mkdr
January 9, 2024, 4:23am
1
Following issue with a Flint router with firmware 4.4.6 and using a OpenVPN connection to VPN provider CyberGhost. Had created a Login/config for OpenVPN in my CyberGhost web portal and copied the zip file into the Flint router. The issue now is, the connection restarts every ~2 minutes periodically/indefinitely.
I cant see the cause in the log file through the GLinet web interface, because the log doesnt survive the restarts (this should be changed too btw I guess in a newer firmware, what sense does the log make, if its cleared with a restart/issue), the log is always totally reset/recreated every 2-3 minutes because the OpenVPN connections restarts.
The log just shows this, but it is not useful because it doesnt show the disconnect fault and then resets for the restart:
Tue Jan 9 05:23:18 2024 daemon.info avahi-daemon[4649]: New relevant interface ovpnclient.IPv4 for mDNS.97-1-de.cg-dialup.net dev=ovpnclient X509_0_CN=berlin-rack453.nodes.gen4.ninja remote_port_1=443 X509_1_CN=CyberGhost Root CA X509_1_C=RO ifconfig_netmask=255.255.255.0 tls_digest_sha256_0=REMOVED daemon_start_time=1704774198 script_context=init ifconfig_local=10.7.5.35 common_name=berlin-rack453.nodes.gen4.ninja tls_digest_sha256_1=REMOVED verb=4 X509_1_L=Bucharest link_mtu=1626 trusted_ip=193.176.86.57 tls_serial_hex_0=REMOVED X509_1_O=CyberGhost S.A. tun_mtu=1500 route_ipv6_network_1=2000::/3 tls_serial_hex_1=REMOVED tru
I have tested severel server locations so far, all have the same issue, using TCP for better stability / error correction.
The config file is the following provided by CyberGhost:
client97-1-de.cg-dialup.net 443
I dont have this issue with NordVPN, which provides a slightly different config:
clientCN=de799.nordvpn.com
mkdr
January 9, 2024, 7:19am
2
I have looked on ssh shell through logread and found this:
Tue Jan 9 08:12:30 2024 daemon.notice ovpnclient[17375]: [frankfurt-rack487.nodes.gen4.ninja] Inactivity timeout (–ping-exit), exiting
This seems to be repeated every 2 minutes and OpenVPN client closes and restarts.
I also notices this, is this normal?
Tue Jan 9 08:12:31 2024 daemon.notice netifd: ovpnclient (21288): * Zone ‘wgserver’Tue Jan 9 08:12:31 2024 daemon.notice netifd: ovpnclient (21288): * Running script ‘/etc/firewall.swap_wan_in_conn_mark.sh’ Tue Jan 9 08:12:31 2024 daemon.notice netifd: ovpnclient (21288): Another app is currently holding the xtables lock. Perhaps you want to use the -w option? Tue Jan 9 08:12:31 2024 daemon.notice netifd: ovpnclient (21288): sed: write error Tue Jan 9 08:12:31 2024 daemon.notice netifd: ovpnclient (21288): ! Failed with exit code 4 Tue Jan 9 08:12:31 2024 daemon.notice netifd: ovpnclient (21288): * Running script ‘/etc/firewall.vpn_server_policy.sh’ Tue Jan 9 08:12:31 2024 daemon.notice netifd: ovpnclient (21288): Another app is currently holding the xtables lock. Perhaps you want to use the -w option? Tue Jan 9 08:12:31 2024 daemon.notice netifd: ovpnclient (21288): Another app is currently holding the xtables lock. Perhaps you want to use the -w option? Tue Jan 9 08:12:31 2024 daemon.notice netifd: ovpnclient (21288): Another app is currently holding the xtables lock. Perhaps you want to use the -w option? Tue Jan 9 08:12:31 2024 daemon.notice netifd: ovpnclient (21288): Another app is currently holding the xtables lock. Perhaps you want to use the -w option? Tue Jan 9 08:12:31 2024 daemon.notice netifd: ovpnclient (21288): Another app is currently holding the xtables lock. Perhaps you want to use the -w option? Tue Jan 9 08:12:31 2024 daemon.notice netifd: ovpnclient (21288): * Running script ‘/usr/bin/gl_block.sh’ Tue Jan 9 08:12:31 2024 daemon.notice netifd: ovpnclient (21288): Failed to parse json data: unexpected character Tue Jan 9 08:12:31 2024 daemon.notice netifd: ovpnclient (21288): uci: Entry not found
mkdr
January 9, 2024, 8:01am
4
No, I am using only Ipv4.
It seems changing ping-exit 30 to ping-restart 30 has fixed it, so far the connection doesnt restart anymore it seems.
1 Like
Great! we’ll optimize the vpn log part soon, it’s quite messed up and misleading.
1 Like
mkdr
January 9, 2024, 8:58am
6
@hansome Can you maybe tell something about the other log entries I showed above, it seems to contain some errors like:
Tue Jan 9 08:12:31 2024 daemon.notice netifd: ovpnclient (21288): Failed to parse json data: unexpected character
It seems some json config file is broken?
Tue Jan 9 08:12:31 2024 daemon.notice netifd: ovpnclient (21288): uci: Entry not found
that doesnt sound right. Or also the firewall reloading warnings.
Tue Jan 9 08:12:31 2024 daemon.notice netifd: ovpnclient (21288): Another app is currently holding the xtables lock. Perhaps you want to use the -w option?
and
Tue Jan 9 08:12:31 2024 daemon.notice netifd: ovpnclient (21288): Warning: fw3_ipt_rule_append(): Can’t find target ‘postrouting_rule’
Some of these seem to be errors for example the parse error, or not properly using iptables -w command.
Also is there anything else I should maybe change in the above config by Cyberghost so it is more compatible or performing better?
My test didn’t report logs like that.http://192.168.8.1/cgi-bin/luci/admin/system/flash
Have you installed any packages manually?
mkdr
January 9, 2024, 5:02pm
8
@hansome these errors are generated when you stop a running/open openvpn client connection from the web gui via the stop button.
Tue Jan 9 18:00:56 2024 user.notice mwan3[4621]: Execute ifdown event on interface ovpnclient (unknown)Tue Jan 9 18:00:57 2024 kern.info kernel: [18253.559571] xt_CT: No such helper “rtsp” @defaults [0] requires unavailable target extension FLOWOFFLOAD, disabling@zone [1] (wan) cannot resolve device of network ‘wan6’@zone [1] (wan) cannot resolve device of network ‘wwan’@zone [2] (guest) cannot resolve device of network ‘guest’@redirect [0] (GL-cam1_rtsp) has no target specified, defaulting to DNAT@redirect [1] (GL-cam2_rtsp) has no target specified, defaulting to DNAT@defaults [0] requires unavailable target extension FLOWOFFLOAD, disabling@zone [2] (guest) has no device, network, subnet or extra options#18 #19 #20 #21 #18 #19 #20 #21 Tue Jan 9 18:00:58 2024 daemon.notice netifd: ovpnclient (4622): Warning: fw3_ipt_rule_append(): Can’t find target ‘postrouting_lan_rule’ Tue Jan 9 18:00:58 2024 daemon.notice netifd: ovpnclient (4622): Another app is currently holding the xtables lock. Perhaps you want to use the -w option? Tue Jan 9 18:00:58 2024 daemon.notice netifd: ovpnclient (4622): ! Skipping due to path error: No such file or directory Tue Jan 9 18:00:58 2024 daemon.notice netifd: ovpnclient (4622): Failed to parse json data: unexpected character Tue Jan 9 18:00:58 2024 daemon.notice netifd: ovpnclient (4622): uci: Entry not found
