4

Situation

  • I'm using OpenVpn Server Access appliance, not the free CE edition; I do not know if they're different in config or in behaviours.
  • Current appliance version is: 2.1.9
  • Server version: 2.5.2
  • License status: 2 devices
  • All of the following configs are done using official web admin interface
  • OS Ubuntu 18.04: Linux realtebo.example.com 4.4.0-134-generic #160-Ubuntu SMP Wed Aug 15 14:58:00 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux

Configurations involed

  • Multiple Sessions per User ON
  • Listinening on eth0: 192.168.1.225
  • Ports: tcp/1194, udp/1194
  • OSI layer: 3 (routing/NAT)
  • Server config directives contains only duplicate-cn
  • Server config directives contains only duplicate-cn
  • I saved, and confirmed to propagate configs to running
  • I already tried to restart service, and also to reboot server; nothing changes

The problem

  • Installed OpenVpn official app both on iPad and on an Android Phone
  • Downloaded the client certificate.
  • I opened the .ovpn file and I can see

     # Extra user-defined configuration
     duplicate-cn
    
  • I connect to VPN using the iPad

  • I connect to VPN using Android Phone
  • iPad is being disconneted from VPN
  • iPad expressly tellme

    Client was halted by server: disconnected due to new connection by same user.
    

Logs

Note the rows starting with OVPN 5 OUT

[-] OVPN 4 OUT: '192.168.1.1:55322 TLS: Initial packet from [AF_INET]192.168.1.1:55322, sid=ef370909 6ae63962'
[-] OVPN 4 OUT: '192.168.1.1:55322 VERIFY OK: depth=1, /CN=OpenVPN CA'
[-] OVPN 4 OUT: '192.168.1.1:55322 VERIFY OK: nsCertType=CLIENT'
[-] OVPN 4 OUT: '192.168.1.1:55322 VERIFY OK: depth=0, /CN=realtebo'
[-] OVPN 4 OUT: '192.168.1.1:55322 peer info: IV_GUI_VER=net.openvpn.connect.ios_3.0.0-712'
[-] OVPN 4 OUT: '192.168.1.1:55322 peer info: IV_VER=3.2'
[-] OVPN 4 OUT: '192.168.1.1:55322 peer info: IV_PLAT=ios'
[-] OVPN 4 OUT: '192.168.1.1:55322 peer info: IV_NCP=2'
[-] OVPN 4 OUT: '192.168.1.1:55322 peer info: IV_TCPNL=1'
[-] OVPN 4 OUT: '192.168.1.1:55322 peer info: IV_PROTO=2'
[-] OVPN 4 OUT: '192.168.1.1:55322 peer info: IV_LZO=1'
[-] OVPN 4 OUT: '192.168.1.1:55322 peer info: IV_LZO_SWAP=1'
[-] OVPN 4 OUT: '192.168.1.1:55322 peer info: IV_LZ4=1'
[-] OVPN 4 OUT: '192.168.1.1:55322 peer info: IV_LZ4v2=1'
[-] OVPN 4 OUT: '192.168.1.1:55322 peer info: IV_COMP_STUB=1'
[-] OVPN 4 OUT: '192.168.1.1:55322 peer info: IV_COMP_STUBv2=1'
[-] OVPN 4 OUT: '192.168.1.1:55322 peer info: IV_HWADDR=D3E089DB-77B9-4A5B-95AA-2081A4EB5366'
[-] OVPN 4 OUT: '192.168.1.1:55322 peer info: IV_BS64DL=1'
[-] OVPN 4 OUT: '192.168.1.1:55322 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA'
[-] OVPN 4 OUT: '192.168.1.1:55322 [realtebo] Peer Connection Initiated with [AF_INET]192.168.1.1:55322'
[-] OVPN 5 OUT: 'MANAGEMENT: CMD \'client-kill 1 "HALT,disconnected due to new connection by same user"\''
[-] OVPN 5 OUT: 'Delayed exit in 5 seconds'
[-] OVPN 5 OUT: "SENT CONTROL [realtebo_AUTOLOGIN]: 'HALT,disconnected due to new connection by same user' (status=1)"
OMIClientAuth,0,] AUTH SUCCESS {'status': 0, 'reason': 'local auth succeeded', 'serial_list': [], 'user': u'realtebo', 
   'proplist': {u'prop_autologin': u'true', u'pvt_password_digest': '[redacted]', u'type': u'user_compile',
   u'prop_autogenerate': u'true'}, 'common_name': u'realtebo', 'serial': '4'} cli=u'ios'/u'3.2'
[-] OVPN 4 OUT: "MANAGEMENT: CMD 'client-auth 2 0'"
[-] OVPN 4 OUT: 'realtebo/192.168.1.1:55322 OPTIONS IMPORT: compression parms modified'
[-] OVPN 4 OUT: 'realtebo/192.168.1.1:55322 MULTI: Learn: 172.27.232.3 -> realtebo/192.168.1.1:55322'
[-] OVPN 4 OUT: 'realtebo/192.168.1.1:55322 MULTI: primary virtual IP for realtebo/192.168.1.1:55322: 172.27.232.3'
[-] OVPN 4 OUT: "realtebo/192.168.1.1:55322 SENT CONTROL [realtebo]: 'PUSH_REPLY,explicit-exit-notify,topology subnet,route-delay 5 30,
    dhcp-pre-release,dhcp-renew,dhcp-release,route-metric 101,ping 12,ping-restart 50,auth-tokenSESS_ID,comp-lzo yes,redirect-private 
    def1,redirect-private bypass-dhcp,redirect-private autolocal,route-gateway 172.27.232.1,route 192.168.1.0 255.255.255.0,
    route 172.27.224.0 255.255.240.0,dhcp-option DNS 192.168.1.228,dhcp-option ADAPTER_DOMAIN_SUFFIX homenet.telecomitalia.it,
    register-dns,block-ipv6,ifconfig 172.27.232.3 255.255.254.0,peer-id 0,cipher AES-256-GCM' (status=1)"
[-] OVPN 4 OUT: "realtebo/192.168.1.1:55322 Data Channel: using negotiated cipher 'AES-256-GCM'"
[-] OVPN 4 OUT: "realtebo/192.168.1.1:55322 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key"
[-] OVPN 4 OUT: "realtebo/192.168.1.1:55322 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key"
[-] OVPN 5 OUT: 'realtebo_AUTOLOGIN/192.168.1.1:39835 SIGTERM[soft,delayed-exit] received, client-instance exiting'

Side notes

  • The user is a standard one, _is not an admin _
  • I've already tried to revoke certificate, delete user, recreate, reinstall certificate on both devices; nothing changes
  • As from a comment, I am not using static IPs
  • OpenVpn server is at latest available version, 2.5.2
  • This issue seems to be fixed since v1.7.1
  • while connecting 2 devices with the same user do not works, connecting 2 devices with different usernames works

Similar questions, and why them do not helped

  • 1
    Hmm. Did you assign a static IP address to the user? This option isn't compatible with multiple simultaneous login. – Michael Hampton Aug 2 '18 at 20:53
  • @MichaelHampton: no, I'm not assigning static IPs – realtebo Aug 11 '18 at 15:10
  • 1
    It's a server-side directive. You did restart the (OpenVPN) server? – roaima Aug 28 '18 at 20:48
  • @roaima. Yes, I saved, than clicked the ui button to propagate to running server. When I see it is not working, I tried also a entire server reboot. (It's not mission critical) – realtebo Aug 29 '18 at 13:36
1

It is just not possible. Make second .openvpn file for another device with another cert - since you are using your own OpenVPN server it wouldn't add you any costs.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.