14

I have an openvpn (version 2.1_rc15 at both ends) connection setup between two gentoo boxes using shared keys. it works fine for the most part. I use mysql, http, ftp, scp over the vpn with no problems. But when I ssh from the client to the server over the vpn, weird things happen. I can login, i can execute some commands. But if i try to run an ncurses application like top, or i try to cat a file, the connection will stall and I'll have to sever the ssh session.

I can, for example, execute "echo blah; echo .; echo blah" and it will output the three lines of text over the ssh session fine. But if i execute "cat /etc/motd" the session will freeze the moment I press enter.

I compiled openvpn 2.1.1 on my mac and copied over my config directory from my gentoo client. The mac connected and ssh sessions worked fine without freezing.

I then compiled it on my older gentoo box (2.6.26 kernel) which I am retiring due to a dying hard drive, and ssh over it also works perfectly.

Why does it fail on my brand new gentoo box ? I've tried compiling three different kernels in case it was that, but other than that there should be no difference between my older and my newer gentoo boxes that I can think of.

Any suggestions on what's wrong ?

Improve this question
1
  • In my case, ssh, cat, top & HTTP all worked, but scp didn't (it would show 100% transferred and hang there). Lowering the MTU to 1380 fixed it.
    – Roger Dueck
    Oct 15, 2015 at 18:56

5 Answers 5

Reset to default
16

smells like mtu issue. try to lower it as described in official manual or in this blog post.

Improve this answer
4
  • 2
    Thanks. I had tried dropping the MTU of the ethernet interface with no result, but adding "fragment 1400" to the client and server as in the post you mentioned worked great. I wonder why the older gentoo box worked fine but the newer one didn't. Oh well, fixed now. Thanks
    – Pawz Lion
    May 3, 2010 at 6:45
  • Thanks. This fixed my issue. At the office I have the exact same setup without any issues, but at my home, it has some hangs in cases. If I curl a url of a file with a - in it, it hangs. Without a -, it works :D, and if I break up long lines in the file, it also works. It makes no sense, but thanks for the solution.
    – Peter
    Jul 18, 2013 at 6:54
  • 1
    Note openvpn's mtu-test option mentioned in the above-linked blog post. This will empirically test the mtu of your openvpn tunnel so you know what values to use when setting fragment and mssfix and aren't just guessing. I saw lots of posts on the internet setting mtu/fragment to 1400, 1350, 1200, etc. But when I actually ran mtu-test, openvpn determined the MTU to be 1189!
    – jdhildeb
    Apr 23, 2015 at 15:18
  • For me it was adding "mssfix 1200" to my .ovpn client config file. Many thanks!
    – mvw
    May 8, 2023 at 22:09
7

This command solves it for me:

$ sudo ip link set dev tun0 mtu 1350 && echo ":)"

You can Verify tun0 settings with

$ ip a s

Cheers!

Improve this answer
2

Yep, it's all about MTU.

But in my case I've got a problem even more weird. At home, using an OpenVPN Windows client it freezes. But in my office it works fine.

I tried to change it on my ADSL Modem without success. At my Office I use a cable modem and other ISP.

After changing the MTU of Windows TAP adapter to 1200, it works fine. Something high than that, would freeze for me.

enter image description here

Improve this answer
1

I had simillar issue when OpenVPN was connecting over 3g with bad coverage and lost of packet loss. Switching to TCP instead of UDP fixed all issues I had after that. Hope this helps you out.

Improve this answer
2
  • Running a VPN over TCP comes with its own set of problems. Fixing the MTU problem and staying with UDP is likely to work better than using TCP will.
    – kasperd
    Nov 26, 2014 at 10:22
  • For OP changing only MTU is probably better suggestion than changing from TCP to UDP. If you have extremely bad, so bad that OpenVPN won't even establish stable connection connection, then you should try TCP instead of UDP. In extremely bad 3G cases changing to TCP was only thing that worked for me.
    – valentt
    Nov 28, 2014 at 14:44
0

I used tunnelblick instead of OpenVPN, and I couldn't find a configuration for the MTU value. Instead, I found the interface for the VPN in the output of ifconfig (in my case it was utun0) and set the MTU for it manually like so:

ifconfig utun0 mtu 576

After that, my ssh session wouldn't freeze anymore.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .