Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

VPNC for some reason keeps disconnecting me after a period of time. I've tried timing it to see how long it takes and it seems to be everytime after 24 minutes.

After being disconnected I have no internett connection as my /etc/resolv.conf is still the same as it should be when connect to vpnc. If I try vpnc-disconnect it only sais "no vpnc found running". I have to take eth0 dow and up, then manually edit the /etc/resolv.conf to get a proper network connection.

My settings are the following:

IPSec gateway xx.xx.xx.xx
IPSec ID anonymized
IPSec secret anonymized
#IKE Authmode hybrid
Xauth username myUsername
DPD idle timeout (our side) 0

I also tried having a ping running continuously. I have streams and music playing continuously as well, but it still disconnects me.

This is working fine without disconnects on windows.

EDIT. More info: Ive added log from my /var/log/syslog of what happens when I am disconnected:

I connect first:

 Jul 24 14:03:09 cad-unix NetworkManager[1086]:    SCPlugin-Ifupdown: devices added 
 path: /sys/devices/virtual/net/tun0, iface: tun0)
 Jul 24 14:03:09 cad-unix NetworkManager[1086]:    SCPlugin-Ifupdown: device added 
 (path: /sys/devices/virtual/net/tun0, iface: tun0): no ifupdown configuration found.

Then I am disconnected after 24 minutes:

 Jul 24 14:27:29 cad-unix avahi-daemon[1089]: Withdrawing workstation service for tun0.
 Jul 24 14:27:29 cad-unix NetworkManager[1086]:    SCPlugin-Ifupdown: devices removed 
 (path: /sys/devices/virtual/net/tun0, iface: tun0)

Edit: Tweaked the question a bit for better reading. Also now specifying that the problem happens at 24 minutes everytime.

Edit: Version Im running: vpnc version 0.5.3

Edit: After compiling version 0.5.1 I now recieve one more entry in the log file: vpnc[16364]: connection terminated by peer

Last edit I guess: Im desperate. Open for any suggestion. Even changing to another linux distro is an option if it is Ubuntu which is the problem.

share|improve this question
    
I have no clue for an actual solution to this, but if it terminates every 24 minutes on the dot that it must be a timeout connection issue. –  KronoS Jul 25 '11 at 15:52
    
Are these logs as verbose as can be generated? –  Darth Android Jul 25 '11 at 16:53
    
@Darth Android, I dont know how I can make more verbose logs with VPNC in Ubuntu. Any suggestion is more than welcome! –  Chris Andrè Dale Jul 25 '11 at 17:17
    
try --debug 3 This should dump everything except authentication data, but please go over it and make sure that no keys or passwords are being exposed. –  Darth Android Jul 25 '11 at 17:35
    
Might need --no-detach as well. –  Darth Android Jul 25 '11 at 17:41
show 3 more comments

7 Answers

up vote 4 down vote accepted
+250

There is a bug report that addresses this problem, dating from 2010-10-28, but unfortunately still unsolved. It seems like the disconnect time is somewhat individual, although the reported times are still longer than 24 minutes.

The article points to a fix described here, which requires the recompilation of vpnc.

If your problem is related to rekeying, then the article rekeying problem with 0.5.3 claims that the bug is new to version 0.5.3 and does not exist in 0.5.1.

[EDIT}

It seems like going back to 0.5.1 didn't work for you. It also seems as if vpnc disconnects are common to many Linux distributions.

I have found Fixing vpnc disconnect problem above version 0.5.x, which suggests that maybe one needs to go back even to 0.4.x. In any case, the article suggests a fix which probably does not relate to your case but you could try :

After all we have to turn off DPD at the client end as well (vpnc) what we can achieve 2 ways:

  • add "--dpd-idle 0" command line switch when invoking "vpnc"
  • better yet to add this line to the config file: "DPD idle timeout (our side) 0"

Further information: man vpnc

There is similar info coming from RedHat support : Bug 484114 - VPN disconnect every 5 mins.

You could try going to vpnc 0.4.x, but I am starting to wonder if the problem is on your side or with some setting of the vpn server : 24 minutes is too precise.

share|improve this answer
    
Hmm interesting. I will try compile a 0.5.1 version. I am behind a router which does NAT'ing for me. I have no troubles with disconnect issues in other applications/games/whatnot. I can try a different router from a different ISP aswell tho for testing purposes. I have 2 ISP's with 2 connections. –  Chris Andrè Dale Jul 26 '11 at 16:48
    
sorry for late response. I had my bachelor party this weekend and alot of other stuff came up. Anyways the 0.5.1 version did not work sadly. It disconnected after 24 minutes. Same log entries in syslog as before –  Chris Andrè Dale Aug 1 '11 at 21:04
    
I added one more possibility. And congratulations! –  harrymc Apr 21 '12 at 16:04
add comment

Try changing the NAT traversal mode to cisco-udp, that solved it for me

NAT Traversal Mode cisco-udp

My Full config looks like this

IPSec gateway VPNHOSTIP
IPSec ID SAMPLESHAREDUSER
IPSec secret SAMPLESHAREDKEY
Xauth username SAMPLEUSER
Xauth password SAMPLEUSERPASS
IKE Authmode psk
#IKE DH Group dh2 # this is the default
DNSUpdate no
DPD idle timeout (our side) 0
NAT Traversal Mode cisco-udp

My VPN conenction is still running after 20 hrs so far.

share|improve this answer
    
Thanks for your sample. This did not work for me sadly :( What version of vpnc are you running? –  Chris Andrè Dale Oct 13 '11 at 12:26
    
I am running 0.5.3 the latest at the time of writing from the ubuntu repo. –  Pykler Oct 17 '11 at 15:41
add comment

I had the same problem, and none of the suggested solutions worked for me. In the end, I gave up on vpnc and tried the ShrewSoft vpn client. It's a bit of a hassle because you have to compile it yourself (and manually install any missing dependencies -- in my case, cmake, libedit2, flex, and bison). But it seems to work fine.

At the time of writing, you can download it from https://www.shrew.net/download/ike

share|improve this answer
add comment

You might look at the --nat-keepalive option, perhaps try --nat-keepalive 1200

At one point this was a known bug, not sure if it ever got fixed.

share|improve this answer
    
There does not seem to be a --nat-keepalive option. Check pastebin.com/sksQafdr of the response when I tried that option in conjunction with the other options which I run with. –  Chris Andrè Dale Jul 25 '11 at 17:16
add comment

I Have the same issue, http://dietrichschroff.blogspot.com/2011/07/linux-vpn-client-disconnect-every-600s.html seems to mention that the issue maybe related to the DH Group being used. To Change the DH Group to 5, in your config file add

IKE DH Group dh5

The options for this config change are

IKE DH Group <dh1/dh2/dh5>
share|improve this answer
    
Didn't work for me though, only the default of dh2 works in my case –  Pykler Oct 6 '11 at 19:01
add comment

Homepage of the VPNC project does not mention this to be a known problem, but I assume "phase2-rekeying" is still not that stable (based on reported bugs). Also note that

  • phase1-rekeying missing

Patched version of 0.5.3 (as the latest in SVN of the original project) release of VPNC at github includes:

  • Adds ability to answer XAuth questions with an external script
  • Adds cleanup routines that run in the event of an unexpected disconnection
  • Adds workaround for scenario where concentrator asks Xauth question as a password request.
  • Adds Mihai Maties' patch for Dead Peer Detection (http://lists.unix-ag.uni-kl.de/pipermail/vpnc-devel/2010-December/003492.html)

I also would recommend a watch guard as an ultimate solution for reconnects https://github.com/dcantrell/vpncwatch/network if an automated mode is very much desired and remote side can still cause (software-unrelated) disconnects.

PS

Since VPNC is a reversed-engineered version of commercial implementation, disconnects with emerging version changes on the remote side can be expected to reappear until being found&fixed again.

Finally,there is an option of using native client (anyconnect) for linux. One of the disadvantages are that client side configuration abilities as DNS record update and no default route are hugely limited. Another, disconnects will still take place but on much rare occasions.

share|improve this answer
add comment

I have the same problem on Ubuntu 12.04, and with VPNC it disconnects exactly after 24 minutes.

I tried "Shrew Soft" which I installed from software center. I was able to configure the VPN using .pcf file that I got from my IT department. Then I got the exact same problem.

However, with "Shrew Soft" you can configure a couple of things. The one that makes my connection stay up forever is the setting in Phase1-rekeying. I changed the "Key Life Time Limit" value from 86400 (24 hours) to 600 seconds. I suppose there is a bug somewhere where it uses 24 minutes instead of 24 hours.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.