Large packets stop working when transferring big data

Need help configuring your VPN? Just post here and you'll get that help.
Forum rules
Please use the [oconf] BB tag for openvpn Configurations. See https://forums.openvpn.net/viewtopic.php?f=30&t=21589 for an example.
michael.uray
OpenVpn Newbie
Posts: 7
Joined: Wed Jan 11, 2017 3:06 pm

Large packets stop working when transferring big data

Postby michael.uray » Wed Jan 11, 2017 3:54 pm

Hi guys,

maybe you can help me out with my issue here.

At first I had a MTU problem that larger packages did not go through, but I was able to fix this with "mssfix".

Now in general larger packets go through the connection (ping test size 1600), but as soon as I start transferring a bigger amount of data over this connection (e.g. VNC remote control via TCP) the maximum size of the possible packets drops down to 1406 bytes (or down to 1326 bytes on another connection).

After about one minute past the big data transfer the large packets start working again.

My connection way looks like this:
Client1 -> Server (iptables, no client-to-client) -> Client2

Server, Debian, OpenVPN 2.2.1
Server
port 1194
proto udp
dev tun
ca certs/SRV01_-_CA.crt
cert certs/SRV01_VPN1_VPN_Server.crt
key certs/SRV01_VPN1_VPN_Server.key
dh dh1024.pem
server 10.101.0.0 255.255.0.0
ifconfig-pool-persist ipp.txt
duplicate-cn
keepalive 10 60
tls-auth ta.key 0 # This file is secret
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
float
status openvpn-status.log 1
status-version 3
log-append /var/log/openvpn/server.log
verb 3
plugin /usr/lib/openvpn/openvpn-auth-ldap.so /etc/openvpn/auth/auth-ldap.conf
username-as-common-name
script-security 2
client-connect /etc/openvpn/scripts/client_connect.sh
client-disconnect /etc/openvpn/scripts/client_disconnect.sh
route 10.1.0.0 255.255.0.0
route 10.100.0.0 255.255.0.0
management 127.0.0.1 2222
mssfix


Client, Windows, OpenVPN 2.3.4
Client
client
dev tun
proto udp
remote secret.com 1194
resolv-retry infinite
nobind
persist-key
persist-tun
float
ca SRV01_-_CA.crt
cert SRV01_VPN1_VPN_Client.crt
key SRV01_VPN1_VPN_Client.key
tls-auth SRV01_VPN1_VPN_ta.key 1
ns-cert-type server
verb 3
auth-user-pass SRV01_VPN1_VPN_Auth.txt
comp-lzo
mssfix
explicit-exit-notify 3
route 0.0.0.0 0.0.0.0
route-metric 512


Large packets stop working (timeout):
Image

Large packets start working again:
Image

Have you guys any idea, where this problem could come from?

Best wishes
Michael

User avatar
TinCanTech
I should be on the dev team.
Posts: 1891
Joined: Fri Jun 03, 2016 1:17 pm

Re: Large packets stop working when transferring big data

Postby TinCanTech » Wed Jan 11, 2017 4:40 pm

michael.uray wrote:Server, Debian, OpenVPN 2.2.1
Built on 08-May-2013 ... is your Debian box likewise as out-of-date as openvpn ?

https://community.openvpn.net/openvpn/wiki/OpenvpnSoftwareRepos

michael.uray
OpenVpn Newbie
Posts: 7
Joined: Wed Jan 11, 2017 3:06 pm

Re: Large packets stop working when transferring big data

Postby michael.uray » Wed Jan 11, 2017 6:59 pm

TinCanTech wrote:Built on 08-May-2013 ... is your Debian box likewise as out-of-date as openvpn ?

Thanks for the hint.

Debian is V 7 (Wheezy) and it is up to date.

I did update the VPN server as well as the two clients to the current OpenVPN version 2.4, but unfortunately is the problem still present.

Maybe any other ideas?

User avatar
TinCanTech
I should be on the dev team.
Posts: 1891
Joined: Fri Jun 03, 2016 1:17 pm

Re: Large packets stop working when transferring big data

Postby TinCanTech » Wed Jan 11, 2017 8:12 pm

Unless you know details about all of the intermediate networks over which your VPN traverses, I would go back to the default values. ie: Do not mess about with MTU. See how that works.

michael.uray
OpenVpn Newbie
Posts: 7
Joined: Wed Jan 11, 2017 3:06 pm

Re: Large packets stop working when transferring big data

Postby michael.uray » Wed Jan 11, 2017 9:41 pm

TinCanTech wrote:Unless you know details about all of the intermediate networks over which your VPN traverses, I would go back to the default values. ie: Do not mess about with MTU. See how that works.

The connections between the client and the server goes through the Internet so I actually know nothing about it.

What do you mean with "back to the default"?

The only thing what I added regarding the MTU problem was the option "mssfix".
Before that a ping with a length of 1600 was not possible at all.

User avatar
TinCanTech
I should be on the dev team.
Posts: 1891
Joined: Fri Jun 03, 2016 1:17 pm

Re: Large packets stop working when transferring big data

Postby TinCanTech » Wed Jan 11, 2017 11:22 pm

michael.uray wrote:Before that a ping with a length of 1600 was not possible at all.
Good .. probably because you have standard MTU of 1500 .. I have no idea how you managed to force that up to 1600 ..

anybody else :?:

TiTex
OpenVPN Power User
Posts: 114
Joined: Tue Apr 12, 2011 6:22 am

Re: Large packets stop working when transferring big data

Postby TiTex » Thu Jan 12, 2017 8:36 am

No idea , i never had to mess around with mssfix,sndbuf,rcvbuf,etc

michael.uray
OpenVpn Newbie
Posts: 7
Joined: Wed Jan 11, 2017 3:06 pm

Re: Large packets stop working when transferring big data

Postby michael.uray » Thu Jan 12, 2017 9:45 am

TinCanTech wrote:Good .. probably because you have standard MTU of 1500 .. I have no idea how you managed to force that up to 1600 ..


Just to prevent any misunderstandings:
The max. MTU size for the VPN packets and in consequence for the packets in the tunnel varies depending on the site where the client is installed.
When I am writing about a ping of 1600 bytes which is possible / not possible, then I mean that fragmenting is working or not.

Without the mssfix option a ping with a length of 1600 is not possible at all.
With the mssfix option the ping with a length of 1600 works, but it stops working for about one minute when more data gets transferred via the tunnel at the same time. - It is also not a bandwidth problem, because one byte more or less doesn't work or does work in this situation.

When a ping with 1600 goes through the tunnel then it gets fragmented for sure and I actually want to test with it if the fragmentation works properly.

User avatar
TinCanTech
I should be on the dev team.
Posts: 1891
Joined: Fri Jun 03, 2016 1:17 pm

Re: Large packets stop working when transferring big data

Postby TinCanTech » Thu Jan 12, 2017 12:03 pm

Please post your client and server logs at --verb 4 .. leave the vpn running for a few minutes and do your pings then post the logs.

User avatar
TinCanTech
I should be on the dev team.
Posts: 1891
Joined: Fri Jun 03, 2016 1:17 pm

Re: Large packets stop working when transferring big data

Postby TinCanTech » Thu Jan 12, 2017 12:06 pm

michael.uray wrote:client
..
route 0.0.0.0 0.0.0.0
Try using --redirect-gateway option .. which is designed to do this properly.

michael.uray
OpenVpn Newbie
Posts: 7
Joined: Wed Jan 11, 2017 3:06 pm

Re: Large packets stop working when transferring big data

Postby michael.uray » Thu Jan 12, 2017 1:31 pm

TinCanTech wrote:
michael.uray wrote:client
..
route 0.0.0.0 0.0.0.0
Try using --redirect-gateway option .. which is designed to do this properly.

I actually do not want to use this connection as default gateway, but it is required to have a default gateway on this connection that the Windows firewall can assign it to a firewall zone. This is also the reason why the metric is set to 512.
It should not related to this problem.

FYI, this is something what is described more in the detail on the following page:
http://asktheoracle.com/blog/how-to-mak ... -firewall/

TinCanTech wrote:Please post your client and server logs at --verb 4 .. leave the vpn running for a few minutes and do your pings then post the logs.


I did a ping test (size 1600) from client1 -> server (via iptables, no client-to-client) -> client2 and opened then a VNC connection from client1 to client2 which caused the interruptions of the ping for about 1 minute.

I did it 5 times and I only got two times the message "PID_ERR replay-window backtrack occurred" on the client1.
No messages on the server and on client2, the verbose level was on 5.

When the ping with larger packages stops working on the client1, then the ping with larger packages to the client2 on the server stops at the same time.

michael.uray
OpenVpn Newbie
Posts: 7
Joined: Wed Jan 11, 2017 3:06 pm

Re: Large packets stop working when transferring big data

Postby michael.uray » Mon Jan 16, 2017 10:50 am

Am actually using the VPN connection on the following way, where the problem with the large packets occurs:
"Client1 (Windows) -> Server (Debian, iptables, no client-to-client) -> Client2 (OpenWRT) -> Host x"

It is also possible for me to connect directly "Client1 (Windows) -> Client2 (OpenWRT) -> Host x" without the server in the middle which acts as VPN concentrator.
Client2 is in this case actually a "server".
On this way the problem does not occur and so I am wondering what could be wrong with the server in the middle (Debian 8 / Jessie, OpenVPN 2.4.0, iptables v1.4.21) or what is different with its configuration compared to the direct client1 -> client2 connection.

The following configuration is used for my "Client1 -> Client2" direct connection:

Client1 Config
client
dev tun
proto udp
remote secret.com 1194
resolv-retry infinite
nobind
persist-key
persist-tun
float
ca ca.crt
cert client.crt
key client.key
ns-cert-type server
verb 3


Client2 Config - which is actually server
server 10.100.54.0 255.255.255.0
proto udp
dev tun
ca CA.crt
cert Server.crt
key Server.key
dh dh1024.pem
ifconfig-pool-persist /tmp/ipp.txt
keepalive 25 60
status /var/log/openvpn-status.log
push route 10.1.54.0 255.255.255.0
duplicate-cn
verb 3


Have you guys some more ideas what could be the reason for this issue?

michael.uray
OpenVpn Newbie
Posts: 7
Joined: Wed Jan 11, 2017 3:06 pm

Re: Large packets stop working when transferring big data

Postby michael.uray » Wed Mar 15, 2017 11:36 am

I am actually still having this issue.

When I try to run the server with the "client-to-client" option then the problem is also present, means it is probably not related to iptables.
I also tried to run both Windows clients to another OpenVPN server on an OpenWRT system with almost the same client configuration and it does not happen there.

This is the comparison between both server configs:
Image

I also did run the OpenWRT server with the comp-lzo option, but it did not cause any problems.

Some more ideas what I could test to locate the problem?

User avatar
TinCanTech
I should be on the dev team.
Posts: 1891
Joined: Fri Jun 03, 2016 1:17 pm

Re: Large packets stop working when transferring big data

Postby TinCanTech » Wed Mar 15, 2017 5:43 pm

TinCanTech wrote:
michael.uray wrote:Before that a ping with a length of 1600 was not possible at all.
Good .. probably because you have standard MTU of 1500 .. I have no idea how you managed to force that up to 1600
You cannot force an MTU of 1600 unless you control every single network between your server and client.

300000
OpenVPN User
Posts: 15
Joined: Tue May 01, 2012 9:30 pm

Re: Large packets stop working when transferring big data

Postby 300000 » Thu Mar 16, 2017 5:47 pm

you shoul try run on tcp than udp . tcp will hanle tranfer data better than udp . dont need to change anything . just try tcp first .

because tcp have the way to correct data when it tranfer so it is best way to use . udp somehow only good if server and client very close location and very good data link to work if not it is sure will mess up with corrup data


Return to “Configuration”

Who is online

Users browsing this forum: No registered users and 6 guests