0

I have an OpenVPN network established between a client and server. Everything works great until I physically unplug the network cable. After that, anything that tries to use the virtual network (ping, ssh, etc.) takes absolutely forever to timeout. I've noticed that I'm not getting back "destination host unreachable" or "no route to host" errors from the tun0 interface, which I do get back from the physical network interface. Is there perhaps a setting that will tell OpenVPN to send back unreachable host signals after a couple of seconds?

Example:

If I try to ssh to a physical address that is unreachable, I get a "no route to host" response in about 3 seconds.

# ssh [physical address]
ssh: connect to host [physical address] port 22: No route to host

If I try to ssh to an unreachable vpn address, I get a connection timeout response instead and it takes around two minutes.

# ssh [vpn address]
ssh: connect to host [vpn address] port 22: Connection timed out

EDIT: Using tcpdump I can see that I never get a "host unreachable" code back from ping on the vpn interface. Instead it sends an echo request to the specified address and then nothing happens. If I ping an unreachable host on the physical network I quickly get back a host unreachable code and no echo request is ever sent.

This behavior persists after disabling iptables and cranking down the keepalive to 1 and 10.

Here are my configuration files:

client.conf

client
dev tun
proto udp
tls-client
remote [server ip] [server port]
resolv-retry infinite
nobind
user nobody
group nobody
persist-key
persist-tun
ca [location]
cert [location]
key [location]
askpass [location]
remote-cert-tls server
tls-auth [location]
cipher AES-256-CBC
tls-version-min 1.2
auth SHA512
auth-nocache
log-append [location]
writepid [location]
verb 5

server.conf

port [port]
proto udp
tls-server
dev tun
ca   [location]
cert [location]
key  [location]
askpass [location]
dh [location]
server [subnet] [netmask]
ifconfig-pool-persist ipp.txt
client-config-dir [location]
client-to-client
keepalive 10 120
tls-auth [location]
cipher AES-256-CBC
tls-version-min 1.2
auth SHA512
auth-nocache
user nobody
group nobody
persist-key
persist-tun
status [location]
log-append  [location]
writepid [location]
verb 5
explicit-exit-notify 1
New contributor
Graph Theory is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.

Your Answer

Graph Theory is a new contributor. Be nice, and check out our Code of Conduct.

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.