Unable to connect to my VPN with the 2.6.0 update
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 14.6k
- Forks
- 3.4k
- PR merge metrics
- No merged PRs in 30d
Description
Describe the bug
My system upgraded the openvpn client to 2.6.0 and since then I'm unable to connect to my VPN.
To Reproduce
I have my system configured in the file /etc/openvpn/client/my-company.conf which starts with
dev tun
proto tcp
verb 5
cipher AES-256-CBC
client
remote-cert-tls server
tls-cipher DEFAULT
remote MY-SERVER-IP PORT
THE CERTIFICATE
route-nopull
a bunch of routes
auth-user-pass ROUTE-TO-FILE
when trying to connect the log outputs
Feb 06 09:35:49 my-computer-name openvpn[13648]: OpenVPN 2.6.0 [git:makepkg/b999466418dddb89+] x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Jan 25 2023
Feb 06 09:35:49 my-computer-name openvpn[13648]: library versions: OpenSSL 3.0.7 1 Nov 2022, LZO 2.10
Feb 06 09:35:49 my-computer-name openvpn[13648]: Control Channel MTU parms [ mss_fix:0 max_frag:0 tun_mtu:1250 tun_max_mtu:0 headroom:126 payload:1600 tailroom:126 ET:0 ]
Feb 06 09:35:49 my-computer-name openvpn[13648]: Data Channel MTU parms [ mss_fix:0 max_frag:0 tun_mtu:1500 tun_max_mtu:1600 headroom:136 payload:1768 tailroom:562 ET:0 ]
Feb 06 09:35:49 my-computer-name openvpn[13648]: TCP/UDP: Preserving recently used remote address: [AF_INET]MYSERVER:PORT
Feb 06 09:35:49 my-computer-name openvpn[13648]: Socket Buffers: R=[131072->131072] S=[16384->16384]
Feb 06 09:35:49 my-computer-name openvpn[13648]: Attempting to establish TCP connection with [AF_INET]MYSERVER:PORT
Feb 06 09:35:49 my-computer-name openvpn[13648]: TCP connection established with [AF_INET]MYSERVER:PORT
Feb 06 09:35:49 my-computer-name openvpn[13648]: TCPv4_CLIENT link local: (not bound)
Feb 06 09:35:49 my-computer-name openvpn[13648]: TCPv4_CLIENT link remote: [AF_INET]MYSERVER:PORT
Feb 06 09:35:49 my-computer-name openvpn[13648]: WRTLS: Initial packet from [AF_INET]MYSERVER:PORT, sid=1afbdcc7 e6e5f0ea
Feb 06 09:35:49 my-computer-name openvpn[13648]: WRWARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Feb 06 09:35:51 my-computer-name openvpn[13648]: WRRWRWRVERIFY OK: depth=1, C=ES, ST=GALICIA, L=Santiago de Compostela, O=xxx, OU=IT, CN=CA
Feb 06 09:35:51 my-computer-name openvpn[13648]: VERIFY KU OK
Feb 06 09:35:51 my-computer-name openvpn[13648]: Validating certificate extended key usage
Feb 06 09:35:51 my-computer-name openvpn[13648]: ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Feb 06 09:35:51 my-computer-name openvpn[13648]: VERIFY EKU OK
Feb 06 09:35:51 my-computer-name openvpn[13648]: VERIFY OK: depth=0, C=XX, ST=XXXX, L=xxx, O=xxx, OU=IT, CN=server
Feb 06 09:35:51 my-computer-name openvpn[13648]: WRWRRWRConnection reset, restarting [0]
Feb 06 09:35:51 my-computer-name openvpn[13648]: TCP/UDP: Closing socket
Feb 06 09:35:51 my-computer-name openvpn[13648]: SIGUSR1[soft,connection-reset] received, process restarting
Feb 06 09:35:51 my-computer-name openvpn[13648]: Restart pause, 1 second(s)
Feb 06 09:35:52 my-computer-name openvpn[13648]: Control Channel MTU parms [ mss_fix:0 max_frag:0 tun_mtu:1250 tun_max_mtu:0 headroom:126 payload:1600 tailroom:126 ET:0 ]
Feb 06 09:35:52 my-computer-name openvpn[13648]: Data Channel MTU parms [ mss_fix:0 max_frag:0 tun_mtu:1500 tun_max_mtu:1600 headroom:136 payload:1768 tailroom:562 ET:0 ]
Feb 06 09:35:52 my-computer-name openvpn[13648]: TCP/UDP: Preserving recently used remote address: [AF_INET]MYSERVER:PORT
Feb 06 09:35:52 my-computer-name openvpn[13648]: Socket Buffers: R=[131072->131072] S=[16384->16384]
Feb 06 09:35:52 my-computer-name openvpn[13648]: Attempting to establish TCP connection with [AF_INET]MYSERVER:PORT
Feb 06 09:35:52 my-computer-name openvpn[13648]: TCP connection established with [AF_INET]MYSERVER:PORT
Feb 06 09:35:52 my-computer-name openvpn[13648]: TCPv4_CLIENT link local: (not bound)
Feb 06 09:35:52 my-computer-name openvpn[13648]: TCPv4_CLIENT link remote: [AF_INET]SERVER-IP:1194
Feb 06 09:35:52 my-computer-name openvpn[13648]: WRTLS: Initial packet from [AF_INET]SERVER-IP:1194, sid=b16dca59 6c565fff
Feb 06 09:35:54 my-computer-name openvpn[13648]: WRWRRWRWRVERIFY OK: depth=1, C=xx, ST=xxx, L=xxxx, O=xxx, OU=IT, CN=CA
Feb 06 09:35:54 my-computer-name openvpn[13648]: VERIFY KU OK
Feb 06 09:35:54 my-computer-name openvpn[13648]: Validating certificate extended key usage
Feb 06 09:35:54 my-computer-name openvpn[13648]: ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Feb 06 09:35:54 my-computer-name openvpn[13648]: VERIFY EKU OK
Feb 06 09:35:54 my-computer-name openvpn[13648]: VERIFY OK: depth=0, C=xxx, ST=xxxx, L=xxxxx, O=xxx, OU=IT, CN=server
Feb 06 09:35:54 my-computer-name openvpn[13648]: WRWRRWRConnection reset, restarting [0]
Feb 06 09:35:54 my-computer-name openvpn[13648]: TCP/UDP: Closing socket
Feb 06 09:35:54 my-computer-name openvpn[13648]: SIGUSR1[soft,connection-reset] received, process restarting
Feb 06 09:35:54 my-computer-name openvpn[13648]: Restart pause, 1 second(s)
Expected behavior
Being able to connect successfully as with previous version (2.5.8)
Version information:
- OS: Archlinux
- OpenVPN version: 2.6.0
Additional context
no additional info
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the configuration at /etc/openvpn/client/my-company.conf and compare the 2.6.0 log sequence with the reported working 2.5.8 behavior. Investigate the connection reset after certificate verification, then verify that the same configuration connects successfully on 2.6.0 without regressing the reported authentication and routing behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- networking, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100