Tunnelblick reconnecting forever

279 views
Skip to first unread message

L S

unread,
Mar 20, 2024, 5:19:51 AM3/20/24
to tunnelblick-discuss
Hi, I am running into an issue that if an VPN connection breaks, tunnelblick would try to reconnect using the config. However, the reconnecting seems to last forever.
I would like to ask whether there's a flag for this that I can set the max interval for trying to reconnect? For exampling, stop reconnecting after trying for 60 seconds. The version I'm using now is Tunnelblick 4.0.0.

I found there was a flag openvpnTerminationTimeout  in version3.3 that might be what I want (https://tunnelblick.net/cz33Prefs.html) but there's no such flag in the latest doc (https://tunnelblick.net/cPreferences.html).

Thanks!

Tunnelblick developer

unread,
Mar 20, 2024, 6:02:20 AM3/20/24
to tunnelblick-discuss
Please post the diagnostic info obtained by following the instructions at Read Before You Post.

L S

unread,
Mar 20, 2024, 9:53:31 PM3/20/24
to tunnelblick-discuss
I've set the openvpnTerminationTimeout to 120 in net.tunnelblick.tunnelblick.plist.
If I didn't think it wrong, the VPN should stop to reconnect after 120 seconds.
But it kept trying to reconnect.

Log from tunnelblick attached, thanks!
tunnelblick.log

Tunnelblick developer

unread,
Mar 20, 2024, 10:04:11 PM3/20/24
to tunnelblick-discuss
The termination timeout was for something completely different: for a situation when OpenVPN doesn't respond.

Tunnelblick isn't trying to reconnect. OpenVPN is trying to connect, failing, and then retrying, as is shown here:

   2024-03-21 10:48:28.642410 Attempting to establish TCP connection with [AF_INET]127.0.0.1:31194
   2024-03-21 10:48:28.642414 MANAGEMENT: >STATE:1710985708,TCP_CONNECT,,,,,,
   2024-03-21 10:48:28.642469 TCP: connect to [AF_INET]127.0.0.1:31194 failed: Connection refused
   2024-03-21 10:48:28.642525 SIGUSR1[connection failed(soft),connection-failed] received, process restarting

I don't know of a setting for OpenVPN that will stop retrying after a specified period of time; you should consult OpenVPN experts about that. You can find some links on our Support page.

Selva Nair

unread,
Mar 21, 2024, 12:30:20 AM3/21/24
to tunnelbli...@googlegroups.com
Hi,

On Wed, Mar 20, 2024 at 9:53 PM 'L S' via tunnelblick-discuss <tunnelbli...@googlegroups.com> wrote:
I've set the openvpnTerminationTimeout to 120 in net.tunnelblick.tunnelblick.plist.
If I didn't think it wrong, the VPN should stop to reconnect after 120 seconds.
But it kept trying to reconnect.

Log from tunnelblick attached, thanks!

You can  set connect-retry-max to some small value, say, 10. Then reconnection will be attempted only 10 times using each remote entry in the configuration file. 10 re-tries will take about 130 seconds with only one remote (provided the issue mentioned below gets fixed).

That said, tunnelblick is also doing something wrong here. It's ignoring the delay time suggested in the hold-release request and is releasing without any delay. This negates the exponential backoff in OpenVPN.

Jon, please see: https://github.com/OpenVPN/openvpn/issues/525 in case you haven't.

Selva


L S

unread,
Mar 21, 2024, 3:01:42 AM3/21/24
to tunnelblick-discuss
Thank you so much.
One more question, should the connect-retry-max be set in the .ovpn file? Or it should be set somewhere else? 
Thanks!

Tunnelblick developer

unread,
Mar 21, 2024, 7:33:05 AM3/21/24
to tunnelblick-discuss
On Thursday, March 21, 2024 at 12:30:20 AM UTC-4 Selva wrote:
That said, tunnelblick is also doing something wrong here. It's ignoring the delay time suggested in the hold-release request and is releasing without any delay. This negates the exponential backoff in OpenVPN.

Jon, please see: https://github.com/OpenVPN/openvpn/issues/525 in case you haven't.

Selva, thanks! I didn't know about the delay problem, nor had I had seen that issue.

I'll look into fixing Tunnelblick and post back here about it.


 

Tunnelblick developer

unread,
Mar 21, 2024, 7:51:44 AM3/21/24
to tunnelblick-discuss
On Thursday, March 21, 2024 at 3:01:42 AM UTC-4 L S wrote:
One more question, should the connect-retry-max be set in the .ovpn file? Or it should be set somewhere else? 

I'm not an OpenVPN expert, but here are some thoughts:
  • It isn't clear to me that it should be set at all, other than as a temporary fix until you're using a version of Tunnelblick that fixes its bug and delays releasing the hold as requested by OpenVPN. Having OpenVPN "give up" after some time, instead of trying indefinitely might be desired, but maybe not.
  • I hope/expect to have this fixed in Tunnelblick "soon" – new stable and beta versions should fix this bug within days, not within weeks or months.
  • The option can be set in the.ovpn file
  • The "somewhere else" would be in the server configuration, which can "push" OpenVPN options to its clients.

Tunnelblick developer

unread,
Mar 21, 2024, 10:17:22 AM3/21/24
to tunnelblick-discuss
 I have developed a fix for this Tunnelblick problem, which has also been discussed on GitHub OpenVPN Issue #525.

@L S and anyone else who would like to test it may email devel...@tunnelblick.net for a link to download a pre-beta version of Tunnelblick that I believe fixes the problem.

Will Kuo

unread,
Mar 29, 2024, 7:58:50 AM3/29/24
to tunnelblick-discuss
Hi team,

Do you have possible timeline to release this feature for solving the Tunnelblick reconnecting forever issue ?
Thanks for your large support.

Will

Tunnelblick developer

unread,
Mar 29, 2024, 8:02:52 AM3/29/24
to tunnelblick-discuss
We don't release on timelines, we release when enough pre-beta testing has been done. And so far, too few people have tested this fix. As I wrote earlier,  anyone else who would like to test it may email devel...@tunnelblick.net for a link to download a pre-beta version of Tunnelblick that I believe fixes the problem.

Will Kuo

unread,
Mar 29, 2024, 9:56:24 AM3/29/24
to tunnelblick-discuss
Thanks for the reply, I have sent the email for testing the fix.

Will Kuo

unread,
Apr 2, 2024, 8:49:07 AM4/2/24
to tunnelblick-discuss
Update~ After trying the pre-beta version "Tunnelblick 5.0.0beta02-TEST-3 (build 6013)", the disconnection can work smoothly now. 
In order to help other people, share the discussions as follows. Thanks for the quick reply and advice.

Could we enable any following features?
(1) Disconnect the Tunnelblick by script (Instead of manually clicking the "Disconnect" button)
(2) Limit the number of reconnection counts
(3) Fully disable the reconnection function

Tunnelblick dev team:
(1) You can disconnect the VPN via a script. See AppleScript Support.
(2) & (3) We don't have plans to do either of these within Tunnelblick:
The reconnection attempts now take few resources from the computer.
If reconnection attempts were disabled, temporary network problems, usually handled without being noticed, would result in a disconnection. Almost no one wants that.
There is an OpenVPN option that can disable retries: --connect-retry-max, which limits the number of retries that are attempted.

I use the --connect-retry-max = 10 setting (put it in the .ovpn configuration file), and it meets our use case.

The detailed logs as follows:
2024-04-02 14:03:28.293763 SIGUSR1[soft,connection-reset] received, process restarting
2024-04-02 14:03:28.293795 MANAGEMENT: >STATE:1712037808,RECONNECTING,connection-reset,,,,,
2024-04-02 14:03:28.633406 *Tunnelblick: Delaying HOLD release for 1.000 seconds
2024-04-02 14:03:29.634210 MANAGEMENT: CMD 'hold release'
2024-04-02 14:03:29.634364 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2024-04-02 14:03:29.643747 TCP/UDP: Preserving recently used remote address: [AF_INET]127.0.0.1:31194
2024-04-02 14:03:29.643895 Socket Buffers: R=[131072->131072] S=[131072->131072]
2024-04-02 14:03:29.643915 Attempting to establish TCP connection with [AF_INET]127.0.0.1:31194
2024-04-02 14:03:29.643935 MANAGEMENT: >STATE:1712037809,TCP_CONNECT,,,,,,
2024-04-02 14:03:29.644201 TCP connection established with [AF_INET]127.0.0.1:31194
2024-04-02 14:03:29.644225 TCPv4_CLIENT link local: (not bound)
2024-04-02 14:03:29.644241 TCPv4_CLIENT link remote: [AF_INET]127.0.0.1:31194
2024-04-02 14:03:29.644385 MANAGEMENT: >STATE:1712037809,WAIT,,,,,,
2024-04-02 14:03:32.758393 Connection reset, restarting [-1]
2024-04-02 14:03:32.759261 SIGUSR1[soft,connection-reset] received, process restarting
2024-04-02 14:03:32.759306 MANAGEMENT: >STATE:1712037812,RECONNECTING,connection-reset,,,,,
2024-04-02 14:03:33.072497 *Tunnelblick: Delaying HOLD release for 1.000 seconds
2024-04-02 14:03:34.074276 MANAGEMENT: CMD 'hold release'
2024-04-02 14:03:34.074633 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2024-04-02 14:03:34.081020 TCP/UDP: Preserving recently used remote address: [AF_INET]127.0.0.1:31194
2024-04-02 14:03:34.081393 Socket Buffers: R=[131072->131072] S=[131072->131072]
2024-04-02 14:03:34.081420 Attempting to establish TCP connection with [AF_INET]127.0.0.1:31194
2024-04-02 14:03:34.081441 MANAGEMENT: >STATE:1712037814,TCP_CONNECT,,,,,,
2024-04-02 14:03:34.082067 TCP connection established with [AF_INET]127.0.0.1:31194
2024-04-02 14:03:34.082122 TCPv4_CLIENT link local: (not bound)
2024-04-02 14:03:34.082146 TCPv4_CLIENT link remote: [AF_INET]127.0.0.1:31194
2024-04-02 14:03:34.082260 MANAGEMENT: >STATE:1712037814,WAIT,,,,,,
2024-04-02 14:03:37.207623 Connection reset, restarting [-1]
2024-04-02 14:03:37.210348 SIGUSR1[soft,connection-reset] received, process restarting
2024-04-02 14:03:37.210564 MANAGEMENT: >STATE:1712037817,RECONNECTING,connection-reset,,,,,
2024-04-02 14:03:37.518237 *Tunnelblick: Delaying HOLD release for 1.000 seconds
2024-04-02 14:03:38.521653 MANAGEMENT: CMD 'hold release'
2024-04-02 14:03:38.522355 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2024-04-02 14:03:38.525657 TCP/UDP: Preserving recently used remote address: [AF_INET]127.0.0.1:31194
2024-04-02 14:03:38.525838 Socket Buffers: R=[131072->131072] S=[131072->131072]
2024-04-02 14:03:38.525857 Attempting to establish TCP connection with [AF_INET]127.0.0.1:31194
2024-04-02 14:03:38.525885 MANAGEMENT: >STATE:1712037818,TCP_CONNECT,,,,,,
2024-04-02 14:03:38.526461 TCP connection established with [AF_INET]127.0.0.1:31194
2024-04-02 14:03:38.526487 TCPv4_CLIENT link local: (not bound)
2024-04-02 14:03:38.526504 TCPv4_CLIENT link remote: [AF_INET]127.0.0.1:31194
2024-04-02 14:03:38.526686 MANAGEMENT: >STATE:1712037818,WAIT,,,,,,
2024-04-02 14:03:41.653698 Connection reset, restarting [-1]
2024-04-02 14:03:41.656388 SIGUSR1[soft,connection-reset] received, process restarting
2024-04-02 14:03:41.656431 MANAGEMENT: >STATE:1712037821,RECONNECTING,connection-reset,,,,,
2024-04-02 14:03:41.966615 *Tunnelblick: Delaying HOLD release for 1.000 seconds
2024-04-02 14:03:42.968960 MANAGEMENT: CMD 'hold release'
2024-04-02 14:03:42.976986 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2024-04-02 14:03:42.987919 TCP/UDP: Preserving recently used remote address: [AF_INET]127.0.0.1:31194
2024-04-02 14:03:42.988352 Socket Buffers: R=[131072->131072] S=[131072->131072]
2024-04-02 14:03:42.988375 Attempting to establish TCP connection with [AF_INET]127.0.0.1:31194
2024-04-02 14:03:42.988417 MANAGEMENT: >STATE:1712037822,TCP_CONNECT,,,,,,
2024-04-02 14:03:42.990432 TCP connection established with [AF_INET]127.0.0.1:31194
2024-04-02 14:03:42.990539 TCPv4_CLIENT link local: (not bound)
2024-04-02 14:03:42.990557 TCPv4_CLIENT link remote: [AF_INET]127.0.0.1:31194
2024-04-02 14:03:42.990635 MANAGEMENT: >STATE:1712037822,WAIT,,,,,,
2024-04-02 14:03:46.101893 Connection reset, restarting [-1]
2024-04-02 14:03:46.102266 SIGUSR1[soft,connection-reset] received, process restarting
2024-04-02 14:03:46.102291 MANAGEMENT: >STATE:1712037826,RECONNECTING,connection-reset,,,,,
2024-04-02 14:03:46.247620 *Tunnelblick: Delaying HOLD release for 1.000 seconds
2024-04-02 14:03:47.250067 MANAGEMENT: CMD 'hold release'
2024-04-02 14:03:47.250641 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2024-04-02 14:03:47.254927 TCP/UDP: Preserving recently used remote address: [AF_INET]127.0.0.1:31194
2024-04-02 14:03:47.255648 Socket Buffers: R=[131072->131072] S=[131072->131072]
2024-04-02 14:03:47.255670 Attempting to establish TCP connection with [AF_INET]127.0.0.1:31194
2024-04-02 14:03:47.255709 MANAGEMENT: >STATE:1712037827,TCP_CONNECT,,,,,,
2024-04-02 14:03:47.257031 TCP connection established with [AF_INET]127.0.0.1:31194
2024-04-02 14:03:47.257093 TCPv4_CLIENT link local: (not bound)
2024-04-02 14:03:47.257108 TCPv4_CLIENT link remote: [AF_INET]127.0.0.1:31194
2024-04-02 14:03:47.257169 MANAGEMENT: >STATE:1712037827,WAIT,,,,,,
2024-04-02 14:03:50.359637 Connection reset, restarting [-1]
2024-04-02 14:03:50.360192 SIGUSR1[soft,connection-reset] received, process restarting
2024-04-02 14:03:50.360222 MANAGEMENT: >STATE:1712037830,RECONNECTING,connection-reset,,,,,
2024-04-02 14:03:50.671035 *Tunnelblick: Delaying HOLD release for 1.000 seconds
2024-04-02 14:03:51.673097 MANAGEMENT: CMD 'hold release'
2024-04-02 14:03:51.673268 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2024-04-02 14:03:51.676572 TCP/UDP: Preserving recently used remote address: [AF_INET]127.0.0.1:31194
2024-04-02 14:03:51.676899 Socket Buffers: R=[131072->131072] S=[131072->131072]
2024-04-02 14:03:51.676917 Attempting to establish TCP connection with [AF_INET]127.0.0.1:31194
2024-04-02 14:03:51.676932 MANAGEMENT: >STATE:1712037831,TCP_CONNECT,,,,,,
2024-04-02 14:03:51.677572 TCP connection established with [AF_INET]127.0.0.1:31194
2024-04-02 14:03:51.677607 TCPv4_CLIENT link local: (not bound)
2024-04-02 14:03:51.677629 TCPv4_CLIENT link remote: [AF_INET]127.0.0.1:31194
2024-04-02 14:03:51.677694 MANAGEMENT: >STATE:1712037831,WAIT,,,,,,
2024-04-02 14:03:54.806064 Connection reset, restarting [-1]
2024-04-02 14:03:54.806619 SIGUSR1[soft,connection-reset] received, process restarting
2024-04-02 14:03:54.806641 MANAGEMENT: >STATE:1712037834,RECONNECTING,connection-reset,,,,,
2024-04-02 14:03:54.957151 *Tunnelblick: Delaying HOLD release for 2.000 seconds
2024-04-02 14:03:56.958753 MANAGEMENT: CMD 'hold release'
2024-04-02 14:03:56.959009 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2024-04-02 14:03:56.962454 TCP/UDP: Preserving recently used remote address: [AF_INET]127.0.0.1:31194
2024-04-02 14:03:56.962704 Socket Buffers: R=[131072->131072] S=[131072->131072]
2024-04-02 14:03:56.962728 Attempting to establish TCP connection with [AF_INET]127.0.0.1:31194
2024-04-02 14:03:56.962747 MANAGEMENT: >STATE:1712037836,TCP_CONNECT,,,,,,
2024-04-02 14:03:56.964562 TCP connection established with [AF_INET]127.0.0.1:31194
2024-04-02 14:03:56.964661 TCPv4_CLIENT link local: (not bound)
2024-04-02 14:03:56.964983 TCPv4_CLIENT link remote: [AF_INET]127.0.0.1:31194
2024-04-02 14:03:56.965203 MANAGEMENT: >STATE:1712037836,WAIT,,,,,,
2024-04-02 14:04:00.092942 Connection reset, restarting [-1]
2024-04-02 14:04:00.093817 SIGUSR1[soft,connection-reset] received, process restarting
2024-04-02 14:04:00.093841 MANAGEMENT: >STATE:1712037840,RECONNECTING,connection-reset,,,,,
2024-04-02 14:04:00.401657 *Tunnelblick: Delaying HOLD release for 4.000 seconds
2024-04-02 14:04:04.407428 MANAGEMENT: CMD 'hold release'
2024-04-02 14:04:04.407772 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2024-04-02 14:04:04.411592 TCP/UDP: Preserving recently used remote address: [AF_INET]127.0.0.1:31194
2024-04-02 14:04:04.411945 Socket Buffers: R=[131072->131072] S=[131072->131072]
2024-04-02 14:04:04.411970 Attempting to establish TCP connection with [AF_INET]127.0.0.1:31194
2024-04-02 14:04:04.411985 MANAGEMENT: >STATE:1712037844,TCP_CONNECT,,,,,,
2024-04-02 14:04:04.412496 TCP connection established with [AF_INET]127.0.0.1:31194
2024-04-02 14:04:04.412513 TCPv4_CLIENT link local: (not bound)
2024-04-02 14:04:04.412525 TCPv4_CLIENT link remote: [AF_INET]127.0.0.1:31194
2024-04-02 14:04:04.412591 MANAGEMENT: >STATE:1712037844,WAIT,,,,,,
2024-04-02 14:04:07.543499 Connection reset, restarting [-1]
2024-04-02 14:04:07.543731 SIGUSR1[soft,connection-reset] received, process restarting
2024-04-02 14:04:07.543750 MANAGEMENT: >STATE:1712037847,RECONNECTING,connection-reset,,,,,
2024-04-02 14:04:07.853077 *Tunnelblick: Delaying HOLD release for 8.000 seconds
2024-04-02 14:04:15.856189 MANAGEMENT: CMD 'hold release'
2024-04-02 14:04:15.856598 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2024-04-02 14:04:15.864113 TCP/UDP: Preserving recently used remote address: [AF_INET]127.0.0.1:31194
2024-04-02 14:04:15.864691 Socket Buffers: R=[131072->131072] S=[131072->131072]
2024-04-02 14:04:15.864725 Attempting to establish TCP connection with [AF_INET]127.0.0.1:31194
2024-04-02 14:04:15.864753 MANAGEMENT: >STATE:1712037855,TCP_CONNECT,,,,,,
2024-04-02 14:04:15.867846 TCP connection established with [AF_INET]127.0.0.1:31194
2024-04-02 14:04:15.867993 TCPv4_CLIENT link local: (not bound)
2024-04-02 14:04:15.868035 TCPv4_CLIENT link remote: [AF_INET]127.0.0.1:31194
2024-04-02 14:04:15.868653 MANAGEMENT: >STATE:1712037855,WAIT,,,,,,
2024-04-02 14:04:19.004755 Connection reset, restarting [-1]
2024-04-02 14:04:19.005378 SIGUSR1[soft,connection-reset] received, process restarting
2024-04-02 14:04:19.005426 MANAGEMENT: >STATE:1712037859,RECONNECTING,connection-reset,,,,,
2024-04-02 14:04:19.322051 *Tunnelblick: Delaying HOLD release for 16.000 seconds
2024-04-02 14:04:35.326920 MANAGEMENT: CMD 'hold release'
2024-04-02 14:04:35.327269 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2024-04-02 14:04:35.333311 TCP/UDP: Preserving recently used remote address: [AF_INET]127.0.0.1:31194
2024-04-02 14:04:35.333682 Socket Buffers: R=[131072->131072] S=[131072->131072]
2024-04-02 14:04:35.333711 Attempting to establish TCP connection with [AF_INET]127.0.0.1:31194
2024-04-02 14:04:35.333732 MANAGEMENT: >STATE:1712037875,TCP_CONNECT,,,,,,
2024-04-02 14:04:35.334889 TCP connection established with [AF_INET]127.0.0.1:31194
2024-04-02 14:04:35.334941 TCPv4_CLIENT link local: (not bound)
2024-04-02 14:04:35.334958 TCPv4_CLIENT link remote: [AF_INET]127.0.0.1:31194
2024-04-02 14:04:35.335049 MANAGEMENT: >STATE:1712037875,WAIT,,,,,,
2024-04-02 14:04:38.455735 Connection reset, restarting [-1]
2024-04-02 14:04:38.456449 SIGUSR1[soft,connection-reset] received, process restarting
2024-04-02 14:04:38.456504 MANAGEMENT: >STATE:1712037878,RECONNECTING,connection-reset,,,,,
2024-04-02 14:04:38.766399 *Tunnelblick: Delaying HOLD release for 32.000 seconds
2024-04-02 14:05:10.772213 MANAGEMENT: CMD 'hold release'
2024-04-02 14:05:10.772424 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2024-04-02 14:05:10.776090 TCP/UDP: Preserving recently used remote address: [AF_INET]127.0.0.1:31194
2024-04-02 14:05:10.776220 Socket Buffers: R=[131072->131072] S=[131072->131072]
2024-04-02 14:05:10.776241 Attempting to establish TCP connection with [AF_INET]127.0.0.1:31194
2024-04-02 14:05:10.776258 MANAGEMENT: >STATE:1712037910,TCP_CONNECT,,,,,,
2024-04-02 14:05:10.776746 TCP connection established with [AF_INET]127.0.0.1:31194
2024-04-02 14:05:10.776770 TCPv4_CLIENT link local: (not bound)
2024-04-02 14:05:10.776786 TCPv4_CLIENT link remote: [AF_INET]127.0.0.1:31194
2024-04-02 14:05:10.776841 MANAGEMENT: >STATE:1712037910,WAIT,,,,,,
2024-04-02 14:05:13.877712 Connection reset, restarting [-1]
2024-04-02 14:05:13.878034 SIGUSR1[soft,connection-reset] received, process restarting
2024-04-02 14:05:13.878057 MANAGEMENT: >STATE:1712037913,RECONNECTING,connection-reset,,,,,
2024-04-02 14:05:14.189462 *Tunnelblick: Delaying HOLD release for 64.000 seconds
2024-04-02 14:06:18.192226 MANAGEMENT: CMD 'hold release'
2024-04-02 14:06:18.192780 MANAGEMENT: Client disconnected
2024-04-02 14:06:18.192815 All connections have been connect-retry-max (10) times unsuccessful, exiting
2024-04-02 14:06:18.192839 Exiting due to fatal error
2024-04-02 14:06:23.097624 *Tunnelblick: Expected disconnection occurred.

Reply all
Reply to author
Forward
0 new messages