How to increase the timeout?

[houmie75]

Hello,

I'm connecting via iOS OpenVPN network extension to OpenVpn 2.5.4 server.
If the OpenVPN servers are close by, then everything works fine.
But if they are far away Europe/West coast US, then the connection can't be established.

After a successful handshake, it says "Sending PUSH_REQUEST to server", but nothing happens and it tries to send a new handshake request, which gets accepted again. And it says again "Sending PUSH_REQUEST to server". After several tries it says: "Session invalidated: KEEPALIVE_TIMEOUT".

Then it tried the whole process again three times and then says "AUTH_FAILED" and it quits. I'm sure the auth failed is a red herring. It just times out because the server is far away and it doesn't have time to establish the connection.

Is there a way to increase this timeout upon connection to give more time to the client to establish the connection, please?

Many Thanks

[TinCanTech]

--server-poll-timeout

[houmie75]

Thank you.

The reference page although from OpenVPN 2.4 says:

--server-poll-timeout n, --connect-timeout n
When connecting to a remote server do not wait for more than n seconds waiting for a response before trying the next server. The default value is 120s. This timeout includes proxy and TCP connect timeouts.

I haven't set it on the server. Hence by default it should be 120s.
But the process doesn't take 120 seconds. It starts retrying after only a few seconds. I'm not sure if this is the right settings for this behaviour.

P.S. I have

Code: Select all

explicit-exit-notify 3

[TinCanTech]

My crystal ball tells me that you have an authentication issue ..

[houmie75]

I know it's hard to believe. I use the same installation script for all servers. It works fine in Europe and East coast USA. Only West coast or Australia don't work, because they are too far away. The auth is not the problem. I don't know why this is thrown.

[TinCanTech]

Do you believe that your script is more reliable than OpenVPN ?

OpenVPN does not send the client and AUTH_FAILED message unless the client has FAILED to AUTHORISE.

[houmie75]

Do you believe that your script is more reliable than OpenVPN ?

Yes. It's the same script that works the same way. There is no reason that it persistently fails for servers that are over certain distance away and persistently works for servers that are in closer proximity.

There are many moving parts here. It could be a bug that causes this failure when the ping is too high. It could be because of FreeRadius 3.0.21, it could be openvpn-auth-radius. It could be this iOS client implementation.

Anyway, no worries, I thought maybe there is a way to change the timeout on the server as a workaround. But this doesn't seem to be the case.

[TinCanTech]

After a successful handshake, it says "Sending PUSH_REQUEST to server", but nothing happens and it tries to send a new handshake request, which gets accepted again. And it says again "Sending PUSH_REQUEST to server". After several tries it says: "Session invalidated: KEEPALIVE_TIMEOUT".

Your client has connected to your server and is waiting for a PUSH_REPLY.

Then it tried the whole process again three times and then says "AUTH_FAILED" and it quits.

Your client connected to your server but failed to authorise and the server told you so.


Your script did not work the way you expected.

xy problem ..