Weird vpn problem, connection restarts with long delay.



  • Running pfSense 2.0 on a Dell server, using OpenVPN Roadwarrior.
    In short: Some - but only some! - vpn clients restarts every 2 minutes after "inactivity timeout". Seems to be some issue with the p12-file (!).

    I have created 5 user-connections, Client config exported via Client Export -> Configuration archive.
    The .ovpn and .key files are identical for all users, .p12 is password protected.
    Problem:

    • Some Windows-users have problem with the tunnel being restarted every 2 minutes.
      Due to the OpenVPN log reconnection is done in a few seconds, however for the client the vpn-connection stalls for about half a minute each time.
    • On my Debian connection is not restarted.
    • On my Win7 connection is restarted with delay.
      Fix one: The .conf file created has unix-style LF/CR!
      So in Windows the config is all in one single line, with no space before new line.
      Example: dev tunpersist-tunpersist-keyproto udp …etc
      I fixed this with notepad, and my problems are gone.
      However, for my colleague this doesn't change anything.
      But when he uses my .p12 then the problems are gone, when I use his .p12 I get the restart problem (both Win & Debian)
      So it has to be related to the .p12, how is that possible?

    Summary:
    2 WinXP both has problem.
    Out of 5 users on Win7 Pro 3 have the delay problem 2 has no problems.
    Adding "ping-restart 0" doesn't help.

    Details:
    Setup
    Firewall & vpn server:

    • One pfsense box in serverhall with one public & one private ip.
    • OpenVPN as Roadwarrior server, Remote Access SSL/TLS.
    • Certificate created, TLS Auth uses Enable authentication of TLS packets.
    • Client config exported via Client Export -> Configuration archive

    Workstations:

    • 4 Office workstations running Win 7.
    • I run Debian Lenny in VirtualBox on one of these workstations as my main OS.
    • A bunch of home 'puters & laptops running Win 7 or Win XP.

    Log:

    Thu Dec  1 15:44:28 2011 Initialization Sequence Completed
    Thu Dec  1 15:46:17 2011 [Roadwarrior_cert] Inactivity timeout (--ping-restart), restarting
    Thu Dec  1 15:46:17 2011 SIGUSR1[soft,ping-restart] received, process restarting
    

    .ovpn:

    dev tun
    persist-tun
    persist-key
    proto udp
    cipher AES-128-CBC
    tls-client
    client
    resolv-retry infinite
    remote #.#.#.# 1194
    tls-remote Roadwarrior cert
    pkcs12 mail-udp-1194.p12
    tls-auth mail-udp-1194-tls.key 1
    

Log in to reply