Dotaz: Gentoo, openvpn - timeout

[dastin517]

Ahojte, mam mensi problemik s ktorym som sa dnes trapil. Mam server - ipFire a clienta - gentoo. Chcem som to spojit prostrednictvom openvpn. Ale mam problem, neviem co robim zle ale kazdych 15-20s. sa mi spojenie prerusi.

Server config

 
#OpenVPN Server conf 

daemon openvpnserver 
writepid /var/run/openvpn.pid 
dev tun 
proto tcp 
port 1194 
script-security 3 system 
ifconfig-pool-persist /var/ipfire/ovpn/ovpn-leases.db 3600 
client-config-dir /var/ipfire/ovpn/ccd 
tls-server 
ca /var/ipfire/ovpn/ca/cacert.pem 
cert /var/ipfire/ovpn/certs/servercert.pem 
key /var/ipfire/ovpn/certs/serverkey.pem 
dh /var/ipfire/ovpn/ca/dh1024.pem 
server 10.39.186.0 255.255.255.0 
client-to-client 
mssfix 
keepalive 10 120 
status-version 1 
status /var/log/ovpnserver.log 30 
cipher BF-CBC 
comp-lzo 
push "redirect-gateway def1" 
max-clients 100 
tls-verify /var/ipfire/ovpn/verify 
crl-verify /var/ipfire/ovpn/crls/cacrl.pem 
user nobody 
group nobody 
persist-key 
persist-tun 
verb 3 

Client

 
#OpenVPN Client conf 
tls-client 
client 
nobind 
dev tun 
proto tcp 
tun-mtu 1500 
remote XXX.XXX.XXX.XXX 1194 
pkcs12 Marek.p12 
cipher BF-CBC 
comp-lzo 
verb 3 
ns-cert-type server 
tls-remote xxxxx.eu 
mssfix 

Posledne riadky Logu

 
Thu Mar 28 14:12:07 2013 /bin/route add -net 192.168.1.0 netmask 255.255.255.0 gw 10.39.186.9 
Thu Mar 28 14:12:07 2013 Initialization Sequence Completed 

Thu Mar 28 14:14:44 2013 [xxxx.eu] Inactivity timeout (--ping-restart), restarting 
Thu Mar 28 14:14:44 2013 TCP/UDP: Closing socket 
Thu Mar 28 14:14:44 2013 /etc/openvpn/down.sh tun0 1500 1544 10.39.186.10 10.39.186.9 restart 
Thu Mar 28 14:14:44 2013 SIGUSR1[soft,ping-restart] received, process restarting 
Thu Mar 28 14:14:44 2013 Restart pause, 5 second(s) 
Thu Mar 28 14:14:49 2013 WARNING: Make sure you understand the semantics of --tls-remote before using it (see the man page). 
Thu Mar 28 14:14:49 2013 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts 
Thu Mar 28 14:14:49 2013 Re-using SSL/TLS context 
Thu Mar 28 14:14:49 2013 LZO compression initialized 
Thu Mar 28 14:14:49 2013 Control Channel MTU parms [ L:1544 D:140 EF:40 EB:0 ET:0 EL:0 ] 
Thu Mar 28 14:14:49 2013 Socket Buffers: R=[87380->131072] S=[16384->131072] 
Thu Mar 28 14:14:49 2013 Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ] 
Thu Mar 28 14:14:49 2013 Local Options hash (VER=V4): '69109d17' 
Thu Mar 28 14:14:49 2013 Expected Remote Options hash (VER=V4): 'c0103fa8' 
Thu Mar 28 14:14:49 2013 Attempting to establish TCP connection with XXX.XXX.XXX.XXX:1194 [nonblock] 

Odpovědi

[Jezus]

Ahoj, Inactivity timeout je jasny duvod. Direktiva keepalive nastavuje jak casto se odesila zprava "jsem na zivu" a jak dlouho se ceka nez se protejsek oznaci za mrtvy. To ze zpravy nechodi muze mit ruzne duvody. Doporucim ti snifovat sit na klientovi a uvidis co se deje. Jo a pouzivani OpenVPNky nad TCP neni dobry napad. Urcite si to prvne prepni a vyzkousej na UDP.