I’m wondering if anybody knows OpenVPN enough here to help me. I just set up a pair of VyOS routers with VRRP (rolling realease VyOS 1.5-rolling-202408210022 on both). I also have dial-in OpenVPN set up on the routers.
Both the VRRP failover and the OpenVPN dial-in works as intended, but OpenVPN clients don’t reconnect to the other router after failover. I can manually disconnect and reconnect the VPN after failover and that works perfectly.
The .ovpn config file has these stanzas
ping 10
ping-restart 30
Which I thought should mean that the OpenVPN client would ping the other end of the tunnel every 10 seconds and after 30 seconds of no reply try to reestablish the connection.
When the tunnel is up and working the OpenVPN client log shows lines like this:
11:55:23 - Tunnel interface is now UP
11:55:33 - Send ping
11:55:44 - Send ping
11:55:49 - Data: Received ping, do nothing
11:55:55 - Send ping
11:56:06 - Send ping
11:56:10 - Data: Received ping, do nothing
…but when the tunnel is down (that is, when I shut down the VRRP master that the client originally connected to) the log only shows “send ping messages” and nothing else:
Yes, that was it. When I added the stanza set interfaces openvpn vtun0 openvpn-option '--keepalive 3 12' to both routers the client started automatically reconnecting.
Thank you for the help marc_s, I had been banging my head against this problem for a few days!
Afterthought: you might want to try the keepalive setting:
16:40 vyos@gw 1.4.0 /home/vyos
✎ edit interfaces openvpn vtun0 » set
Possible completions:
> authentication Authentication settings
description Description
device-type OpenVPN interface device-type (default: tun)
disable Administratively disable interface
> encryption Data Encryption settings
hash Hashing Algorithm
> ip IPv4 routing parameters
> ipv6 IPv6 routing parameters
> keep-alive Keepalive helper options
+> local-address Local IP address of tunnel (IPv4 or IPv6)
local-host Local IP address to accept connections (all if not set)
local-port Local port number to accept connections
> mirror Mirror ingress/egress packets
mode OpenVPN mode of operation
> offload Configurable offload options
+ openvpn-option Additional OpenVPN options. You must use the syntax of
openvpn.conf in this text-field. Using this without proper
knowledge may result in a crashed OpenVPN server. Check
system log to look for errors.
persistent-tunnel Do not close and reopen interface (TUN/TAP device) on client
restarts
protocol OpenVPN communication protocol (default: udp)
redirect Redirect incoming packet to destination
+ remote-address IP address of remote end of tunnel
+ remote-host Remote host to connect to (dynamic if not set)
remote-port Remote port number to connect to
> replace-default-route
OpenVPN tunnel to be used as the default route
> server Server-mode options
shared-secret-key Secret key shared with remote end of tunnel
> tls Transport Layer Security (TLS) options
use-lzo-compression Use fast LZO compression on this TUN/TAP interface
vrf VRF instance name
16:40 vyos@gw 1.4.0 /home/vyos
✎ edit interfaces openvpn vtun0 » set keep-alive
Possible completions:
failure-count Maximum number of keepalive packet failures (default: 60)
interval Keepalive packet interval in seconds (default: 10)
They should expand into local (VyOS) and remote (push ...) stanzas. IMHO better than an openvpn-option ... command.
