Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am having a rather strange issue with my OpenVPN configuration. I am connecting from Windows 7 with official latest OpenVPN client to my OpenVPN server (OpenVPN 2.1.4 i386-redhat-linux-gnu).

The problem is I am getting disconnected from my OpenVPN server exactly after 1 hour and I can't understand what directive/option is reponsible for this. Maybe it's a client issue? I have tried different Windows systems and Windows VPN clients. The Linux clients are working as expected with no disconnections.

Could you please help me to troublshoot this issue? I have tried reading books and googling and some people advise to play with keepalive and reneg-sec directives. But that does not seem to help.

OpenVPN server config

port 1194
proto udp
dev tun
ca ca.crt
cert server.crt
key server.key
dh dh1024.pem
server 192.168.2.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 10.0.0.0 255.0.0.0"
client-config-dir ccd
route 192.168.51.0 255.255.255.0
keepalive 60 600
reneg-sec 5000
hand-window 15
tls-auth ta.key 0
comp-lzo
max-clients 50
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
verb 4
crl-verify crl.pem
management localhost 11111
plugin /usr/share/openvpn/plugin/lib/openvpn-auth-pam.so login
push "dhcp-option DNS 192.168.2.1"
push "dhcp-option DOMAIN example.com"
push "dhcp-option SEARCH example.com"

Server log (isn't the problem in reinit_src=1?)

Oct  9 07:23:38 vpn openvpn[19495]: user/192.168.253.20:54568 TLS Error: TLS handshake failed
Oct  9 07:23:38 vpn openvpn[19495]: user/192.168.253.20:54568 TLS: move_session: dest=TM_LAME_DUCK src=TM_ACTIVE reinit_src=1
Oct  9 07:24:53 vpn openvpn[19495]: user/192.168.253.20:54568 TLS Error: TLS handshake failed
Oct  9 07:26:08 vpn openvpn[19495]: user/192.168.253.20:54568 TLS Error: TLS key negotiation failed to occur within 15 seconds (check your network connectivity)
Oct  9 07:26:08 vpn openvpn[19495]: user/192.168.253.20:54568 TLS Error: TLS handshake failed
Oct  9 07:26:39 vpn openvpn[19495]: user/192.168.253.20:54568 [UNDEF] Inactivity timeout (--ping-restart), restarting
Oct  9 07:26:39 vpn openvpn[19495]: user/192.168.253.20:54568 SIGUSR1[soft,ping-restart] received, client-instance restarting

Client log

RwrWRwRwRwRwTue Oct 09 07:26:39 2012 us=796000 TLS: soft reset sec=0 bytes=7405621/0 pkts=9459/0
Tue Oct 09 07:26:39 2012 us=600000 ERROR: could not read Auth username from stdin
Tue Oct 09 07:26:39 2012 us=600000 Exiting
Tue Oct 09 07:26:39 2012 us=600000 C:\WINDOWS\system32\route.exe DELETE 192.168.2.1 MASK 255.255.255.255 192.168.100.150
Tue Oct 09 07:26:39 2012 us=600000 Route deletion via IPAPI succeeded [adaptive]
Tue Oct 09 07:26:39 2012 us=600000 C:\WINDOWS\system32\route.exe DELETE 10.0.0.0 MASK 255.0.0.0 192.168.100.150
Tue Oct 09 07:26:39 2012 us=600000 Route deletion via IPAPI succeeded [adaptive]
Tue Oct 09 07:26:39 2012 us=600000 Closing TUN/TAP interface

Thank you very much.

share|improve this question

2 Answers 2

up vote 4 down vote accepted

The culprit seems to be your authentication configuration. You are using plugin /usr/share/openvpn/plugin/lib/openvpn-auth-pam.so login which would require the client to supply a valid username/password combination to connect. Apparently, this is also required upon rekeying and your OpenVPN client seems unable to request the user name from stdin (ERROR: could not read Auth username from stdin).

As for the reason why raising reneg-sec in your server configuration does not help matters, this is because the parameter has to be specified in both - the server's and the client's config to be effectively raised above the default of 3600 seconds (which happens to cause the one hour - disconnect you are seeing).

So your options would be to

  • use an authentication method which does not require user input (certificates spring to mind)
  • troubleshoot why your client is unable to prompt for the user name / password combination after connection establishment
  • raise the rekeying period or disable rekeying entirely (which weakens your connection's security, so it surely is only an inferior workaround to your problem)
share|improve this answer
    
You are right, putting reneg-sec to the client.ovpn helped to resolve this issue. –  Andrew Oct 10 '12 at 9:51

I experienced a similar effect when I added the 'auth-nocache' option to my client configuration. I use certificates AND a username + password combination to authenticate.

A few times I noticed in the connection logs that openvpn reported the following warning:

WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this

So I thought I'll just add this option and see what happens. Well, the above warning does go away, but after an hour a dialog box popped up, asking me for my username and password.

I noticed that the above configuration by Andrew doesn't contain this option so I'm a little puzzled as to why it doesn't cache the password. Maybe this is because I'm using a newer version of openvpn or maybe it can be set on the server config to push this option to the client.

This was seen on: OpenVPN 2.2.1-8+deb7u2 with OpenVPN GUI v5 for Windows.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.