handshake failed and move_session TM_LAME_DUCK

fero

Hello,

after some digging in your forums and Google, I decide to post here a specific question regarding LAME_DUCK connection which is the one that I think is giving to me weird problems.

I have an UDP based VPN with 10 clients which are (damn) proprietary devices
that supports OpenVPN (client version 2.0.5) and they must ever connected to the network.
I think OpenVPN should be good to reach this result.(what do you think?)
These clients send continuosly some data to the server.

These devices have both ethernet and gprs connection.

I prefer to connect them via ethernet when I can, unfortunately (and strangely)
with ethernet connection I experience this weird problem that I don't experience with gprs connection.

OpenVPN renegotiate keys every hour. This seems to work well almost everytime,
but sometime, it seems that it fails with these messages:

1 17:39:30 [5466]XXXX1-12345 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
1 17:39:30 [5466]XXXX1-12345 TLS Error: TLS handshake failed
1 17:39:30 [5466]XXXX1-12345 TLS: move_session: dest=TM_LAME_DUCK src=TM_ACTIVE reinit_src=1
1 17:40:45 [5466]XXXX1-12345 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
1 17:40:45 [5466]XXXX1-12345 TLS Error: TLS handshake failed
1 17:41:27 [5466]XXXX1-12345 [UNDEF] Inactivity timeout (--ping-restart), restarting
1 17:41:27 [5466]XXXX1-12345 SIGUSR1[soft,ping-restart] received, client-instance restarting

Other times renegotiation occurs correctly, but there is no mention of TLS timeout error and this TM_LAME_DUCK stuff.
Now I upgraded OpenVPN to latest Debian package from OpenVPN repos (thank for this! I use squeeze),
I augmented server logging to "verb 6" and I see if it happens again.
I have also set 'reneg-sec 0' to see how clients are configured.

Is it a standard OpenVPN behaviour to stop trying when client is diconnected from ethernet?
I think also that clients are not disconnected...
Furthermore I had another client (which is a new and open embedded device)
which after some successful connections didn't succeed anymore with the same problem.
In that case it could be also an hardware problem or a compilation problem.

I read about what a lame duck is (interesting 😉)
http://openvpn.net/archive/openvpn-users/2002-10/msg00010.html

Invocation of move_session function is in tls_multi_process
https://community.openvpn.net/openvpn/browser/ssl.c?rev=db3fb3d489df234c78ddcb9fce66de4d8fbb28e6#L4268
and I see that for getting TLS exiting message I have to set "verb 9" that I'd like to avoid.

I cannot go deeper than this alone, help me please

Follows server configuration and logs verb 3
tia
Luca aka fero

dev tun1
proto udp
port 1195
management localhost 7595

# Our up script will establish routes
# once the VPN is alive.
up ./net.up
script-security 2

# This is useful for server configuration, but ip allocation is done through client-config-dir directive
server 172.20.0.0 255.255.128.0 nopool

client-connect ./client-connected.sh
client-disconnect ./client-disconnected.sh
client-config-dir ccd

push "route 172.20.128.0 255.255.128.0"
push "route 172.20.1.1 255.255.255.255"
push "dhcp-option DNS 172.20.1.1"
push "dhcp-option DOMAIN aaaaa.bbbbb.com"

# Diffie-Hellman Parameters (tls-server only)
dh /etc/openvpn/dh1024.pem

ca /ca.crt
cert /f.crt
key /f.key

keepalive 10 90
ping 10 #I read that this is not useful if I have set keepalive, so in new version (with reneg-sec 0) I removed it
ping-restart 90 #I read that this is not useful if I have set keepalive, so in new version (with reneg-sec 0) I removed it
user openvpnmon
group openvpnmon

comp-lzo
persist-tun
persist-key
verb 6

1 07:37:23 [5466]XXXX1-12345 TLS: tls_process: killed expiring key
1 07:37:36 [5466]XXXX1-12345 VERIFY OK: depth=1, /xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
1 07:37:36 [5466]XXXX1-12345 VERIFY OK: depth=0, /xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
1 07:37:36 [5466]XXXX1-12345 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
1 07:37:36 [5466]XXXX1-12345 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
1 07:37:36 [5466]XXXX1-12345 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
1 07:37:36 [5466]XXXX1-12345 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
1 07:37:36 [5466]XXXX1-12345 Control Channel: TLSv1, cipher TLSv1/SSLv3 EDH-RSA-DES-CBC3-SHA, 1024 bit RSA
1 08:37:29 [5466]XXXX1-12345 TLS: tls_process: killed expiring key
1 08:37:36 [5466]XXXX1-12345 TLS: soft reset sec=0 bytes=6593316/0 pkts=29479/0
1 08:37:42 [5466]XXXX1-12345 VERIFY OK: depth=1, /xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
1 08:37:42 [5466]XXXX1-12345 VERIFY OK: depth=0, /xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
1 08:37:42 [5466]XXXX1-12345 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
1 08:37:42 [5466]XXXX1-12345 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
1 08:37:42 [5466]XXXX1-12345 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
1 08:37:42 [5466]XXXX1-12345 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
1 08:37:42 [5466]XXXX1-12345 Control Channel: TLSv1, cipher TLSv1/SSLv3 EDH-RSA-DES-CBC3-SHA, 1024 bit RSA
1 09:37:36 [5466]XXXX1-12345 TLS: tls_process: killed expiring key
1 09:37:42 [5466]XXXX1-12345 TLS: soft reset sec=0 bytes=6626814/0 pkts=29539/0
1 09:37:48 [5466]XXXX1-12345 VERIFY OK: depth=1, /xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
1 09:37:48 [5466]XXXX1-12345 VERIFY OK: depth=0, /xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
1 09:37:48 [5466]XXXX1-12345 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
1 09:37:48 [5466]XXXX1-12345 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
1 09:37:48 [5466]XXXX1-12345 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
1 09:37:48 [5466]XXXX1-12345 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
1 09:37:48 [5466]XXXX1-12345 Control Channel: TLSv1, cipher TLSv1/SSLv3 EDH-RSA-DES-CBC3-SHA, 1024 bit RSA
1 10:37:42 [5466]XXXX1-12345 TLS: tls_process: killed expiring key
1 10:37:48 [5466]XXXX1-12345 TLS: soft reset sec=0 bytes=6638288/0 pkts=29721/0
1 10:37:54 [5466]XXXX1-12345 VERIFY OK: depth=1, /xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
1 10:37:54 [5466]XXXX1-12345 VERIFY OK: depth=0, /xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
1 10:37:54 [5466]XXXX1-12345 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
1 10:37:54 [5466]XXXX1-12345 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
1 10:37:54 [5466]XXXX1-12345 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
1 10:37:54 [5466]XXXX1-12345 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
1 10:37:54 [5466]XXXX1-12345 Control Channel: TLSv1, cipher TLSv1/SSLv3 EDH-RSA-DES-CBC3-SHA, 1024 bit RSA
1 11:37:48 [5466]XXXX1-12345 TLS: tls_process: killed expiring key
1 11:38:00 [5466]XXXX1-12345 VERIFY OK: depth=1, /xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
1 11:38:00 [5466]XXXX1-12345 VERIFY OK: depth=0, /xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
1 11:38:00 [5466]XXXX1-12345 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
1 11:38:00 [5466]XXXX1-12345 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
1 11:38:00 [5466]XXXX1-12345 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
1 11:38:00 [5466]XXXX1-12345 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
1 11:38:00 [5466]XXXX1-12345 Control Channel: TLSv1, cipher TLSv1/SSLv3 EDH-RSA-DES-CBC3-SHA, 1024 bit RSA
1 12:37:54 [5466]XXXX1-12345 TLS: tls_process: killed expiring key
1 12:38:00 [5466]XXXX1-12345 TLS: soft reset sec=0 bytes=7136622/0 pkts=31374/0
1 12:38:06 [5466]XXXX1-12345 VERIFY OK: depth=1, /xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
1 12:38:06 [5466]XXXX1-12345 VERIFY OK: depth=0, /xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
1 12:38:06 [5466]XXXX1-12345 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
1 12:38:06 [5466]XXXX1-12345 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
1 12:38:06 [5466]XXXX1-12345 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
1 12:38:06 [5466]XXXX1-12345 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
1 12:38:06 [5466]XXXX1-12345 Control Channel: TLSv1, cipher TLSv1/SSLv3 EDH-RSA-DES-CBC3-SHA, 1024 bit RSA
1 13:38:00 [5466]XXXX1-12345 TLS: tls_process: killed expiring key
1 13:38:06 [5466]XXXX1-12345 TLS: soft reset sec=0 bytes=7123818/0 pkts=31483/0
1 13:38:12 [5466]XXXX1-12345 VERIFY OK: depth=1, /xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
1 13:38:12 [5466]XXXX1-12345 VERIFY OK: depth=0, /xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
1 13:38:12 [5466]XXXX1-12345 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
1 13:38:12 [5466]XXXX1-12345 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
1 13:38:12 [5466]XXXX1-12345 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
1 13:38:12 [5466]XXXX1-12345 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
1 13:38:12 [5466]XXXX1-12345 Control Channel: TLSv1, cipher TLSv1/SSLv3 EDH-RSA-DES-CBC3-SHA, 1024 bit RSA
1 14:38:07 [5466]XXXX1-12345 TLS: tls_process: killed expiring key
1 14:38:12 [5466]XXXX1-12345 TLS: soft reset sec=0 bytes=7102417/0 pkts=31460/0
1 14:38:18 [5466]XXXX1-12345 VERIFY OK: depth=1, /xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
1 14:38:18 [5466]XXXX1-12345 VERIFY OK: depth=0, /xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
1 14:38:18 [5466]XXXX1-12345 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
1 14:38:18 [5466]XXXX1-12345 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
1 14:38:18 [5466]XXXX1-12345 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
1 14:38:18 [5466]XXXX1-12345 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
1 14:38:18 [5466]XXXX1-12345 Control Channel: TLSv1, cipher TLSv1/SSLv3 EDH-RSA-DES-CBC3-SHA, 1024 bit RSA
1 15:38:12 [5466]XXXX1-12345 TLS: tls_process: killed expiring key
1 15:38:18 [5466]XXXX1-12345 TLS: soft reset sec=0 bytes=7118824/0 pkts=31428/0
1 15:38:24 [5466]XXXX1-12345 VERIFY OK: depth=1, /xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
1 15:38:24 [5466]XXXX1-12345 VERIFY OK: depth=0, /xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
1 15:38:24 [5466]XXXX1-12345 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
1 15:38:24 [5466]XXXX1-12345 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
1 15:38:24 [5466]XXXX1-12345 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
1 15:38:24 [5466]XXXX1-12345 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
1 15:38:24 [5466]XXXX1-12345 Control Channel: TLSv1, cipher TLSv1/SSLv3 EDH-RSA-DES-CBC3-SHA, 1024 bit RSA
1 16:38:18 [5466]XXXX1-12345 TLS: tls_process: killed expiring key
1 16:38:30 [5466]XXXX1-12345 VERIFY OK: depth=1, /xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
1 16:38:30 [5466]XXXX1-12345 VERIFY OK: depth=0, /xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
1 16:38:30 [5466]XXXX1-12345 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
1 16:38:30 [5466]XXXX1-12345 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
1 16:38:30 [5466]XXXX1-12345 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
1 16:38:30 [5466]XXXX1-12345 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
1 16:38:30 [5466]XXXX1-12345 Control Channel: TLSv1, cipher TLSv1/SSLv3 EDH-RSA-DES-CBC3-SHA, 1024 bit RSA
1 17:38:24 [5466]XXXX1-12345 TLS: tls_process: killed expiring key
1 17:38:30 [5466]XXXX1-12345 TLS: soft reset sec=0 bytes=7041942/0 pkts=31345/0
1 17:39:30 [5466]XXXX1-12345 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
1 17:39:30 [5466]XXXX1-12345 TLS Error: TLS handshake failed
1 17:39:30 [5466]XXXX1-12345 TLS: move_session: dest=TM_LAME_DUCK src=TM_ACTIVE reinit_src=1
1 17:40:45 [5466]XXXX1-12345 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
1 17:40:45 [5466]XXXX1-12345 TLS Error: TLS handshake failed
1 17:41:27 [5466]XXXX1-12345 [UNDEF] Inactivity timeout (--ping-restart), restarting
1 17:41:27 [5466]XXXX1-12345 SIGUSR1[soft,ping-restart] received, client-instance restarting

------- other device ------

2 03:39:37 [5466]XXXXX-22222 TLS: tls_process: killed expiring key
2 03:39:44 [5466]XXXXX-22222 TLS: soft reset sec=0 bytes=474817/0 pkts=2859/0
2 03:39:50 [5466]XXXXX-22222 VERIFY OK: depth=1, /xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
2 03:39:50 [5466]XXXXX-22222 VERIFY OK: depth=0, /xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
2 03:39:50 [5466]XXXXX-22222 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
2 03:39:50 [5466]XXXXX-22222 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
2 03:39:50 [5466]XXXXX-22222 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
2 03:39:50 [5466]XXXXX-22222 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
2 03:39:51 [5466]XXXXX-22222 Control Channel: TLSv1, cipher TLSv1/SSLv3 EDH-RSA-DES-CBC3-SHA, 1024 bit RSA
2 04:39:44 [5466]XXXXX-22222 TLS: tls_process: killed expiring key
2 04:39:56 [5466]XXXXX-22222 VERIFY OK: depth=1, /xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
2 04:39:56 [5466]XXXXX-22222 VERIFY OK: depth=0, /xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
2 04:39:56 [5466]XXXXX-22222 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
2 04:39:56 [5466]XXXXX-22222 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
2 04:39:56 [5466]XXXXX-22222 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
2 04:39:56 [5466]XXXXX-22222 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
2 04:39:57 [5466]XXXXX-22222 Control Channel: TLSv1, cipher TLSv1/SSLv3 EDH-RSA-DES-CBC3-SHA, 1024 bit RSA
2 05:39:50 [5466]XXXXX-22222 TLS: tls_process: killed expiring key
2 05:40:02 [5466]XXXXX-22222 VERIFY OK: depth=1, /xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
2 05:40:02 [5466]XXXXX-22222 VERIFY OK: depth=0, /xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
2 05:40:02 [5466]XXXXX-22222 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
2 05:40:02 [5466]XXXXX-22222 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
2 05:40:02 [5466]XXXXX-22222 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
2 05:40:02 [5466]XXXXX-22222 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
2 05:40:02 [5466]XXXXX-22222 Control Channel: TLSv1, cipher TLSv1/SSLv3 EDH-RSA-DES-CBC3-SHA, 1024 bit RSA
2 06:39:56 [5466]XXXXX-22222 TLS: tls_process: killed expiring key
2 06:40:02 [5466]XXXXX-22222 TLS: soft reset sec=0 bytes=474791/0 pkts=2862/0
2 06:40:08 [5466]XXXXX-22222 VERIFY OK: depth=1, /xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
2 06:40:08 [5466]XXXXX-22222 VERIFY OK: depth=0, /xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
2 06:40:08 [5466]XXXXX-22222 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
2 06:40:08 [5466]XXXXX-22222 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
2 06:40:08 [5466]XXXXX-22222 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
2 06:40:08 [5466]XXXXX-22222 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
2 06:40:08 [5466]XXXXX-22222 Control Channel: TLSv1, cipher TLSv1/SSLv3 EDH-RSA-DES-CBC3-SHA, 1024 bit RSA
2 07:40:02 [5466]XXXXX-22222 TLS: tls_process: killed expiring key
2 07:40:08 [5466]XXXXX-22222 TLS: soft reset sec=0 bytes=474045/0 pkts=2860/0
2 07:40:14 [5466]XXXXX-22222 VERIFY OK: depth=1, /xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
2 07:40:14 [5466]XXXXX-22222 VERIFY OK: depth=0, /xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
2 07:40:14 [5466]XXXXX-22222 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
2 07:40:14 [5466]XXXXX-22222 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
2 07:40:14 [5466]XXXXX-22222 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
2 07:40:14 [5466]XXXXX-22222 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
2 07:40:14 [5466]XXXXX-22222 Control Channel: TLSv1, cipher TLSv1/SSLv3 EDH-RSA-DES-CBC3-SHA, 1024 bit RSA
2 08:40:08 [5466]XXXXX-22222 TLS: tls_process: killed expiring key
2 08:40:14 [5466]XXXXX-22222 TLS: soft reset sec=0 bytes=473467/0 pkts=2861/0
2 08:41:14 [5466]XXXXX-22222 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
2 08:41:14 [5466]XXXXX-22222 TLS Error: TLS handshake failed
2 08:41:14 [5466]XXXXX-22222 TLS: move_session: dest=TM_LAME_DUCK src=TM_ACTIVE reinit_src=1
2 08:42:29 [5466]XXXXX-22222 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
2 08:42:29 [5466]XXXXX-22222 TLS Error: TLS handshake failed
2 08:43:11 [5466]XXXXX-22222 [UNDEF] Inactivity timeout (--ping-restart), restarting
2 08:43:11 [5466]XXXXX-22222 SIGUSR1[soft,ping-restart] received, client-instance restarting

fero

anyone experienced this problem or do you think I am totally in wrong path ?!?

TIA
fero

eirirlar

I've got the same issue (lame duck etc). Seems we have similar clients. Im running Android 2.3.4 modified with openvpn 2 and only gprs, no wlan. I also have another client, windows and gprs. Sometimes the connection stays up a good while, but eventually the connection always goes down in the way you describe. Super annoying and absolutely unusable for my users.

One thing Ive noticed on the server, which is windows server 2003, is that the subnet mask is 255.255.255.252. This mask is only intended for one-client-one-server setups according to wikipedia. Could it be a possible cause? If so, how do I change it?

-Eirik

Mimiko

What do you mean by

prefer to connect them via ethernet when I can

Do you have an ethernet socket in your mobile? I doubt it. Please explain.

"reneg-sec 0" will stop key renegotiation, which will drop those messages. Unfortunally, stock Android 2.x is buggy in working with OpenVPN. Does not know about Android 4 stability yet.