Connection hangs

pvassalli

I'm experiencing some problems on my vpn connection.
After about 30' the connection gets reset.

On client the log is:
Mon Jun 20 12:06:45 2011 us=947828 TUN READ [200]
Mon Jun 20 12:22:49 2011 us=483323 read TCPv4_CLIENT [NO-INFO]: Connection timed out (code=110)
Mon Jun 20 12:22:49 2011 us=483323 TCPv4_CLIENT READ [0] from 62.167.10.120:20006: DATA UNDEF len=-1
Mon Jun 20 12:22:49 2011 us=483323 Connection reset, restarting [0]
Mon Jun 20 12:22:49 2011 us=483323 TCP/UDP: Closing socket
Mon Jun 20 12:22:49 2011 us=483323 SIGUSR1[soft,connection-reset] received, process restarting
Mon Jun 20 12:22:49 2011 us=483323 Restart pause, 5 second(s)

On server the log is:
Mon Jun 20 10:06:46 2011 us=846514 TUN READ [200]
Mon Jun 20 10:08:41 2011 us=550830 Inactivity timeout (--ping-restart), restarting
Mon Jun 20 10:08:41 2011 us=551017 TCP/UDP: Closing socket
Mon Jun 20 10:08:41 2011 us=551138 SIGUSR1[soft,ping-restart] received, process restarting
Mon Jun 20 10:08:41 2011 us=551217 Restart pause, 1 second(s)

The client configuration is:
dev tun1
secret client1.key
script-security 1
remote xxx.xxx.xxx.xxx
rport 20006
ifconfig 192.168.6.210 192.168.210.6
comp-lzo
proto tcp-client
ping-timer-rem
ping 30
tun-mtu 1500
tun-mtu-extra 64
float
persist-tun
persist-key
persist-local-ip
verb 6
log /var/log/openvpn/connection.log

The server configuration is:
dev tun6
keepalive 10 120
secret client1.key
lport 20006
ifconfig 192.168.210.6 192.168.6.210
comp-lzo
proto tcp-server
tun-mtu 1500
tun-mtu-extra 64
float
verb 6
persist-tun
persist-key
persist-local-ip
log /var/log/openvpn/client1.log

janjust

seems like the underlying TCP connection is reset - there's very little that can be done about that. your client config looks screwed up,however: change

ifconfig 192.168.6.210 192.168.210.6

ifconfig 192.168.210.5 192.168.210.6

(and reverse on the other end).

Also, remove

tun-mtu-extra 64

on both sides, as this can only make things worse, not better 😉

pvassalli

Ok, I'm trying without the mtu parameter.
How can I get an automatic restart just after the TCP connection reset?
Is it possible?

janjust

did you change the 'ifconfig' statements as well?
in this mode it is quite hard to get an automatic restart - persist-key + persist-tun should have taken care of most of it.

pvassalli

Yep, changed in client:
ifconfig 192.168.6.210 192.168.210.4
and in server:
ifconfig 192.168.210.4 192.168.6.210

I see that "persist-key + persist-tun should have taken care of most of it", but how long does openvpn takes to understand that everything is gone out and that is restarting? 5 minutes, 10 miutes or more?
Can I fix that parameter in about 5 seconds, or 10 seconds?

maikcat

hi there,

as jjk mentioned earlier

change this

>ifconfig 192.168.6.210 192.168.210.4
>and in server:
>ifconfig 192.168.210.4 192.168.6.210
to this

ifconfig 192.168.210.6 192.168.210.4
and in server:
ifconfig 192.168.210.4 192.168.210.6

Michael.

janjust

as Michael said, you did not change the 'ifconfig' adresses correctly; the 'ifconfig' addresses should be (at least) part of the same subnet, e.g. on the client

192.168.210.2 192.168.210.1

and on the server

192.168.210.1 192.168.210.2

you can pick pretty much any subnet.

pvassalli

Ok, I've removed and the parameters are:

Server:
dev tun6
keepalive 10 120
secret client1.key
lport 20006
ifconfig 192.168.220.6 192.168.220.4
comp-lzo
proto tcp-server
#ping 30
#ping-restart 60

tun-mtu 1500
#tun-mtu-extra 64
float
persist-tun
persist-key
persist-local-ip
verb 3

log /var/log/openvpn/client1.log

Client
dev tun210
secret server1.key
script-security 1
remote ::servername::
rport 20006
ifconfig 192.168.220.4 192.168.220.6
comp-lzo
proto tcp-client
ping-timer-rem
ping 30
tun-mtu 1500
float
persist-tun
persist-key
persist-local-ip
log /var/log/openvpn/server.log
verb 3

But, once again, the line falls... 🙁((

The error log is:
Tue Jun 21 10:28:46 2011 SIGUSR1[soft,connection-reset] received, process restarting
Tue Jun 21 10:28:46 2011 TCP/UDP: Closing socket
Tue Jun 21 10:28:46 2011 Connection reset, restarting [0]

I'm very disappointed for that: can I do anything so that the line perists or so that the line is immediately reconfigured?

janjust

just wondering: is there a difference between 'client1.key' and 'server1.key' ? because there shouldn't be ; in the mode you're running you're using preshared keys, which means the same key is used on both ends.

pvassalli

it's the same key, just called the file with a different name to understand on which machine I am... 🙂
but, after a stable connection of more than 2 hours and trasmitting data for a long time, once again:

Tue Jun 21 13:11:56 2011 Inactivity timeout (--ping-restart), restarting
Tue Jun 21 13:11:56 2011 SIGUSR1[soft,ping-restart] received, process restartingì

janjust

try commenting out 'keepalive' and use 0 for 'ping' and 'ping-restart' on both sides:

#keepalive 10 120
ping 0
ping-restart 0

pvassalli

So now, I am investigating about a line, since with the parameters you have suggested it seems to be working effectively.
Now I'm wondering if it is possible, in case the vpn goes down, to invoke a script, not only a restart try with ping and ping-restart.

janjust

you could either add a wrapper script around openvpn itself or you could use a 'down' script which triggers a relaunch, AFTER the current openvpn instance has stopped.