Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    OpenVPN tunnel allways reconnects

    Scheduled Pinned Locked Moved OpenVPN
    3 Posts 3 Posters 1.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • H Offline
      hikmat
      last edited by

      Hi People,

      Please HELP, need urgent suggestion!!!

      In Tashkent city (Uzbekistan) we have Pfsense 2.3.3.1 with 8 Openvpn services. One of them binded to 443 UDP in TUN Peer-to-Peer SSL/TLS and Public IP.
      In Beijing city (China) we also have Pfsense 2.3.3.1 with Openvpn acting as client over ISP NAT router.
      The client succesfully connects to the server , seems everything is working. Ping is here, we can see all devices on remote sites.
      The problem is that  every N-time (5-10-30 minutes, each time different), the connection loss and client restarts tunnel. This time allways on-demand service can't work.
      How to fugure the issue?

      By the way, in this OpenVpn tunnel we can't ping IP of tunnels, although on the others one we can.
      Both sites have according Rules/Openvpn where source=Local NETs + Tunnel Net pass all traffic to all destination.

      Server Conf /var/etc/openvpn/server5.conf:

      
dev ovpns5
verb 4
dev-type tun
tun-ipv6
dev-node /dev/tun5
writepid /var/run/openvpn_server5.pid
#user nobody
#group nobody
script-security 3
daemon
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
proto udp
cipher AES-256-CBC
auth SHA512
up /usr/local/sbin/ovpn-linkup
down /usr/local/sbin/ovpn-linkdown
local 195.158.х.х
tls-server
server 10.0.100.0 255.255.255.0
client-config-dir /var/etc/openvpn-csc/server5
ifconfig 10.0.100.1 10.0.100.2
tls-verify "/usr/local/sbin/ovpn_auth_verify tls 'vpn-server.mfa.uz' 1"
lport 443
management /var/etc/openvpn/server5.sock unix
push "route 172.30.30.176 255.255.255.240"
push "route 192.168.1.0 255.255.255.0"
route 192.168.45.0 255.255.255.0
route 192.168.46.0 255.255.255.0
ca /var/etc/openvpn/server5.ca 
cert /var/etc/openvpn/server5.cert 
key /var/etc/openvpn/server5.key 
dh /etc/dh-parameters.4096
crl-verify /var/etc/openvpn/server5.crl-verify 
tls-auth /var/etc/openvpn/server5.tls-auth 0
persist-remote-ip
float
topology subnet

      Client override /var/etc/openvpn-csc/server5

      
iroute 192.168.45.0 255.255.255.0

      Client Conf /var/etc/openvpn/client1.conf:

      
dev ovpnc1
verb 1
dev-type tun
tun-ipv6
dev-node /dev/tun1
writepid /var/run/openvpn_client1.pid
#user nobody
#group nobody
script-security 3
daemon
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
proto udp
cipher AES-256-CBC
auth SHA512
up /usr/local/sbin/ovpn-linkup
down /usr/local/sbin/ovpn-linkdown
local 192.168.200.199
tls-client
client
lport 0
management /var/etc/openvpn/client1.sock unix
remote 195.158.х.х 443
ca /var/etc/openvpn/client1.ca
cert /var/etc/openvpn/client1.cert
key /var/etc/openvpn/client1.key
tls-auth /var/etc/openvpn/client1.tls-auth 1
resolv-retry infinite
remote-cert-tls server

      **Client LOGS:

      
May 3 15:04:56 	openvpn 	94536 	Initialization Sequence Completed
May 3 15:04:56 	openvpn 	94536 	Preserving previous TUN/TAP instance: ovpnc1
May 3 15:04:54 	openvpn 	94536 	[vpn-server.mfa.uz] Peer Connection Initiated with [AF_INET]195.158.х.х:443
May 3 15:04:38 	openvpn 	94536 	UDPv4 link remote: [AF_INET]195.158.х.х:443
May 3 15:04:38 	openvpn 	94536 	UDPv4 link local (bound): [AF_INET]192.168.200.199
May 3 15:04:38 	openvpn 	94536 	NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
May 3 15:04:35 	openvpn 	94536 	SIGUSR1[soft,ping-restart] received, process restarting
May 3 15:04:35 	openvpn 	94536 	[UNDEF] Inactivity timeout (--ping-restart), restarting
May 3 15:03:35 	openvpn 	94536 	UDPv4 link remote: [AF_INET]195.158.х.х:443
May 3 15:03:35 	openvpn 	94536 	UDPv4 link local (bound): [AF_INET]192.168.200.199
May 3 15:03:35 	openvpn 	94536 	NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
May 3 15:03:33 	openvpn 	94536 	SIGUSR1[soft,ping-restart] received, process restarting
May 3 15:03:33 	openvpn 	94536 	[UNDEF] Inactivity timeout (--ping-restart), restarting
May 3 15:02:33 	openvpn 	94536 	UDPv4 link remote: [AF_INET]195.158.х.х:443
May 3 15:02:33 	openvpn 	94536 	UDPv4 link local (bound): [AF_INET]192.168.200.199
May 3 15:02:33 	openvpn 	94536 	NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
May 3 15:02:31 	openvpn 	94536 	SIGUSR1[soft,tls-error] received, process restarting
May 3 15:02:31 	openvpn 	94536 	TLS Error: TLS handshake failed
May 3 15:02:31 	openvpn 	94536 	TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
May 3 15:01:37 	openvpn 	94536 	TLS Error: Unroutable control packet received from [AF_INET]195.158.х.х:443 (si=3 op=P_ACK_V1)
May 3 15:01:31 	openvpn 	94536 	UDPv4 link remote: [AF_INET]195.158.х.х:443
May 3 15:01:31 	openvpn 	94536 	UDPv4 link local (bound): [AF_INET]192.168.200.199
May 3 15:01:31 	openvpn 	94536 	NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
May 3 15:01:29 	openvpn 	94536 	SIGUSR1[soft,ping-restart] received, process restarting
May 3 15:01:29 	openvpn 	94536 	[UNDEF] Inactivity timeout (--ping-restart), restarting
May 3 15:00:29 	openvpn 	94536 	UDPv4 link remote: [AF_INET]195.158.х.х:443
May 3 15:00:29 	openvpn 	94536 	UDPv4 link local (bound): [AF_INET]192.168.200.199
May 3 15:00:29 	openvpn 	94536 	NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
May 3 15:00:27 	openvpn 	94536 	SIGUSR1[soft,ping-restart] received, process restarting
May 3 15:00:27 	openvpn 	94536 	[UNDEF] Inactivity timeout (--ping-restart), restarting
May 3 14:59:27 	openvpn 	94536 	UDPv4 link remote: [AF_INET]195.158.х.х:443
May 3 14:59:27 	openvpn 	94536 	UDPv4 link local (bound): [AF_INET]192.168.200.199
May 3 14:59:27 	openvpn 	94536 	NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
May 3 14:59:25 	openvpn 	94536 	SIGUSR1[soft,ping-restart] received, process restarting
May 3 14:59:25 	openvpn 	94536 	[vpn-server.mfa.uz] Inactivity timeout (--ping-restart), restarting
May 3 14:58:25 	openvpn 	94536 	[vpn-server.mfa.uz] Peer Connection Initiated with [AF_INET]195.158.х.х:443
May 3 14:58:11 	openvpn 	94536 	UDPv4 link remote: [AF_INET]195.158.х.х:443
May 3 14:58:11 	openvpn 	94536 	UDPv4 link local (bound): [AF_INET]192.168.200.199
May 3 14:58:11 	openvpn 	94536 	NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
May 3 14:58:09 	openvpn 	94536 	SIGUSR1[soft,ping-restart] received, process restarting
May 3 14:58:09 	openvpn 	94536 	[UNDEF] Inactivity timeout (--ping-restart), restarting
May 3 14:57:09 	openvpn 	94536 	UDPv4 link remote: [AF_INET]195.158.х.х:443
May 3 14:57:09 	openvpn 	94536 	UDPv4 link local (bound): [AF_INET]192.168.200.199
May 3 14:57:09 	openvpn 	94536 	NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
May 3 14:57:07 	openvpn 	94536 	SIGUSR1[soft,ping-restart] received, process restarting
May 3 14:57:07 	openvpn 	94536 	[UNDEF] Inactivity timeout (--ping-restart), restarting
May 3 14:56:07 	openvpn 	94536 	UDPv4 link remote: [AF_INET]195.158.х.х:443
May 3 14:56:07 	openvpn 	94536 	UDPv4 link local (bound): [AF_INET]192.168.200.199
May 3 14:56:07 	openvpn 	94536 	NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
May 3 14:56:05 	openvpn 	94536 	SIGUSR1[soft,ping-restart] received, process restarting
May 3 14:56:05 	openvpn 	94536 	[vpn-server.mfa.uz] Inactivity timeout (--ping-restart), restarting
May 3 14:34:33 	openvpn 	94536 	Initialization Sequence Completed
May 3 14:34:33 	openvpn 	94536 	Preserving previous TUN/TAP instance: ovpnc1
May 3 14:34:31 	openvpn 	94536 	[vpn-server.mfa.uz] Peer Connection Initiated with [AF_INET]195.158.х.х:443
May 3 14:34:27 	openvpn 	94536 	TLS Error: Unroutable control packet received from [AF_INET]195.158.х.х:443 (si=3 op=P_ACK_V1)
May 3 14:34:13 	openvpn 	94536 	UDPv4 link remote: [AF_INET]195.158.х.х:443
May 3 14:34:13 	openvpn 	94536 	UDPv4 link local (bound): [AF_INET]192.168.200.199
May 3 14:34:13 	openvpn 	94536 	NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
May 3 14:34:11 	openvpn 	94536 	SIGUSR1[soft,ping-restart] received, process restarting
May 3 14:34:11 	openvpn 	94536 	[UNDEF] Inactivity timeout (--ping-restart), restarting
May 3 14:33:11 	openvpn 	94536 	UDPv4 link remote: [AF_INET]195.158.х.х:443
May 3 14:33:11 	openvpn 	94536 	UDPv4 link local (bound): [AF_INET]192.168.200.199
May 3 14:33:11 	openvpn 	94536 	NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
May 3 14:33:09 	openvpn 	94536 	SIGUSR1[soft,ping-restart] received, process restarting
May 3 14:33:09 	openvpn 	94536 	[UNDEF] Inactivity timeout (--ping-restart), restarting
May 3 14:32:09 	openvpn 	94536 	UDPv4 link remote: [AF_INET]195.158.х.х:443
May 3 14:32:09 	openvpn 	94536 	UDPv4 link local (bound): [AF_INET]192.168.200.199
May 3 14:32:09 	openvpn 	94536 	NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
May 3 14:32:07 	openvpn 	94536 	SIGUSR1[soft,tls-error] received, process restarting
May 3 14:32:07 	openvpn 	94536 	TLS Error: TLS handshake failed
May 3 14:32:07 	openvpn 	94536 	TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
May 3 14:31:07 	openvpn 	94536 	UDPv4 link remote: [AF_INET]195.158.х.х:443
May 3 14:31:07 	openvpn 	94536 	UDPv4 link local (bound): [AF_INET]192.168.200.199
May 3 14:31:07 	openvpn 	94536 	NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
May 3 14:31:05 	openvpn 	94536 	SIGUSR1[soft,ping-restart] received, process restarting
May 3 14:31:05 	openvpn 	94536 	[UNDEF] Inactivity timeout (--ping-restart), restarting
May 3 14:30:05 	openvpn 	94536 	UDPv4 link remote: [AF_INET]195.158.х.х:443
May 3 14:30:05 	openvpn 	94536 	UDPv4 link local (bound): [AF_INET]192.168.200.199
May 3 14:30:05 	openvpn 	94536 	NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
May 3 14:30:03 	openvpn 	94536 	SIGUSR1[soft,ping-restart] received, process restarting
May 3 14:30:03 	openvpn 	94536 	[UNDEF] Inactivity timeout (--ping-restart), restarting
May 3 14:29:03 	openvpn 	94536 	UDPv4 link remote: [AF_INET]195.158.х.х:443
May 3 14:29:03 	openvpn 	94536 	UDPv4 link local (bound): [AF_INET]192.168.200.199
May 3 14:29:03 	openvpn 	94536 	NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
May 3 14:29:01 	openvpn 	94536 	SIGUSR1[soft,ping-restart] received, process restarting
May 3 14:29:01 	openvpn 	94536 	[vpn-server.mfa.uz] Inactivity timeout (--ping-restart), restarting
May 3 14:21:39 	openvpn 	94536 	Initialization Sequence Completed
May 3 14:21:39 	openvpn 	94536 	Preserving previous TUN/TAP instance: ovpnc1
May 3 14:21:36 	openvpn 	94536 	[vpn-server.mfa.uz] Peer Connection Initiated with [AF_INET]195.158.х.х:443
May 3 14:21:28 	openvpn 	94536 	UDPv4 link remote: [AF_INET]195.158.х.х:443
May 3 14:21:28 	openvpn 	94536 	UDPv4 link local (bound): [AF_INET]192.168.200.199
May 3 14:21:28 	openvpn 	94536 	NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
May 3 14:21:26 	openvpn 	94536 	SIGUSR1[soft,ping-restart] received, process restarting
May 3 14:21:26 	openvpn 	94536 	[UNDEF] Inactivity timeout (--ping-restart), restarting
May 3 14:20:26 	openvpn 	94536 	UDPv4 link remote: [AF_INET]195.158.х.х:443
May 3 14:20:26 	openvpn 	94536 	UDPv4 link local (bound): [AF_INET]192.168.200.199
May 3 14:20:26 	openvpn 	94536 	NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
May 3 14:20:24 	openvpn 	94536 	SIGUSR1[soft,ping-restart] received, process restarting
May 3 14:20:24 	openvpn 	94536 	[UNDEF] Inactivity timeout (--ping-restart), restarting
May 3 14:19:23 	openvpn 	94536 	UDPv4 link remote: [AF_INET]195.158.х.х:443

      Server LOGS:

      
May 3 12:14:21 	openvpn 	33468 	I/O WAIT TR|Tw|SR|Sw [7/9931]
May 3 12:14:21 	openvpn 	33468 	PO_CTL rwflags=0x0001 ev=5 arg=0x00693598
May 3 12:14:21 	openvpn 	33468 	PO_CTL rwflags=0x0001 ev=7 arg=0x00693594
May 3 12:14:21 	openvpn 	33468 	PO_CTL rwflags=0x0001 ev=6 arg=0x00694740
May 3 12:14:21 	openvpn 	33468 	SCHEDULE: schedule_find_least wakeup=[Wed May 3 12:14:29 2017 us=9926] pri=2071388902
May 3 12:14:21 	openvpn 	33468 	kayumov.mfa.uz/84.54.112.26:64383 SCHEDULE: schedule_add_modify wakeup=[Wed May 3 12:14:29 2017 us=9926] pri=2042523469
May 3 12:14:21 	openvpn 	33468 	kayumov.mfa.uz/84.54.112.26:64383 RANDOM USEC=58507
May 3 12:14:21 	openvpn 	33468 	kayumov.mfa.uz/84.54.112.26:64383 TLS: tls_multi_process: i=2 state=S_UNDEF, mysid=00000000 00000000, stored-sid=00000000 00000000, stored-ip=[undef]
May 3 12:14:21 	openvpn 	33468 	kayumov.mfa.uz/84.54.112.26:64383 TLS: tls_multi_process: i=1 state=S_INITIAL, mysid=3e08c98b 0f86ddcb, stored-sid=00000000 00000000, stored-ip=[undef]
May 3 12:14:21 	openvpn 	33468 	kayumov.mfa.uz/84.54.112.26:64383 TLS: tls_process: timeout set to 1096
May 3 12:14:21 	openvpn 	33468 	kayumov.mfa.uz/84.54.112.26:64383 ACK reliable_send_timeout 604800 [6]
May 3 12:14:21 	openvpn 	33468 	kayumov.mfa.uz/84.54.112.26:64383 ACK reliable_can_send active=0 current=0 : [6]
May 3 12:14:21 	openvpn 	33468 	kayumov.mfa.uz/84.54.112.26:64383 STATE S_NORMAL_OP
May 3 12:14:21 	openvpn 	33468 	kayumov.mfa.uz/84.54.112.26:64383 TLS: tls_process: chg=0 ks=S_NORMAL_OP lame=S_NORMAL_OP to_link->len=0 wakeup=1096
May 3 12:14:21 	openvpn 	33468 	kayumov.mfa.uz/84.54.112.26:64383 TLS: tls_multi_process: i=0 state=S_NORMAL_OP, mysid=0f678122 b7f33cc8, stored-sid=af61d163 b797e3aa, stored-ip=[AF_INET]84.54.112.26:64383
May 3 12:14:21 	openvpn 	33468 	kayumov.mfa.uz/84.54.112.26:64383 TIMER: coarse timer wakeup 7 seconds
May 3 12:14:21 	openvpn 	33468 	MULTI: REAP range 144 -> 160
May 3 12:14:21 	openvpn 	33468 	I/O WAIT status=0x0020
May 3 12:14:21 	openvpn 	33468 	event_wait returned 0
May 3 12:14:18 	openvpn 	33468 	I/O WAIT TR|Tw|SR|Sw [3/104880]
May 3 12:14:18 	openvpn 	33468 	PO_CTL rwflags=0x0001 ev=5 arg=0x00693598
May 3 12:14:18 	openvpn 	33468 	PO_CTL rwflags=0x0001 ev=7 arg=0x00693594
May 3 12:14:18 	openvpn 	33468 	PO_CTL rwflags=0x0001 ev=6 arg=0x00694740
May 3 12:14:18 	openvpn 	33468 	kayumov.mfa.uz/84.54.112.26:64383 UDPv4 write returned 165
May 3 12:14:18 	openvpn 	33468 	kayumov.mfa.uz/84.54.112.26:64383 UDPv4 WRITE [165] to [AF_INET]84.54.112.26:64383: P_DATA_V1 kid=2 DATA 6a49b95a 47d31a9e caa0eb92 df3bd156 c39da98a 884fd3ab 99dd6e71 2af1916[more...]
May 3 12:14:18 	openvpn 	33468 	I/O WAIT status=0x0002
May 3 12:14:18 	openvpn 	33468 	event_wait returned 1
May 3 12:14:18 	openvpn 	33468 	PO_WAIT[0,0] fd=6 rev=0x00000004 rwflags=0x0002 arg=0x00694740
May 3 12:14:18 	openvpn 	33468 	I/O WAIT Tr|Tw|Sr|SW [3/104880]
May 3 12:14:18 	openvpn 	33468 	PO_CTL rwflags=0x0001 ev=5 arg=0x00693598
May 3 12:14:18 	openvpn 	33468 	PO_CTL rwflags=0x0000 ev=7 arg=0x00693594
May 3 12:14:18 	openvpn 	33468 	PO_CTL rwflags=0x0002 ev=6 arg=0x00694740
May 3 12:14:18 	openvpn 	33468 	kayumov.mfa.uz/84.54.112.26:64383 ENCRYPT TO: 884fd3ab 99dd6e71 2af1916b 62e91d17 50555648 b6a0102c b45f3ca5 4d564e2[more...]
May 3 12:14:18 	openvpn 	33468 	kayumov.mfa.uz/84.54.112.26:64383 ENCRYPT FROM: 0000011a 45000077 bc520000 3f11d545 ac1e1ebe 0a001502 0035edf2 00633e5[more...]
May 3 12:14:18 	openvpn 	33468 	kayumov.mfa.uz/84.54.112.26:64383 ENCRYPT IV: 884fd3ab 99dd6e71 2af1916b 62e91d17
May 3 12:14:18 	openvpn 	33468 	kayumov.mfa.uz/84.54.112.26:64383 TLS: tls_pre_encrypt: key_id=2
May 3 12:14:18 	openvpn 	33468 	kayumov.mfa.uz/84.54.112.26:64383 TUN READ [119]
May 3 12:14:18 	openvpn 	33468 	GET INST BY VIRT: 10.0.21.2 -> kayumov.mfa.uz/84.54.112.26:64383 via 10.0.21.2
May 3 12:14:18 	openvpn 	33468 	read from TUN/TAP returned 119
May 3 12:14:18 	openvpn 	33468 	MULTI: REAP range 128 -> 144
May 3 12:14:18 	openvpn 	33468 	I/O WAIT status=0x0004
May 3 12:14:18 	openvpn 	33468 	event_wait returned 1
May 3 12:14:18 	openvpn 	33468 	PO_WAIT[1,0] fd=7 rev=0x00000001 rwflags=0x0001 arg=0x00693594
May 3 12:14:17 	openvpn 	33468 	I/O WAIT TR|Tw|SR|Sw [4/104880]
May 3 12:14:17 	openvpn 	33468 	PO_CTL rwflags=0x0001 ev=5 arg=0x00693598
May 3 12:14:17 	openvpn 	33468 	PO_CTL rwflags=0x0001 ev=7 arg=0x00693594
May 3 12:14:17 	openvpn 	33468 	PO_CTL rwflags=0x0001 ev=6 arg=0x00694740
May 3 12:14:17 	openvpn 	33468 	kayumov.mfa.uz/84.54.112.26:64383 write to TUN/TAP returned 72
May 3 12:14:17 	openvpn 	33468 	kayumov.mfa.uz/84.54.112.26:64383 TUN WRITE [72]
May 3 12:14:17 	openvpn 	33468 	I/O WAIT status=0x0008 

```**
      1 Reply Last reply Reply Quote 0
      • J Offline
        jameswebb
        last edited by

        Sounds to me like an ISP firewall issue.
        You may have to perform some form of header re-writing to get past DPI firewalls.

        1 Reply Last reply Reply Quote 0
        • M Offline
          mixinocencio
          last edited by

          Hi Everyone!
          Im from Brazil and i have a some problem.
          My CA restart in 30 minutes.

          sent error in my client :

          "Thu May 18 17:43:19 2017 [server-certificado] Inactivity timeout (–ping-restart), restarting
          Thu May 18 17:43:19 2017 SIGUSR1[soft,ping-restart] received, process restarting
          Thu May 18 17:43:19 2017 Restart pause, 2 second(s)
          Thu May 18 17:43:21 2017 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
          Thu May 18 17:43:21 2017 Socket Buffers: R=[163840->131072] S=[163840->131072]
          "

          1 Reply Last reply Reply Quote 0
          • First post
            Last post
          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.