Re: openvpn

["Raphael Bittencourt S. Costa" <raphaelbscosta@yahoo.com.br>]

Eu tenho instalado a algum tempo e ate agora nao me apresentou problemas...
Mas da uma olhada no FAQ do OPENVPN.. "*remember that UDP is 
connectionless"*


   I'm using TLS mode with no --remote option on the server. When I
   start the server then the client it works ok. I can restart the
   client with no problem, but if I restart the server and the client
   is connected I get the following problem: "TLS Error: Unknown data
   channel key ID or IP address received from 111.222.333.444:10203".
   In this case I need to restart the client again to make it work. Do
   you know what the problem is?

This problem occurs because when you restart the server, there is 
nothing to trigger a new TLS key exchange. The server can't trigger it 
because it doesn't have a *--remote* option giving it the address of its 
peer, so it wants to sit and wait for a client to connect. The client 
doesn't trigger it because it doesn't know the server was restarted 
(remember that UDP is connectionless).

There are several ways to fix this problem, listed in the order of 
preference:

   * Add a *--remote* option to the server which points to the client,
     making the connection peer-to-peer rather than client/server. When
     one peer restarts, it will force a new key exchange with the other
     peer.
   * Use the *--ping* and *--ping-restart* options to force a key
     negotiation any time that packets are not getting through the
     tunnel. Restarts always trigger a new key exchange.
   * Use static keys which allow OpenVPN to run in an essentially
     stateless manner.
   * Use TCP rather than UDP as your tunnel transport (available
     currently in the 1.5.x and higher with the *--proto* option). TCP
     is a connection-oriented protocol, and as such, either side of the
     connection knows immediately when the other side has disconnected.





dilceu@linuxservers.com.br wrote:

> Olá pessoal,
>  
> Instalei o openvpn no debian tem mais ou menos 3 meses e até agora não 
> consegui resolver um problema.
>  
> Quando não tem dados trafegando a vpn fica fincionando normamalmente, 
> porém quando começa trafegar dados (qualquer tipo, http, ssh, dns...) 
> a vpn simplesmente cai.
>  
> A principio achei que fosse problema no modem adsl da matriz, pois 
> estava fazendo NAT (direcionando a porta 5000 para o ip do servidor) 
> ai então mudei, deixei o modem (alcatel) em pptp e agora o ip válido 
> 200....... esta chegando diretamente na placa de rede do linux (ppp0), 
> porém o problema continua. Alguém tem alguma sugestão?
>  
> Obs: nessa vpn esta a matriz e mais seis filiais e todas acontecem o 
> mesmo problema.
>  
> Segue abaixo a saida do log na hora em que a vpn (de uma filial) caiu.
>  
> Dec  1 11:53:20 liguecom last message repeated 3 times
> Dec  1 11:53:20 liguecom openvpn[114]: TLS Error: Unknown data channel 
> key ID or IP address received from 201.14.157.55:50465: 4 (see FAQ for 
> more info on this error)
> Dec  1 11:53:35 liguecom last message repeated 3 times
> Dec  1 13:05:20 liguecom openvpn[20684]: TLS: soft reset sec=-982 
> bytes=13636/0 pkts=102/0
> Dec  1 11:53:49 liguecom openvpn[20684]: VERIFY OK: depth=1, 
> /C=BR/ST=SANTA.CATARINA/L=LAGES/O=LIGUECOM/OU=VPN/CN=CA/Email=FOO@BLE.COM
> Dec  1 11:53:49 liguecom openvpn[20684]: VERIFY OK: depth=0, 
> /C=BR/ST=SANTA.CATARINA/O=LIGUECOM/OU=VPN/CN=FILIAL8/Email=FOO@BLE
> Dec  1 11:53:50 liguecom openvpn[20684]: Data Channel Decrypt: Cipher 
> 'BF-CBC' initialized with 128 bit key
> Dec  1 11:53:50 liguecom openvpn[20684]: Data Channel Decrypt: Using 
> 160 bit message hash 'SHA1' for HMAC authentication
> Dec  1 11:53:50 liguecom openvpn[20684]: Data Channel Encrypt: Cipher 
> 'BF-CBC' initialized with 128 bit key
> Dec  1 11:53:50 liguecom openvpn[20684]: Data Channel Encrypt: Using 
> 160 bit message hash 'SHA1' for HMAC authentication
> Dec  1 11:53:50 liguecom openvpn[20684]: Control Channel: TLSv1, 
> cipher TLSv1/SSLv3 EDH-RSA-DES-CBC3-SHA, 1024 bit RSA
> Dec  1 11:53:50 liguecom openvpn[114]: TLS Error: Unknown data channel 
> key ID or IP address received from 201.14.157.55:50465: 4 (see FAQ for 
> more info on this error)
>  
> Alguém pode me dar alguma luz???
>  
> Dilceu Luiz Pazinatto
> Adm. de sistemas
> LinuxServers
> Voice 49 2237788
> Mobile 49 84029393
> Registred Linux ID 369936