OpenVPNの再接続が失敗し、手動で再起動する

Question

Azure仮想マシンにOpenVPNサーバーをセットアップしました。セットアップには https://github.com/Nyr/openvpn-install のスクリプトを使用しました。

次に、Sudo openvpn --config client.ovpnを使用してサーバーに接続します。これは完全に機能します。次に、イーサネットケーブルをクライアントマシンから取り外してから、再接続します。その後、クライアントは再接続を試みますが、成功することはありません。次に、クライアント（ctrl+c）を強制終了し、同じコマンドで再起動してみました-これは機能します。

クライアントは現在、少なくとも2つのNAT=レイヤーを持つオフィスネットワーク上にあります。最終的に、クライアントはかなり不安定なクライアントのネットワーク上にあり、ネットワークセットアップを制御できません。

TCPまたはUDPを使用しても、同じ動作が得られます。

再接続の動作がOpenVPNクライアントを停止してから開始するのと異なるのはなぜですか？

すべてが失敗した場合は、もちろん、OpenVPNクライアントを再起動するラッパースクリプトを作成できますが、もちろん、これを行わない方がよいでしょう。

サーバーとクライアントの両方がUbuntuサーバー18.04を実行します

.ovpnファイルのヘッダーは次のとおりです。

client
dev tun
proto udp
sndbuf 0
rcvbuf 0
remote <Host> 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
auth SHA512
cipher AES-256-CBC
setenv opt block-outside-dns
key-direction 1
verb 3

UDPを使用する場合、OpenVPNクライアントからログを記録します（TCPは非常に似ています）：

$ Sudo openvpn --config client.ovpn
Mon Jan 28 13:24:35 2019 Unrecognized option or missing or extra parameter(s) in client.ovpn:14: block-outside-dns (2.4.4)
Mon Jan 28 13:24:35 2019 OpenVPN 2.4.4 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Sep  5 2018
Mon Jan 28 13:24:35 2019 library versions: OpenSSL 1.1.0g  2 Nov 2017, LZO 2.08                        
Mon Jan 28 13:24:35 2019 Outgoing Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Mon Jan 28 13:24:35 2019 Incoming Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Mon Jan 28 13:24:35 2019 TCP/UDP: Preserving recently used remote address: [AF_INET]<server_ip>:1194
Mon Jan 28 13:24:35 2019 Socket Buffers: R=[212992->212992] S=[212992->212992]                                             
Mon Jan 28 13:24:35 2019 UDP link local: (not bound)    
Mon Jan 28 13:24:35 2019 UDP link remote: [AF_INET]<server_ip>:1194       
Mon Jan 28 13:24:35 2019 TLS: Initial packet from [AF_INET]<server_ip>:1194, sid=<> 78915078
Mon Jan 28 13:24:35 2019 VERIFY OK: depth=1, CN=ChangeMe                                               
Mon Jan 28 13:24:35 2019 VERIFY KU OK                                         
Mon Jan 28 13:24:35 2019 Validating certificate extended key usage
Mon Jan 28 13:24:35 2019 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Mon Jan 28 13:24:35 2019 VERIFY EKU OK
Mon Jan 28 13:24:35 2019 VERIFY OK: depth=0, CN=server
Mon Jan 28 13:24:35 2019 Control Channel: TLSv1.2, cipher TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
Mon Jan 28 13:24:35 2019 [server] Peer Connection Initiated with [AF_INET]<server_ip>:1194
Mon Jan 28 13:24:36 2019 SENT CONTROL [server]: 'Push_REQUEST' (status=1)
Mon Jan 28 13:24:36 2019 Push: Received control message: 'Push_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 1.1.1.1,dhcp-option DNS 1.0.0.1,route-gateway 10.8.0.1,topology subnet,ping 10,ping-restart 120,ifconfig 10.8.0.3 255.2
55.255.0,peer-id 0,cipher AES-256-GCM'
Mon Jan 28 13:24:36 2019 OPTIONS IMPORT: timers and/or timeouts modified
Mon Jan 28 13:24:36 2019 OPTIONS IMPORT: --ifconfig/up options modified
Mon Jan 28 13:24:36 2019 OPTIONS IMPORT: route options modified
Mon Jan 28 13:24:36 2019 OPTIONS IMPORT: route-related options modified
Mon Jan 28 13:24:36 2019 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Mon Jan 28 13:24:36 2019 OPTIONS IMPORT: peer-id set
Mon Jan 28 13:24:36 2019 OPTIONS IMPORT: adjusting link_mtu to 1624
Mon Jan 28 13:24:36 2019 OPTIONS IMPORT: data channel crypto options modified
Mon Jan 28 13:24:36 2019 Data Channel: using negotiated cipher 'AES-256-GCM'
Mon Jan 28 13:24:36 2019 Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Mon Jan 28 13:24:36 2019 Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
Mon Jan 28 13:24:36 2019 ROUTE_GATEWAY 192.169.0.1/255.255.255.0 IFACE=enp0s31f6 HWADDR=<mac>
Mon Jan 28 13:24:36 2019 TUN/TAP device tun0 opened
Mon Jan 28 13:24:36 2019 TUN/TAP TX queue length set to 100
Mon Jan 28 13:24:36 2019 do_ifconfig, tt->did_ifconfig_ipv6_setup=0
Mon Jan 28 13:24:36 2019 /sbin/ip link set dev tun0 up mtu 1500
Mon Jan 28 13:24:36 2019 /sbin/ip addr add dev tun0 10.8.0.3/24 broadcast 10.8.0.255
Mon Jan 28 13:24:36 2019 /sbin/ip route add <server_ip>/32 via 192.169.0.1
Mon Jan 28 13:24:36 2019 /sbin/ip route add 0.0.0.0/1 via 10.8.0.1
Mon Jan 28 13:24:36 2019 /sbin/ip route add 128.0.0.0/1 via 10.8.0.1
Mon Jan 28 13:24:36 2019 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Mon Jan 28 13:24:36 2019 Initialization Sequence Completed
Mon Jan 28 13:28:47 2019 [server] Inactivity timeout (--ping-restart), restarting
Mon Jan 28 13:28:47 2019 SIGUSR1[soft,ping-restart] received, process restarting
Mon Jan 28 13:28:47 2019 Restart pause, 5 second(s)
Mon Jan 28 13:28:52 2019 TCP/UDP: Preserving recently used remote address: [AF_INET]<server_ip>:1194
Mon Jan 28 13:28:52 2019 Socket Buffers: R=[212992->212992] S=[212992->212992]
Mon Jan 28 13:28:52 2019 UDP link local: (not bound)
Mon Jan 28 13:28:52 2019 UDP link remote: [AF_INET]<server_ip>:1194
Mon Jan 28 13:29:52 2019 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Mon Jan 28 13:29:52 2019 TLS Error: TLS handshake failed                                                                                                                                                                                      
Mon Jan 28 13:29:52 2019 SIGUSR1[soft,tls-error] received, process restarting                                                                                                                                                                 
Mon Jan 28 13:29:52 2019 Restart pause, 5 second(s)                                                                                                                                                                                           
Mon Jan 28 13:29:57 2019 TCP/UDP: Preserving recently used remote address: [AF_INET]<server_ip>:1194
Mon Jan 28 13:29:57 2019 Socket Buffers: R=[212992->212992] S=[212992->212992]                                               
Mon Jan 28 13:29:57 2019 UDP link local: (not bound)                                                                         
Mon Jan 28 13:29:57 2019 UDP link remote: [AF_INET]<server_ip>:1194                                 
Mon Jan 28 13:30:57 2019 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Mon Jan 28 13:30:57 2019 TLS Error: TLS handshake failed
Mon Jan 28 13:30:57 2019 SIGUSR1[soft,tls-error] received, process restarting
Mon Jan 28 13:30:57 2019 Restart pause, 5 second(s)                                                  
Mon Jan 28 13:31:02 2019 TCP/UDP: Preserving recently used remote address: [AF_INET]<server_ip>:1194
Mon Jan 28 13:31:02 2019 Socket Buffers: R=[212992->212992] S=[212992->212992]
Mon Jan 28 13:31:02 2019 UDP link local: (not bound)              
Mon Jan 28 13:31:02 2019 UDP link remote: [AF_INET]<server_ip>:1194                                                    
Mon Jan 28 13:32:02 2019 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Mon Jan 28 13:32:02 2019 TLS Error: TLS handshake failed
Mon Jan 28 13:32:02 2019 SIGUSR1[soft,tls-error] received, process restarting                              
Mon Jan 28 13:32:02 2019 Restart pause, 5 second(s)                                          
Mon Jan 28 13:32:07 2019 TCP/UDP: Preserving recently used remote address: [AF_INET]<server_ip>:1194
Mon Jan 28 13:32:07 2019 Socket Buffers: R=[212992->212992] S=[212992->212992]                                                                                                                                                                
Mon Jan 28 13:32:07 2019 UDP link local: (not bound)
Mon Jan 28 13:32:07 2019 UDP link remote: [AF_INET]<server_ip>:1194  
Mon Jan 28 13:33:07 2019 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Mon Jan 28 13:33:07 2019 TLS Error: TLS handshake failed       
Mon Jan 28 13:33:07 2019 SIGUSR1[soft,tls-error] received, process restarting
Mon Jan 28 13:33:07 2019 Restart pause, 5 second(s)                                      
Mon Jan 28 13:33:12 2019 TCP/UDP: Preserving recently used remote address: [AF_INET]<server_ip>:1194
Mon Jan 28 13:33:12 2019 Socket Buffers: R=[212992->212992] S=[212992->212992]
Mon Jan 28 13:33:12 2019 UDP link local: (not bound)                         
Mon Jan 28 13:33:12 2019 UDP link remote: [AF_INET]<server_ip>:1194      
Mon Jan 28 13:34:13 2019 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Mon Jan 28 13:34:13 2019 TLS Error: TLS handshake failed                                         
Mon Jan 28 13:34:13 2019 SIGUSR1[soft,tls-error] received, process restarting                            
Mon Jan 28 13:34:13 2019 Restart pause, 5 second(s)
Mon Jan 28 13:34:18 2019 TCP/UDP: Preserving recently used remote address: [AF_INET]<server_ip>:1194
Mon Jan 28 13:34:18 2019 Socket Buffers: R=[212992->212992] S=[212992->212992]
Mon Jan 28 13:34:18 2019 UDP link local: (not bound)           
Mon Jan 28 13:34:18 2019 UDP link remote: [AF_INET]<server_ip>:1194              
Mon Jan 28 13:35:18 2019 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Mon Jan 28 13:35:18 2019 TLS Error: TLS handshake failed          
Mon Jan 28 13:35:18 2019 SIGUSR1[soft,tls-error] received, process restarting
Mon Jan 28 13:35:18 2019 Restart pause, 10 second(s)                                                                             
Mon Jan 28 13:35:28 2019 TCP/UDP: Preserving recently used remote address: [AF_INET]<server_ip>:1194
Mon Jan 28 13:35:28 2019 Socket Buffers: R=[212992->212992] S=[212992->212992]   

Answer 1

私は解決策を見つけました。

クライアントのovpnファイルで、persist-tunを無効にします。

;persist-tun

そしてそれを試してみてください。

参照：
- https://forums.openvpn.net/viewtopic.php?t=2202
- https://forums.openvpn.net/viewtopic.php?f=6&t=22325&p=64015#p64015