Hi Jan,
Thanx for the detaled explanation.
So the warning is due to the early phase cipher mismatch. This is no issue
with me as long as the tunnel will bahave normally and no fragmentation
issues will rise.
Thanx,
Alex
On Sep 20, 2017 1:33 PM, "Jan Just Keijser" <[email protected]> wrote:
> Hi Alex,
>
> On 20/09/17 12:04, Alex K wrote:
>
> Hi Jan,
>
> The VPN tunnel is established successfully and connectivity is possible
> through the tunnel, except the link-mtu warning.
> Attached the client log.
>
>
>
> the client log shows that the "per-client cipher" patch is not 100%
> complete. Here's what happens:
>
> - the client connects to the server with "cipher none" set; the server has
> "cipher aes-128-cbc" set
> - the client detects a mismatch between ciphers (and thus link-mtu size)
> and prints a warning
> - the server then pushes a cipher to the client
> - the client accepts the ciphers and recalculates the link-mtu size (as
> well as a few other parameters).
>
> After that the link-mtu mismatch is gonen and the tunnel is happily up and
> running.
>
> It would have been nicer to avoid the initial warning message, but I know
> that part of the OpenVPN code : it's quite hard to avoid that warning...
>
> HTH,
>
> JJK
>
>
>
> On Wed, Sep 20, 2017 at 12:25 PM, Jan Just Keijser <[email protected]>
> wrote:
>
>> Hi Alex,
>>
>> On 18/09/17 18:53, Alex K wrote:
>>
>> Hi Jan,
>>
>> Yes, I use ncp-disable on client side so as to be able to have per client
>> cipher negotiation.
>> How can one have ncp-disable and avoid link MTU issues?
>>
>>
>> I must say that I have not tried the per-client cipher patch yet, but I
>> can imagine at which point it might cause problems. Of course, a per-client
>> cipher would never have worked with OpenVPN < 2.4, so I am not surprised
>> that you did not see it in the past.
>> Can you post/mail the client-side log file of a failing connection?
>>
>> cheers,
>>
>> JJK
>>
>>
>> On Mon, Sep 18, 2017 at 7:43 PM, Jan Just Keijser <[email protected]>
>> wrote:
>>
>>> Hi Alex,
>>>
>>> On 15/09/17 18:54, Alex K wrote:
>>>
>>> Hi all,
>>>
>>> I am receiving the below warning on server and client side when setting
>>> up the tunnel:
>>>
>>> server:
>>> Fri Sep 15 16:45:14 2017 172.30.0.180:44304 WARNING: 'link-mtu' is used
>>> inconsistently, local='link-mtu 1562', remote='link-mtu 1530'
>>>
>>> client:
>>> Fri Sep 15 16:45:14 2017 us=87436 WARNING: 'link-mtu' is used
>>> inconsistently, local='link-mtu 1530', remote='link-mtu 1562'
>>>
>>> and further down on client side:
>>> Fri Sep 15 16:45:15 2017 us=282768 OPTIONS IMPORT: adjusting link_mtu to
>>> 1629
>>>
>>>
>>> I have on server side:
>>> tun-mtu 1500
>>> fragment 1360
>>> mssfix
>>>
>>>
>>> and on client side exactly the same:
>>> tun-mtu 1500
>>> fragment 1360
>>> mssfix
>>>
>>> The tun interfaces on both sides show as 1500 with ifconfig.
>>>
>>> Why is this case? I cannot recall seeing such warning on openvpn 2.2.1-8.
>>> I can provide more details if needed.
>>>
>>>
>>> the link-mtu size also depends on the cipher and auth used ; are you
>>> using NCP at all (i.e. do you explicitly specify 'disable-ncp' ?) A log
>>> file of a failing client with 'verb 4' set would help.
>>>
>>> HTH,
>>>
>>> JJK
>>>
>>>
>>
>>
>
>
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
Openvpn-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openvpn-users
