I have been struggling to figure out why my OpenVPN connection simply
stops working after some number of time -- sometimes 5 minutes,
sometimes hours. In each case, the connection stops passing any
traffic at all, the keepalive timer times out after its set time, and
the connection restarts, after which the behavior repeats itself. The
failure to pass traffic happens very suddenly, not when the connection
is idle; I can be in the middle of an active Vim editing session over
SSH over the connection, and have everything suddenly freeze. I have
checked logs (all logs, not just OpenVPN) on both the server and
client, and see no indication of *anything* happening at that time.
Outside of the ping-restart (and reconnection messages afterwards), he
only thing I see in the log on either end is the following. Often I
see those right after connection, although sometimes it happens at
later times.
Mon Feb 9 15:34:12 2015 us=645586 pomluser/172.19.41.84:51109 MULTI:
bad source address from client [10.0.2.15], packet dropped
Mon Feb 9 15:34:14 2015 us=651738 pomluser/172.19.41.84:51109 MULTI:
bad source address from client [10.0.2.15], packet dropped
Mon Feb 9 15:34:18 2015 us=658866 pomluser/172.19.41.84:51109 MULTI:
bad source address from client [10.0.2.15], packet dropped
I know what those addresses are, but not the why.
The client is inside a VM running on a laptop. When the client
connects, the address OpenVPN sees is the address of the host, which
makes sense given that the VM is using a NATed connection:
Mon Feb 9 15:33:36 2015 us=980980 172.19.41.84:51109 [pomluser] Peer
Connection Initiated with [AF_INET]172.19.41.84:51109
Mon Feb 9 15:33:36 2015 us=981001 pomluser/172.19.41.84:51109
MULTI_sva: pool returned IPv4=10.88.16.2, IPv6=(Not enabled)
Mon Feb 9 15:33:36 2015 us=981027 pomluser/172.19.41.84:51109 MULTI:
Learn: 10.88.16.2 -> pomluser/172.19.41.84:51109
Mon Feb 9 15:33:36 2015 us=981034 pomluser/172.19.41.84:51109 MULTI:
primary virtual IP for pomluser/172.19.41.84:51109: 10.88.16.2
However, the "bad source address" messages above are showing the IP
address of eth0 on the VM. Somehow along the way messages seem to
switch their origin.
I know that if you have an actual authoritative network behind a
connection that iroute can be used to solve this problem, but the
problem is that there are many of these VMs, and any given VM may have
the same internal IP since it comes via DHCP from the VM software --
plus, that IP may not be the same from bootup to bootup of the VM.
So: what would cause the packets to have different source addresses at
connection time and some later time, and how can I solve this when
clients may have the same IP address?
And, if that might not be the cause of my disconnects, what might be?
I've tried playing with different keepalive values (both in terms of
timeout and how often the pings happen), but nothing has helped.
This is 2.3.2-7ubuntu3.1 on Ubuntu 14.04.1 LTS.
Client and server configs follow below.
Thanks,
Jeff
Server (I have two; they differ only in the subnets they are
responsible for and the routes they push, as they have connectivity on
the backend).
port 443
proto udp
dev tun0
ca /etc/openvpn/easy-rsa/keys/ca.crt
cert /etc/openvpn/easy-rsa/keys/server.crt
key /etc/openvpn/easy-rsa/keys/server.key
dh /etc/openvpn/easy-rsa/keys/dh2048.pem
server 10.88.8.0 255.255.248.0
tls-server
topology subnet
push "route 10.88.0.0 255.255.0.0"
push "dhcp-option DNS 10.88.0.1"
keepalive 1 180
tls-auth /etc/openvpn/easy-rsa/keys/ta.key 0
client-to-client
keepalive 1 180
comp-lzo
duplicate-cn
user nobody
group nogroup
persist-key
persist-tun
no-replay
status openvpn-status.log
mute 20
verb 4
log /var/log/openvpn/poml-udp.log
Client (can connect to either server, as they both have backend connectivity):
client
dev tun
proto udp
remote {removed}
remote {removed}
remote-random
float
resolv-retry 10
nobind
persist-key
persist-tun
mute-replay-warnings
no-replay
ca ca.crt
cert pomluser.crt
key pomluser.key
pull
keepalive 1 180
auth-retry interact
ns-cert-type server
tls-auth ta.key 1
comp-lzo
up-restart
up "/etc/rc.local vpnup"
down-pre
down "/etc/rc.local vpndown"
verb 4
mute 20
------------------------------------------------------------------------------
Dive into the World of Parallel Programming. The Go Parallel Website,
sponsored by Intel and developed in partnership with Slashdot Media, is your
hub for all things parallel software development, from weekly thought
leadership blogs to news, videos, case studies, tutorials and more. Take a
look and join the conversation now. http://goparallel.sourceforge.net/
_______________________________________________
Openvpn-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-users
