OpenVPN / OpenVPN/openvpn

Error messages being uninformative

Open
#582 19 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C
Stars
14.6k
Forks
3.4k
PR merge metrics
No merged PRs in 30d

Description

Describe the bug
I get messages in my log on the openvpn server that are very uninformative regarding both what they are trying to tell me and what condition they really refer to.

The first I encountered was:

read UDPv4 [ECONNREFUSED]: Connection refused (fd=6,code=111)

After changing some things in my server config, it seems to have changed to

Connection Attempt read UDPv4 [ECONNREFUSED]: Connection refused (fd=6,code=111)

sometimes there are multiple ECONNREFUSED:

Connection Attempt read UDPv4 [ECONNREFUSED|ECONNREFUSED|ECONNREFUSED|ECONNREFUSED]: Connection refused (fd=6,code=111)
Connection Attempt read UDPv4 [ECONNREFUSED|ECONNREFUSED]: Connection refused (fd=6,code=111)

I have not the slightest idea what these messages mean or what might cause them. Among others my questions are:
Which IP attempted to connect to which IP and port? In particular: is that an incoming or an outgoing connection?
What do the multiple ECONNREFUSED mean?
What does it mean?
What could be wrong?

To Reproduce
Generate a key:

openvpn --genkey secret static.key

run a server with following config:

ifconfig 10.19.254.1 10.19.254.2
dev tun
mode server
tls-server
dh none
cert /etc/openvpn/_REPLACE_WITH_INSTANCE_NAME_/server.pem
key /etc/openvpn/_REPLACE_WITH_INSTANCE_NAME_/server.pem
cipher AES-256-GCM
peer-fingerprint _REPLACE_WITH_FINGERPRINT_

keepalive 10 60
push "explicit-exit-notify 3"

Expected behavior
I would expect this log message to either contain or be accompanied by some more context to understand what is really happening and why this is worth logging.

Version information (please complete the following information):

  • OS: Debian GNU/Linux 12 (bookworm)
  • OpenVPN version: 2.6.3-1+deb12u2 amd64
  • Peer does not seem relevant as it is very likely not a/the peer that is causing this.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

The report names the UDPv4 ECONNREFUSED log output and provides a minimal server configuration; begin by locating the code that formats this message and tracing the related connection path. Reproduce it with the supplied configuration, then define done as logs that identify the relevant endpoints, direction, and meaning of repeated errors.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
networking, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.