Client VPN is closing its connection randomly
-
@mcury
same message as before.. see the times 18:06 connected -18:22 disconnected
Feb 15 18:22:56 openvpn 39332 [openvpn2.vpnunlimitedapp.com] Inactivity timeout (--ping-exit), exiting
Feb 15 18:06:35 openvpn 39332 Initialization Sequence CompletedAnd this happens while i am using the connection
-
@jonny-b74 This problem happens if you have a client behind pfense constantly using the VPN?
Connect the pfsense to the VPN again, and in a computer behind pfsense, keep pinging 8.8.8.8 or any other IP in the internet to confirm if the VPN will drop.
The error is indicating inactivity timeout, which shouldn't be happening with the ping 5 value.
I wonder if pfsense is pinging the server.. and which source IP would be using to do it..Did you create the openvpn interface? I suspect that this could be the problem..
Can you capture packets in the openvpn interface to confirm if the ping 5 is working?Edit: If you didn't create the openvpn, here is a how to:
https://docs.netgate.com/pfsense/en/latest/vpn/openvpn/assign.html#figure-assign-openvpn-interfaceBy the way, this is just a guess..
-
@mcury
Just tried that cannot ping 8.8.8.8 i can surf the web thoughMy gateway status
KEEPSOLID_US_VPNV4 10.200.0.45 8.8.8.8 38.059ms 3.084ms 0.0% Online Interface KEEPSOLID_US_VPNV4 Gateway -
@jonny-b74 Google is probably blocking VPN known IP addresses..
Keep browsing the internet, this would achieve the same goal of the ping to Google..Or find another IP that is accepting your ping requests and set a constant ping to it.. in Windows it would be ping IP -t
In Linux just ping IP
-
just dropped again
Feb 15 18:58:32 openvpn 40886 SIGTERM[soft,ping-exit] received, process exiting
Feb 15 18:58:32 openvpn 40886 PID packet_id_free
Feb 15 18:58:32 openvpn 40886 /usr/local/sbin/ovpn-linkdown ovpnc1 1500 1625 10.200.0.46 10.200.0.45 init
Feb 15 18:58:32 openvpn 40886 Closing TUN/TAP interface
Feb 15 18:58:32 openvpn 40886 /sbin/route delete -net 128.0.0.0 10.200.0.45 128.0.0.0
Feb 15 18:58:32 openvpn 40886 /sbin/route delete -net 0.0.0.0 10.200.0.45 128.0.0.0
Feb 15 18:58:32 openvpn 40886 /sbin/route delete -net 66.23.205.226 99.227.40.1 255.255.255.255
Feb 15 18:58:32 openvpn 40886 /sbin/route delete -net 10.200.0.1 10.200.0.45 255.255.255.255
Feb 15 18:58:32 openvpn 40886 TCP/UDP: Closing socket
Feb 15 18:58:32 openvpn 40886 PID packet_id_free
Feb 15 18:58:32 openvpn 40886 PID packet_id_free
Feb 15 18:58:32 openvpn 40886 PID packet_id_free
Feb 15 18:58:32 openvpn 40886 PID packet_id_free
Feb 15 18:58:32 openvpn 40886 PID packet_id_free
Feb 15 18:58:32 openvpn 40886 PID packet_id_free
Feb 15 18:58:32 openvpn 40886 PID packet_id_free
Feb 15 18:58:32 openvpn 40886 SSL alert (write): warning: close notify
Feb 15 18:58:32 openvpn 40886 PID packet_id_free
Feb 15 18:58:32 openvpn 40886 TIMER: coarse timer wakeup 30 seconds
Feb 15 18:58:32 openvpn 40886 [openvpn2.vpnunlimitedapp.com] Inactivity timeout (--ping-exit), exiting
Feb 15 18:58:32 openvpn 40886 ENCRYPT TO: 48000008 27bfd656 56a640ad 529d804c 5a1d8b5e 47e7e55b 03cba599 b459272[more...] -
running a ping in the background now.. will test and report
-
Interface setting
-
@jonny-b74 said in Client VPN is closing its connection randomly:
running a ping in the background now.. will test and report
In theory, with the ping happening, the connection won't ping-exit anymore
https://openvpn.net/community-resources/reference-manual-for-openvpn-2-4/
–inactive n [bytes] Causes OpenVPN to exit after n seconds of inactivity on the TUN/TAP device. The time length of inactivity is measured since the last incoming or outgoing tunnel packet. The default value is 0 seconds, which disables this feature.If the optional bytes parameter is included, exit if less than bytes of combined in/out traffic are produced on the tun/tap device in n seconds. In any case, OpenVPN’s internal ping packets (which are just keepalives) and TLS control packets are not considered “activity”, nor are they counted as traffic, as they are used internally by OpenVPN and are not an indication of actual user activity. –ping n Ping remote over the TCP/UDP control channel if no packets have been sent for at least n seconds (specify –ping on both peers to cause ping packets to be sent in both directions since OpenVPN ping packets are not echoed like IP ping packets). When used in one of OpenVPN’s secure modes (where –secret, –tls-server, or –tls-client is specified), the ping packet will be cryptographically secure.This option has two intended uses: (1) Compatibility with stateful firewalls. The periodic ping will ensure that a stateful firewall rule which allows OpenVPN UDP packets to pass will not time out. (2) To provide a basis for the remote to test the existence of its peer using the –ping-exit option. –ping-exit n Causes OpenVPN to exit after n seconds pass without reception of a ping or other packet from remote. This option can be combined with –inactive, –ping, and –ping-exit to create a two-tiered inactivity disconnect.For example, openvpn [options…] –inactive 3600 –ping 10 –ping-exit 60 when used on both peers will cause OpenVPN to exit within 60 seconds if its peer disconnects, but will exit after one hour if no actual tunnel data is exchanged. -
@mcury
here is my states table (1st line is 8.8.8.8 monitor ip, second line is my ping running)
connection is solid so far, let me stop the other 2nd line ping in the background
thanks for the link , I did read that man page, so what do i do to keep ping alive or why does the monitor ip ping not keep alive?
-
@jonny-b74 said in Client VPN is closing its connection randomly:
here is my states table (1st line is 8.8.8.8 monitor ip, second line is my ping running)
If Google is blocking pings from your VPN IP, I would change the VPN monitor IP, choose one that replies back.
thanks for the link , I did read that man page, so what do i do to keep ping alive or why does the monitor ip ping not keep alive?
Change your VPN monitor IP as per my comment above.
I suppose that the ping 5 setting needs an openvpn interface in pfsense, to source that ping.. I see that you created one, lets see how it goes. -
Just to clarify , in my states image above it shows monitor ip icmp working, is that using my WAN interface to monitor the VPN? and hence it is not blocked
not sure how to source a ping on the openvpn Interface and would you recommend that to run infinitely?
i have tried a few monitor ip's 1.1.1.1 etc did not help keep connection alive
-
do i need any firewall rules on my openvpn interface ?
edit: did not make any difference adding any rules
I am using a vlans interface with gateway keepsolid_v4 and has allow all
My computer is connected to the vlan and can surf the openvpn for that 10 mins -
@jonny-b74 Your image is showing interface KEEPSOLID_US as the source, so how you have replies from 8.8.8.8 and the ping you tried earlier didn't work?
I would confirm if 8.8.8.8 is reachable through the VPN by pinging it directly, you can use a computer that is set to go out through the VPN, so you wouldn't need to choose any source interface in pfsense..
Just make sure that the computer is indeed being routed through the VPN.. -
@mcury said in Client VPN is closing its connection randomly:
@jonny-b74 Your image is showing interface KEEPSOLID_US as the source, so how you have replies from 8.8.8.8 and the ping you tried earlier didn't work?
I would confirm if 8.8.8.8 is reachable through the VPN by pinging it directly, you can use a computer that is set to go out through the VPN, so you wouldn't need to choose any source interface in pfsense..
8.8.8.8 is not reachable from my computer via the vpn ... apologies it just did
Just make sure that the computer is indeed being routed through the VPN..
-
@jonny-b74 said in Client VPN is closing its connection randomly:
8.8.8.8 is not reachable from my computer via the vpn ... apologies it just did
If the ping is working , OK, but note that Google drops some ICMP packets, at least they used to drop.
Based on your ping/ping-exit config, if no packets sent/received for at least 5 seconds, one ping would be sent, and if this ping is not replied by remote 6 times in a roll (5 x 6 = 30), a ping-exit will happen..
So, keep using the computer for at least 30 minutes, just use the VPN, to confirm if it will drop..
Then report backYou can leave a ping running to 8.8.8.8 from this computer, check if you have drops..
-
vpn just dropped aroung 20 mins total time
Feb 15 20:02:49 openvpn 35548 SIGTERM[soft,ping-exit] received, process exitingI was running ping 8.8.8.8 in the background
-
hm, that is really strange, ping,soft-exit, received..
It seems that they are dropping you, and it's not your side (pfsense), that is dropping the connection..
Are you sure that you have the most up to date ovpn file? Try to check if they have a newer version.. Do they have a guide to connect pfsense or any other client to their servers?
Somehow they are saying that you are not using the tunnel, so they drop the connection for inactivity..do i need any firewall rules on my openvpn interface ?
No, delete any rule from the openvpn interface, that would disrupt the reply-to to work.
Leave only the rules in the KEEPSOLID interface you created.. -
They said they are not dropping me, i cannot be sure of that statement from them
Yes it generates the config.ovpn file with a cert and key only for me everytime using their guide
I have tried many of their servers various us, japan does not hold for more that 10-30 mins
Their other protocols "L2TP" in pfsense work
Works in windows openvpn client software with no changes direct import.
Not sure why in pfsense Openvpn it drops for this provider, other provider i tested with works OOB
-
@jonny-b74 Well, unfortunately I don't know either..
If it works in Windows, and not in pfsense, maybe there is a difference in the openvpn version, or maybe you are not importing all the .opvn settings to pfsense..
I would edit the .opvn file in Windows, and try to configure exactly as it is in the pfsense, are you using the custom options in pfsense?
Edit: You can set a higher debug level in the openvpn configuration to see more details about the problem
-
@mcury said in Client VPN is closing its connection randomly:
@jonny-b74 Well, unfortunately I don't know either..
If it works in Windows, and not in pfsense, maybe there is a difference in the openvpn version, or maybe you are not importing all the .opvn settings to pfsense..
I would edit the .opvn file in Windows, and try to configure exactly as it is in the pfsense, are you using the custom options in pfsense?
I am using the settings from their config file and many combinations as such,
I have edited the config.ovpn in pfsense directly and pasted the entire config file in there run the openvpn daemon manually in shellhere are their settings
reneg-sec 0
persist-tun
persist-key
ping 5
ping-exit 30
comp-lzo no
remote-random
remote-cert-tls server
auth-nocache
route-metric 1
cipher AES-256-CBC
auth sha512Edit: tired with debug level 11 in openvpn pfsense not more details only the extra around the close time was was the SSL alert (write): warning: close notify