Hello ,
I have a Mikrotik router with Openvpn server on it
I’m trying to connect using a openvpn clients on my Raspberry PIs (I have 5 of them)
sometime the PI unable to connect for a long time time , and only after reboot he is able to connect to the vpn
I do see some times , networks issue with the pi (unable to go out to the internet - then he get disconnect from the vpn, but when the network return - he is unable to reconnect)
what can cause this problem and how to fix it ?
change something in the openvpn file in the PI? timeout \ reconnect option ?
change something in the router? reduce keep alive?
It sounds like you haven’t configured the RPis to close the failed connections and then reconnect.
Please post the config for your MikroTik (see code below) and a copy of the RPi OpenVPN config (you’ll need to manually redact the sensistive parts yourself) so that we can see just how you’ve got things setup.
I don’t use the automatic reconnect feature of OpenVPN so I’m basing the following on what I’ve read and can’t guarantee that it will help you.
On the MikroTik OpenVPN Server:
The keepalive-timeout is set for 30 seconds. This means that the unit won’t kill the connection, if it fails, for about 1 minute (could be longer depending on network issues).
The OpenVPN profile has the only-one option set to no, which is what it should be for your scenario.
On the Raspberry Pi Client:
You haven’t defined the connect-retry value so it uses the defaults (this means that, depending on the default configuration specified by the installer, it might not even retry to connect. - I don’t know).
If the OpenVPN client is using the defaults listed in the OpenVPN documentation, the connect-retry time might have increased to as much as 5 minutes.
My suggestions:
Reduce the keepalive-timeout on the MikroTik to 15 seconds, and/or
Put these lines in your OpenVPN client config file of:
keepalive 10 60
connect-retry 5 10
The connect-retry will cause the client to retry 5 seconds after the initial failure and every 10 seconds after that. The keepalive is more relevant to UDP connections but doesn’t hurt TCP ones.
I haven’t tried any of these things so don’t know if they’ll help. Let me know if they do and good luck.
–
Backups are your friend. Always make a backup!
/system backup save encryption=aes-sha256 name=MyBackup
Please, export and attach your current config to your post if you want help with a config issue:
Feb 26 17:22:04 raspberrypi systemd[1]: Failed to start OpenVPN connection to client.
Feb 26 17:22:09 raspberrypi systemd[1]: openvpn@client.service: Service RestartSec=5s expired, scheduling restart.
Feb 26 17:22:09 raspberrypi systemd[1]: openvpn@client.service: Scheduled restart job, restart counter is at 142.
Feb 26 17:22:09 raspberrypi systemd[1]: Stopped OpenVPN connection to client.
Feb 26 17:22:09 raspberrypi systemd[1]: Starting OpenVPN connection to client...
Feb 26 17:22:09 raspberrypi ovpn-client[18097]: Options error: --ca fails with '/home/pi/Documents/CRT/ca.crt': No such file or directory (errno=2)
Feb 26 17:22:09 raspberrypi ovpn-client[18097]: Options error: --cert fails with '/home/pi/Documents/CRT/client.crt': No such file or directory (errno=2)
Feb 26 17:22:09 raspberrypi ovpn-client[18097]: WARNING: cannot stat file '/home/pi/Documents/CRT/client.key': No such file or directory (errno=2)
Feb 26 17:22:09 raspberrypi ovpn-client[18097]: Options error: --key fails with '/home/pi/Documents/CRT/client.key': No such file or directory (errno=2)
Feb 26 17:22:09 raspberrypi systemd[1]: openvpn@client.service: Main process exited, code=exited, status=1/FAILURE
Feb 26 17:22:09 raspberrypi ovpn-client[18097]: WARNING: file '/etc/openvpn/.secrets' is group or others accessible
Feb 26 17:22:09 raspberrypi systemd[1]: openvpn@client.service: Failed with result 'exit-code'.
Feb 26 17:22:09 raspberrypi ovpn-client[18097]: Options error: Please correct these errors.
Feb 26 17:22:09 raspberrypi systemd[1]: Failed to start OpenVPN connection to client.
Feb 26 17:22:09 raspberrypi ovpn-client[18097]: Use --help for more information.
2 things are not clear :
I’m connect to the unit using VPN - so how could it be that it say “Failed to start OpenVPN connection to client”
why it say “cannot stat file ‘/home/pi/Documents/CRT/client.key’: No such file or directory (errno=2)” ? the files are there 100000%
The “Failed to start OpenVPN connection to client” error means that the OpenVPN service couldn’t start the connection specified in the client.conf file. If you had called the file myserver.conf it would have reported “Failed to start OpenVPN connection to myserver”.
The certificate errors are to do with the permissions on the files and can be resolved by running the following commands:
Very strange and I can’t explain it. I’ve had the same problem with certificates that you had and what I said about them is how I corrected the problem.
I found some details on a Reddit post that might help. You already have lines for persist-key and persist-tun but the post seems to indicate that adding a keepalive satement in the client config would help. They suggest:
keepalive 2 10
With the explanation: “The keepalive pings every 2 seconds and after twice waiting 10 seconds will restart the connection process.”
I don’t know if this will help you… but… I reinstalled my system (windows) last month. I installed openvpn - which was working fine before. By the way, I wanted to check something on the router and I restored it to factory settings, later I restored it from a backup. And the vpn was throwing errors. “unknown cipher alg or key size”. I tried 100 different ways and nothing. Finally, somewhere I came across a problem in which the incompatibility of protocols and versions was described. I installed a version of OpenVPN from a year ago - and the magic worked right away.
