Page 1 of 1
Is it an mtu case?
Posted: Mon Feb 11, 2013 3:24 pm
by jbgood
My server.cfg
Code: Select all
local my-ip
port 1194
proto udp
dev tun
tun-mtu 1200
ca keys/ca.crt
cert keys/my.crt
key keys/my.key
dh keys/dh1024.pem
crl-verify keys/crl.pem
server 10.0.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
client-to-client
keepalive 10 120
comp-lzo
max-clients 100
user openvpn
group openvpn
persist-key
persist-tun
status openvpn-status.log
log /var/log/openvpn.log
verb 3
My client con.ovpn
Code: Select all
client
remote my-servers-ip 1194
comp-lzo yes
dev tun
proto udp
script-security 2
persist-key
persist-tun
tun-mtu 1200
verb 5
<ca>
-----BEGIN CERTIFICATE-----
ommited
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
ommited
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN RSA PRIVATE KEY-----
ommited
-----END RSA PRIVATE KEY-----
</key>
In server log i have:
and then, after timeout:
Code: Select all
TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
TLS Error: TLS handshake failed
In client log:
Code: Select all
EVENT: CONNECTION_TIMEOUT [ERR]
EVENT: DISCONNECTED
And that's all.
It is also known that server has nothing that prevents traffic from clients.
Appreciate any help!
Re: Is it an mtu case?
Posted: Tue Feb 12, 2013 7:51 am
by maikcat
can you connect from a different location?
can you switch to tcp for testing?
Michael.
Re: Is it an mtu case?
Posted: Tue Feb 12, 2013 8:03 am
by jbgood
can you connect from a different location?
Nope =( I have always the same error (timeout on both sides) no-matter where from i try to connect.
can you switch to tcp for testing?
Unfortunately no. This is production VPN with many working clients.
I also noticed a total absence of traffic between iDevice-and-server on servers public interface after "VERIFY OK:" messages in log.
Re: Is it an mtu case?
Posted: Tue Feb 12, 2013 9:17 am
by maikcat
i am a bit confused here....
Nope =( I have always the same error (timeout on both sides) no-matter where from i try to connect.
Unfortunately no. This is production VPN with many working clients.
is your setup works or no?
Michael.
Re: Is it an mtu case?
Posted: Tue Feb 12, 2013 9:54 am
by jbgood
It works, but not with iOS app)
Re: Is it an mtu case?
Posted: Tue Feb 12, 2013 10:56 am
by maikcat
via which network you are trying to connect from ios?
maybe someone after ios filters traffic...
Michael.
Re: Is it an mtu case?
Posted: Tue Feb 12, 2013 11:36 am
by jbgood
via which network you are trying to connect from ios?
I tried lots of internet sources (which surely do not have any traffic limitations) - and always got same behavior.
Re: Is it an mtu case?
Posted: Tue Feb 12, 2013 4:20 pm
by jbgood
Finally i localized the problem. It is "mtu 1200".
So iOS client doesn't support mtu resize, am i right ?