VPN sessions are not fully disconnected with --inactive in use #89

New issue

Closed

opened 2026-02-02 12:41:55 +01:00 by dazo · 1 comment

dazo commented

2026-02-02 12:41:55 +01:00

Owner

An OpenVPN server configuration with --inactive and --keepalive will result in the OpenVPN 3 Linux client not fully disconnecting when the inactive timer is triggered.

Server options needed to trigger this behavior:

push "inactive 50"
keepalive 15 30

The client log will show:

2026-02-02 12:35:00  Client DEBUG: [Core] inactive timer expired
2026-02-02 12:35:00  Client DEBUG:  EVENT [7][name=INACTIVE_TIMEOUT]:
2026-02-02 12:35:00  Client INFO: Connection closing due to inactivity
2026-02-02 12:35:00  [STATUS] Connection, Client disconnecting: Connection inactivity
2026-02-02 12:35:00  Client DEBUG:  EVENT [8][name=DISCONNECTED]:
2026-02-02 12:35:00  [STATUS] Connection, Client disconnected
2026-02-02 12:35:00  Client INFO: Disconnected
2026-02-02 12:35:00  Client DEBUG: tun_builder_teardown, disconnect requested -> destroying virtual device
2026-02-02 12:35:00  Client DEBUG: Closing virtial interface fd 13
2026-02-02 12:35:17  Client DEBUG: Network configuration cleanup requested

But the output of openvpn3 sessions-list shows:

$ openvpn3 sessions-list
-----------------------------------------------------------------------------
        Path: /net/openvpn/v3/sessions/e5a2c113sb3d9s49c5s8981s06d08f9c0272
     Created: 2026-02-02 12:32:02                       PID: 48331
       Owner: user                                   Device:
 Config name: inactive-test
      Status: Connection, Client disconnected
-----------------------------------------------------------------------------

The server side logs shows the session being disconnected:

2026-02-02 11:35:00 us=866759 Test-Client/udp4:........102.213:46873 CC-EEN exit message received by peer
2026-02-02 11:35:00 us=866828 Test-Client/udp4:........102.213:46873 Delayed exit in 5 seconds
2026-02-02 11:35:06 us=29619 Test-Client/udp4:........102.213:46873 SIGTERM[soft,delayed-exit] received, client-instance exiting

This issue was discovered via a reported issue in openvpn3-indicator project: https://github.com/OpenVPN/openvpn3-indicator/issues/37

An OpenVPN server configuration with `--inactive` and `--keepalive` will result in the OpenVPN 3 Linux client not fully disconnecting when the inactive timer is triggered. Server options needed to trigger this behavior: push "inactive 50" keepalive 15 30 The client log will show: ``` 2026-02-02 12:35:00 Client DEBUG: [Core] inactive timer expired 2026-02-02 12:35:00 Client DEBUG: EVENT [7][name=INACTIVE_TIMEOUT]: 2026-02-02 12:35:00 Client INFO: Connection closing due to inactivity 2026-02-02 12:35:00 [STATUS] Connection, Client disconnecting: Connection inactivity 2026-02-02 12:35:00 Client DEBUG: EVENT [8][name=DISCONNECTED]: 2026-02-02 12:35:00 [STATUS] Connection, Client disconnected 2026-02-02 12:35:00 Client INFO: Disconnected 2026-02-02 12:35:00 Client DEBUG: tun_builder_teardown, disconnect requested -> destroying virtual device 2026-02-02 12:35:00 Client DEBUG: Closing virtial interface fd 13 2026-02-02 12:35:17 Client DEBUG: Network configuration cleanup requested ``` But the output of `openvpn3 sessions-list` shows: ``` $ openvpn3 sessions-list ----------------------------------------------------------------------------- Path: /net/openvpn/v3/sessions/e5a2c113sb3d9s49c5s8981s06d08f9c0272 Created: 2026-02-02 12:32:02 PID: 48331 Owner: user Device: Config name: inactive-test Status: Connection, Client disconnected ----------------------------------------------------------------------------- ``` The server side logs shows the session being disconnected: ``` 2026-02-02 11:35:00 us=866759 Test-Client/udp4:........102.213:46873 CC-EEN exit message received by peer 2026-02-02 11:35:00 us=866828 Test-Client/udp4:........102.213:46873 Delayed exit in 5 seconds 2026-02-02 11:35:06 us=29619 Test-Client/udp4:........102.213:46873 SIGTERM[soft,delayed-exit] received, client-instance exiting ``` This issue was discovered via a reported issue in `openvpn3-indicator` project: https://github.com/OpenVPN/openvpn3-indicator/issues/37