Client failed to resume after server restart.

SashaSapkhoshin

I have server-client configuration, "star" topology, privileges drop enabled. After clean start it works, renegotiations procedures are successful (every hour), ping is going well. But after I have to restart manually "server" instance of OpenVPN, "client" can not resume connection - ping stops. After subsequent client's daemon restart connection become healthy.

How to eliminate this?

Versions on both ends:
OS is CentOS 6.2 with up to date upgrades,
OpenVPN is 2.2.1-1.el6 from repository.

Here is address of Zip with logs, configurations, etc:
http://ubuntuone.com/1oleVtxUOL6QJWLjGPjO8r , size 28KB
Inside it there are files. Here is list of them.
Server configuration files:

devServerName.nix.ovpn
ccd-devServerName/devClientCN00

Client configuration file:

devServerName-devClientCN00.nix.ovpn

Sequence of actions in terminal, marked with "---> N <". For server and client start-stop time:

cli-commands.txt

Logs:

server.log
client.log

List of files attributes:

file-access-attr.txt

All SSL staff is not a secret (it was produced for "testing"), I can publish it, if there is a sence.

Below are placed only configuration files.

Server:

dev-type	tun
dev		devServerName
lport 33033
proto udp
server            10.20.30.0 255.255.255.0
push              "route 10.20.30.0 255.255.255.0"
client-config-dir "ccd-devServerName"
tls-server
dh                "ssl-devServerName/dh2048-devServerName.pem"
ca                "ssl-devServerName/CA_cert.pem"
cert              "ssl-devServerName/certs/devServerName.pem"
key               "ssl-devServerName/keys/devServerName.pem"
crl-verify        "/opt/ovpn/ssl-devServerName/crl/crl.pem"
tls-auth          "ssl-devServerName/devServerName.hmac.key" 0
comp-lzo
keepalive         30 10800
tun-mtu           1500
mssfix            1450
persist-key
persist-tun
user             openvpn
group            openvpn
daemon openvpn_devServerName
verb              6

Client:

client
dev-type      tun
dev           devServerName
proto         udp
remote        192.168.56.101
rport         33033
tls-client
tls-remote    devServerName
ca            "/opt/ovpn/ssl-devServerName-devClientCN00/CA_cert.pem"
cert          "/opt/ovpn/ssl-devServerName-devClientCN00/C_devServerName_devClientCN00.pem"
key           "/opt/ovpn/ssl-devServerName-devClientCN00/K_devServerName_devClientCN00.pem"
tls-auth      "/opt/ovpn/ssl-devServerName-devClientCN00/devServerName.hmac.key" 1
ns-cert-type  server
comp-lzo
tun-mtu       1500
mssfix        1450
persist-key
persist-tun
user             openvpn
group            openvpn
daemon           openvpn_devServerName_devClientCN00
verb             6

SashaSapkhoshin

Tried tcpdump and pings from client to server.

I see that at error state pings are sent out inside tunnel via OVPN interface from client. But I do not see them on server side. Also, UDP traffic generated by OVPN itself have only one direction from client to server.

Server:

[root@centos-srv ~]# tcpdump -n -i eth1 "port 33033"
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth1, link-type EN10MB (Ethernet), capture size 65535 bytes
12:14:39.553158 IP 192.168.56.102.openvpn > 192.168.56.101.33033: UDP, length 125
12:14:40.554511 IP 192.168.56.102.openvpn > 192.168.56.101.33033: UDP, length 125
...
[root@centos-srv ~]# tcpdump -n -i devServerName
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on devServerName, link-type RAW (Raw IP), capture size 65535 bytes
^C
0 packets captured
0 packets received by filter
0 packets dropped by kernel

[root@centos-srv ~]# iptables -S
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
[root@centos-srv ~]#

Client:

[root@centos-clnt ovpn]# tcpdump -i eth3 "port 33033"
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth3, link-type EN10MB (Ethernet), capture size 65535 bytes
12:17:10.233885 IP 192.168.56.102.openvpn > 192.168.56.101.33033: UDP, length 125
12:17:11.234401 IP 192.168.56.102.openvpn > 192.168.56.101.33033: UDP, length 125
...

[root@centos-clnt ovpn]# tcpdump -i devServerName
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on devServerName, link-type RAW (Raw IP), capture size 65535 bytes
12:16:21.224161 IP 10.20.30.6 > 10.20.30.1: ICMP echo request, id 53768, seq 909, length 64
12:16:22.224543 IP 10.20.30.6 > 10.20.30.1: ICMP echo request, id 53768, seq 910, length 64
...

[root@centos-clnt ovpn]# iptables -S
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
[root@centos-clnt ovpn]#

simai

i think