VPNC disconnects/reconnects after every hour

Post new topic   Reply to topic    DD-WRT Forum Index -> Broadcom SoC based Hardware
Goto page 1, 2  Next
Author Message
mweber88
DD-WRT Novice


Joined: 10 Feb 2010
Posts: 12

PostPosted: Sat Feb 13, 2010 3:47    Post subject: VPNC disconnects/reconnects after every hour Reply with quote
I have successfully installed DDWRT build 13064 onto my WRT310n and configured it to connect to the Cisco router at my office. Then, I have connected my IP phone to the WRT310n and voila, I have my office phone and network 350 miles away.

The problem is that the vpnc loses connection, and then pings fail and the disconnect/reconnect in the script takes over and the connection resumes. This happens every hour on the clock. I have been sitting here watching my phone for several hours and right at 19 past the hour, I lose computer connection to my office and the phone reboots.

I have the dead peer detection command line setting in the startup script still in there, but hourly, this thing goes dead. This is getting to be a big problem as I kept dropping client phone calls after each hour today, then had to redial the client.

I've SSH'd into the router and tried to view options, version or help for vpnc, but apparently the compiled vpnc code is REALLY light and all that has been left out.

Any help would be GREATLY appreciated!

Mike
Sponsor
mweber88
DD-WRT Novice


Joined: 10 Feb 2010
Posts: 12

PostPosted: Mon Feb 15, 2010 0:08    Post subject: Reply with quote
Any ideas? Anybody?
phuzi0n
DD-WRT Guru


Joined: 10 Oct 2006
Posts: 10141

PostPosted: Mon Feb 15, 2010 1:53    Post subject: Reply with quote
Check you WAN status page to see if a DHCP lease renewal coincides with your disconnection. If it does then see the link below for a command to add to your firewall script and add a reply to the ticket.

http://svn.dd-wrt.com:8000/dd-wrt/ticket/973

_________________
Read the forum announcements thoroughly! Be cautious if you're inexperienced.
Available for paid consulting. (Don't PM about complicated setups otherwise)
Looking for bricks and spare routers to expand my collection. (not interested in G spec models)
mweber88
DD-WRT Novice


Joined: 10 Feb 2010
Posts: 12

PostPosted: Tue Feb 16, 2010 18:23    Post subject: Reply with quote
phuzi0n wrote:
Check you WAN status page to see if a DHCP lease renewal coincides with your disconnection. If it does then see the link below for a command to add to your firewall script and add a reply to the ticket.

http://svn.dd-wrt.com:8000/dd-wrt/ticket/973


I just checked it, and I have 6 days remaining on my WAN DHCP lease. So, I don't think that's the issue.

I've been scouring the wiki and other pages for the last two days and I cannot find any way to determine what version of vpnc is used in this build, and none of the usage or help information remains in the vpnc executable, so doing vpnc --version yields nothing.

I'm thinking of PMing brainslayer to ask him that question. Do you think that's a wise choice?

Thanks!

Mike
phuzi0n
DD-WRT Guru


Joined: 10 Oct 2006
Posts: 10141

PostPosted: Tue Feb 16, 2010 18:43    Post subject: Reply with quote
Check the source yourself.

http://svn.dd-wrt.com:8000/dd-wrt/browser/src/router/vpnc

_________________
Read the forum announcements thoroughly! Be cautious if you're inexperienced.
Available for paid consulting. (Don't PM about complicated setups otherwise)
Looking for bricks and spare routers to expand my collection. (not interested in G spec models)
alain
DD-WRT Guru


Joined: 06 Jun 2006
Posts: 601

PostPosted: Tue Feb 16, 2010 20:05    Post subject: Reply with quote
If your disconnect is not caused by a dhcp renew, maybe rekeying fails.
Can you check what your rekeying interval is?
Does the same problem also occur when using vpnc on your computer? (under linux, using cygwin also possible under windows)

Greetings,
Alain
mweber88
DD-WRT Novice


Joined: 10 Feb 2010
Posts: 12

PostPosted: Tue Feb 16, 2010 22:47    Post subject: Reply with quote
alain wrote:
If your disconnect is not caused by a dhcp renew, maybe rekeying fails.
Can you check what your rekeying interval is?
Does the same problem also occur when using vpnc on your computer? (under linux, using cygwin also possible under windows)

Greetings,
Alain


Alain--

I have looked at my router's log and see that the crypto lifetime setting is 3600 seconds, which does correspond to the issue I'm seeing.

Additionally, in the logs on the router, I see that the time duration of my connection is right around that time, anywhere from 58 minutes to exactly 1:00:00 and the reason is generally "other" while when I use my Windows Cisco client and disconnect it is "peer delete request" when I disconnect.

I no longer have a Linux machine to which I can connect, but I am building a VM right now and will test that as well to see what happens when I get it built. I will post my results here.

Thanks!
mweber88
DD-WRT Novice


Joined: 10 Feb 2010
Posts: 12

PostPosted: Wed Feb 17, 2010 0:02    Post subject: Reply with quote
I have built the Linux VM, installed vpnc, configured, and it is currently connected. I am running ping on a 30-second interval to ping the router at the other end. I will look to see when and if it quits around 1 hour into the pinging, and then I will post my findings.

Thanks!

Mike
mweber88
DD-WRT Novice


Joined: 10 Feb 2010
Posts: 12

PostPosted: Wed Feb 17, 2010 1:04    Post subject: Reply with quote
After allowing it to run for a little over an hour on my Linux machine, with a 30-second interval between pings, it stopped after 117 pings (and I started pinging a little late).

The vpnc version installed on my Linux machine is 0.5.3, which appears to be the same that is in dd-wrt.

So, it does appear to be a problem in vpnc. Your thoughts?

Thanks!

Mike
alain
DD-WRT Guru


Joined: 06 Jun 2006
Posts: 601

PostPosted: Wed Feb 17, 2010 14:52    Post subject: Reply with quote
Ok, so your problem is not dd-wrt related.
Try to run vpnc on your pc (vmware image) with
vpnc --debug 2 --no-detach <configfile>

pls post the output you get.
mweber88
DD-WRT Novice


Joined: 10 Feb 2010
Posts: 12

PostPosted: Sat Feb 20, 2010 21:00    Post subject: Reply with quote
Code:

   lifetime status: 3294 of 3600 seconds used, 4|3 of 4608000 kbytes used
   lifetime status: 3303 of 3600 seconds used, 4|3 of 4608000 kbytes used
   lifetime status: 3313 of 3600 seconds used, 4|3 of 4608000 kbytes used
   lifetime status: 3322 of 3600 seconds used, 4|3 of 4608000 kbytes used
   lifetime status: 3332 of 3600 seconds used, 4|3 of 4608000 kbytes used
   NAT-T mode, adding non-esp marker
   lifetime status: 3341 of 3600 seconds used, 4|3 of 4608000 kbytes used
   lifetime status: 3341 of 3600 seconds used, 4|3 of 4608000 kbytes used
   got late ike paket: 92 bytes
   got r-u-there ack
   lifetime status: 3350 of 3600 seconds used, 4|3 of 4608000 kbytes used
   lifetime status: 3360 of 3600 seconds used, 4|3 of 4608000 kbytes used
   lifetime status: 3369 of 3600 seconds used, 4|3 of 4608000 kbytes used
   lifetime status: 3379 of 3600 seconds used, 4|3 of 4608000 kbytes used
   lifetime status: 3388 of 3600 seconds used, 4|3 of 4608000 kbytes used
   lifetime status: 3398 of 3600 seconds used, 4|3 of 4608000 kbytes used
   lifetime status: 3407 of 3600 seconds used, 4|3 of 4608000 kbytes used
   lifetime status: 3413 of 3600 seconds used, 4|3 of 4608000 kbytes used
   got late ike paket: 172 bytes
   got ipsec lifetime attributes: 3600 seconds
   got ipsec lifetime attributes: 4608000 kilobyte
   got ipsec lifetime attributes: 4608000 kilobyte
   NAT-T mode, adding non-esp marker
   lifetime status: 9 of 3600 seconds used, 0|0 of 4608000 kbytes used
   lifetime status: 18 of 3600 seconds used, 0|0 of 4608000 kbytes used
   lifetime status: 28 of 3600 seconds used, 0|0 of 4608000 kbytes used
   lifetime status: 37 of 3600 seconds used, 0|0 of 4608000 kbytes used
   lifetime status: 47 of 3600 seconds used, 0|0 of 4608000 kbytes used
   lifetime status: 56 of 3600 seconds used, 0|0 of 4608000 kbytes used
   lifetime status: 66 of 3600 seconds used, 0|0 of 4608000 kbytes used
   lifetime status: 75 of 3600 seconds used, 0|0 of 4608000 kbytes used
   lifetime status: 85 of 3600 seconds used, 0|0 of 4608000 kbytes used
   lifetime status: 94 of 3600 seconds used, 0|0 of 4608000 kbytes used
   lifetime status: 104 of 3600 seconds used, 0|0 of 4608000 kbytes used
   lifetime status: 113 of 3600 seconds used, 0|0 of 4608000 kbytes used
   lifetime status: 123 of 3600 seconds used, 0|0 of 4608000 kbytes used
   lifetime status: 129 of 3600 seconds used, 0|0 of 4608000 kbytes used
   lifetime status: 129 of 3600 seconds used, 0|0 of 4608000 kbytes used
   lifetime status: 130 of 3600 seconds used, 0|0 of 4608000 kbytes used
   lifetime status: 130 of 3600 seconds used, 0|0 of 4608000 kbytes used
   lifetime status: 131 of 3600 seconds used, 0|0 of 4608000 kbytes used
   lifetime status: 131 of 3600 seconds used, 0|0 of 4608000 kbytes used
   lifetime status: 132 of 3600 seconds used, 0|0 of 4608000 kbytes used
   lifetime status: 132 of 3600 seconds used, 0|0 of 4608000 kbytes used
   lifetime status: 133 of 3600 seconds used, 0|0 of 4608000 kbytes used
   lifetime status: 133 of 3600 seconds used, 0|0 of 4608000 kbytes used
   lifetime status: 134 of 3600 seconds used, 0|0 of 4608000 kbytes used
   lifetime status: 134 of 3600 seconds used, 0|0 of 4608000 kbytes used
   lifetime status: 135 of 3600 seconds used, 0|0 of 4608000 kbytes used
   lifetime status: 135 of 3600 seconds used, 0|0 of 4608000 kbytes used
   lifetime status: 136 of 3600 seconds used, 0|0 of 4608000 kbytes used
   lifetime status: 136 of 3600 seconds used, 0|0 of 4608000 kbytes used
   lifetime status: 137 of 3600 seconds used, 0|0 of 4608000 kbytes used
   lifetime status: 137 of 3600 seconds used, 0|0 of 4608000 kbytes used
   lifetime status: 138 of 3600 seconds used, 0|0 of 4608000 kbytes used
   lifetime status: 138 of 3600 seconds used, 0|0 of 4608000 kbytes used
   lifetime status: 139 of 3600 seconds used, 0|0 of 4608000 kbytes used
   lifetime status: 139 of 3600 seconds used, 0|0 of 4608000 kbytes used
   lifetime status: 140 of 3600 seconds used, 0|0 of 4608000 kbytes used
   lifetime status: 140 of 3600 seconds used, 0|0 of 4608000 kbytes used
   lifetime status: 149 of 3600 seconds used, 0|0 of 4608000 kbytes used
   lifetime status: 158 of 3600 seconds used, 0|0 of 4608000 kbytes used
   lifetime status: 168 of 3600 seconds used, 0|0 of 4608000 kbytes used
   lifetime status: 177 of 3600 seconds used, 0|0 of 4608000 kbytes used
   lifetime status: 187 of 3600 seconds used, 0|0 of 4608000 kbytes used
   lifetime status: 187 of 3600 seconds used, 0|0 of 4608000 kbytes used
   got late ike paket: 76 bytes

S7.1 QM_packet1
 [2010-02-20 14:45:44]

S7.2 QM_packet2 send_receive
 [2010-02-20 14:45:44]
   NAT-T mode, adding non-esp marker

S7.3 QM_packet2 validate type
 [2010-02-20 14:45:44]

S7.5 QM_packet2 check reject offer
 [2010-02-20 14:45:44]

S7.6 QM_packet2 check and process proposal
 [2010-02-20 14:45:44]
   got ipsec lifetime attributes: 2147483 seconds
   IPSEC SA selected aes256-sha1
   got ipsec lifetime attributes: 3600 seconds
   got ipsec lifetime attributes: 4608000 kilobyte
   NAT-T mode, adding non-esp marker

S7.7 QM_packet3 sent
 [2010-02-20 14:45:44]

S7.8 setup ipsec tunnel
 [2010-02-20 14:45:44]
   lifetime status: 9 of 3600 seconds used, 0|0 of 4608000 kbytes used
   lifetime status: 19 of 3600 seconds used, 0|0 of 4608000 kbytes used
   lifetime status: 28 of 3600 seconds used, 0|0 of 4608000 kbytes used
   lifetime status: 38 of 3600 seconds used, 0|0 of 4608000 kbytes used
   lifetime status: 40 of 3600 seconds used, 0|0 of 4608000 kbytes used
   NAT-T mode, adding non-esp marker
   lifetime status: 41 of 3600 seconds used, 0|1 of 4608000 kbytes used
   lifetime status: 41 of 3600 seconds used, 0|1 of 4608000 kbytes used
   lifetime status: 41 of 3600 seconds used, 0|1 of 4608000 kbytes used
   got late ike paket: 92 bytes
   got r-u-there ack
   lifetime status: 42 of 3600 seconds used, 0|1 of 4608000 kbytes used
   lifetime status: 43 of 3600 seconds used, 0|1 of 4608000 kbytes used
   lifetime status: 44 of 3600 seconds used, 0|1 of 4608000 kbytes used
   lifetime status: 45 of 3600 seconds used, 0|1 of 4608000 kbytes used
   lifetime status: 46 of 3600 seconds used, 0|1 of 4608000 kbytes used
   lifetime status: 47 of 3600 seconds used, 0|1 of 4608000 kbytes used
   lifetime status: 56 of 3600 seconds used, 0|1 of 4608000 kbytes used
   lifetime status: 66 of 3600 seconds used, 0|1 of 4608000 kbytes used
   lifetime status: 75 of 3600 seconds used, 0|1 of 4608000 kbytes used
   lifetime status: 85 of 3600 seconds used, 0|1 of 4608000 kbytes used


Here is some of the output.

Toward the top, where it was nearing the 3600 second limit, I still could ping.
Even after it somehow reset that counter and started counting up again, I could still ping.

However, after it went through the S7.1-S7.8 items again (which it did at the very beginning of the connection), I could no longer ping.

I looked at ifconfig and I did see the tunnel (tun0) listed there. And, when I would ping, I could watch the debug output change at the apparent rate of pinging. But, I never saw a ping response.

I hope this helps! I am sorry for the delay, but Thursday and Friday I was in my office, which is the vpn destination, and I couldn't vpn in to test while I was in, and I didn't have any internet access where I was staying.

Thanks much everyone!
Mike
alain
DD-WRT Guru


Joined: 06 Jun 2006
Posts: 601

PostPosted: Sat Feb 27, 2010 17:32    Post subject: Reply with quote
Hmm, is this all you get?
Because I cant even see that anything goes wrong...
Is this the log from your router or linux pc?
mweber88
DD-WRT Novice


Joined: 10 Feb 2010
Posts: 12

PostPosted: Wed Mar 03, 2010 23:13    Post subject: Reply with quote
That was on the PC, running exactly the command that you specified.

I know WHERE in that output that something went wrong, even though it doesn't look like anything went wrong. It happens during the S7.1-S7.8 lines. Maybe it's something with the version of Linux that I'm using (CentOS 5.3)?

I'll check the kernel version and run it again, and post that as well.
mweber88
DD-WRT Novice


Joined: 10 Feb 2010
Posts: 12

PostPosted: Thu Mar 04, 2010 1:44    Post subject: Reply with quote
The VPNC version is 0.5.3, and the kernel version is 2.6.18-128.el5

I've captured everything now, and am including it in a file attachment. Hopefully this will have more of what you need.

What I did notice at first inspection is that when the tunnel was first setup, VPNC did something (S7.9) which was not done the second time around (after it came close to the 3600 second limit). Is this possibly what is going wrong?

This thing had me beating my head against the wall all day today as it's really causing me grief! I was hoping that I could determine the problem and address it in the dd-wrt start script, but I realize that it's not that the bridge to the tunnel disappears, but rather that the tunnel itself cannot (or does not) pass data. The bridge to the tunnel is irrelevant, because if the bridging is not done, the router itself can still ping, and it's this router's ability to ping that fails after close to one hour. But I'm going to go out on a limb and guess that it is somehow due to the re-keying of the connection when it's close to expiration.

As always, your thoughts and input are greatly appreciated!

Michael



vpncout.txt
 Description:
Output of the debug command line specified above

Download
 Filename:  vpncout.txt
 Filesize:  56.34 KB
 Downloaded:  604 Time(s)

skarface
DD-WRT Novice


Joined: 22 Feb 2010
Posts: 15

PostPosted: Thu Mar 04, 2010 2:21    Post subject: Reply with quote
mweber88 wrote:
After allowing it to run for a little over an hour on my Linux machine, with a 30-second interval between pings, it stopped after 117 pings (and I started pinging a little late).

The vpnc version installed on my Linux machine is 0.5.3, which appears to be the same that is in dd-wrt.

So, it does appear to be a problem in vpnc. Your thoughts?

Thanks!

Mike


It's been a while since I messed with vpnc, but I know that it would not re-key for me when I used it. Our key interval was 8 hours, so I just dropped and reconnected when it was convenient. Google around for vpnc stuff and see what you can find.
Goto page 1, 2  Next Display posts from previous:    Page 1 of 2
Post new topic   Reply to topic    DD-WRT Forum Index -> Broadcom SoC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum