This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Strange openVPN problem

Hi, some maybe with the same problem?

The connection with openVPN is working only in 75% of the time!

I am using the dynamic ip addresses for packet filtering, so maybe this is the problem.

Some of the users (mainly customers) have of course only access to their DMZ.

So here what is happening:

During connect, the openVPN client gets an ip address which was already held by another client and is still in the connection table of Astaros Webadmin.

If this ip address is of one of these customers above, there is still a packet filter rule for it and the newly conencted client cannot connect to the internal network.

Astaro said, they are aware of this but they had no chance to investigate yet because a reboot seems to solve the problem!

Anyone?

Regards!
Frank

This thread was automatically locked due to age.

0 d12fk over 14 years ago

Do you use the User Network objects in the packetfilter rules?
Cancel
Vote Up 0 Vote Down

Cancel
0 FrankFiene over 14 years ago in reply to d12fk

Yes, exactly this is the problem, if an internal user gets one of these old addresses which are blocked out of one network for example, the packet filter rule will block this user from this network.
Cancel
Vote Up 0 Vote Down

Cancel
0 d12fk over 14 years ago in reply to FrankFiene

What machine do you run the ASG on and how many users connect to it?
Cancel
Vote Up 0 Vote Down

Cancel
0 FrankFiene over 14 years ago

On the IBM Dual-Quadcore HA-Cluster (yes i really need 64 bit for v8!!!).

We've just started implementation, max. 20-25 at the same time!

Does that matter? CPU usage is under 10% at any time (average 2%), RAM usage
Cancel
Vote Up 0 Vote Down

Cancel
0 d12fk over 14 years ago in reply to FrankFiene

Of course it does matter, otherwise I wouldn't have asked. =) It's of interest if only slow boxes are affected or if it also happens on ones which have reasonable resources left over to handle load peaks. I'd count your machine to the latter group, so this really seems to affect all installations out there.

Hang on, I'll provide a script to reset the addresses for user objects. From there we can go on tracking this issue down.
Cancel
Vote Up 0 Vote Down

Cancel
0 FrankFiene over 14 years ago in reply to d12fk

I have this script and it is running at 02:00 as a cron job.

This was not the complete solution:

I have to restart openVPN after running this script because all IP addresses the Astaro has learned from openVPN are gone if I do not! As a result all dynamically created netfilter rules were gone!

I've tested with iptables -L

I've told that to Astaro support, maybe they will ask you? Are you the developer they are talking about?
Then I will ask you directly next time! :-D

Most of the time I think, the support has less knowledge then me, if I have a real support case, it is every time a little bit complicated! ;-)
Cancel
Vote Up 0 Vote Down

Cancel
0 FrankFiene over 14 years ago in reply to FrankFiene

Aeehhmm, yes I know, a restart maybe will fix this.
Switch to slave and back was not working, the problem has moved from one instance to the other!

But I want to help to find the real solution, so I try not to reboot the whole cluster as long as possible!

Frank
Cancel
Vote Up 0 Vote Down

Cancel
0 d12fk over 14 years ago

Could you enable SSH access from Astaro HQ again, please.
Cancel
Vote Up 0 Vote Down

Cancel
0 FrankFiene over 14 years ago in reply to d12fk

It is enabled!
Cancel
Vote Up 0 Vote Down

Cancel
0 d12fk over 14 years ago

Can't connect. Please provide the right hostname and port via PM
Cancel
Vote Up 0 Vote Down

Cancel