OpenVPN Always Connects - however data does not always flow

graphite-or-graphene

So been at this issue for months now thinking a new graphene update would help. It has not :-( Hoping the community would have a clue what's going on if anyone else is using this and experiencing similar issues.

Setup: Pfsense 2.6.0 running openvpn server 1.6.4 in the home. Pixel 7 - newest updates - 1 owner main profile

FYI - Have 2 other cell phones in the house all work 100% fine for years with this setup. Got this Pixel phone loaded with graphene and the O.S. has issues with this setup for some reason.

Symptoms: On the phone, the openvpn app ALWAYS connects 100% of the time to my home vpn. All logs below on the phone indicate its connected AND all logs on the vpn server show connected. However 0% data actually flows. I can try browsing the internet, my home cameras, it does not matter, nothing flows. But wait there is more!

If I stop and start the connection maybe 7 - 20 times, on one of these connections, data will flow.
If I mess around with "always on vpn" on the phone and start and stop the app up to 20 times data will flow with one of the connections
If data is going to flow, it will do it instantly, there is no waiting 10 minutes while connected and then it magically happens. Been down this rabbit hole.

You get the idea.... HELP!!! For a security rich phone, vpns should be rock solid.

The below logs are from the vpn server, anything with xxxxxxxxxxxx is me keeping sensitive data private
2023-04-23 11:34:22.684278-04:00 openvpn 2706 openvpn server 'ovpns1' user 'xxxxxxxxxxxx' address 'xxxxxxxxxxxx.123' - connected
2023-04-23 11:34:22.680599-04:00 openvpn 43975 xxxxxxxxxxxx.123:18034 MULTI_sva: pool returned IPv4=192.168.75.2, IPv6=(Not enabled)
2023-04-23 11:34:22.673291-04:00 openvpn 2335 user 'xxxxxxxxxxxx' authenticated
2023-04-23 11:34:22.469959-04:00 openvpn 43975 xxxxxxxxxxxx.123:18034 [xxxxxxxxxxxx] Peer Connection Initiated with [AF_INET]xxxxxxxxxxxx123:18034

These logs below are from the phone / openvpn app side on the pixel 7 - anything with xxxxxxxxxxxx is me keeping sensitive data private
[Apr 23, 2023, 11:29:19] ----- OpenVPN Start -----

[Apr 23, 2023, 11:29:19] EVENT: CORE_THREAD_ACTIVE

[Apr 23, 2023, 11:29:19] OpenVPN core 3.git::081bfebe:RelWithDebInfo android arm64 64-bit PT_PROXY

[Apr 23, 2023, 11:29:19] Frame=512/2048/512 mssfix-ctrl=1250

[Apr 23, 2023, 11:29:19] UNUSED OPTIONS
0 [persist-tun]
1 [persist-key]
2 [data-ciphers] [AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305:AES-256-CBC]
3 [data-ciphers-fallback] [AES-256-CBC]
5 [tls-client]
8 [block-outside-dns]
9 [lport] [0]
13 [explicit-exit-notify]

[Apr 23, 2023, 11:29:19] EVENT: RESOLVE

[Apr 23, 2023, 11:29:21] Contacting xxxxxxxxxx.161:1195 via UDP

[Apr 23, 2023, 11:29:21] EVENT: WAIT

[Apr 23, 2023, 11:29:21] Connecting to [xxxxxxxxxx.net]:1195 (xxxxxxxxxx7.161) via UDPv4

[Apr 23, 2023, 11:29:21] EVENT: CONNECTING

[Apr 23, 2023, 11:29:21] Tunnel Options:V4,dev-type tun,link-mtu 1553,tun-mtu 1500,proto UDPv4,cipher BF-CBC,auth SHA256,keysize 128,key-method 2,tls-client

[Apr 23, 2023, 11:29:21] Creds: Username/Password

[Apr 23, 2023, 11:29:21] Peer Info:
IV_VER=3.git::081bfebe:RelWithDebInfo
IV_PLAT=android
IV_NCP=2
IV_TCPNL=1
IV_PROTO=30
IV_CIPHERS=AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305:BF-CBC
IV_GUI_VER=net.openvpn.connect.android_3.3.3-9248
IV_SSO=webauth,openurl,crtext
IV_BS64DL=1

[Apr 23, 2023, 11:29:21] VERIFY OK: depth=1, /CN=openvpn home ca cert, signature: RSA-SHA256

[Apr 23, 2023, 11:29:21] VERIFY OK: depth=0, /CN=openvpn home server cert, signature: RSA-SHA256

[Apr 23, 2023, 11:29:22] SSL Handshake: peer certificate: CN=openvpn home server cert, 2048 bit RSA, cipher: TLS_AES_256_GCM_SHA384 TLSv1.3 Kx=any Au=any Enc=AESGCM(256) Mac=AEAD

[Apr 23, 2023, 11:29:22] Session is ACTIVE

[Apr 23, 2023, 11:29:22] Sending PUSH_REQUEST to server...

[Apr 23, 2023, 11:29:22] EVENT: GET_CONFIG

[Apr 23, 2023, 11:29:22] OPTIONS:
0 [dhcp-option] [DOMAIN] [xxxxxxxxxxxxxxxxx.lan]
1 [block-outside-dns]
2 [register-dns]
3 [redirect-gateway] [def1]
4 [redirect-gateway] [ipv6]
5 [route-gateway] [192.168.75.1]
6 [topology] [subnet]
7 [ping] [10]
8 [ping-restart] [60]
9 [ifconfig] [192.168.75.2] [255.255.255.0]
10 [peer-id] [0]
11 [cipher] [AES-256-GCM]

[Apr 23, 2023, 11:29:22] PROTOCOL OPTIONS:
cipher: AES-256-GCM
digest: NONE
key-derivation: OpenVPN PRF
compress: NONE
peer ID: 0
control channel: tls-crypt enabled

[Apr 23, 2023, 11:29:22] EVENT: ASSIGN_IP

[Apr 23, 2023, 11:29:22] Google DNS fallback enabled

[Apr 23, 2023, 11:29:22] Connected via tun

[Apr 23, 2023, 11:29:22] EVENT: CONNECTED info='xxxxxxxxx@xxxxxxxxx.net:1195 (xxxxxxxxxx.161) via /UDPv4 on tun/192.168.75.2/ gw=[192.168.75.1/]' trans=TO_CONNECTED

AdamBv1

OPNsense 23.1.6 and OpenVPN on a Pixel 7 user here, I can't say I have had any issues like this. Any time it says connected it works fine and if the connection breaks and fails to reestablish itself (happened a few times on a recent vacation where I was in airplane mode and connecting via WiFi and frequently walking in and out of range) it will show reconnecting and it would take a manual disconnect and reconnect to fix it and then all was good.

Have you checked to see if there's anything listed on the PFsense connection status under bytes sent and received? This might help troubleshoot if data is only flowing one direction. The OpenVPN client on Android doesn't seem to show total amounts transferred but you can see the speed there so it's also worth noting if one of them is always at zero since even an idle connection should show some data transfer.

Otherwise I can't see any obvious issues from your connection log but our setups don't seem to be exactly the same so I can't make a perfect direct comparison. If you have working android clients it might be worth checking them against the P7 to see if anything is different. Pretty sure ciphers would have to be correct to generate a connection at all but mismatched compression settings like to break things.

On another VPN note, it was this vacation and the occasional connection issues that got me to switch over to primarily using WireGuard instead, being a stateless connection it worked FAR better with frequent loss and reconnection to a network and the performance was noticeably better as well with the lower overhead. It's also a bit easier to set up since there are just fewer options to misconfigure while it's pretty easy to mess something up with OpenVPN.

graphite-or-graphene

AdamBv1 Dude, ok wireguard is soo much better, however quite complicated to setup so I will give it a try when I have time. It seems to be better on every level (except setup). Having said that yeah - I checked my firewall logs and the data IS being allowing in/out I also checked to see if packets were even flowing as you mentioned and sure enough they are

Below is on firewall dynamic logs:
Server UDP4:1195 Client Connections: 1
xxxx public ip xxxxxxx:18001 192.168.75.2 2023-04-24 12:14:52 432 KiB 59 KiB AES-256-GCM

That's 432kb sent and 59kb received. I tried to post a picture on here but can't seem to. It only gives me an http reference not a picture embed option.

AdamBv1

graphite-or-graphene Well it's good the server recognizes there's traffic in and out, hopefully the client is saying the same. I believe sent just means the server flung that much data at the client IP and port while received should mean they have been received and decrypted.

I would double check the client log against one from a working client line by line and see what, if anything, is different. You could also try opening and checking the .ovpn files and comparing them as well. This is often one of the easier ways to troubleshoot issues when you have working and non-working devices.

As for WireGuard, the hard part about it is really just doing key exchanges between the clients and the server. OpenVPN does make that easier by simply exporting everything you need at once from the server instead of every endpoint generating their own key pair and then you needing to copy around public keys.

graphite-or-graphene

follow up - It's been a while with phone updates, etc. In some way, graphene os is the problem and does not properly work with the OpenVPN app. I can (and have) installed the exact same setup on 2 of my other samsung phones with zero issues. Based on the recommendations of AdamBv1, I have installed wireguard on my google pixel 7 / graphene os and everything is working fine now with that protocol.

aenyewedd

I have the same problem with OpenVPN, but only occurring when connecting through one Wi-Fi network specifically. I think pinned it down to IPv6 connectivity - although connectivity for IPv4 addresses works through the VPN (sshing into things, logging onto things on remote LAN), websites paradoxically only work, if the domain has a AAAA DNS record. Despite this, with one of those "what is my IP" websites that has an AAAA DNS record, when I loaded it (successfully), it showed my VPN server's IPv4 address, and no IPv6 connectivity, suggesting it is probably not IPv6 leakage - would also be weird, since block IPv6 toggle in the OpenVPN app is indeed checked. Still no idea why that would be though, or how to fix it.