I am configuring a vpn with linux clients and ubiquity nanostations as clients. The server config is this: [code]port 1194 proto tcp dev tap-mon ca keys/ca.crt cert keys/server.crt key keys/server.key dh keys/dh1024.pem server 10.1.0.0 255.255.0.0 keepalive 10 60 tls-server user nobody group nogroup persist-key #persist-tun status monitoreo/status.log script-security 2 duplicate-cn username-as-common-name auth-user-pass-verify "/etc/openvpn/monitoreo/scripts/validar_openvpn" via-file client-connect "/etc/openvpn/monitoreo/scripts/configurar_openvpn" client-disconnect "/etc/openvpn/monitoreo/scripts/desconectado_openvpn" reneg-sec 60 tmp-dir /etc/openvpn/monitoreo/tmp client-cert-not-required client-to-client tun-mtu-extra 32 mssfix 1500[/code] The client runs with this command-line: [code]openvpn --client --dev tap --proto tcp --remote 192.168.100.4 --auth-user-pass /etc/openvpn/passfile --auth SHA1 --pull --ca /etc/openvpn/ca.crt --cert /etc/openvpn/client1.crt --key /etc/openvpn/client1.key --keepalive 10 60 [/code] For testing purposes, it is connected in a local network and the communications works correctly (tested with ping -f) The problem is the ping is very inestable, sometimes a ping lastes more than 10 seconds to be answered!: [code]64 bytes from 10.1.1.100: icmp_seq=46 ttl=64 time=1.36 ms 64 bytes from 10.1.1.100: icmp_seq=47 ttl=64 time=1.42 ms 64 bytes from 10.1.1.100: icmp_seq=48 ttl=64 time=1.23 ms 64 bytes from 10.1.1.100: icmp_seq=49 ttl=64 time=1.26 ms 64 bytes from 10.1.1.100: icmp_seq=50 ttl=64 time=1.16 ms 64 bytes from 10.1.1.100: icmp_seq=51 ttl=64 time=1.55 ms 64 bytes from 10.1.1.100: icmp_seq=52 ttl=64 time=1.18 ms 64 bytes from 10.1.1.100: icmp_seq=53 ttl=64 time=5.15 ms 64 bytes from 10.1.1.100: icmp_seq=54 ttl=64 time=1.50 ms 64 bytes from 10.1.1.100: icmp_seq=55 ttl=64 time=1.19 ms 64 bytes from 10.1.1.100: icmp_seq=56 ttl=64 time=1.52 ms 64 bytes from 10.1.1.100: icmp_seq=57 ttl=64 time=12664 ms 64 bytes from 10.1.1.100: icmp_seq=58 ttl=64 time=11664 ms 64 bytes from 10.1.1.100: icmp_seq=59 ttl=64 time=10664 ms 64 bytes from 10.1.1.100: icmp_seq=60 ttl=64 time=9664 ms 64 bytes from 10.1.1.100: icmp_seq=61 ttl=64 time=8664 ms 64 bytes from 10.1.1.100: icmp_seq=62 ttl=64 time=7664 ms 64 bytes from 10.1.1.100: icmp_seq=63 ttl=64 time=6664 ms 64 bytes from 10.1.1.100: icmp_seq=68 ttl=64 time=1665 ms 64 bytes from 10.1.1.100: icmp_seq=69 ttl=64 time=700 ms 64 bytes from 10.1.1.100: icmp_seq=70 ttl=64 time=1.29 ms 64 bytes from 10.1.1.100: icmp_seq=71 ttl=64 time=1.91 ms 64 bytes from 10.1.1.100: icmp_seq=72 ttl=64 time=1.38 ms 64 bytes from 10.1.1.100: icmp_seq=73 ttl=64 time=1.37 ms [/code] ¿What am I doing wrong?

[quote="maikcat"]stupid question, you are pinging 10.1.1.100.. whose ip is this? Michael[/quote] It is the IP assigned by openvpn server to the client.

inestable connection

anv

I am configuring a vpn with linux clients and ubiquity nanostations as clients.

The server config is this:

port 1194
proto tcp
dev tap-mon
ca keys/ca.crt
cert keys/server.crt
key keys/server.key
dh keys/dh1024.pem
server 10.1.0.0 255.255.0.0
keepalive 10 60
tls-server
user nobody
group nogroup
persist-key
#persist-tun
status monitoreo/status.log
script-security 2
duplicate-cn
username-as-common-name
auth-user-pass-verify  "/etc/openvpn/monitoreo/scripts/validar_openvpn" via-file
client-connect "/etc/openvpn/monitoreo/scripts/configurar_openvpn"
client-disconnect "/etc/openvpn/monitoreo/scripts/desconectado_openvpn"
reneg-sec 60
tmp-dir /etc/openvpn/monitoreo/tmp
client-cert-not-required
client-to-client
tun-mtu-extra 32
mssfix 1500

The client runs with this command-line:

openvpn --client --dev tap --proto tcp --remote 192.168.100.4 --auth-user-pass /etc/openvpn/passfile --auth SHA1 --pull --ca /etc/openvpn/ca.crt --cert /etc/openvpn/client1.crt --key /etc/openvpn/client1.key --keepalive 10 60

For testing purposes, it is connected in a local network and the communications works correctly (tested with ping -f)

The problem is the ping is very inestable, sometimes a ping lastes more than 10 seconds to be answered!:

64 bytes from 10.1.1.100: icmp_seq=46 ttl=64 time=1.36 ms
64 bytes from 10.1.1.100: icmp_seq=47 ttl=64 time=1.42 ms
64 bytes from 10.1.1.100: icmp_seq=48 ttl=64 time=1.23 ms
64 bytes from 10.1.1.100: icmp_seq=49 ttl=64 time=1.26 ms
64 bytes from 10.1.1.100: icmp_seq=50 ttl=64 time=1.16 ms
64 bytes from 10.1.1.100: icmp_seq=51 ttl=64 time=1.55 ms
64 bytes from 10.1.1.100: icmp_seq=52 ttl=64 time=1.18 ms
64 bytes from 10.1.1.100: icmp_seq=53 ttl=64 time=5.15 ms
64 bytes from 10.1.1.100: icmp_seq=54 ttl=64 time=1.50 ms
64 bytes from 10.1.1.100: icmp_seq=55 ttl=64 time=1.19 ms
64 bytes from 10.1.1.100: icmp_seq=56 ttl=64 time=1.52 ms
64 bytes from 10.1.1.100: icmp_seq=57 ttl=64 time=12664 ms
64 bytes from 10.1.1.100: icmp_seq=58 ttl=64 time=11664 ms
64 bytes from 10.1.1.100: icmp_seq=59 ttl=64 time=10664 ms
64 bytes from 10.1.1.100: icmp_seq=60 ttl=64 time=9664 ms
64 bytes from 10.1.1.100: icmp_seq=61 ttl=64 time=8664 ms
64 bytes from 10.1.1.100: icmp_seq=62 ttl=64 time=7664 ms
64 bytes from 10.1.1.100: icmp_seq=63 ttl=64 time=6664 ms
64 bytes from 10.1.1.100: icmp_seq=68 ttl=64 time=1665 ms
64 bytes from 10.1.1.100: icmp_seq=69 ttl=64 time=700 ms
64 bytes from 10.1.1.100: icmp_seq=70 ttl=64 time=1.29 ms
64 bytes from 10.1.1.100: icmp_seq=71 ttl=64 time=1.91 ms
64 bytes from 10.1.1.100: icmp_seq=72 ttl=64 time=1.38 ms
64 bytes from 10.1.1.100: icmp_seq=73 ttl=64 time=1.37 ms

¿What am I doing wrong?

maikcat

hi there,

when the server delays to answers what load it has?
is it a linux box?
if you issue a top command ,what it shows?
if at the same time ping it from local lan,does it responds ok?

Michael.

anv

maikcat wrotehi there,

when the server delays to answers what load it has?
is it a linux box?

Michael.

The server is a Linux box with an Intel Core i7 (4 cores/8 threads) with 8Gb RAM. I think there will be always enough CPU for openVPN. Even, it is not compressing.

maikcat wrote if you issue a top command ,what it shows?

Output of top:
top - 16:57:31 up 8:24, 7 users, load average: 0.28, 0.21, 0.19
Tasks: 402 total, 2 running, 390 sleeping, 1 stopped, 9 zombie
Cpu(s): 4.1%us, 1.0%sy, 0.0%ni, 93.9%id, 0.7%wa, 0.0%hi, 0.3%si, 0.0%st
Mem: 8296752k total, 4589540k used, 3707212k free, 256548k buffers
Swap: 2040176k total, 0k used, 2040176k free, 2993792k cached

maikcat wrote if at the same time ping it from local lan,does it responds ok?

Pig to the lan IP address is normal (less than a half microsecond).

maikcat

stupid question,

you are pinging 10.1.1.100..
whose ip is this?

Michael

anv

maikcat wrotestupid question,

you are pinging 10.1.1.100..
whose ip is this?

Michael

It is the IP assigned by openvpn server to the client.

Mimiko

Could you try following commands simultaneosly when the issue occurs:

ping 10.1.0.1 # OpenVPN server's assigned IP
ping 192.168.100.4
ping 127.0.0.1
ping 192.168.x.y # IP other any other computer on the lan