Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

OpenVPN works fine over TCP port 443 but fails to connect over UDP port 53. I've checked firewalls. Initial handshake works fine but then client hangs in WAIT state. VPN server is Ubuntu and client is Windows.

Update: just tried to connect from different network and everything worked fine. What may be broken in my network?

Here are the configs:

mode server
tls-server
server 172.16.130.0 255.255.255.0
port 53
proto udp
dev tun0
comp-lzo
persist-key
persist-tun
user nobody
group nogroup
duplicate-cn
keepalive 10 120
ifconfig-pool-persist ipp.txt
status openvpn-status.log
log-append /var/log/openvpn.log
verb 5

#certificates and encryption
ca easy-rsa/keys/ca.crt
cert easy-rsa/keys/home.crt
key easy-rsa/keys/home.key
dh easy-rsa/keys/dh2048.pem
tls-auth easy-rsa/keys/ta.key 0

#routes
push "route 172.16.128.0 255.255.252.0"

.

client
dev tun
dev-node vpn-home
proto udp
remote 89.188.126.148 53
resolv-retry infinite
nobind
persist-key
persist-tun
ca home_ca.crt
cert home-client.crt
key home-client.key
tls-auth home_ta.key 1
comp-lzo
verb 5

And logs. Server:

Wed May 21 16:40:43 2014 us=592168 Initialization Sequence Completed
Wed May 21 16:41:02 2014 us=502237 MULTI: multi_create_instance called
Wed May 21 16:41:02 2014 us=502452 85.142.26.224:20351 Re-using SSL/TLS context
Wed May 21 16:41:02 2014 us=502597 85.142.26.224:20351 LZO compression initialized
Wed May 21 16:41:02 2014 us=503143 85.142.26.224:20351 Control Channel MTU parms [ L:1542 D:166 EF:66 EB:0 ET:0 EL:0 ]
Wed May 21 16:41:02 2014 us=503208 85.142.26.224:20351 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Wed May 21 16:41:02 2014 us=503359 85.142.26.224:20351 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 0,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-server'
Wed May 21 16:41:02 2014 us=503409 85.142.26.224:20351 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-client'
Wed May 21 16:41:02 2014 us=503493 85.142.26.224:20351 Local Options hash (VER=V4): '14168603'
Wed May 21 16:41:02 2014 us=503557 85.142.26.224:20351 Expected Remote Options hash (VER=V4): '504e774e'
RWed May 21 16:41:02 2014 us=503691 85.142.26.224:20351 TLS: Initial packet from [AF_INET]85.142.26.224:20351, sid=ac1bebfb 9e347a98
WWRWWRWRWRW^C

Client:

Wed May 21 16:40:45 2014 OpenVPN 2.3.2 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [eurephia] [IPv6] built on Aug  8 2013
Wed May 21 16:40:45 2014 MANAGEMENT: TCP Socket listening on [AF_INET]127.0.0.1:25340
Wed May 21 16:40:45 2014 Need hold release from management interface, waiting...
Wed May 21 16:40:45 2014 MANAGEMENT: Client connected from [AF_INET]127.0.0.1:25340
Wed May 21 16:40:45 2014 MANAGEMENT: CMD 'state on'
Wed May 21 16:40:45 2014 MANAGEMENT: CMD 'log all on'
Wed May 21 16:40:46 2014 MANAGEMENT: CMD 'hold off'
Wed May 21 16:40:46 2014 MANAGEMENT: CMD 'hold release'
Wed May 21 16:40:46 2014 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.
Wed May 21 16:40:46 2014 Control Channel Authentication: using 'home_ta.key' as a OpenVPN static key file
Wed May 21 16:40:46 2014 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed May 21 16:40:46 2014 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Wed May 21 16:40:46 2014 LZO compression initialized
Wed May 21 16:40:46 2014 Control Channel MTU parms [ L:1542 D:166 EF:66 EB:0 ET:0 EL:0 ]
Wed May 21 16:40:46 2014 Socket Buffers: R=[8192->8192] S=[8192->8192]
Wed May 21 16:40:46 2014 MANAGEMENT: >STATE:1400676046,RESOLVE,,,
Wed May 21 16:40:46 2014 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Wed May 21 16:40:46 2014 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-client'
Wed May 21 16:40:46 2014 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 0,cipher BF-CBC,auth SHA1,keysize 128,tls-auth,key-method 2,tls-server'
Wed May 21 16:40:46 2014 Local Options hash (VER=V4): '504e774e'
Wed May 21 16:40:46 2014 Expected Remote Options hash (VER=V4): '14168603'
Wed May 21 16:40:46 2014 UDPv4 link local: [undef]
Wed May 21 16:40:46 2014 UDPv4 link remote: [AF_INET]89.188.126.148:53
Wed May 21 16:40:46 2014 MANAGEMENT: >STATE:1400676046,WAIT,,,
share|improve this question
    
One possible case is MTU of your link being smaller than the size of packets OpenVPN exchanges, and PMTU-D is broken for at least one hop in your network link. See e.g. this and this and this in general. Note that your server or client might be misconfigured to ignore ICMP "can't fragment" messages which break PMTU-D (see this for more info). –  kostix May 21 at 13:16
    
IOW, while the first two links explain possible workarounds, it's usually better to make sure both ends of your link are able to detect the MSS by themselves, and use it, and for that to work, you need to have working PMTU-D on both ends and all the hops between them. –  kostix May 21 at 13:18
    
Also note that forcibly setting MTU too low might bite your Windows client if it joins a domain and hence uses Kerberos for authentication: Kerberos by default uses UDP (port 88, IIRC), and its ticket request/response datagrams might be quire large -- almost hitting the 1500 limit of Ethernet frames. And if you'll artifically lower the OpenVPN's link below something like 1.4k, you will experience Kerberos failing strangely, and authentication problems. On the other hand, Windows might be condigured to use TCP for Kerberos exchanges. –  kostix May 21 at 13:21

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.