Troubleshoot SSL-VPN connection issues - VPN Gateway - Alibaba Cloud Documentation Center

If you encounter issues when using SSL-VPN connections, check the logs of SSL-VPN clients or the SSL-VPN connection logs in the VPN Gateway console to troubleshoot the issues.

Background

This topic describes common SSL-VPN connection issues and troubleshooting steps. Check the logs of SSL-VPN clients or the SSL-VPN connection logs in the VPN Gateway console. See the Summary table section.

For information about querying SSL-VPN client logs on Linux, Windows, macOS, or Android, see the Log file locations for SSL-VPN clients section of this topic.
For information about querying SSL-VPN connection logs, see Query the logs of an SSL server.

Log file locations for SSL-VPN clients

The default log file location depends on the client operating system. The following table lists the default log file directories for each supported operating system.

Note

If you specified a custom directory when installing the VPN application, the log file is in that directory instead.

Operating system	Default log file directory
Linux client with OpenVPN installed	/var/log/openvpn.log
Windows client with OpenVPN installed	By default, the log file is stored in the log folder of the directory in which OpenVPN is installed. Example: C:\Users\User\OpenVPN\log.
macOS client with Tunnelblick installed	/Library/Application Support/Tunnelblick/Logs
macOS client with OpenVPN installed	/Library/Application Support/OpenVPN/log/connection_name.log

Common SSL-VPN connection issues and troubleshooting

After you obtain the SSL-VPN connection logs, search for relevant keywords to identify the issue. The following table lists common issues, keywords, and troubleshooting steps.

Category	Cause	Keyword	Solution
Network connection failure	Network communication is abnormal.	`network is unreachable` `TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)` `TLS Error: TLS handshake failed`	From your client, run the `ping` or `mtr` command to test connectivity to the public IP address of the VPN Gateway. If the internet connection is poor due to high latency or packet loss, contact your internet service provider (ISP) for assistance. If network connectivity is normal, check whether the SSL server logs contain the client's connection information. If no client connection records are found, try changing the Port used by the SSL server. Then, download and install a new SSL client certificate on the client. Change the Protocol of the SSL server to TCP for better reliability. If you use an SSL-VPN connection for long-distance communication, such as from US (Silicon Valley) to Singapore, and the issue persists after you change the Protocol to TCP, we recommend using Cloud Enterprise Network and Smart Access Gateway to connect your client to the VPC. If multiple VPN applications are installed on your client, use only one to create SSL-VPN connections. Restart the client or reinstall the VPN application on the client.
Protocol or port number mismatch	The client and SSL server use different protocols or ports.	`MANAGEMENT: >STATE:1676379239,TCP_CONNECT,,,,,,` `TCP: connect to [AF_INET]...:1194 failed: Unknown error`	Change the Protocol and Port on the SSL server, then download and install a new SSL client certificate on the client.
Excessive connections	The number of SSL-VPN connections exceeds the limit.	`MANAGEMENT: >STATE:1676370715,WAIT,,,,,`	Check whether the number of SSL clients connected to the VPN gateway exceeds the limit. If the limit is exceeded, increase the maximum number of connections for the VPN gateway. If the limit is exceeded and you do not want to increase it, disconnect idle clients. Resources are released about 5 minutes after a client disconnects. Change the SSL server Protocol to TCP, then download and install a new SSL client certificate. This prevents unreliable UDP connections from occupying the connection quota. In addition, TCP connections are more reliable.
Certificate expiration	The SSL client certificate has expired.	`VERIFY ERROR: certificate has expired`	Check the validity period of the SSL client certificate. The default validity period of the SSL client certificate is three years. Delete the current SSL client certificate and all its configurations, then download and install a new certificate on the client. You must download and install the SSL client certificate again after enabling or disabling two-factor authentication, or after modifying the SSL server configuration.
Certificate configuration error	The certificate configuration is invalid.	`Options error: --ca fails with 'ca.crt': No such file or directory (errno=2)` `Options error: --cert fails with 'vsc-**.crt': No such file or directory (errno=2)` `WARNING: cannot stat file 'vsc-.key': No such file or directory (errno=2)` `Options error: --key fails with 'vsc-**.key'` `Options error: Please correct these errors.`	Delete the current SSL client certificate and all its configurations, then download and install a new certificate on the client.
Incompatible VPN application versions	The version of the VPN application installed on the client is incompatible with the Alibaba Cloud SSL server.	`Data Channel Offload doesn't support DATA_V1 packets` `Upgrade your server to` `suggesting an upgrade to the server version`	Uninstall the existing VPN application from the client and install a version compatible with the SSL server. For more information, see the "Step 4: Configure the client" section of the Connect a client to a VPC topic.
Insufficient IP addresses	The client CIDR block on the SSL server does not have enough IP addresses.	`OpenVPN needs a gateway parameter for a -- route option and no default was specified by either --route-gateway or --ifconfig options`	Make sure that the number of IP addresses in the client CIDR block is at least four times the maximum number of SSL-VPN connections supported by the VPN gateway. For more information, see Create and manage an SSL server. For example, if you specify 192.168.0.0/24 as the client CIDR block, the system first divides a subnet CIDR block with a subnet mask of 30 from 192.168.0.0/24, such as 192.168.0.4/30. This subnet provides up to four IP addresses. Then, the system allocates an IP address from 192.168.0.4/30 to the client and uses the other three IP addresses to ensure network communication. In this case, one client consumes four IP addresses. Therefore, to ensure that an IP address can be allocated to your client, you must make sure that the number of IP addresses in the client CIDR block is at least four times the maximum number of SSL-VPN connections supported by the associated VPN gateway.
Encryption algorithm mismatch	The SSL server and client use different TLS cipher suites and no matching encryption algorithm can be found.	`TLS error: The server has no TLS ciphersuites in common with the client. Your --tls-cipher setting might be too restrictive.` `OpenSSL: error:1408A0C1:SSL routines:ssl3_get_client_hello:no shared cipher`	Install the VPN application recommended by VPN Gateway on your client. For more information, see the "Step 4: Configure the client" section of the Connect a client to a VPC topic.
Inconsistent encryption algorithms	The configurations of encryption algorithms in the SSL server and client are inconsistent.	`Authenticate/Decrypt packet error: cipher final failed`	Check whether the encryption algorithm of the SSL client certificate installed on the client is consistent with that of the SSL server. If the encryption algorithms are inconsistent, delete the current SSL client certificate and all configurations, redownload the certificate, and then install the certificate on the client. The encryption algorithm for the SSL client certificate is the value of the `cipher` field in the config.ovpn file. To view the encryption algorithm of the SSL server, perform the following operations: Go to the SSL Servers page in the VPN Gateway console. Find the SSL server that you want to manage. Click Details in the Actions column. On the details page of the SSL server, view the encryption algorithm.
Packet ID conflict	The network connection is unstable or the encryption algorithm of the SSL server is set to none.	`Authenticate/Decrypt packet error: bad packet ID (may be a replay)`	Change the protocol used by the SSL server to TCP for higher reliability. Check if the Encryption Algorithm for the SSL server is set to none. If it is, change the Encryption Algorithm to an AES algorithm, such as AES-128-CBC, AES-192-CBC, or AES-256-CBC. After you modify the configuration of the SSL server, delete the current SSL client certificate and all configurations, redownload the certificate, and then install the certificate on the client.
Time synchronization issue	SSL verification fails or the time difference between the client and SSL server exceeds 10 minutes.	`OpenSSL: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed` `TLS_ERROR: BIO read tls_read_plaintext error` `TLS Error: TLS object -> incoming plaintext read error` `TLS Error: TLS handshake failed`	The time difference between the client and SSL server must not exceed 10 minutes. Synchronize the client time with a standard time source. Check the validity period of the SSL client certificate. The default validity period of the SSL client certificate is three years.
Certificate verification failure	The SSL certificate verification fails.	`No server certificate verification method has been enabled`	Check the SSL client certificate validity. By default, SSL client certificates are valid for three years. Delete the current SSL client certificate and all its configurations, then download and install a new certificate on the client. You must download and install the SSL client certificate again after enabling or disabling two-factor authentication, or after modifying the SSL server configuration.
Two-factor authentication failure	The two-factor authentication fails.	`AUTH: Received control message: AUTH_FAILED` `TCP/UDP: Closing socket` `SIGUSR1[soft,auth-failure] received, process restarting` `MANAGEMENT: >STATE:1676381342,RECONNECTING,auth-failure,,,,,`	Check whether you entered a valid username and password. Check whether the account is configured in the IDaaS instance, whether the account is disabled, and whether the IDaaS instance has expired. For more information, see What is IDaaS? If the IDaaS instance is not the cause, try a different account. Delete the current SSL client certificate and all its configurations, then download and install a new certificate on the client. You must download and install the SSL client certificate again after enabling or disabling two-factor authentication, or after modifying the SSL server configuration.
Missing TAP adapter	The client does not have a TAP virtual Ethernet adapter.	`There are no TAP-Windows adapters on this system. You should be able to create a TAP` `CreateFile failed on TAP device` `All TAP-Win32 adapters on this system are currently in use`	Confirm that you selected the TAP virtual Ethernet adapter option when you installed the OpenVPN software. If you did not select this option during installation, create a TAP virtual Ethernet adapter or reinstall OpenVPN. Close OpenVPN. Then, run OpenVPN as an administrator.
Stopped ovpnagent program	The ovpnagent program on a macOS client is not running.	`Transport Error: socket_protect error`	Run the following command by using the CLI of the client to start the ovpnagent program: `/Library/Frameworks/OpenVPNConnect.framework/Versions/Current/usr/sbin/ovpnagent` For macOS clients, we recommend using Tunnelblick to create SSL-VPN connections.
Frequent client reconnection	The client automatically reconnects to the server.	`Connection reset, restarting [-1]SIGUSR1[soft,connection-reset] received, client-instance restarting` `TCP/UDP: Closing socket`	Check whether the client restarted or reconnected at the time shown in the logs. Check the SSL client certificate validity. By default, SSL client certificates are valid for three years. Check the client system time. The time difference between the client and SSL server must not exceed 10 minutes. Synchronize the client time with a standard time source.
Network ACL configuration issues	The network ACL bound to the VPC vSwitch does not allow inbound traffic from the VPN client CIDR block	The SSL-VPN connection is established successfully, but resources in the VPC cannot be accessed.	Check the network ACL bound to the VPC vSwitch to which the SSL-VPN connection belongs. Confirm that the inbound rule of the network ACL allows the client CIDR block configured on the SSL server. The client CIDR block refers to the CIDR block from which IP addresses are allocated to clients on the SSL server, for example, 10.200.200.0/24. If the inbound rule does not allow the client CIDR block, add an inbound rule to allow traffic from this CIDR block.

Check security group rules

Make sure that the security group rule of the ECS instance allows access from the client.
Security group rules have priorities. If a security group contains two rules that have the same priority but different actions (allow and deny), the deny rule takes precedence. Example:
Symptom: Unable to ping resources in the VPC after the SSL-VPN connection is established.
Cause: The security group contains two inbound ICMP rules, both with priority 1:
- Deny all sources (0.0.0.0/0)
- Allow the VPN client CIDR block (10.200.200.0/24)
When the two rules have the same priority, the deny rule takes precedence, causing ICMP traffic to be blocked.
Solution: Increase the priority value of the deny rule (for example, change it from 1 to 2) so that the allow rule (priority 1) is matched and takes effect first.

Check the operating system firewall of the ECS instance

If the SSL-VPN connection is established successfully but you cannot ping the ECS instance or access services on the ECS instance, log on to the ECS instance to check whether the operating system firewall blocks traffic from the VPN client.

Run the following command to check the status of the firewalld service.
```
systemctl status firewalld
```
If firewalld is in the active (running) state, the firewall is running. Run sudo systemctl stop firewalld to temporarily disable the firewall and then test the connectivity again. If traffic is restored after the firewall is disabled, the firewalld rules block the VPN traffic. Configure a rule to allow the VPN client CIDR block.
Run the following command to view the iptables rules.
```
iptables -L
```
Check whether the output contains a DROP or REJECT rule that blocks traffic from the VPN client CIDR block. If such a rule exists, run sudo iptables -I INPUT -s <VPN client CIDR block> -j ACCEPT to add an allow rule.
Run the following command to check the SELinux status.
```
getenforce
```
If Enforcing is returned, SELinux is in enforcing mode. Run sudo setenforce 0 to temporarily switch to Permissive mode and then test again. If traffic is restored, the SELinux policy affects VPN communication. Adjust the SELinux policy to allow VPN traffic.

References

The following references may help you troubleshoot SSL-VPN connection issues.

To modify the configuration of the SSL server, see Modify an SSL server.
To modify the connection specification of the SSL server, see Modify SSL concurrent connections.
To create an SSL client certificate, see Create and manage SSL client certificates.
To download an SSL client certificate, see Download an SSL client certificate.
"Step 4: Configure the client" section in the Connect a client to a VPC topic
To view the log information of the SSL server, see View the logs of the SSL server.
To view client connection information, see View SSL client connections.

Note

To modify client configurations when troubleshooting SSL-VPN connection issues, refer to your client's user guide.