0

I got a bit of a weird problem, I have an OpenVPN Server running on my WNDR3700 router that used DD-WRT.

Server Configuration

push "route 192.168.1.0 255.255.255.0"
server 192.168.1.0 255.255.255.0

dev tun0
proto udp
keepalive 10 120
dh /tmp/openvpn/dh.pem
ca /tmp/openvpn/ca.crt
cert /tmp/openvpn/cert.pem
key /tmp/openvpn/key.pem

As a side note, I've also tried Bridged Mode and it results the same way!

Client Configuration

remote myserver.com 1194
client 
dev tun
proto udp 
resolv-retry infinite 
nobind 
persist-key 
persist-tun 

ca ca.crt
cert client.crt
key client.key
ns-cert-type server

verb 3

I will use comp-lzo and cipher once the tunnel is up.

The problem is that the connection disconnects when I try to remote desktop or surf to a web-site inside the LAN on the VPN-side. But I can SSH and Ping the Server without it disconnecting. But as soon as I try to access a Website ( i.e. 192.168.1.1 the router management interface ) the Ping stops and the connection does not work anymore.

Example

ping 192.168.1.1  -n 1000
Reply from 192.168.1.1: bytes=32 time=27ms TTL=64
Reply from 192.168.1.1: bytes=32 time=27ms TTL=64
Reply from 192.168.1.1: bytes=32 time=28ms TTL=64
Request timed out.

The Time out occurs when I do "heavy" stuff over the VPN. Any suggestions how I fix this? The same setup has worked with another VPN Server Before and I can't see any weird settings.

Improve this question

3 Answers 3

Reset to default
2

looks like a MTU problem, verify by sending big-packet pings (ping -s). check packet-splitting options, when that works do turn on LZO compression (otherwise performance can take a dip). also check about advertising a smaller MTU (only works on router links, not on bridge-type links)

edit: from OpenVPN docs:

The usual symptom of such a breakdown is an OpenVPN connection which successfully starts, but then stalls during active usage.

If --fragment and --mssfix are used together, --mssfix will take its default max parameter from the --fragment max option.

Therefore, one could lower the maximum UDP packet size to 1300 (a good first try for solving MTU-related connection problems) with the following options:

--tun-mtu 1500 --fragment 1300 --mssfix
Improve this answer
13
  • Does OpenVPN / The router have specific settings for packat-splitting? It's a Windows -> Windows connection over the VPN, if that matters. So both the RDP client and RDP server should have 1500 MTU
    – Filip Ekberg
    Oct 25, 2010 at 15:02
  • encapsulating an IP packet inside and UDP one adds overhead. it should work either splitting the packet, or advertising a new lower MTU for the link. if you don't do either, big packets will be dropped. small pings and ssh keypresses are short enough to work, but any real data transfer would quickly abort.
    – Javier
    Oct 25, 2010 at 18:56
  • Ok, tried ping 192.168.1.1 -n 2000 -l 40960 and that resulted in the same thing, one ping works but the next one time outs. Does it suffice to do fragment 1000 in the server.conf ?
    – Filip Ekberg
    Oct 26, 2010 at 7:33
  • I've also tried setting link-mtu to 800 ( to be very low ) but that didn't work out either, still the same issue. And when checking load on cpu / memory I can't see anything out of the ordernary it's not going over 10% ever.
    – Filip Ekberg
    Oct 26, 2010 at 8:53
  • a 40k ping won't work. 1500bytes should. if not, that's your problem. try smaller pings until you find the exact size, that's your MTU. btw, none of these problems would result in high cpu or memory usage.
    – Javier
    Oct 26, 2010 at 12:47
1

your VPN IP range seems to be same as your internal network IP range - that is not advisable/possible:

push "route 192.168.1.0 255.255.255.0" server 192.168.1.0 255.255.255.0

Try choosing a different VPN IP range (e.g. server 10.8.0.0 255.255.255.0)

HTH,

JJK

Improve this answer
2
  • I've tried that too, doens't solve the above problem though..
    – Filip Ekberg
    Oct 25, 2010 at 10:20
  • Also, I tried this now and it still does the same disconnection as before, however the logs doesnt say anything at all, it just stops responding.
    – Filip Ekberg
    Oct 25, 2010 at 11:16
0

Similar problem here. There are also others who reported problems with the DD-WRT / WNDR3700 / OpenVPN combination on the DD-WRT forum.

I transferred my OpenVPN config from my router to a server on the LAN and it worked perfectly.

I think it comes down to some sort of incompatibility between this router and DD-WRT / OpenVPN and there is nothing much you can do unfortunately. What a shame.

Improve this answer
1
  • 1
    Changing the mtu solved the problem.
    – Filip Ekberg
    Apr 19, 2011 at 12:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .