OpenVPN tunnel up but the connection resets all the time

[bortek]

There is something weird going on with one of my VPN tunnels. I Have a setup according to this drawing which has been working up until now.

First Short description of the setup. It is Site-to-Site OpenVPN where Site-JS is a server and two on the left/right are clients. VPN tunnel towards Site-JÖ works fine and traffic flows both ways inside the tunnels.

But Site-KL has some strange issues. I have lately was on that site and from there communication towards Site-JS was working (while being at Site-KL). Now I came back and sitting at Site-JS and have these strange issues when communication to Site-KL via the tunnel.

It looks like as soon as I send data faster than X amount or maybe even bigger than Y bytes the connection is being reset. I mean I cannot access my home assistant or router GUIS via the browser. It starts to get the data but then all of a sudden connection reset and a big STOP. No more data coming in. Whats more weird is that the tunnel is not experiencing any issues, there are no errors on either side in the syslog.log even with debug level 7. How do I know? I can start ssh tunnel and monitor the logs when I test. Yes SSH is the only thing that works since it does not take much data. But as soon as I try to cat the log file there will be the same thing. Connection reset/stop and need to reconnect. I have already restarted many times both AC86U nodes acting as router and AiMesh node (on Site-KL) as well as AC86U on Site-JS.

Now what has changed on Site-KL since it was working last time?

One obvious thing which still make no sense.

- I have replaced a 4G SIM card with a new one from the same mobile operator. That SIM is sitting in the 4G stick connected to USB on the back of primary AC86U unit at Site-KL. This is how this site connects to the internet.

Other than that I can not come up with other changes.

So please help me thinking what is going here and what else should I check or troubleshoot using ssh terminal.

 

[ika]

Shooting in the dark here, but if everything worked and this is happening since the SIM change, you might want to check on the SIM card. Not all SIMs are equal, it depends when they were issued. Newer SIMs might have newer chips inside which are able to use more frequencies which might lead to more stable connections.

The other thing I would try: TCP tunnel for a test if you are using UDP or vice versa

 

[bortek]

I think I wasn't clear enough about a SIM. After I replaced it I stayed atvthe Site-KL dor a few days and was using Internet with that SIM and it worked just fine. So the sim itself is working. And also checked with mobile operator and they are not blocking any sort of vpns.


An yes I am using udp vpn. To switch it to tcp I would need some instructions how to do it on the client sidd using only cli since I cannot access gui.

 

[ika]

An yes I am using udp vpn. To switch it to tcp I would need some instructions how to do it on the client sidd using only cli since I cannot access gui.

I'm not sure you can do that, but I would try to start a second VPN server from the shell (obviously make sure it is a different subnet). Doesn't even needs to be OpenVPN if you only gonna use it for fixing/reconfiguring stuff.

 

[bortek]

The damm thing started to work by itself without me doing anything. I blamed mobile operator was doing some magic with the traffic.

 

[martinr]

The damm thing started to work by itself without me doing anything. I blamed mobile operator was doing some magic with the traffic.

Self-fixing faults are the best faults.

 

[bortek]

a short update. I replaced the SIM card (of the same mobile operator) that was sitting in USB/4G doungle and was connected to the router. So I blame the mobile operator doing something with the traffic. This can come back though e.g. if they detect usage of the VPN and they want to block/traffic_shape it in some way. Well I did also some reconfiguration of the AIMesh nodes but that should not affect VPN stuff IMO.

So the takeaway is that there was nothing wrong with the config in here.