I have an OpenVPN network established between a client and server. Everything works great until I physically unplug the network cable. After that, anything that tries to use the virtual network (ping, ssh, etc.) takes absolutely forever to timeout. I've noticed that I'm not getting back "destination host unreachable" or "no route to host" errors from the tun0 interface, which I do get back from the physical network interface. Is there perhaps a setting that will tell OpenVPN to send back unreachable host signals after a couple of seconds?
If I try to ssh to a physical address that is unreachable, I get a "no route to host" response in about 3 seconds.
# ssh [physical address] ssh: connect to host [physical address] port 22: No route to host
If I try to ssh to an unreachable vpn address, I get a connection timeout response instead and it takes around two minutes.
# ssh [vpn address] ssh: connect to host [vpn address] port 22: Connection timed out
EDIT: Using tcpdump I can see that I never get a "host unreachable" code back from ping on the vpn interface. Instead it sends an echo request to the specified address and then nothing happens. If I ping an unreachable host on the physical network I quickly get back a host unreachable code and no echo request is ever sent.
This behavior persists after disabling iptables and cranking down the keepalive to 1 and 10.
Here are my configuration files:
client dev tun proto udp tls-client remote [server ip] [server port] resolv-retry infinite nobind user nobody group nobody persist-key persist-tun ca [location] cert [location] key [location] askpass [location] remote-cert-tls server tls-auth [location] cipher AES-256-CBC tls-version-min 1.2 auth SHA512 auth-nocache log-append [location] writepid [location] verb 5
port [port] proto udp tls-server dev tun ca [location] cert [location] key [location] askpass [location] dh [location] server [subnet] [netmask] ifconfig-pool-persist ipp.txt client-config-dir [location] client-to-client keepalive 10 120 tls-auth [location] cipher AES-256-CBC tls-version-min 1.2 auth SHA512 auth-nocache user nobody group nobody persist-key persist-tun status [location] log-append [location] writepid [location] verb 5 explicit-exit-notify 1