Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a network, and one of the hosts (server0, have puppetmaster installed. Others are connecting to it and everything seems fine.

Another one host (server1) is on another network and have openvpn connection to to puppetmaster host, openvpn network is ( - server0, - server1).

Everything was working some time ago, but now when I'm trying to run puppet on server1 it fails with no message:

/usr/sbin/puppetd --no-daemonize --debug -o --server server0.fqdn
debug: Loaded state in 0.00 seconds
debug: Using cached certificate for ca
debug: Using cached certificate for server1
debug: Using cached certificate_revocation_list for ca
debug: catalog supports formats: b64_zlib_yaml marshal pson raw yaml; using pson
err: Could not retrieve catalog from remote server: 
info: Not using expired catalog for server1 from cache; expired at Fri May 27 15:56:15 +0300 2011
notice: Using cached catalog
err: Could not retrieve catalog; skipping run

Can't understand what am I missing. Telnet to puppet port works fine, as well as http. I've tried to connect to both 192.168.124.X and 10.10.0.X ips.

Here is the routing table to server1:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface UGH   0      0        0 tun0 UH    0      0        0 tun0   UG    0      0        0 tun0   U     0      0        0 eth0         192.168.10.X         UG    0      0        0 eth0

tcpdump of connection attempt:

15:44:17.556745 IP > S 3630206975:3630206975(0) win 5840 <mss 1460,sackOK,timestamp 333953908 0,nop,wscale 7>
15:44:17.938407 IP > S 3687729362:3687729362(0) ack 3630206976 win 5792 <mss 1366,sackOK,timestamp 3325304835 333953908,nop,wscale 7>
15:44:17.938417 IP > . ack 1 win 46 <nop,nop,timestamp 333954290 3325304835>
15:44:17.939187 IP > P 1:106(105) ack 1 win 46 <nop,nop,timestamp 333954291 3325304835>
15:44:18.274663 IP > F 1:1(0) ack 1 win 46 <nop,nop,timestamp 3325305329 333954290>
15:44:18.274893 IP > F 106:106(0) ack 2 win 46 <nop,nop,timestamp 333954626 3325305329>
15:44:18.533685 IP > R 3687729363:3687729363(0) win 0
15:44:18.753026 IP > R 3687729364:3687729364(0) win 0

Why does it resets connection?

There's nothing in puppetmaster log, even when running with -d switch.

Any ideas? Thanks.

share|improve this question
Run puppet master in --no-daemonize --debug mode and see what it says. – Daniel C. Sobral May 30 '11 at 14:00
Nothing about this host :( – rvs May 30 '11 at 14:12

Did you put the network inside fileserver.conf? Also, are you sure date&time on client and server are reasonably synchronized?

Oh, I just noticed the server is natted! You said server0's IP is, but the connection is being made to according to the dump. This might cause the server certificate to be rejected.

If I were you, I'd make sure to connect to the non-natted IP, and also make sure that the name of the puppet server matches its non-natted IP, and that the reverse of the IP matches the name.

Use a different name for the OpenVPN IP.

share|improve this answer
Yes, vpn network added to fileserver.conf. Date/time is synced, but servers are in different timezones (so local time have huge difference). I'll try to temporary switch servers to the same timezone (not on business hours, so I can't try this right now). – rvs May 30 '11 at 14:14
@rvs Different timezone shouldn't matter. Was the client certificate signed at all? And is there any NAT happening? – Daniel C. Sobral May 30 '11 at 17:02
@rvs I just noticed something else, and edited my answer. – Daniel C. Sobral Jun 1 '11 at 14:27
@rvs and does the name server0.fqdn solves to the IP and vice versa on both client and server? – Daniel C. Sobral Jun 1 '11 at 15:00
@rvs But the other clients do access the IP, do they? – Daniel C. Sobral Jun 1 '11 at 18:23

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.