☰

OpenVPN 客户端每 120 秒翻转一次状态

tag-icon • tag-icon freebsd openvpn pfsense
OpenVPN 客户端每 120 秒翻转一次状态

我正在使用 pfSense 的 OpenVPN 客户端连接到两个 OpenVPN 服务器。

连接可以工作，但每 120 秒就会从可用变为不可用，然后再返回。即ping工作120秒，然后停止工作，120秒不工作，然后再次工作，依此类推。

每个周期持续 120 秒，非常精确。

日志如下：

[server] Inactivity timeout (--ping-restart), restarting
SIGUSR1[soft,ping-restart] received, process restarting
Restart pause, 2 second(s)
WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Socket Buffers: R=[42080->42080] S=[57344->57344]
UDPv4 link local (bound): [AF_INET]MY.SE.RV.ER
UDPv4 link remote: [AF_INET]MY.SE.RV.ER:1194
TLS: Initial packet from [AF_INET]MY.SE.RV.ER:1194, sid=e1f19b04 500620f5
VERIFY OK: ...
VERIFY OK: ...
Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
WARNING: INSECURE cipher with block size less than 128 bit (64 bit). This allows attacks like SWEET32. Mitigate by using a --cipher with a larger block size (e.g. AES-256-CBC).
Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
WARNING: INSECURE cipher with block size less than 128 bit (64 bit). This allows attacks like SWEET32. Mitigate by using a --cipher with a larger block size (e.g. AES-256-CBC).
Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
[server] Peer Connection Initiated with [AF_INET]MY.SE.RV.ER:1194
SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
PUSH: Received control message: 'PUSH_REPLY,route 10.10.0.0 255.255.255.0,route-gateway 10.11.0.1,ping 10,ping-restart 120,ifconfig 10.11.0.34 255.255.255.0'
OPTIONS IMPORT: timers and/or timeouts modified
OPTIONS IMPORT: --ifconfig/up options modified
OPTIONS IMPORT: route options modified
OPTIONS IMPORT: route-related options modified
Preserving previous TUN/TAP instance: ovpnc5
Initialization Sequence Completed

120秒是有的，但是它们有什么影响呢？

答案1

可能的原因是传出流量正在通过多个 WAN 连接。对于像 HTTP 这样的普通连接，这是可以的，但是对于UDPopenvp，它可能导致服务器无法 ping 回并且服务器触发重新启动。

还没有证明足够。

相关内容