Hi Alex,
On 20/09/17 12:04, Alex K wrote:
Hi Jan,
The VPN tunnel is established successfully and connectivity is possible through
the tunnel, except the link-mtu warning.
Attached the client log.
the client log shows that the "per-client cipher" patch is not 100% complete.
Here's what happens:
- the client connects to the server with "cipher none" set; the server has "cipher
aes-128-cbc" set
- the client detects a mismatch between ciphers (and thus link-mtu size) and
prints a warning
- the server then pushes a cipher to the client
- the client accepts the ciphers and recalculates the link-mtu size (as well as
a few other parameters).
After that the link-mtu mismatch is gonen and the tunnel is happily up and
running.
It would have been nicer to avoid the initial warning message, but I know that part of the OpenVPN code : it's quite hard to
avoid that warning...
HTH,
JJK
On Wed, Sep 20, 2017 at 12:25 PM, Jan Just Keijser <[email protected]
<mailto:[email protected]>> wrote:
Hi Alex,
On 18/09/17 18:53, Alex K wrote:
Hi Jan,
Yes, I use ncp-disable on client side so as to be able to have per client
cipher negotiation.
How can one have ncp-disable and avoid link MTU issues?
I must say that I have not tried the per-client cipher patch yet, but I can
imagine at which point it might cause
problems. Of course, a per-client cipher would never have worked with OpenVPN
< 2.4, so I am not surprised that you did
not see it in the past.
Can you post/mail the client-side log file of a failing connection?
cheers,
JJK
On Mon, Sep 18, 2017 at 7:43 PM, Jan Just Keijser <[email protected]
<mailto:[email protected]>> wrote:
Hi Alex,
On 15/09/17 18:54, Alex K wrote:
Hi all,
I am receiving the below warning on server and client side when setting
up the tunnel:
server:
Fri Sep 15 16:45:14 2017 172.30.0.180:44304 <http://172.30.0.180:44304>
WARNING: 'link-mtu' is used inconsistently,
local='link-mtu 1562', remote='link-mtu 1530'
client:
Fri Sep 15 16:45:14 2017 us=87436 WARNING: 'link-mtu' is used
inconsistently, local='link-mtu 1530',
remote='link-mtu 1562'
and further down on client side:
Fri Sep 15 16:45:15 2017 us=282768 OPTIONS IMPORT: adjusting link_mtu
to 1629
I have on server side:
tun-mtu 1500
fragment 1360
mssfix
and on client side exactly the same:
tun-mtu 1500
fragment 1360
mssfix
The tun interfaces on both sides show as 1500 with ifconfig.
Why is this case? I cannot recall seeing such warning on openvpn
2.2.1-8.
I can provide more details if needed.
the link-mtu size also depends on the cipher and auth used ; are you
using NCP at all (i.e. do you explicitly specify
'disable-ncp' ?) A log file of a failing client with 'verb 4' set
would help.
HTH,
JJK
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
Openvpn-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-users
