IKEv2 Server freezes due to Android phone client #1190
Comments
|
On Thu, 30 Jun 2022, sleepingmoonmoon wrote:
Here is a recent output in OrangePI before it crashes:
Message from ***@***.*** at Jun 30 20:34:34 ...
kernel:[74457.676442] Internal error: Oops: 805 [#1] SMP THUMB2
Message from ***@***.*** at Jun 30 20:34:34 ...
kernel:[74457.881451] Process pluto (pid: 3268, stack limit = 0xecee338d)
So the libreswan IKE daemon crashed :/
It would be good to get more details, which might be hard to do. Perhaps
you can change /etc/ipsec.conf and add plutodebug=tmi so that we might
know based on the last debug logs where we kind of crash. But getting
the pluto log entries from just before this message would also be
useful.
Last log before the freeze happened:
Jun 29 12:53:50 orangepizero pluto[17222]: Initializing NSS using read-write database "sql:/etc/ipsec.d"
Jun 29 12:53:50 orangepizero pluto[17222]: FIPS Mode: NO
Jun 29 12:53:50 orangepizero pluto[17222]: NSS crypto library initialized
...
These are the startup messages, eg that is pluto starting after it has crashed.
Paul
|
Thank you for your reply! I'm sorry I am still new to using Linux. Where do I add plutodebug=tmi? Kindly see my /etc/ipsec.conf and /etc/ipsec.d/ikev2.conf below: /etc/ipsec.conf: /etc/ipsec.d/ikev2.conf: |
Please see the last part of the pluto log, that was the part where it crashed. I am attaching another pluto log right before it crashed. pluto log right before crash (see last part): The last time saved in the log is 08:22:53PM and IKE daemon crashed at 8:34:34PM based from the message from OrangePI: |
|
On Thu, 30 Jun 2022, sleepingmoonmoon wrote:
It would be good to get more details, which might be hard to do. Perhaps
you can change /etc/ipsec.conf and add plutodebug=tmi so that we might
know based on the last debug logs where we kind of crash
Thank you for your reply! I'm sorry I am still new to using Linux. Where do I add plutodebug=tmi? Kindly see my /etc/ipsec.conf and
/etc/ipsec.d/ikev2.conf below:
/etc/ipsec.conf:
version 2.0
config setup
virtual-private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:!192.168.42.0/24,%v4:!192.168.43.0/24
uniqueids=no
Add it here under uniqueids=no
The other logs did not show anything useful unfortunately.
Paul
|
|
I have updated /etc/ipsec.conf to include plutodebug=tmi. I will send the pluto log when my VPN freeze again. Is there anything I can do to maybe automatically reboot OrangePI or restart ipsec when IKE daemon crashes? This is just a workaround if ever until the real cause of the issue is found. Thank you! |
|
Libreswan will already restart once it crashes. But that will kick out every client. It might take a few seconds for those clients to realize their connection died.
Sent using a virtual keyboard on a phone
… On Jun 30, 2022, at 13:19, sleepingmoonmoon ***@***.***> wrote:
I have updated /etc/ipsec.conf to include plutodebug=tmi. I will send the pluto log when my VPN freeze again.
Is there anything I can do to maybe automatically reboot OrangePI or restart ipsec when IKE daemon crashes? This is just a workaround if ever until the real cause of the issue is found. Thank you!
—
Reply to this email directly, view it on GitHub, or unsubscribe.
You are receiving this because you commented.
|
|
I see. It's just that when my orange pi freezes, the clients cannot connect to the VPN until I disconnect its power to manually restart the orange pi so I need to be close to it at all times. Today, I monitored this and there was no freezing that occurred since they are connected to their Home wifi all day. It seems that it is their Work wifi that causes this problem and not the android device of one of the clients. But I still have no clue why this happens. |
|
Hello @letoams, my orange pi froze once again. It was fine yesterday when the clients are connected using their home wifi (86.x.x.x). Today, one was connected to the work wifi (212.x.x.x) when freezing occurred. Is it safe to assume that the work wifi causes this issue? Kindly see log below for plutodebug log: |
|
Hello! As a workaround, I used wireguard for my clients when they are using their work network and will only use IKEv2 when they are at home. My server does not freeze anymore using this setup. I am closing this issue for now but it would be good if I will only need to implement a single VPN for my clients. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
I have setup my VPN server in Orange PI using your scripts and I have 4 different users that use it in their work and home WiFi.
This is their current setup:
My problem is that when they are using the VPN while in their work, the server freezes and I cannot ssh to my OrangePI. I need to manually restart OrangePI for the VPN to work again. After some monitoring, I suspect that User A that uses the android device during work causes this problem because he is always connected (ipsec traffic) before the freezing occurs.
How do I fix this? Also, what can I do to isolate the cause of this problem (what to monitor)? I have attached an output in my OrangePI when the freeze occurs below and also the VPN logs right before the freezing occured.
Here is a recent output in OrangePI before it crashes:
Last log before the freeze happened:
The text was updated successfully, but these errors were encountered: