Connection with 2.7 RC3 to a server bridge goes constantly up and down every minute or so

[realsimix]

I have an old server (2.4.12) where clients connect. The server has server-bridge nogw and keepalive 16 48 in the config. Old clients (2.4.12) work fine in this setup.

With the same client config on 2.7 RC3, the connection comes up fine, then stays for a minute or so and then goes down again, just to come online again. This repeats endlessly every minute or so.

Is there anyone having an idea why this happens?

Thanks,
Simon

[realsimix]

Server config:

local x.x.x.x
port 1199
dev tap0
server-bridge nogw
client-to-client
dh dh2048.pem
remote-cert-tls client
ca ca.crt
cert bridge-server.crt
key bridge-server.key
tls-auth ta.key 0
keepalive 16 48
ping-timer-rem
explicit-exit-notify
push "explicit-exit-notify"
passtos
nice -7
verb 3

Client config:

remote x.x.x.x
port 1199
dev tap0
client
script-security 2
up   /etc/openvpn/server/bridge-client.sh
down /etc/openvpn/server/bridge-client.sh
remote-cert-tls server
ca ca.crt
cert bridge-client.crt
key bridge-client.key
tls-auth ta.key 1
reneg-sec 0
passtos
nice -7
verb 3

[schwabe]

please include logfiles

[cron2]

Indeed, logfiles (verb 3 to start) or it did not happen. Start with the client log, which usually gives some sort of idea what is happening.

[realsimix]

Logfile with verb 3 is attached, let me know if higher verbosity is needed.

log1.txt

Thanks,
Simon

[realsimix]

In case it helps the same procedure with verb 5.

log2.txt

[realsimix]

I'm constantly pinging through the tunnel. When the tunnel stops working, nothing is logged at all. First log is about inactivity timeout, where the tunnel is brought to life again.

[realsimix]

While looking at the server logs I found it: For the test host with new openvpn version, I took the config of a host running an old version. Now, I forgot to stop openvpn on the old host and I don't have duplicate-cn enabled. Both clients have played ping pong.

Thanks,
Simon

[cron2]

Thanks for looking closely into the server logs, and finding the culprit ;-) - indeed, this can be a very annoying scenario (end users at one of my sites like to do this when migrating to a new laptop, and then connecting both old and new laptop at the same time, and then complaining that the VPN is broken...).

@schwabe the server is aware of the situation, but just "forgets" the old client. Do you think we could send something like an EEN to the now-superseded old client to signal what happened?