse . : fe80::382a:7c81:ac90:4a72%32(Bevorzugt) IPv4-Adresse . . . . . . . . . . : 192.168.1.106(Bevorzugt) Subnetzmaske . . . . . . . . . . : 255.255.255.0 Lease erhalten. . . . . . . . . . : Montag, 16. Mai 2011 11:08:44 Lease luft ab. . . . . . . . . . : Dienstag, 15. Mai 2012 11:08:43 Standardgateway . . . . . . . . . : DHCP-Server . . . . . . . . . . . : 192.168.1.0 DHCPv6-IAID . . . . . . . . . . . : 218169239 DHCPv6-Client-DUID. . . . . . . . : 00-01-00-01-12-EA-2A-46-00-14-22-E4-7E-27 DNS-Server . . . . . . . . . . . : 192.168.1.251 NetBIOS ber TCP/IP . . . . . . . : Aktiviert [/code]

I still don't like this part [quote]server-bridge 192.168.1.0 255.255.255.0 192.168.1.102 192.168.1.125[/quote] what is the address of the bridge interface on the server? please use that IP address for the 'server-bridge' and try again.

Hi, I changed to become [code]server-bridge 192.168.1.233 255.255.255.0 192.168.1.102 192.168.1.125[/code] unfortionatly that did not help. Thanks for your efforts

but is the correct gateway now pushed? can you ping this bridge address from the client? what happens if you ping it - is there any activity on the server side?

Connection works for only few seconds

[deleted]

can you assist me janjust here https://forums.openvpn.net/topic8160.html

smfe

Hello again,

very sorry for late reply but I was very busy (typical sysadmin :-)
unfortunately I don't have time to follow on this problem. Thanks alot janjust.

Peace!

« Previous Page