OpenVPN / openvpn

OpenVPN is an open source VPN daemon
http://openvpn.net
Other
10.75k stars 2.99k forks source link

2.6 client exits unexpectedly during problem on 2.4 server #480

Closed cycloon closed 8 months ago

cycloon commented 9 months ago

Describe the bug I have a 2.6.6 client, that connects to a 2.4.7 server. The server had a problem with the CRL getting outdated and refused all clients. While older clients (2.5.x) did retry the connection infinitely, the 2.6.6 client exited immediately without any log message.

Questions

  1. Why was there no log message?
  2. Is there anything that changed from 2.5 to 2.6 that makes the client exit?
  3. What can I do to prevent the 2.6 client from exiting?

To Reproduce

  1. Run 2.4.7 server
  2. let the CRL get outdated
  3. fix the CRL
  4. 2.5-clients reconnect without manual intervention
  5. 2.6-clients die...

Expected behavior 2.6-Clients should not die when server has outdated CRL.

Version information (please complete the following information):

Server config

server 10.0.0.0 255.255.255.0
cert server.crt
key server.key
cd /etc/openvpn/ccd
chroot /etc/openvpn/ccd
daemon
user _openvpn
group _openvpn
writepid openvpn.pid
status status.log
verb 1
mute 200
script-security 2
client-connect "client-routes.sh connect"
client-disconnect "client-routes.sh disconnect"
proto udp4
port 3868
multihome
explicit-exit-notify 1
topology net30
push "route 192.168.0.0 255.255.255.0"
dev tun100
persist-tun
connect-freq 3 5
hand-window 120
keepalive 10 60
tun-mtu 1500
fragment 1437
passtos
dh dh.pem
ca ca3.crt
persist-key
crl-verify crl.pem
comp-lzo

Client config

daemon
port 3868
dev tun0
remote server.example.com
tun-mtu 1500
fragment 1437
comp-lzo
tls-client
ca /etc/openvpn/ca.crt
cert /etc/openvpn/cert.crt
key /etc/openvpn/cert.key
ping 10
ping-restart 30
resolv-retry infinite
pull
verb 1
schwabe commented 9 months ago

You should add a log of both 2.5 and 2.6 clients that show that behaviour so we can unerstand what is really happening.

cycloon commented 8 months ago

Close as I could not reproduce.