OpenVPN client not reconnecting after OpenVPN server service restart

[kojo1984]

Hello people.

I'm using OpenVPN client to establish a VPN connection automatically after reboot. Everything works fine. Client is on Windows

However, I noticed that if a client is connected to a OpenVPN server (Debian 11, connecting over UDP), when I change some settings in config of OpenVPN server and restart the OpenVPN server service, client gets disconnected (as expected), but never reconnect.

I have put directives into OpenVPN config, like:

Code: Select all

explicit-exit-notify 1

But it did not helped.

User must manually disconnect then connect again. That happens without issues.

Here is a part of a log from a server.

Code: Select all

2023-05-11 19:21:43 SOME_IP:49274 TLS: Initial packet from [AF_INET]SOME_IP:49274, sid=c455e2fc db55e4d4
2023-05-11 19:21:43 SOME_IP:49274 VERIFY OK: depth=1, CN=ChangeMe
2023-05-11 19:21:43 SOME_IP:49274 VERIFY OK: depth=0, CN=SOME_USER
2023-05-11 19:21:43 SOME_IP:49274 peer info: IV_VER=3.git::d3f8b18b
2023-05-11 19:21:43 SOME_IP:49274 peer info: IV_PLAT=win
2023-05-11 19:21:43 SOME_IP:49274 peer info: IV_NCP=2
2023-05-11 19:21:43 SOME_IP:49274 peer info: IV_TCPNL=1
2023-05-11 19:21:43 SOME_IP:49274 peer info: IV_PROTO=30
2023-05-11 19:21:43 SOME_IP:49274 peer info: IV_CIPHERS=AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305
2023-05-11 19:21:43 SOME_IP:49274 peer info: IV_GUI_VER=OCWindows_3.3.7-2979
2023-05-11 19:21:43 SOME_IP:49274 peer info: IV_SSO=webauth,openurl,crtext
2023-05-11 19:21:43 SOME_IP:49274 TLS Error: Auth Username/Password was not provided by peer
2023-05-11 19:21:43 SOME_IP:49274 TLS Error: TLS handshake failed
2023-05-11 19:21:43 SOME_IP:49274 SIGUSR1[soft,tls-error] received, client-instance restarting

[kojo1984]

What helped me is that I added this directive into OpenVPN config file:

Code: Select all

push "nobind"

EXPLANATION: nobind
Do not bind to local address and port. The IP stack will allocate a dynamic port for returning packets. Since the value of the dynamic port could not be known in advance by a peer, this option is only suitable for peers which will be initiating connections by using the --remote option.

Also, I've set

Code: Select all

keepalive 2 10

directive to lower values so client reconnect faster.

Now, after I restart OpenVPN service, client can reconnect again, without intervention from user.

[volleynbike]

have you tried:
--keepalive args