Arch Linux

coexistence

Member

Registered: 2012-07-08

Posts: 3

Cleanly close VPN.

I got an account with Mullvad, and set it up the account directly with OpenVPN files rather with the client they provide.

To start the connection I run

 sudo openvpn /etc/openvpn/mullvad_linux.conf

I get a connection and to terminate it I press CTRL+C with the following result

]^CSat Jul  7 22:11:58 2012 event_wait : Interrupted system call (code=4)
Sat Jul  7 22:11:58 2012 TCP/UDP: Closing socket
Sat Jul  7 22:11:58 2012 /usr/sbin/ip route del 10.9.0.1/32
Sat Jul  7 22:11:58 2012 /usr/sbin/ip route del 95.211.10.3/32
Sat Jul  7 22:11:58 2012 /usr/sbin/ip route del 0.0.0.0/1
Sat Jul  7 22:11:58 2012 /usr/sbin/ip route del 128.0.0.0/1
Sat Jul  7 22:11:58 2012 Closing TUN/TAP interface
Sat Jul  7 22:11:58 2012 /usr/sbin/ip addr del dev tun0 local 10.9.0.46 peer 10.9.0.45
Sat Jul  7 22:11:58 2012 /usr/share/openvpn/update-resolv-conf tun0 1500 1542 10.9.0.46 10.9.0.45 init
Sat Jul  7 22:11:58 2012 SIGINT[hard,] received, process exitin

I open up wireshark  (after the terminated VPN connection) and the ouput provided  shows that mullvad are being denied on every connection attempt as they are sending a UDP segment and my machine is responding with an IMCP Port Unreachable (even if I reboot I get the same results). 

I sent a email to mullvad a got the following response "The VPN servers have a long timeout when trying to keep a tunnel alive when it is not cleanly closed for some reason. If you have made many connections then the servers send ping packets for many tunnels, each tunnel having a port of its own. "

This is my config /etc/openvpn/mullvad_linux.conf

# Notice to Mullvad customers:
# 
# Apart from openvpn, you also need to install the
# package "resolvconf", available via apt, e.g.
#
# For those of you behind very restrictive firewalls,
# you can use our tunnels on tcp port 80, as well as
# on udp port 53.
client

dev tun

proto udp
#proto tcp

remote openvpn.mullvad.net 1194
#remote openvpn.mullvad.net 80
#remote openvpn.mullvad.net 53

# Keep trying indefinitely to resolve the
# host name of the OpenVPN server.  Very useful
# on machines which are not permanently connected
# to the internet such as laptops.
resolv-retry infinite

# Most clients don't need to bind to
# a specific local port number.
nobind

# Try to preserve some state across restarts.
persist-key
persist-tun

# Enable compression on the VPN link.
comp-lzo

# Set log file verbosity.
verb 3

remote-cert-tls server

ping-exit 60

# Allow calling of built-in executables and user-defined scripts.
script-security 2

# Parses DHCP options from openvpn to update resolv.conf
up /usr/share/openvpn/update-resolv-conf
down /usr/share/openvpn/update-resolv-conf

ping 10

ca /etc/openvpn/master.mullvad.net.crt
cert /etc/openvpn/mullvad.crt
key /etc/openvpn/mullvad.key

As for the update-resolv-conf I am using the one provided on Archlinux  OpenVPN Wiki (DNS section) .

What could be causing the VPN connection to not cleanly close?

Last edited by coexistence (2012-07-08 04:21:58)

tomk

Forum Fellow

From: Ireland

Registered: 2004-07-21

Posts: 9,839

Re: Cleanly close VPN.

Ask Mullvad for their particular definition of "cleanly closed".

Gcool

Member

Registered: 2011-08-16

Posts: 1,456

Re: Cleanly close VPN.

The way you're using the vpn connection is fine, no worries there.

Are you by any chance firewalling connectivity to/from your Arch box? One thing that comes to mind when the vpn provider states the connection isn't "cleanly closed", would be a firewall (iptables,...) blocking the fin/ack packet.

---

Burninate!

coexistence

Member

Registered: 2012-07-08

Posts: 3

Re: Cleanly close VPN.

I will contact Mullvad and will update back.

Yes, I am using Iptables, here is my /etc/iptables/iptables.rules.

*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [700:98250]
:TCP - [0:0]
:UDP - [0:0]
-A INPUT -s 127.0.0.0/8 ! -i lo -j DROP
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m conntrack --ctstate INVALID -j DROP
-A INPUT -p icmp -m icmp --icmp-type 8 -m conntrack --ctstate NEW -j ACCEPT
-A INPUT -p udp -m conntrack --ctstate NEW -j UDP
-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m conntrack --ctstate NEW -j TCP
-A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable
-A INPUT -p tcp -j REJECT --reject-with tcp-reset
-A INPUT -j REJECT --reject-with icmp-proto-unreachable
COMMIT

Gcool

Member

Registered: 2011-08-16

Posts: 1,456

Re: Cleanly close VPN.

That looks perfectly fine.

And you can disregard my previous comment. Openvpn is using udp by default, so you're obviously not going to have all that many fin/ack packets to deal with

---

Burninate!