OpenVPN hickups with Remote Printers for MS RDP

ofrxnz

So, I have a Vyatta based OpenVPN server and a DDWRT OpenVPN client. Pretty much everything works as expected.

But when I run MS RDP it works great unless I turn on Roaming Printers (also known as "Local Resources->Local Devices and Resources -> Printers").

If Roaming Printers are on, the RDP session gets to the "loading Desktop" stage. Then the tunnel studders for about 30 seconds and during this time pings are either dropped or have a latency between 10-17 seconds (normal ping is 40ms).

Once it gets past this bit, everything works great, even RDP.

My original thought was MTU cap, but I cranked it down to what our other vpn solution uses and still no joy.

Does anyone have any thoughts, solutions or ideas why turning on the Roaming Printers portion of MS RDP would cause serious disruptions?

maikcat

can you please post your config?

are you using tcp for openvpn?

Michael.

ecrist

I routinely use RDP with printer and file system sharing across an OpenVPN tunnel and I've never noticed an issue. This has worked well for me on both Mac and Windows clients. Could you provide your configurations and perhaps your logs, as mentioned in the forum rules?

ofrxnz

It seems that if a request originates from the client LAN, it is fine. But if it originates from the Server LAN, it has issues.

Client config

client
dev tun
proto udp
remote <serverIP> 1194
resolv-retry infinite
nobind
persist-key
persist-tun
tun-mtu 1418
tun-mtu-extra 32
fragment 1368
mssfix
ca ca.crt
cert client.crt
key client.key
verb 3
comp-lzo
keepalive 30 120
daemon
pull

Server Config. Its in the Vyatta format.....It doesn't let you directly get an openvpn config file out. Though I will keep looking.

 openvpn vtun0 {
     encryption bf128
     mode server
     openvpn-option "--comp-lzo --tun-mtu 1418 --tun-mtu-extra 32 --fragment 1368 --mssfix "
     protocol udp
     server {
         client ddwrtclient {
             ip 10.x.y.x
             push-route 10.0.0.0/8
             push-route 192.168.0.0/16
             subnet 10.x.q.0/24
         }
         name-server x.x.x.x
         name-server y.y.y.y
         push-route 192.168.0.0/16
         push-route 10.0.0.0/8
         subnet 10.x.y.0/24
         topology point-to-point
     }
     tls {
         ca-cert-file /root/OpenVPN_CA.crt
         cert-file /root/openvpnsrv.crt
         dh-file /root/dh2048.pem
         key-file /root/openvpnsrv_key2.pem
     }
 }

I have a feeling It may be DDWRT IP tables related. (vyatta has no firewalls between lan/vtun0 yet). DDWRT comes with a lot of default rules.

Custom DDWRT rules (create a vanilla DDWRT chain, run all vtun0 traffic through it and pop a few ports

iptables -N VPN
iptables -F VPN
iptables -I INPUT -i tun0 -j VPN
iptables -I FORWARD -i tun0 -j VPN
iptables -A VPN -i tun0 -o br0 -j ACCEPT
iptables -I POSTROUTING -t nat -o tun0 -j RETURN
iptables -I VPN 1 -i tun0 -p tcp --dport 53 -j ACCEPT
iptables -I VPN 2 -i tun0 -p udp --dport 53 -j ACCEPT
iptables -I VPN 3 -i tun0 -p icmp -j ACCEPT
iptables -I VPN 4 -i tun0 -p tcp --dport 80 -j ACCEPT
iptables -I VPN 5 -i tun0 -p tcp --dport 22 -j ACCEPT
iptables -I VPN 6 -i tun0 -p tcp --dport 443 -j ACCEPT

The full ddrwt VPN firewall

Client Firewall

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
   20  2796 VPN        0    --  tun0   *       0.0.0.0/0            0.0.0.0/0
  346 92439 ACCEPT     0    --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
    0     0 DROP       udp  --  eth1   *       0.0.0.0/0            0.0.0.0/0           udp dpt:520
    0     0 DROP       udp  --  br0    *       0.0.0.0/0            0.0.0.0/0           udp dpt:520
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0           udp dpt:520
    0     0 DROP       icmp --  eth1   *       0.0.0.0/0            0.0.0.0/0
    0     0 DROP       2    --  *      *       0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     udp  --  eth1   *       0.0.0.0/0            0.0.0.0/0           udp dpt:5060
    1    74 ACCEPT     0    --  lo     *       0.0.0.0/0            0.0.0.0/0           state NEW
  248 21631 logaccept  0    --  br0    *       0.0.0.0/0            0.0.0.0/0           state NEW
   49  6897 DROP       0    --  *      *       0.0.0.0/0            0.0.0.0/0

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
  183 58894 VPN        0    --  tun0   *       0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     47   --  *      eth1    10.1.200.0/24        0.0.0.0/0
    0     0 ACCEPT     tcp  --  *      eth1    10.1.200.0/24        0.0.0.0/0           tcp dpt:1723
    0     0 ACCEPT     0    --  br0    br0     0.0.0.0/0            0.0.0.0/0
   54  2800 TCPMSS     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp flags:0x06/0x02 TCPMSS clamp to PMTU
  935  288K lan2wan    0    --  *      *       0.0.0.0/0            0.0.0.0/0
  867  282K ACCEPT     0    --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
    0     0 TRIGGER    0    --  eth1   br0     0.0.0.0/0            0.0.0.0/0           TRIGGER type:in match:0 relate:0
   68  5698 trigger_out  0    --  br0    *       0.0.0.0/0            0.0.0.0/0
   68  5698 ACCEPT     0    --  br0    *       0.0.0.0/0            0.0.0.0/0           state NEW
    0     0 DROP       0    --  *      *       0.0.0.0/0            0.0.0.0/0

Chain OUTPUT (policy ACCEPT 513 packets, 101K bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain VPN (2 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 ACCEPT     tcp  --  tun0   *       0.0.0.0/0            0.0.0.0/0           tcp dpt:53
    0     0 ACCEPT     udp  --  tun0   *       0.0.0.0/0            0.0.0.0/0           udp dpt:53
    2   120 ACCEPT     icmp --  tun0   *       0.0.0.0/0            0.0.0.0/0
    0     0 ACCEPT     tcp  --  tun0   *       0.0.0.0/0            0.0.0.0/0           tcp dpt:80
    0     0 ACCEPT     tcp  --  tun0   *       0.0.0.0/0            0.0.0.0/0           tcp dpt:22
    0     0 ACCEPT     tcp  --  tun0   *       0.0.0.0/0            0.0.0.0/0           tcp dpt:443
  181 58774 ACCEPT     0    --  tun0   br0     0.0.0.0/0            0.0.0.0/0

Chain advgrp_1 (0 references)
 pkts bytes target     prot opt in     out     source               destination

Chain advgrp_10 (0 references)
 pkts bytes target     prot opt in     out     source               destination

Chain advgrp_2 (0 references)
 pkts bytes target     prot opt in     out     source               destination

Chain advgrp_3 (0 references)
 pkts bytes target     prot opt in     out     source               destination

Chain advgrp_4 (0 references)
 pkts bytes target     prot opt in     out     source               destination

Chain advgrp_5 (0 references)
 pkts bytes target     prot opt in     out     source               destination

Chain advgrp_6 (0 references)
 pkts bytes target     prot opt in     out     source               destination

Chain advgrp_7 (0 references)
 pkts bytes target     prot opt in     out     source               destination

Chain advgrp_8 (0 references)
 pkts bytes target     prot opt in     out     source               destination

Chain advgrp_9 (0 references)
 pkts bytes target     prot opt in     out     source               destination

Chain grp_1 (0 references)
 pkts bytes target     prot opt in     out     source               destination

Chain grp_10 (0 references)
 pkts bytes target     prot opt in     out     source               destination

Chain grp_2 (0 references)
 pkts bytes target     prot opt in     out     source               destination

Chain grp_3 (0 references)
 pkts bytes target     prot opt in     out     source               destination

Chain grp_4 (0 references)
 pkts bytes target     prot opt in     out     source               destination

Chain grp_5 (0 references)
 pkts bytes target     prot opt in     out     source               destination

Chain grp_6 (0 references)
 pkts bytes target     prot opt in     out     source               destination

Chain grp_7 (0 references)
 pkts bytes target     prot opt in     out     source               destination

Chain grp_8 (0 references)
 pkts bytes target     prot opt in     out     source               destination

Chain grp_9 (0 references)
 pkts bytes target     prot opt in     out     source               destination

Chain lan2wan (1 references)
 pkts bytes target     prot opt in     out     source               destination

Chain logaccept (1 references)
 pkts bytes target     prot opt in     out     source               destination
  248 21631 ACCEPT     0    --  *      *       0.0.0.0/0            0.0.0.0/0

Chain logdrop (0 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DROP       0    --  *      *       0.0.0.0/0            0.0.0.0/0

Chain logreject (0 references)
 pkts bytes target     prot opt in     out     source               destination
    0     0 REJECT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp reject-with tcp-reset

Chain trigger_out (1 references)
 pkts bytes target     prot opt in     out     source               destination

Here is an example of what ICMP does when "Roaming Printers" is enabled.

64 bytes from 10.1.1.1: seq=16 ttl=64 time=40.862 ms
64 bytes from 10.1.1.1: seq=17 ttl=64 time=39.092 ms
64 bytes from 10.1.1.1: seq=18 ttl=64 time=40.135 ms
64 bytes from 10.1.1.1: seq=19 ttl=64 time=62.107 ms
64 bytes from 10.1.1.1: seq=20 ttl=64 time=41.330 ms
64 bytes from 10.1.1.1: seq=21 ttl=64 time=41.533 ms
64 bytes from 10.1.1.1: seq=22 ttl=64 time=38.375 ms
64 bytes from 10.1.1.1: seq=23 ttl=64 time=46.089 ms
64 bytes from 10.1.1.1: seq=24 ttl=64 time=41.163 ms
64 bytes from 10.1.1.1: seq=25 ttl=64 time=38.488 ms
64 bytes from 10.1.1.1: seq=26 ttl=64 time=49.573 ms
64 bytes from 10.1.1.1: seq=31 ttl=64 time=43.499 ms
64 bytes from 10.1.1.1: seq=32 ttl=64 time=35417.249 ms
64 bytes from 10.1.1.1: seq=33 ttl=64 time=34431.188 ms
64 bytes from 10.1.1.1: seq=34 ttl=64 time=33431.231 ms
64 bytes from 10.1.1.1: seq=35 ttl=64 time=32422.653 ms
64 bytes from 10.1.1.1: seq=36 ttl=64 time=31430.424 ms
64 bytes from 10.1.1.1: seq=37 ttl=64 time=30422.234 ms
64 bytes from 10.1.1.1: seq=38 ttl=64 time=29412.690 ms
64 bytes from 10.1.1.1: seq=39 ttl=64 time=28405.486 ms
64 bytes from 10.1.1.1: seq=40 ttl=64 time=27395.776 ms
64 bytes from 10.1.1.1: seq=41 ttl=64 time=26404.658 ms
64 bytes from 10.1.1.1: seq=67 ttl=64 time=147.224 ms
64 bytes from 10.1.1.1: seq=68 ttl=64 time=40.070 ms
64 bytes from 10.1.1.1: seq=69 ttl=64 time=41.228 ms
64 bytes from 10.1.1.1: seq=70 ttl=64 time=42.467 ms

ofrxnz

Sorry, and the logs.

Client (the route logs are because the route already exists and are working )

Jan 11 18:07:53 remote1 daemon.notice openvpn[1776]: OpenVPN 2.1.1 mips-unknown-linux-gnu [SSL] [LZO2] [EPOLL] built on Mar 24 2010
Jan 11 18:07:53 remote1 daemon.warn openvpn[1776]: WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Jan 11 18:07:53 remote1 daemon.notice openvpn[1776]: LZO compression initialized
Jan 11 18:07:53 remote1 daemon.warn openvpn[1776]: WARNING: normally if you use --mssfix and/or --fragment, you should also set --tun-mtu 1500 (currently it is 1418)
Jan 11 18:07:53 remote1 daemon.notice openvpn[1776]: Control Channel MTU parms [ L:1496 D:138 EF:38 EB:0 ET:0 EL:0 ]
Jan 11 18:07:53 remote1 daemon.notice openvpn[1776]: Data Channel MTU parms [ L:1496 D:1368 EF:46 EB:135 ET:32 EL:0 AF:3/1 ]
Jan 11 18:07:53 remote1 daemon.notice openvpn[1776]: Fragmentation MTU parms [ L:1496 D:1368 EF:45 EB:135 ET:33 EL:0 AF:3/1 ]
Jan 11 18:07:53 remote1 daemon.notice openvpn[1778]: Socket Buffers: R=[114688->131072] S=[114688->131072]
Jan 11 18:07:53 remote1 daemon.notice openvpn[1778]: UDPv4 link local: [undef]
Jan 11 18:07:53 remote1 daemon.notice openvpn[1778]: UDPv4 link remote: x.x.x.x:1194
Jan 11 18:07:53 remote1 daemon.notice openvpn[1778]: TLS: Initial packet from x..x.x.x:1194, sid=6782bbc2 249b63da
Jan 11 18:07:53 remote1 daemon.notice openvpn[1778]: VERIFY OK: depth=1, /CN=OpenVPN_CA
Jan 11 18:07:53 remote1 daemon.notice openvpn[1778]: VERIFY OK: depth=0, /CN=openvpnsrv
Jan 11 18:07:55 remote1 daemon.notice openvpn[1778]: Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Jan 11 18:07:55 remote1 daemon.notice openvpn[1778]: Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Jan 11 18:07:55 remote1 daemon.notice openvpn[1778]: Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Jan 11 18:07:55 remote1 daemon.notice openvpn[1778]: Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Jan 11 18:07:55 remote1 daemon.notice openvpn[1778]: Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Jan 11 18:07:55 remote1 daemon.notice openvpn[1778]: [openvpnsrv] Peer Connection Initiated with 66.83.9.130:1194
Jan 11 18:07:57 remote1 daemon.notice openvpn[1778]: SENT CONTROL [openvpnsrv]: 'PUSH_REQUEST' (status=1)
Jan 11 18:07:58 remote1 daemon.notice openvpn[1778]: PUSH: Received control message: 'PUSH_REPLY,dhcp-option DNS 192.168.x.x,dhcp-option DNS 192.168.x.x,route 192.168.0.0 255.255.0.0,route 10.0.0.0 255.0.0.0,topology p2p,ping 10,ping-restart 60,route 10.0.0.0 255.0.0
Jan 11 18:07:58 remote1 daemon.notice openvpn[1778]: OPTIONS IMPORT: timers and/or timeouts modified
Jan 11 18:07:58 remote1 daemon.notice openvpn[1778]: OPTIONS IMPORT: --ifconfig/up options modified
Jan 11 18:07:58 remote1 daemon.notice openvpn[1778]: OPTIONS IMPORT: route options modified
Jan 11 18:07:58 remote1 daemon.notice openvpn[1778]: OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Jan 11 18:07:58 remote1 daemon.notice openvpn[1778]: TUN/TAP device tun0 opened
Jan 11 18:07:58 remote1 daemon.notice openvpn[1778]: TUN/TAP TX queue length set to 100
Jan 11 18:07:58 remote1 daemon.notice openvpn[1778]: /sbin/ifconfig tun0 10.1.100.2 pointopoint 10.1.100.1 mtu 1418
Jan 11 18:07:58 remote1 daemon.notice openvpn[1778]: /sbin/route add -net 192.168.0.0 netmask 255.255.0.0 gw 10.1.100.1
Jan 11 18:07:58 remote1 daemon.warn openvpn[1778]: WARNING: potential route subnet conflict between local LAN [10.0.1.0/255.255.255.0] and remote VPN [10.0.0.0/255.0.0.0]
Jan 11 18:07:58 remote1 daemon.notice openvpn[1778]: /sbin/route add -net 10.0.0.0 netmask 255.0.0.0 gw 10.1.100.1
Jan 11 18:07:58 remote1 daemon.warn openvpn[1778]: WARNING: potential route subnet conflict between local LAN [10.0.1.0/255.255.255.0] and remote VPN [10.0.0.0/255.0.0.0]
Jan 11 18:07:58 remote1 daemon.notice openvpn[1778]: /sbin/route add -net 10.0.0.0 netmask 255.0.0.0 gw 10.1.100.1
Jan 11 18:07:58 remote1 daemon.warn openvpn[1778]: ERROR: Linux route add command failed: external program exited with error status: 1
Jan 11 18:07:58 remote1 daemon.notice openvpn[1778]: /sbin/route add -net 192.168.0.0 netmask 255.255.0.0 gw 10.1.100.1
Jan 11 18:07:58 remote1 daemon.warn openvpn[1778]: ERROR: Linux route add command failed: external program exited with error status: 1
Jan 11 18:07:58 remote1 daemon.notice openvpn[1778]: Initialization Sequence Completed

Server

Jan 11 18:07:53 PRI-RDU-R01 openvpn[22006]: openvpnclienta/174.97.158.93:32770 TLS: new session incoming connection from [AF_INET]174.97.158.93:32770
Jan 11 18:07:55 PRI-RDU-R01 openvpn[22006]: openvpnclienta/174.97.158.93:32770 VERIFY OK: depth=1, /CN=OpenVPN_CA
Jan 11 18:07:55 PRI-RDU-R01 openvpn[22006]: openvpnclienta/174.97.158.93:32770 VERIFY OK: depth=0, /CN=openvpnclienta
Jan 11 18:07:55 PRI-RDU-R01 openvpn[22006]: openvpnclienta/174.97.158.93:32770 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Jan 11 18:07:55 PRI-RDU-R01 openvpn[22006]: openvpnclienta/174.97.158.93:32770 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Jan 11 18:07:55 PRI-RDU-R01 openvpn[22006]: openvpnclienta/174.97.158.93:32770 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Jan 11 18:07:55 PRI-RDU-R01 openvpn[22006]: openvpnclienta/174.97.158.93:32770 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Jan 11 18:07:55 PRI-RDU-R01 openvpn[22006]: openvpnclienta/174.97.158.93:32770 TLS: move_session: dest=TM_ACTIVE src=TM_UNTRUSTED reinit_src=1
Jan 11 18:07:55 PRI-RDU-R01 openvpn[22006]: openvpnclienta/174.97.158.93:32770 TLS: tls_multi_process: untrusted session promoted to semi-trusted
Jan 11 18:07:55 PRI-RDU-R01 openvpn[22006]: openvpnclienta/174.97.158.93:32770 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Jan 11 18:07:58 PRI-RDU-R01 openvpn[22006]: openvpnclienta/174.97.158.93:32770 PUSH: Received control message: 'PUSH_REQUEST'
Jan 11 18:07:58 PRI-RDU-R01 openvpn[22006]: openvpnclienta/174.97.158.93:32770 SENT CONTROL [openvpnclienta]: 'PUSH_REPLY,dhcp-option DNS 192.168.x.x,dhcp-option DN$
Jan 11 18:08:00 PRI-RDU-R01 openvpn[22006]: openvpnclienta/174.97.158.93:32770 MULTI: Learn: 10.1.200.144 -> openvpnclienta/174.97.158.93:32770

ofrxnz

Ok, so i flushed all rules and chains on the DDWRT (Client Side) and still the same result,

Though, it does recover faster. So, it seems IP tables was hurting but not the source of the issue.

On the server side, i have confirmed there are no effective firewall rules or things like snort on any of the effected interfaces.

I am only left with an OpenVPN issue which perplexes me since it should be all or nothing.

Adam

ofrxnz

This is not an OpenVPN issue. It is an IPTables issue.

DDWRT comes with a ton of built in firewall rules that took some extra slicing to get through.

Here is the mostly working "bonus" firewall rules.

iptables -N VPN
iptables -F VPN
iptables -I INPUT -i tun0 -j VPN
iptables -I FORWARD -i tun0 -j VPN
iptables -A VPN -i tun0 -o br0 -j ACCEPT
iptables -I POSTROUTING -t nat -o tun0 -j RETURN
iptables -I VPN 1 -i tun0 -p tcp --dport 53 -j ACCEPT
iptables -I VPN 2 -i tun0 -p udp --dport 53 -j ACCEPT
iptables -I VPN 3 -i tun0 -p icmp -j ACCEPT
iptables -I VPN 4 -i tun0 -p tcp --dport 80 -j ACCEPT
iptables -I VPN 5 -i tun0 -p tcp --dport 22 -j ACCEPT
iptables -I VPN 6 -i tun0 -p tcp --dport 443 -j ACCEPT
iptables -t nat -I POSTROUTING -o tun0 -j ACCEPT
iptables -t nat -I PREROUTING -i tun0 -j ACCEPT