I am running an OpenVPN server on a Debian virtual machine.

OpenVPN 2.1.0 x86_64-pc-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [MH] [PF_INET6] [eurephia] built on Jul  9 2010
Originally developed by James Yonan
Copyright (C) 2002-2009 OpenVPN Technologies, Inc. <sales@openvpn.net>

I recently switch from the TCP protocol to UDP. I had to use TCP as this was the only protocol that wasn't blocked in the network I used my VPN. I However won't be using that network anymore, and UDP should be allowed on all networks I'll be using the VPN in now.

However, I recently started to notice random disconnects on the VPN clients (both on a Mac and a Windows 7). I sometimes manage to stay connected for over an hour, sometimes only a couple of minutes. Also attempting to reconnect rarely works and I need to reload or restart the VPN service for it to work.

This is what's in the server log:

Sun Jul 25 12:54:29 2010 us=83586 vpn.rootspirit.com/ PUSH: Received control message: 'PUSH_REQUEST'
Sun Jul 25 12:54:29 2010 us=83660 vpn.rootspirit.com/ SENT CONTROL [vpn.rootspirit.com]: 'PUSH_REPLY,route,dhcp-option DOMAIN vpn.tuinslak.org,dhcp-option DNS,dhcp-option DNS,dhcp-option DNS,dhcp-option DNS,dhcp-option NTP,redirect-gateway def1,route,topology net30,ping 10,ping-restart 120,ifconfig' (status=1)
Sun Jul 25 13:49:23 2010 us=593925 MULTI: multi_create_instance called
Sun Jul 25 13:49:23 2010 us=593996 Re-using SSL/TLS context
Sun Jul 25 13:49:23 2010 us=594028 LZO compression initialized
Sun Jul 25 13:49:23 2010 us=594125 Control Channel MTU parms [ L:1542 D:166 EF:66 EB:0 ET:0 EL:0 ]
Sun Jul 25 13:49:23 2010 us=594140 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Sun Jul 25 13:49:23 2010 us=594175 Local Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 0,cipher DES-EDE3-CBC,auth SHA1,keysize 192,tls-auth,key-method 2,tls-server'
Sun Jul 25 13:49:23 2010 us=594188 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1542,tun-mtu 1500,proto UDPv4,comp-lzo,keydir 1,cipher DES-EDE3-CBC,auth SHA1,keysize 192,tls-auth,key-method 2,tls-client'
Sun Jul 25 13:49:23 2010 us=594206 Local Options hash (VER=V4): 'b5edb94e'
Sun Jul 25 13:49:23 2010 us=594222 Expected Remote Options hash (VER=V4): '53f7fc82'
Sun Jul 25 13:49:23 2010 us=594255 TLS: Initial packet from, sid=ad75fbfb 003c5c1f
Sun Jul 25 13:50:23 2010 us=47907 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Sun Jul 25 13:50:23 2010 us=47956 TLS Error: TLS handshake failed
Sun Jul 25 13:50:23 2010 us=48048 SIGUSR1[soft,tls-error] received, client-instance restarting
Sun Jul 25 13:53:09 2010 us=208133 vpn.rootspirit.com/ [vpn.rootspirit.com] Inactivity timeout (--ping-restart), restarting
Sun Jul 25 13:53:09 2010 us=208192 vpn.rootspirit.com/ SIGUSR1[soft,ping-restart] received, client-instance restarting

Everything seems to lead to a ping timeout or broken internet connection. However, other PCs here in this network stay connected to the internet just fine. So I don't think it's my vDSL connection that's dropping. Same for packet loss to the server; close to 0% loss.

Keep alive is set to this:

keepalive 10 120

Any idea what might cause this issue?

Kind regards, Tuinslak

  • This doesn't seem to appear over TCP (same server). Only over UDP.
    – Tuinslak
    Jul 29 '10 at 11:44
  • I've come to notice that restarting my network interfaces (/etc/init.d/networking restart) restores the VPN connectivity.
    – Tuinslak
    Jul 31 '10 at 23:30

I had similar behaviour when I happened to have multiple clients with same certificate or certificates with same common name while duplicate-cn setting was not enabled. Solving either of these causes made the connection stable.

Information from OpenVPN server config:

# Uncomment this directive if multiple clients
# might connect with the same certificate/key
# files or common names.  This is recommended
# only for testing purposes.  For production use,
# each client should have its own certificate/key
# pair.
  • The only solution which worked for me. Oct 26 '20 at 19:28

I haven't used the VPN for a while -- because of the reason stated above.

However, I recently used it again and it no longer seems to disconnected. I'm guessing it was a bug somewhere fixed when updating software. I also upgraded from Lenny to Squeeze a while back.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.