Posted: Sat Feb 13, 2010 3:47 Post subject: VPNC disconnects/reconnects after every hour
I have successfully installed DDWRT build 13064 onto my WRT310n and configured it to connect to the Cisco router at my office. Then, I have connected my IP phone to the WRT310n and voila, I have my office phone and network 350 miles away.
The problem is that the vpnc loses connection, and then pings fail and the disconnect/reconnect in the script takes over and the connection resumes. This happens every hour on the clock. I have been sitting here watching my phone for several hours and right at 19 past the hour, I lose computer connection to my office and the phone reboots.
I have the dead peer detection command line setting in the startup script still in there, but hourly, this thing goes dead. This is getting to be a big problem as I kept dropping client phone calls after each hour today, then had to redial the client.
I've SSH'd into the router and tried to view options, version or help for vpnc, but apparently the compiled vpnc code is REALLY light and all that has been left out.
Check you WAN status page to see if a DHCP lease renewal coincides with your disconnection. If it does then see the link below for a command to add to your firewall script and add a reply to the ticket.
http://svn.dd-wrt.com:8000/dd-wrt/ticket/973 _________________ Read the forum announcements thoroughly! Be cautious if you're inexperienced.
Available for paid consulting. (Don't PM about complicated setups otherwise)
Looking for bricks and spare routers to expand my collection. (not interested in G spec models)
Check you WAN status page to see if a DHCP lease renewal coincides with your disconnection. If it does then see the link below for a command to add to your firewall script and add a reply to the ticket.
I just checked it, and I have 6 days remaining on my WAN DHCP lease. So, I don't think that's the issue.
I've been scouring the wiki and other pages for the last two days and I cannot find any way to determine what version of vpnc is used in this build, and none of the usage or help information remains in the vpnc executable, so doing vpnc --version yields nothing.
I'm thinking of PMing brainslayer to ask him that question. Do you think that's a wise choice?
http://svn.dd-wrt.com:8000/dd-wrt/browser/src/router/vpnc _________________ Read the forum announcements thoroughly! Be cautious if you're inexperienced.
Available for paid consulting. (Don't PM about complicated setups otherwise)
Looking for bricks and spare routers to expand my collection. (not interested in G spec models)
If your disconnect is not caused by a dhcp renew, maybe rekeying fails.
Can you check what your rekeying interval is?
Does the same problem also occur when using vpnc on your computer? (under linux, using cygwin also possible under windows)
If your disconnect is not caused by a dhcp renew, maybe rekeying fails.
Can you check what your rekeying interval is?
Does the same problem also occur when using vpnc on your computer? (under linux, using cygwin also possible under windows)
Greetings,
Alain
Alain--
I have looked at my router's log and see that the crypto lifetime setting is 3600 seconds, which does correspond to the issue I'm seeing.
Additionally, in the logs on the router, I see that the time duration of my connection is right around that time, anywhere from 58 minutes to exactly 1:00:00 and the reason is generally "other" while when I use my Windows Cisco client and disconnect it is "peer delete request" when I disconnect.
I no longer have a Linux machine to which I can connect, but I am building a VM right now and will test that as well to see what happens when I get it built. I will post my results here.
I have built the Linux VM, installed vpnc, configured, and it is currently connected. I am running ping on a 30-second interval to ping the router at the other end. I will look to see when and if it quits around 1 hour into the pinging, and then I will post my findings.
After allowing it to run for a little over an hour on my Linux machine, with a 30-second interval between pings, it stopped after 117 pings (and I started pinging a little late).
The vpnc version installed on my Linux machine is 0.5.3, which appears to be the same that is in dd-wrt.
So, it does appear to be a problem in vpnc. Your thoughts?
lifetime status: 3294 of 3600 seconds used, 4|3 of 4608000 kbytes used
lifetime status: 3303 of 3600 seconds used, 4|3 of 4608000 kbytes used
lifetime status: 3313 of 3600 seconds used, 4|3 of 4608000 kbytes used
lifetime status: 3322 of 3600 seconds used, 4|3 of 4608000 kbytes used
lifetime status: 3332 of 3600 seconds used, 4|3 of 4608000 kbytes used
NAT-T mode, adding non-esp marker
lifetime status: 3341 of 3600 seconds used, 4|3 of 4608000 kbytes used
lifetime status: 3341 of 3600 seconds used, 4|3 of 4608000 kbytes used
got late ike paket: 92 bytes
got r-u-there ack
lifetime status: 3350 of 3600 seconds used, 4|3 of 4608000 kbytes used
lifetime status: 3360 of 3600 seconds used, 4|3 of 4608000 kbytes used
lifetime status: 3369 of 3600 seconds used, 4|3 of 4608000 kbytes used
lifetime status: 3379 of 3600 seconds used, 4|3 of 4608000 kbytes used
lifetime status: 3388 of 3600 seconds used, 4|3 of 4608000 kbytes used
lifetime status: 3398 of 3600 seconds used, 4|3 of 4608000 kbytes used
lifetime status: 3407 of 3600 seconds used, 4|3 of 4608000 kbytes used
lifetime status: 3413 of 3600 seconds used, 4|3 of 4608000 kbytes used
got late ike paket: 172 bytes
got ipsec lifetime attributes: 3600 seconds
got ipsec lifetime attributes: 4608000 kilobyte
got ipsec lifetime attributes: 4608000 kilobyte
NAT-T mode, adding non-esp marker
lifetime status: 9 of 3600 seconds used, 0|0 of 4608000 kbytes used
lifetime status: 18 of 3600 seconds used, 0|0 of 4608000 kbytes used
lifetime status: 28 of 3600 seconds used, 0|0 of 4608000 kbytes used
lifetime status: 37 of 3600 seconds used, 0|0 of 4608000 kbytes used
lifetime status: 47 of 3600 seconds used, 0|0 of 4608000 kbytes used
lifetime status: 56 of 3600 seconds used, 0|0 of 4608000 kbytes used
lifetime status: 66 of 3600 seconds used, 0|0 of 4608000 kbytes used
lifetime status: 75 of 3600 seconds used, 0|0 of 4608000 kbytes used
lifetime status: 85 of 3600 seconds used, 0|0 of 4608000 kbytes used
lifetime status: 94 of 3600 seconds used, 0|0 of 4608000 kbytes used
lifetime status: 104 of 3600 seconds used, 0|0 of 4608000 kbytes used
lifetime status: 113 of 3600 seconds used, 0|0 of 4608000 kbytes used
lifetime status: 123 of 3600 seconds used, 0|0 of 4608000 kbytes used
lifetime status: 129 of 3600 seconds used, 0|0 of 4608000 kbytes used
lifetime status: 129 of 3600 seconds used, 0|0 of 4608000 kbytes used
lifetime status: 130 of 3600 seconds used, 0|0 of 4608000 kbytes used
lifetime status: 130 of 3600 seconds used, 0|0 of 4608000 kbytes used
lifetime status: 131 of 3600 seconds used, 0|0 of 4608000 kbytes used
lifetime status: 131 of 3600 seconds used, 0|0 of 4608000 kbytes used
lifetime status: 132 of 3600 seconds used, 0|0 of 4608000 kbytes used
lifetime status: 132 of 3600 seconds used, 0|0 of 4608000 kbytes used
lifetime status: 133 of 3600 seconds used, 0|0 of 4608000 kbytes used
lifetime status: 133 of 3600 seconds used, 0|0 of 4608000 kbytes used
lifetime status: 134 of 3600 seconds used, 0|0 of 4608000 kbytes used
lifetime status: 134 of 3600 seconds used, 0|0 of 4608000 kbytes used
lifetime status: 135 of 3600 seconds used, 0|0 of 4608000 kbytes used
lifetime status: 135 of 3600 seconds used, 0|0 of 4608000 kbytes used
lifetime status: 136 of 3600 seconds used, 0|0 of 4608000 kbytes used
lifetime status: 136 of 3600 seconds used, 0|0 of 4608000 kbytes used
lifetime status: 137 of 3600 seconds used, 0|0 of 4608000 kbytes used
lifetime status: 137 of 3600 seconds used, 0|0 of 4608000 kbytes used
lifetime status: 138 of 3600 seconds used, 0|0 of 4608000 kbytes used
lifetime status: 138 of 3600 seconds used, 0|0 of 4608000 kbytes used
lifetime status: 139 of 3600 seconds used, 0|0 of 4608000 kbytes used
lifetime status: 139 of 3600 seconds used, 0|0 of 4608000 kbytes used
lifetime status: 140 of 3600 seconds used, 0|0 of 4608000 kbytes used
lifetime status: 140 of 3600 seconds used, 0|0 of 4608000 kbytes used
lifetime status: 149 of 3600 seconds used, 0|0 of 4608000 kbytes used
lifetime status: 158 of 3600 seconds used, 0|0 of 4608000 kbytes used
lifetime status: 168 of 3600 seconds used, 0|0 of 4608000 kbytes used
lifetime status: 177 of 3600 seconds used, 0|0 of 4608000 kbytes used
lifetime status: 187 of 3600 seconds used, 0|0 of 4608000 kbytes used
lifetime status: 187 of 3600 seconds used, 0|0 of 4608000 kbytes used
got late ike paket: 76 bytes
S7.8 setup ipsec tunnel
[2010-02-20 14:45:44]
lifetime status: 9 of 3600 seconds used, 0|0 of 4608000 kbytes used
lifetime status: 19 of 3600 seconds used, 0|0 of 4608000 kbytes used
lifetime status: 28 of 3600 seconds used, 0|0 of 4608000 kbytes used
lifetime status: 38 of 3600 seconds used, 0|0 of 4608000 kbytes used
lifetime status: 40 of 3600 seconds used, 0|0 of 4608000 kbytes used
NAT-T mode, adding non-esp marker
lifetime status: 41 of 3600 seconds used, 0|1 of 4608000 kbytes used
lifetime status: 41 of 3600 seconds used, 0|1 of 4608000 kbytes used
lifetime status: 41 of 3600 seconds used, 0|1 of 4608000 kbytes used
got late ike paket: 92 bytes
got r-u-there ack
lifetime status: 42 of 3600 seconds used, 0|1 of 4608000 kbytes used
lifetime status: 43 of 3600 seconds used, 0|1 of 4608000 kbytes used
lifetime status: 44 of 3600 seconds used, 0|1 of 4608000 kbytes used
lifetime status: 45 of 3600 seconds used, 0|1 of 4608000 kbytes used
lifetime status: 46 of 3600 seconds used, 0|1 of 4608000 kbytes used
lifetime status: 47 of 3600 seconds used, 0|1 of 4608000 kbytes used
lifetime status: 56 of 3600 seconds used, 0|1 of 4608000 kbytes used
lifetime status: 66 of 3600 seconds used, 0|1 of 4608000 kbytes used
lifetime status: 75 of 3600 seconds used, 0|1 of 4608000 kbytes used
lifetime status: 85 of 3600 seconds used, 0|1 of 4608000 kbytes used
Here is some of the output.
Toward the top, where it was nearing the 3600 second limit, I still could ping.
Even after it somehow reset that counter and started counting up again, I could still ping.
However, after it went through the S7.1-S7.8 items again (which it did at the very beginning of the connection), I could no longer ping.
I looked at ifconfig and I did see the tunnel (tun0) listed there. And, when I would ping, I could watch the debug output change at the apparent rate of pinging. But, I never saw a ping response.
I hope this helps! I am sorry for the delay, but Thursday and Friday I was in my office, which is the vpn destination, and I couldn't vpn in to test while I was in, and I didn't have any internet access where I was staying.
That was on the PC, running exactly the command that you specified.
I know WHERE in that output that something went wrong, even though it doesn't look like anything went wrong. It happens during the S7.1-S7.8 lines. Maybe it's something with the version of Linux that I'm using (CentOS 5.3)?
I'll check the kernel version and run it again, and post that as well.
The VPNC version is 0.5.3, and the kernel version is 2.6.18-128.el5
I've captured everything now, and am including it in a file attachment. Hopefully this will have more of what you need.
What I did notice at first inspection is that when the tunnel was first setup, VPNC did something (S7.9) which was not done the second time around (after it came close to the 3600 second limit). Is this possibly what is going wrong?
This thing had me beating my head against the wall all day today as it's really causing me grief! I was hoping that I could determine the problem and address it in the dd-wrt start script, but I realize that it's not that the bridge to the tunnel disappears, but rather that the tunnel itself cannot (or does not) pass data. The bridge to the tunnel is irrelevant, because if the bridging is not done, the router itself can still ping, and it's this router's ability to ping that fails after close to one hour. But I'm going to go out on a limb and guess that it is somehow due to the re-keying of the connection when it's close to expiration.
As always, your thoughts and input are greatly appreciated!
After allowing it to run for a little over an hour on my Linux machine, with a 30-second interval between pings, it stopped after 117 pings (and I started pinging a little late).
The vpnc version installed on my Linux machine is 0.5.3, which appears to be the same that is in dd-wrt.
So, it does appear to be a problem in vpnc. Your thoughts?
Thanks!
Mike
It's been a while since I messed with vpnc, but I know that it would not re-key for me when I used it. Our key interval was 8 hours, so I just dropped and reconnected when it was convenient. Google around for vpnc stuff and see what you can find.
