Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Все время реконнектится Openvpn

    Scheduled Pinned Locked Moved
    Russian
    2
    6
    2.0k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • H
      hikmat
      last edited by

      Народ добрый день,

      Помогите пожалуйста,

      Есть в Ташкенте сервер Pfsense 2.3.3.1 с поднятым несколькими Openvpn на борту. Один из них настроен на 443 порт по UDP в режиме tun Peer-to-Peer SSL/TLS.
      В Пекине в филиале также имеется клиент Pfsense 2.3.3.1 с поднятым Openvpn.
      Клиент успешно подключается к серверу, вроде все работает. Пингуем и видим компы в удаленных сетях, соотвественно.
      Проблема, каждые N-минут (5-10-30 и т.д., всегда по разному), пропадает связь и клиент рестартует туннель.
      в чем может быть проблема?

      Да кстати, почему-то не могу пинговать адреса туннеля, хотя на других экземлярах Openvpn подобные адреса пингуются.
      В обеих точках во вкладе Rules/Openvpn имеется доступ с source=локальные сети + сеть туннеля до всех адресов по любому протоколу.

      Конфиг сервера /var/etc/openvpn/server5.conf:

      
dev ovpns5
verb 4
dev-type tun
tun-ipv6
dev-node /dev/tun5
writepid /var/run/openvpn_server5.pid
#user nobody
#group nobody
script-security 3
daemon
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
proto udp
cipher AES-256-CBC
auth SHA512
up /usr/local/sbin/ovpn-linkup
down /usr/local/sbin/ovpn-linkdown
local 195.158.х.х
tls-server
server 10.0.100.0 255.255.255.0
client-config-dir /var/etc/openvpn-csc/server5
ifconfig 10.0.100.1 10.0.100.2
tls-verify "/usr/local/sbin/ovpn_auth_verify tls 'vpn-server.mfa.uz' 1"
lport 443
management /var/etc/openvpn/server5.sock unix
push "route 172.30.30.176 255.255.255.240"
push "route 192.168.1.0 255.255.255.0"
route 192.168.45.0 255.255.255.0
route 192.168.46.0 255.255.255.0
ca /var/etc/openvpn/server5.ca 
cert /var/etc/openvpn/server5.cert 
key /var/etc/openvpn/server5.key 
dh /etc/dh-parameters.4096
crl-verify /var/etc/openvpn/server5.crl-verify 
tls-auth /var/etc/openvpn/server5.tls-auth 0
persist-remote-ip
float
topology subnet

      Оверрайд клиента /var/etc/openvpn-csc/server5

      
iroute 192.168.45.0 255.255.255.0

      Конфиг клиента /var/etc/openvpn/client1.conf:

      
dev ovpnc1
verb 1
dev-type tun
tun-ipv6
dev-node /dev/tun1
writepid /var/run/openvpn_client1.pid
#user nobody
#group nobody
script-security 3
daemon
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
proto udp
cipher AES-256-CBC
auth SHA512
up /usr/local/sbin/ovpn-linkup
down /usr/local/sbin/ovpn-linkdown
local 192.168.200.199
tls-client
client
lport 0
management /var/etc/openvpn/client1.sock unix
remote 195.158.x.x 443
ca /var/etc/openvpn/client1.ca
cert /var/etc/openvpn/client1.cert
key /var/etc/openvpn/client1.key
tls-auth /var/etc/openvpn/client1.tls-auth 1
resolv-retry infinite
remote-cert-tls server

      **Вот логи клиента:```
      May 3 15:04:56 openvpn 94536 Initialization Sequence Completed
      May 3 15:04:56 openvpn 94536 Preserving previous TUN/TAP instance: ovpnc1
      May 3 15:04:54 openvpn 94536 [vpn-server.mfa.uz] Peer Connection Initiated with [AF_INET]195.158.x.x:443
      May 3 15:04:38 openvpn 94536 UDPv4 link remote: [AF_INET]195.158.x.x:443
      May 3 15:04:38 openvpn 94536 UDPv4 link local (bound): [AF_INET]192.168.200.199
      May 3 15:04:38 openvpn 94536 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
      May 3 15:04:35 openvpn 94536 SIGUSR1[soft,ping-restart] received, process restarting
      May 3 15:04:35 openvpn 94536 [UNDEF] Inactivity timeout (--ping-restart), restarting
      May 3 15:03:35 openvpn 94536 UDPv4 link remote: [AF_INET]195.158.x.x:443
      May 3 15:03:35 openvpn 94536 UDPv4 link local (bound): [AF_INET]192.168.200.199
      May 3 15:03:35 openvpn 94536 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
      May 3 15:03:33 openvpn 94536 SIGUSR1[soft,ping-restart] received, process restarting
      May 3 15:03:33 openvpn 94536 [UNDEF] Inactivity timeout (--ping-restart), restarting
      May 3 15:02:33 openvpn 94536 UDPv4 link remote: [AF_INET]195.158.x.x:443
      May 3 15:02:33 openvpn 94536 UDPv4 link local (bound): [AF_INET]192.168.200.199
      May 3 15:02:33 openvpn 94536 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
      May 3 15:02:31 openvpn 94536 SIGUSR1[soft,tls-error] received, process restarting
      May 3 15:02:31 openvpn 94536 TLS Error: TLS handshake failed
      May 3 15:02:31 openvpn 94536 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
      May 3 15:01:37 openvpn 94536 TLS Error: Unroutable control packet received from [AF_INET]195.158.x.x:443 (si=3 op=P_ACK_V1)
      May 3 15:01:31 openvpn 94536 UDPv4 link remote: [AF_INET]195.158.x.x:443
      May 3 15:01:31 openvpn 94536 UDPv4 link local (bound): [AF_INET]192.168.200.199
      May 3 15:01:31 openvpn 94536 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
      May 3 15:01:29 openvpn 94536 SIGUSR1[soft,ping-restart] received, process restarting
      May 3 15:01:29 openvpn 94536 [UNDEF] Inactivity timeout (--ping-restart), restarting
      May 3 15:00:29 openvpn 94536 UDPv4 link remote: [AF_INET]195.158.x.x:443
      May 3 15:00:29 openvpn 94536 UDPv4 link local (bound): [AF_INET]192.168.200.199
      May 3 15:00:29 openvpn 94536 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
      May 3 15:00:27 openvpn 94536 SIGUSR1[soft,ping-restart] received, process restarting
      May 3 15:00:27 openvpn 94536 [UNDEF] Inactivity timeout (--ping-restart), restarting
      May 3 14:59:27 openvpn 94536 UDPv4 link remote: [AF_INET]195.158.x.x:443
      May 3 14:59:27 openvpn 94536 UDPv4 link local (bound): [AF_INET]192.168.200.199
      May 3 14:59:27 openvpn 94536 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
      May 3 14:59:25 openvpn 94536 SIGUSR1[soft,ping-restart] received, process restarting
      May 3 14:59:25 openvpn 94536 [vpn-server.mfa.uz] Inactivity timeout (--ping-restart), restarting
      May 3 14:58:25 openvpn 94536 [vpn-server.mfa.uz] Peer Connection Initiated with [AF_INET]195.158.x.x:443
      May 3 14:58:11 openvpn 94536 UDPv4 link remote: [AF_INET]195.158.x.x:443
      May 3 14:58:11 openvpn 94536 UDPv4 link local (bound): [AF_INET]192.168.200.199
      May 3 14:58:11 openvpn 94536 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
      May 3 14:58:09 openvpn 94536 SIGUSR1[soft,ping-restart] received, process restarting
      May 3 14:58:09 openvpn 94536 [UNDEF] Inactivity timeout (--ping-restart), restarting
      May 3 14:57:09 openvpn 94536 UDPv4 link remote: [AF_INET]195.158.x.x:443
      May 3 14:57:09 openvpn 94536 UDPv4 link local (bound): [AF_INET]192.168.200.199
      May 3 14:57:09 openvpn 94536 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
      May 3 14:57:07 openvpn 94536 SIGUSR1[soft,ping-restart] received, process restarting
      May 3 14:57:07 openvpn 94536 [UNDEF] Inactivity timeout (--ping-restart), restarting
      May 3 14:56:07 openvpn 94536 UDPv4 link remote: [AF_INET]195.158.x.x:443
      May 3 14:56:07 openvpn 94536 UDPv4 link local (bound): [AF_INET]192.168.200.199
      May 3 14:56:07 openvpn 94536 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
      May 3 14:56:05 openvpn 94536 SIGUSR1[soft,ping-restart] received, process restarting
      May 3 14:56:05 openvpn 94536 [vpn-server.mfa.uz] Inactivity timeout (--ping-restart), restarting
      May 3 14:34:33 openvpn 94536 Initialization Sequence Completed
      May 3 14:34:33 openvpn 94536 Preserving previous TUN/TAP instance: ovpnc1
      May 3 14:34:31 openvpn 94536 [vpn-server.mfa.uz] Peer Connection Initiated with [AF_INET]195.158.x.x:443
      May 3 14:34:27 openvpn 94536 TLS Error: Unroutable control packet received from [AF_INET]195.158.x.x:443 (si=3 op=P_ACK_V1)
      May 3 14:34:13 openvpn 94536 UDPv4 link remote: [AF_INET]195.158.x.x:443
      May 3 14:34:13 openvpn 94536 UDPv4 link local (bound): [AF_INET]192.168.200.199
      May 3 14:34:13 openvpn 94536 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
      May 3 14:34:11 openvpn 94536 SIGUSR1[soft,ping-restart] received, process restarting
      May 3 14:34:11 openvpn 94536 [UNDEF] Inactivity timeout (--ping-restart), restarting
      May 3 14:33:11 openvpn 94536 UDPv4 link remote: [AF_INET]195.158.x.x:443
      May 3 14:33:11 openvpn 94536 UDPv4 link local (bound): [AF_INET]192.168.200.199
      May 3 14:33:11 openvpn 94536 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
      May 3 14:33:09 openvpn 94536 SIGUSR1[soft,ping-restart] received, process restarting
      May 3 14:33:09 openvpn 94536 [UNDEF] Inactivity timeout (--ping-restart), restarting
      May 3 14:32:09 openvpn 94536 UDPv4 link remote: [AF_INET]195.158.x.x:443
      May 3 14:32:09 openvpn 94536 UDPv4 link local (bound): [AF_INET]192.168.200.199
      May 3 14:32:09 openvpn 94536 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
      May 3 14:32:07 openvpn 94536 SIGUSR1[soft,tls-error] received, process restarting
      May 3 14:32:07 openvpn 94536 TLS Error: TLS handshake failed
      May 3 14:32:07 openvpn 94536 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
      May 3 14:31:07 openvpn 94536 UDPv4 link remote: [AF_INET]195.158.x.x:443
      May 3 14:31:07 openvpn 94536 UDPv4 link local (bound): [AF_INET]192.168.200.199
      May 3 14:31:07 openvpn 94536 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
      May 3 14:31:05 openvpn 94536 SIGUSR1[soft,ping-restart] received, process restarting
      May 3 14:31:05 openvpn 94536 [UNDEF] Inactivity timeout (--ping-restart), restarting
      May 3 14:30:05 openvpn 94536 UDPv4 link remote: [AF_INET]195.158.x.x:443
      May 3 14:30:05 openvpn 94536 UDPv4 link local (bound): [AF_INET]192.168.200.199
      May 3 14:30:05 openvpn 94536 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
      May 3 14:30:03 openvpn 94536 SIGUSR1[soft,ping-restart] received, process restarting
      May 3 14:30:03 openvpn 94536 [UNDEF] Inactivity timeout (--ping-restart), restarting
      May 3 14:29:03 openvpn 94536 UDPv4 link remote: [AF_INET]195.158.x.x:443
      May 3 14:29:03 openvpn 94536 UDPv4 link local (bound): [AF_INET]192.168.200.199
      May 3 14:29:03 openvpn 94536 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
      May 3 14:29:01 openvpn 94536 SIGUSR1[soft,ping-restart] received, process restarting
      May 3 14:29:01 openvpn 94536 [vpn-server.mfa.uz] Inactivity timeout (--ping-restart), restarting
      May 3 14:21:39 openvpn 94536 Initialization Sequence Completed
      May 3 14:21:39 openvpn 94536 Preserving previous TUN/TAP instance: ovpnc1
      May 3 14:21:36 openvpn 94536 [vpn-server.mfa.uz] Peer Connection Initiated with [AF_INET]195.158.x.x:443
      May 3 14:21:28 openvpn 94536 UDPv4 link remote: [AF_INET]195.158.x.x:443
      May 3 14:21:28 openvpn 94536 UDPv4 link local (bound): [AF_INET]192.168.200.199
      May 3 14:21:28 openvpn 94536 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
      May 3 14:21:26 openvpn 94536 SIGUSR1[soft,ping-restart] received, process restarting
      May 3 14:21:26 openvpn 94536 [UNDEF] Inactivity timeout (--ping-restart), restarting
      May 3 14:20:26 openvpn 94536 UDPv4 link remote: [AF_INET]195.158.x.x:443
      May 3 14:20:26 openvpn 94536 UDPv4 link local (bound): [AF_INET]192.168.200.199
      May 3 14:20:26 openvpn 94536 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
      May 3 14:20:24 openvpn 94536 SIGUSR1[soft,ping-restart] received, process restarting
      May 3 14:20:24 openvpn 94536 [UNDEF] Inactivity timeout (--ping-restart), restarting
      May 3 14:19:23 openvpn 94536 UDPv4 link remote: [AF_INET]195.158.x.x:443

      
**Вот лог севрера:**

      May 3 12:14:21 openvpn 33468 I/O WAIT TR|Tw|SR|Sw [7/9931]
      May 3 12:14:21 openvpn 33468 PO_CTL rwflags=0x0001 ev=5 arg=0x00693598
      May 3 12:14:21 openvpn 33468 PO_CTL rwflags=0x0001 ev=7 arg=0x00693594
      May 3 12:14:21 openvpn 33468 PO_CTL rwflags=0x0001 ev=6 arg=0x00694740
      May 3 12:14:21 openvpn 33468 SCHEDULE: schedule_find_least wakeup=[Wed May 3 12:14:29 2017 us=9926] pri=2071388902
      May 3 12:14:21 openvpn 33468 kayumov.mfa.uz/84.54.112.26:64383 SCHEDULE: schedule_add_modify wakeup=[Wed May 3 12:14:29 2017 us=9926] pri=2042523469
      May 3 12:14:21 openvpn 33468 kayumov.mfa.uz/84.54.112.26:64383 RANDOM USEC=58507
      May 3 12:14:21 openvpn 33468 kayumov.mfa.uz/84.54.112.26:64383 TLS: tls_multi_process: i=2 state=S_UNDEF, mysid=00000000 00000000, stored-sid=00000000 00000000, stored-ip=[undef]
      May 3 12:14:21 openvpn 33468 kayumov.mfa.uz/84.54.112.26:64383 TLS: tls_multi_process: i=1 state=S_INITIAL, mysid=3e08c98b 0f86ddcb, stored-sid=00000000 00000000, stored-ip=[undef]
      May 3 12:14:21 openvpn 33468 kayumov.mfa.uz/84.54.112.26:64383 TLS: tls_process: timeout set to 1096
      May 3 12:14:21 openvpn 33468 kayumov.mfa.uz/84.54.112.26:64383 ACK reliable_send_timeout 604800 [6]
      May 3 12:14:21 openvpn 33468 kayumov.mfa.uz/84.54.112.26:64383 ACK reliable_can_send active=0 current=0 : [6]
      May 3 12:14:21 openvpn 33468 kayumov.mfa.uz/84.54.112.26:64383 STATE S_NORMAL_OP
      May 3 12:14:21 openvpn 33468 kayumov.mfa.uz/84.54.112.26:64383 TLS: tls_process: chg=0 ks=S_NORMAL_OP lame=S_NORMAL_OP to_link->len=0 wakeup=1096
      May 3 12:14:21 openvpn 33468 kayumov.mfa.uz/84.54.112.26:64383 TLS: tls_multi_process: i=0 state=S_NORMAL_OP, mysid=0f678122 b7f33cc8, stored-sid=af61d163 b797e3aa, stored-ip=[AF_INET]84.54.112.26:64383
      May 3 12:14:21 openvpn 33468 kayumov.mfa.uz/84.54.112.26:64383 TIMER: coarse timer wakeup 7 seconds
      May 3 12:14:21 openvpn 33468 MULTI: REAP range 144 -> 160
      May 3 12:14:21 openvpn 33468 I/O WAIT status=0x0020
      May 3 12:14:21 openvpn 33468 event_wait returned 0
      May 3 12:14:18 openvpn 33468 I/O WAIT TR|Tw|SR|Sw [3/104880]
      May 3 12:14:18 openvpn 33468 PO_CTL rwflags=0x0001 ev=5 arg=0x00693598
      May 3 12:14:18 openvpn 33468 PO_CTL rwflags=0x0001 ev=7 arg=0x00693594
      May 3 12:14:18 openvpn 33468 PO_CTL rwflags=0x0001 ev=6 arg=0x00694740
      May 3 12:14:18 openvpn 33468 kayumov.mfa.uz/84.54.112.26:64383 UDPv4 write returned 165
      May 3 12:14:18 openvpn 33468 kayumov.mfa.uz/84.54.112.26:64383 UDPv4 WRITE [165] to [AF_INET]84.54.112.26:64383: P_DATA_V1 kid=2 DATA 6a49b95a 47d31a9e caa0eb92 df3bd156 c39da98a 884fd3ab 99dd6e71 2af1916[more...]
      May 3 12:14:18 openvpn 33468 I/O WAIT status=0x0002
      May 3 12:14:18 openvpn 33468 event_wait returned 1
      May 3 12:14:18 openvpn 33468 PO_WAIT[0,0] fd=6 rev=0x00000004 rwflags=0x0002 arg=0x00694740
      May 3 12:14:18 openvpn 33468 I/O WAIT Tr|Tw|Sr|SW [3/104880]
      May 3 12:14:18 openvpn 33468 PO_CTL rwflags=0x0001 ev=5 arg=0x00693598
      May 3 12:14:18 openvpn 33468 PO_CTL rwflags=0x0000 ev=7 arg=0x00693594
      May 3 12:14:18 openvpn 33468 PO_CTL rwflags=0x0002 ev=6 arg=0x00694740
      May 3 12:14:18 openvpn 33468 kayumov.mfa.uz/84.54.112.26:64383 ENCRYPT TO: 884fd3ab 99dd6e71 2af1916b 62e91d17 50555648 b6a0102c b45f3ca5 4d564e2[more...]
      May 3 12:14:18 openvpn 33468 kayumov.mfa.uz/84.54.112.26:64383 ENCRYPT FROM: 0000011a 45000077 bc520000 3f11d545 ac1e1ebe 0a001502 0035edf2 00633e5[more...]
      May 3 12:14:18 openvpn 33468 kayumov.mfa.uz/84.54.112.26:64383 ENCRYPT IV: 884fd3ab 99dd6e71 2af1916b 62e91d17
      May 3 12:14:18 openvpn 33468 kayumov.mfa.uz/84.54.112.26:64383 TLS: tls_pre_encrypt: key_id=2
      May 3 12:14:18 openvpn 33468 kayumov.mfa.uz/84.54.112.26:64383 TUN READ [119]
      May 3 12:14:18 openvpn 33468 GET INST BY VIRT: 10.0.21.2 -> kayumov.mfa.uz/84.54.112.26:64383 via 10.0.21.2
      May 3 12:14:18 openvpn 33468 read from TUN/TAP returned 119
      May 3 12:14:18 openvpn 33468 MULTI: REAP range 128 -> 144
      May 3 12:14:18 openvpn 33468 I/O WAIT status=0x0004
      May 3 12:14:18 openvpn 33468 event_wait returned 1
      May 3 12:14:18 openvpn 33468 PO_WAIT[1,0] fd=7 rev=0x00000001 rwflags=0x0001 arg=0x00693594
      May 3 12:14:17 openvpn 33468 I/O WAIT TR|Tw|SR|Sw [4/104880]
      May 3 12:14:17 openvpn 33468 PO_CTL rwflags=0x0001 ev=5 arg=0x00693598
      May 3 12:14:17 openvpn 33468 PO_CTL rwflags=0x0001 ev=7 arg=0x00693594
      May 3 12:14:17 openvpn 33468 PO_CTL rwflags=0x0001 ev=6 arg=0x00694740
      May 3 12:14:17 openvpn 33468 kayumov.mfa.uz/84.54.112.26:64383 write to TUN/TAP returned 72
      May 3 12:14:17 openvpn 33468 kayumov.mfa.uz/84.54.112.26:64383 TUN WRITE [72]
      May 3 12:14:17 openvpn 33468 I/O WAIT status=0x0008

      1 Reply Last reply Reply Quote 0
      • P
        pigbrother
        last edited by

        Конфиги на, первый взгляд, адекватные.
        Не может ли ваша проблема быть связана с работой DPI\Великого китайского файрволла?

        Попробуйте другие комбинации TCP\UDP и портов.

        И да, если прячете IP - делайте это тщательнее. ;)

        1 Reply Last reply Reply Quote 0
        • H
          hikmat
          last edited by

          Спасибо, я и сам думал про это. Прочитал про китаёзских файрвол. Попробую с верхних диапазонов взять порты выше 25000.
          Рекомендуют через SSH туннель пускать, но неохота так заморачиваться.
          Можно ли как-то полностью спрятать наличие траффика OpenVPN, чтобы handshake не выделялся и был один в один похож на обычный SSL?

          1 Reply Last reply Reply Quote 0
          • P
            pigbrother
            last edited by

            @hikmat:

            Спасибо, я и сам думал про это. Прочитал про китаёзских файрвол. Попробую с верхних диапазонов взять порты выше 25000.
            Рекомендуют через SSH туннель пускать, но неохота так заморачиваться.
            Можно ли как-то полностью спрятать наличие траффика OpenVPN, чтобы handshake не выделялся и был один в один похож на обычный SSL?

            В OpenVPN 2.4 появилась такая возможность (название директивы не помню, недавно тут обсуждалось) OpenVPN 2.4 доступен в бете pfsense 2.4.

            1 Reply Last reply Reply Quote 0
            • P
              pigbrother
              last edited by

              Вспомнил:
              TLS Encryption (–tls-crypt)

              https://forum.pfsense.org/index.php?topic=66442.msg711087#msg711087

              1 Reply Last reply Reply Quote 0
              • H
                hikmat
                last edited by

                Огромное спасибо за подсказку,

                Тогда подождем немного, надеюсь скоро выйдет стабильная версия

                1 Reply Last reply Reply Quote 0
                • First post
                  Last post
                Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.