OpenVPN / OpenVPN/openvpn

Unable to connect to my VPN with the 2.6.0 update

Open
#240 19 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C
Stars
14.6k
Forks
3.4k
PR merge metrics
No merged PRs in 30d

Description

Describe the bug
My system upgraded the openvpn client to 2.6.0 and since then I'm unable to connect to my VPN.

To Reproduce
I have my system configured in the file /etc/openvpn/client/my-company.conf which starts with

dev tun
proto tcp
verb 5

cipher AES-256-CBC
client
remote-cert-tls server
tls-cipher DEFAULT
remote MY-SERVER-IP PORT

THE CERTIFICATE

route-nopull

a bunch of routes

auth-user-pass ROUTE-TO-FILE

when trying to connect the log outputs


Feb 06 09:35:49 my-computer-name openvpn[13648]: OpenVPN 2.6.0 [git:makepkg/b999466418dddb89+] x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Jan 25 2023
Feb 06 09:35:49 my-computer-name openvpn[13648]: library versions: OpenSSL 3.0.7 1 Nov 2022, LZO 2.10
Feb 06 09:35:49 my-computer-name openvpn[13648]: Control Channel MTU parms [ mss_fix:0 max_frag:0 tun_mtu:1250 tun_max_mtu:0 headroom:126 payload:1600 tailroom:126 ET:0 ]
Feb 06 09:35:49 my-computer-name openvpn[13648]: Data Channel MTU parms [ mss_fix:0 max_frag:0 tun_mtu:1500 tun_max_mtu:1600 headroom:136 payload:1768 tailroom:562 ET:0 ]
Feb 06 09:35:49 my-computer-name openvpn[13648]: TCP/UDP: Preserving recently used remote address: [AF_INET]MYSERVER:PORT
Feb 06 09:35:49 my-computer-name openvpn[13648]: Socket Buffers: R=[131072->131072] S=[16384->16384]
Feb 06 09:35:49 my-computer-name openvpn[13648]: Attempting to establish TCP connection with [AF_INET]MYSERVER:PORT
Feb 06 09:35:49 my-computer-name openvpn[13648]: TCP connection established with [AF_INET]MYSERVER:PORT
Feb 06 09:35:49 my-computer-name openvpn[13648]: TCPv4_CLIENT link local: (not bound)
Feb 06 09:35:49 my-computer-name openvpn[13648]: TCPv4_CLIENT link remote: [AF_INET]MYSERVER:PORT
Feb 06 09:35:49 my-computer-name openvpn[13648]: WRTLS: Initial packet from [AF_INET]MYSERVER:PORT, sid=1afbdcc7 e6e5f0ea
Feb 06 09:35:49 my-computer-name openvpn[13648]: WRWARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Feb 06 09:35:51 my-computer-name openvpn[13648]: WRRWRWRVERIFY OK: depth=1, C=ES, ST=GALICIA, L=Santiago de Compostela, O=xxx, OU=IT, CN=CA
Feb 06 09:35:51 my-computer-name openvpn[13648]: VERIFY KU OK
Feb 06 09:35:51 my-computer-name openvpn[13648]: Validating certificate extended key usage
Feb 06 09:35:51 my-computer-name openvpn[13648]: ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Feb 06 09:35:51 my-computer-name openvpn[13648]: VERIFY EKU OK
Feb 06 09:35:51 my-computer-name openvpn[13648]: VERIFY OK: depth=0, C=XX, ST=XXXX, L=xxx, O=xxx, OU=IT, CN=server
Feb 06 09:35:51 my-computer-name openvpn[13648]: WRWRRWRConnection reset, restarting [0]
Feb 06 09:35:51 my-computer-name openvpn[13648]: TCP/UDP: Closing socket
Feb 06 09:35:51 my-computer-name openvpn[13648]: SIGUSR1[soft,connection-reset] received, process restarting
Feb 06 09:35:51 my-computer-name openvpn[13648]: Restart pause, 1 second(s)
Feb 06 09:35:52 my-computer-name openvpn[13648]: Control Channel MTU parms [ mss_fix:0 max_frag:0 tun_mtu:1250 tun_max_mtu:0 headroom:126 payload:1600 tailroom:126 ET:0 ]
Feb 06 09:35:52 my-computer-name openvpn[13648]: Data Channel MTU parms [ mss_fix:0 max_frag:0 tun_mtu:1500 tun_max_mtu:1600 headroom:136 payload:1768 tailroom:562 ET:0 ]
Feb 06 09:35:52 my-computer-name openvpn[13648]: TCP/UDP: Preserving recently used remote address: [AF_INET]MYSERVER:PORT
Feb 06 09:35:52 my-computer-name openvpn[13648]: Socket Buffers: R=[131072->131072] S=[16384->16384]
Feb 06 09:35:52 my-computer-name openvpn[13648]: Attempting to establish TCP connection with [AF_INET]MYSERVER:PORT
Feb 06 09:35:52 my-computer-name openvpn[13648]: TCP connection established with [AF_INET]MYSERVER:PORT
Feb 06 09:35:52 my-computer-name openvpn[13648]: TCPv4_CLIENT link local: (not bound)
Feb 06 09:35:52 my-computer-name openvpn[13648]: TCPv4_CLIENT link remote: [AF_INET]SERVER-IP:1194
Feb 06 09:35:52 my-computer-name openvpn[13648]: WRTLS: Initial packet from [AF_INET]SERVER-IP:1194, sid=b16dca59 6c565fff
Feb 06 09:35:54 my-computer-name openvpn[13648]: WRWRRWRWRVERIFY OK: depth=1, C=xx, ST=xxx, L=xxxx, O=xxx, OU=IT, CN=CA
Feb 06 09:35:54 my-computer-name openvpn[13648]: VERIFY KU OK
Feb 06 09:35:54 my-computer-name openvpn[13648]: Validating certificate extended key usage
Feb 06 09:35:54 my-computer-name openvpn[13648]: ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Feb 06 09:35:54 my-computer-name openvpn[13648]: VERIFY EKU OK
Feb 06 09:35:54 my-computer-name openvpn[13648]: VERIFY OK: depth=0, C=xxx, ST=xxxx, L=xxxxx, O=xxx, OU=IT, CN=server
Feb 06 09:35:54 my-computer-name openvpn[13648]: WRWRRWRConnection reset, restarting [0]
Feb 06 09:35:54 my-computer-name openvpn[13648]: TCP/UDP: Closing socket
Feb 06 09:35:54 my-computer-name openvpn[13648]: SIGUSR1[soft,connection-reset] received, process restarting
Feb 06 09:35:54 my-computer-name openvpn[13648]: Restart pause, 1 second(s)

Expected behavior
Being able to connect successfully as with previous version (2.5.8)

Version information:

  • OS: Archlinux
  • OpenVPN version: 2.6.0

Additional context
no additional info

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the configuration at /etc/openvpn/client/my-company.conf and compare the 2.6.0 log sequence with the reported working 2.5.8 behavior. Investigate the connection reset after certificate verification, then verify that the same configuration connects successfully on 2.6.0 without regressing the reported authentication and routing behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
networking, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.