OpenVPN not reconnecting

[plainzwalker 0]

So I have my configuration setup so it will reconnect whenever the connection drops. However for some reason it fails to reconnect.

 

I have been wrestling with this for a while and its getting frustrating.

 

Thank you in advance

 

OS is Ubuntu

 

/etc/default/openvpn:

# Start only these VPNs automatically via init script.
# Allowed values are "all", "none" or space separated list of
# names of the VPNs. If empty, "all" is assumed.
# The VPN name refers to the VPN configutation file name.
# i.e. "home" would be /etc/openvpn/home.conf
#
AUTOSTART="all"
#AUTOSTART="none"
#AUTOSTART="home office"
#
# Refresh interval (in seconds) of default status files
# located in /var/run/openvpn.$NAME.status
# Defaults to 10, 0 disables status file generation
#
#STATUSREFRESH=10
#STATUSREFRESH=0
# Optional arguments to openvpn's command line
OPTARGS="--ping 5 --ping-restart 30 --client-connect up.sh"
#
# If you need openvpn running after sendsigs, i.e.
# to let umountnfs work over the vpn, set OMIT_SENDSIGS
# to 1 and include umountnfs as Required-Stop: in openvpn's
# init.d script (remember to run insserv after that)
#
OMIT_SENDSIGS=0

CFG file in /etc/openvpn/

downloadcloneembedreportprint text 1.54 KB
/etc/openvpn cfg file:
# --------------------------------------------------------
# Air VPN | https://airvpn.org | Wednesday 6th of January 2016 02:31:28 AM
# OpenVPN Client Configuration
# AirVPN_Netherlands_UDP-443
# --------------------------------------------------------
 
client
dev tun
proto udp
remote nl.vpn.airdns.org 443
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
cipher AES-256-CBC
comp-lzo no
route-delay 5
verb 3
explicit-exit-notify 5
ca "ca.crt"
cert "user.crt"
key "user.key"
tls-auth "ta.key" 1
keepalive 10 120
log-append /var/log/openvpn.log

Last 100 lines of openvpn log file:

Mon Oct 10 06:43:24 2016 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 4096 bit RSA
Mon Oct 10 07:35:39 2016 [server] Inactivity timeout (--ping-restart), restarting
Mon Oct 10 07:35:39 2016 SIGUSR1[soft,ping-restart] received, process restarting
Mon Oct 10 07:35:39 2016 Restart pause, 2 second(s)
Mon Oct 10 07:35:41 2016 Socket Buffers: R=[212992->212992] S=[212992->212992]
Mon Oct 10 07:36:21 2016 RESOLVE: Cannot resolve host address: nl.vpn.airdns.org: Temporary failure in name resolution
Mon Oct 10 07:37:01 2016 RESOLVE: Cannot resolve host address: nl.vpn.airdns.org: Temporary failure in name resolution
Mon Oct 10 07:37:46 2016 RESOLVE: Cannot resolve host address: nl.vpn.airdns.org: Temporary failure in name resolution
Mon Oct 10 07:38:31 2016 RESOLVE: Cannot resolve host address: nl.vpn.airdns.org: Temporary failure in name resolution
Mon Oct 10 07:39:16 2016 RESOLVE: Cannot resolve host address: nl.vpn.airdns.org: Temporary failure in name resolution
Mon Oct 10 07:40:01 2016 RESOLVE: Cannot resolve host address: nl.vpn.airdns.org: Temporary failure in name resolution
Mon Oct 10 07:40:46 2016 RESOLVE: Cannot resolve host address: nl.vpn.airdns.org: Temporary failure in name resolution
Mon Oct 10 07:41:31 2016 RESOLVE: Cannot resolve host address: nl.vpn.airdns.org: Temporary failure in name resolution
Mon Oct 10 07:42:16 2016 RESOLVE: Cannot resolve host address: nl.vpn.airdns.org: Temporary failure in name resolution
Mon Oct 10 07:43:01 2016 RESOLVE: Cannot resolve host address: nl.vpn.airdns.org: Temporary failure in name resolution
Mon Oct 10 07:43:46 2016 RESOLVE: Cannot resolve host address: nl.vpn.airdns.org: Temporary failure in name resolution
Mon Oct 10 07:44:31 2016 RESOLVE: Cannot resolve host address: nl.vpn.airdns.org: Temporary failure in name resolution
Mon Oct 10 07:45:16 2016 RESOLVE: Cannot resolve host address: nl.vpn.airdns.org: Temporary failure in name resolution
Mon Oct 10 07:46:01 2016 RESOLVE: signal received during DNS resolution attempt
Mon Oct 10 07:46:01 2016 /sbin/ip route del 213.152.161.34/32
Mon Oct 10 07:46:01 2016 /sbin/ip route del 0.0.0.0/1
Mon Oct 10 07:46:01 2016 /sbin/ip route del 128.0.0.0/1
Mon Oct 10 07:46:01 2016 Closing TUN/TAP interface
Mon Oct 10 07:46:01 2016 /sbin/ip addr del dev tun0 10.4.79.72/16
Mon Oct 10 07:46:01 2016 SIGTERM[hard,init_instance] received, process exiting
Mon Oct 10 07:46:02 2016 OpenVPN 2.3.10 x86_64-pc-linux-gnu [SSL (OpenSSL)] [LZO] [EPOLL] [PKCS11] [MH] [IPv6] built on Feb  2 2016
Mon Oct 10 07:46:02 2016 library versions: OpenSSL 1.0.2g  1 Mar 2016, LZO 2.08
Mon Oct 10 07:46:02 2016 WARNING: file 'user.key' is group or others accessible
Mon Oct 10 07:46:02 2016 WARNING: file 'ta.key' is group or others accessible
Mon Oct 10 07:46:02 2016 Control Channel Authentication: using 'ta.key' as a OpenVPN static key file
Mon Oct 10 07:46:02 2016 Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Oct 10 07:46:02 2016 Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Oct 10 07:46:02 2016 Socket Buffers: R=[212992->212992] S=[212992->212992]
Mon Oct 10 07:46:02 2016 UDPv4 link local: [undef]
Mon Oct 10 07:46:02 2016 UDPv4 link remote: [AF_INET]213.152.161.39:443
Mon Oct 10 07:46:02 2016 TLS: Initial packet from [AF_INET]213.152.161.39:443, sid=60b1b2c3 01debb21
Mon Oct 10 07:46:02 2016 VERIFY OK: depth=1, C=IT, ST=IT, L=Perugia, O=airvpn.org, CN=airvpn.org CA, emailAddress=info@airvpn.org
Mon Oct 10 07:46:02 2016 Validating certificate key usage
Mon Oct 10 07:46:02 2016 ++ Certificate has key usage  00a0, expects 00a0
Mon Oct 10 07:46:02 2016 VERIFY KU OK
Mon Oct 10 07:46:02 2016 Validating certificate extended key usage
Mon Oct 10 07:46:02 2016 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Mon Oct 10 07:46:02 2016 VERIFY EKU OK
Mon Oct 10 07:46:02 2016 VERIFY OK: depth=0, C=IT, ST=IT, L=Perugia, O=airvpn.org, CN=server, emailAddress=info@airvpn.org
Mon Oct 10 07:46:02 2016 Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Mon Oct 10 07:46:02 2016 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Oct 10 07:46:02 2016 Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
Mon Oct 10 07:46:02 2016 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Mon Oct 10 07:46:02 2016 Control Channel: TLSv1.2, cipher TLSv1/SSLv3 DHE-RSA-AES256-GCM-SHA384, 4096 bit RSA
Mon Oct 10 07:46:02 2016 [server] Peer Connection Initiated with [AF_INET]213.152.161.39:443
Mon Oct 10 07:46:05 2016 SENT CONTROL [server]: 'PUSH_REQUEST' (status=1)
Mon Oct 10 07:46:05 2016 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 10.4.0.1,comp-lzo no,route-gateway 10.4.0.1,topology subnet,ping 10,ping-restart 60,ifconfig 10.4.81.240 255.255.0.0'
Mon Oct 10 07:46:05 2016 OPTIONS IMPORT: timers and/or timeouts modified
Mon Oct 10 07:46:05 2016 OPTIONS IMPORT: LZO parms modified
Mon Oct 10 07:46:05 2016 OPTIONS IMPORT: --ifconfig/up options modified
Mon Oct 10 07:46:05 2016 OPTIONS IMPORT: route options modified
Mon Oct 10 07:46:05 2016 OPTIONS IMPORT: route-related options modified
Mon Oct 10 07:46:05 2016 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Mon Oct 10 07:46:05 2016 ROUTE_GATEWAY 192.168.1.1/255.255.255.0 IFACE=eth0 HWADDR=bc:5f:f4:38:06:c9
Mon Oct 10 07:46:05 2016 TUN/TAP device tun0 opened
Mon Oct 10 07:46:05 2016 TUN/TAP TX queue length set to 100
Mon Oct 10 07:46:05 2016 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Mon Oct 10 07:46:05 2016 /sbin/ip link set dev tun0 up mtu 1500
Mon Oct 10 07:46:05 2016 /sbin/ip addr add dev tun0 10.4.81.240/16 broadcast 10.4.255.255
Mon Oct 10 07:46:11 2016 /sbin/ip route add 213.152.161.39/32 via 192.168.1.1
Mon Oct 10 07:46:11 2016 /sbin/ip route add 0.0.0.0/1 via 10.4.0.1
Mon Oct 10 07:46:11 2016 /sbin/ip route add 128.0.0.0/1 via 10.4.0.1
Mon Oct 10 07:46:11 2016 Initialization Sequence Completed
Mon Oct 10 07:47:45 2016 [server] Inactivity timeout (--ping-restart), restarting
Mon Oct 10 07:47:45 2016 SIGUSR1[soft,ping-restart] received, process restarting
Mon Oct 10 07:47:45 2016 Restart pause, 2 second(s)
Mon Oct 10 07:47:47 2016 Socket Buffers: R=[212992->212992] S=[212992->212992]
Mon Oct 10 07:48:28 2016 RESOLVE: Cannot resolve host address: nl.vpn.airdns.org: Temporary failure in name resolution
Mon Oct 10 07:49:08 2016 RESOLVE: Cannot resolve host address: nl.vpn.airdns.org: Temporary failure in name resolution
Mon Oct 10 07:49:53 2016 RESOLVE: Cannot resolve host address: nl.vpn.airdns.org: Temporary failure in name resolution
Mon Oct 10 07:50:38 2016 RESOLVE: Cannot resolve host address: nl.vpn.airdns.org: Temporary failure in name resolution
Mon Oct 10 07:51:23 2016 RESOLVE: Cannot resolve host address: nl.vpn.airdns.org: Temporary failure in name resolution
Mon Oct 10 07:52:08 2016 RESOLVE: Cannot resolve host address: nl.vpn.airdns.org: Temporary failure in name resolution
Mon Oct 10 07:52:53 2016 RESOLVE: Cannot resolve host address: nl.vpn.airdns.org: Temporary failure in name resolution
Mon Oct 10 07:53:38 2016 RESOLVE: Cannot resolve host address: nl.vpn.airdns.org: Temporary failure in name resolution
Mon Oct 10 07:54:23 2016 RESOLVE: Cannot resolve host address: nl.vpn.airdns.org: Temporary failure in name resolution
Mon Oct 10 07:55:08 2016 RESOLVE: Cannot resolve host address: nl.vpn.airdns.org: Temporary failure in name resolution
Mon Oct 10 07:55:53 2016 RESOLVE: Cannot resolve host address: nl.vpn.airdns.org: Temporary failure in name resolution
Mon Oct 10 07:56:38 2016 RESOLVE: Cannot resolve host address: nl.vpn.airdns.org: Temporary failure in name resolution
Mon Oct 10 07:57:23 2016 RESOLVE: Cannot resolve host address: nl.vpn.airdns.org: Temporary failure in name resolution
Mon Oct 10 07:58:08 2016 RESOLVE: Cannot resolve host address: nl.vpn.airdns.org: Temporary failure in name resolution
Mon Oct 10 07:58:53 2016 RESOLVE: Cannot resolve host address: nl.vpn.airdns.org: Temporary failure in name resolution
Mon Oct 10 07:59:38 2016 RESOLVE: Cannot resolve host address: nl.vpn.airdns.org: Temporary failure in name resolution
Mon Oct 10 08:00:23 2016 RESOLVE: Cannot resolve host address: nl.vpn.airdns.org: Temporary failure in name resolution
Mon Oct 10 08:01:08 2016 RESOLVE: Cannot resolve host address: nl.vpn.airdns.org: Temporary failure in name resolution
Mon Oct 10 08:01:53 2016 RESOLVE: Cannot resolve host address: nl.vpn.airdns.org: Temporary failure in name resolution
Mon Oct 10 08:02:38 2016 RESOLVE: Cannot resolve host address: nl.vpn.airdns.org: Temporary failure in name resolution
Mon Oct 10 08:03:23 2016 RESOLVE: Cannot resolve host address: nl.vpn.airdns.org: Temporary failure in name resolution
Mon Oct 10 08:04:08 2016 RESOLVE: Cannot resolve host address: nl.vpn.airdns.org: Temporary failure in name resolution
Mon Oct 10 08:04:53 2016 RESOLVE: Cannot resolve host address: nl.vpn.airdns.org: Temporary failure in name resolution
Mon Oct 10 08:05:38 2016 RESOLVE: Cannot resolve host address: nl.vpn.airdns.org: Temporary failure in name resolution
Mon Oct 10 08:06:23 2016 RESOLVE: Cannot resolve host address: nl.vpn.airdns.org: Temporary failure in name resolution
Mon Oct 10 08:07:08 2016 RESOLVE: Cannot resolve host address: nl.vpn.airdns.org: Temporary failure in name resolution
Mon Oct 10 08:07:53 2016 RESOLVE: Cannot resolve host address: nl.vpn.airdns.org: Temporary failure in name resolution
Mon Oct 10 08:08:38 2016 RESOLVE: Cannot resolve host address: nl.vpn.airdns.org: Temporary failure in name resolution

 

[OpenSourcerer 1441]

Mon Oct 10 07:47:45 2016 [server] Inactivity timeout (--ping-restart), restarting
Mon Oct 10 07:47:45 2016 SIGUSR1[soft,ping-restart] received, process restarting
Mon Oct 10 07:47:45 2016 Restart pause, 2 second(s)
Mon Oct 10 07:47:47 2016 Socket Buffers: R=[212992->212992] S=[212992->212992]
Mon Oct 10 07:48:28 2016 RESOLVE: Cannot resolve host address: nl.vpn.airdns.org: Temporary failure in name resolution

This suggests that after the inactivity timeout no reachable DNS server is there to resolve the name. But then again, we don't have the complete logfile. Could you fill the gap, please? Copy logs from line 1 downwards.

[go558a83nk 364]

easiest fix is to resolve nl.vpn.airdns.org and put that in the config.

 

at the time of reconnection your DNS is still AirVPN but the tunnel is down.  Therefore, Air's DNS resolver is unreachable. 

[marching_cow 0]

I also have this problem and do not quite understand how to solve it. Is it possible to configure openvpn to bring tun0 down during reconnect? Otherwise, as I understand, all DNS requests will force into tun0 which is not ready.

[marching_cow 0]

Seems like I solved it by commenting out 'persist-tun' in the config file. Without this option, tun0 is brought down during reconnect and all DNS requests proceed to the underlying internet connection.

[vitaly.dvd 0]

Thank you, 

commenting out 'persist-tun'

resolved similar issue:
 

 

  VPN-connection on Ubuntu 18.04 becomes 'stale' after switching to another network interface when 'persist-tun' is in the client config (created by Config Generator):
 

Dec 16 13:04:29 nuc8i7 ovpn-AirVPN_Europe_UDP-443[3257]: /sbin/ip link set dev tun0 up mtu 1500
Dec 16 13:04:29 nuc8i7 ovpn-AirVPN_Europe_UDP-443[3257]: /sbin/ip addr add dev tun0 10.10.116.159/24 broadcast 10.10.116.255
Dec 16 13:04:34 nuc8i7 ovpn-AirVPN_Europe_UDP-443[3257]: /sbin/ip route add 213.152.161.9/32 via 192.168.2.1
Dec 16 13:04:34 nuc8i7 ovpn-AirVPN_Europe_UDP-443[3257]: /sbin/ip route add 0.0.0.0/1 via 10.10.116.1
Dec 16 13:04:34 nuc8i7 ovpn-AirVPN_Europe_UDP-443[3257]: /sbin/ip route add 128.0.0.0/1 via 10.10.116.1
Dec 16 13:04:34 nuc8i7 ovpn-AirVPN_Europe_UDP-443[3257]: Initialization Sequence Completed      <=== CONNECTED, EVERYTHING IS OK, BUT LET'S TURN OFF WIRED CONNECTION
Dec 16 13:10:06 nuc8i7 ovpn-AirVPN_Europe_UDP-443[3257]: [Atik] Inactivity timeout (--ping-restart), restarting    <=== Inactivity timeout, reconnecting using WIRELESS CONNECTION
Dec 16 13:10:06 nuc8i7 ovpn-AirVPN_Europe_UDP-443[3257]: SIGUSR1[soft,ping-restart] received, process restarting
Dec 16 13:10:06 nuc8i7 ovpn-AirVPN_Europe_UDP-443[3257]: Restart pause, 5 second(s)
Dec 16 13:10:11 nuc8i7 ovpn-AirVPN_Europe_UDP-443[3257]: TCP/UDP: Preserving recently used remote address: [AF_INET]213.152.161.9:443
Dec 16 13:10:11 nuc8i7 ovpn-AirVPN_Europe_UDP-443[3257]: Socket Buffers: R=[212992->212992] S=[212992->212992]
Dec 16 13:10:11 nuc8i7 ovpn-AirVPN_Europe_UDP-443[3257]: UDP link local: (not bound)
Dec 16 13:10:11 nuc8i7 ovpn-AirVPN_Europe_UDP-443[3257]: UDP link remote: [AF_INET]213.152.161.9:443
Dec 16 13:11:11 nuc8i7 ovpn-AirVPN_Europe_UDP-443[3257]: [UNDEF] Inactivity timeout (--ping-restart), restarting
Dec 16 13:11:11 nuc8i7 ovpn-AirVPN_Europe_UDP-443[3257]: SIGUSR1[soft,ping-restart] received, process restarting
Dec 16 13:11:11 nuc8i7 ovpn-AirVPN_Europe_UDP-443[3257]: Restart pause, 5 second(s)
Dec 16 13:11:17 nuc8i7 ovpn-AirVPN_Europe_UDP-443[3257]: TCP/UDP: Preserving recently used remote address: [AF_INET]213.152.161.68:443
Dec 16 13:11:17 nuc8i7 ovpn-AirVPN_Europe_UDP-443[3257]: Socket Buffers: R=[212992->212992] S=[212992->212992]
Dec 16 13:11:17 nuc8i7 ovpn-AirVPN_Europe_UDP-443[3257]: UDP link local: (not bound)
Dec 16 13:11:17 nuc8i7 ovpn-AirVPN_Europe_UDP-443[3257]: UDP link remote: [AF_INET]213.152.161.68:443
Dec 16 13:12:18 nuc8i7 ovpn-AirVPN_Europe_UDP-443[3257]: [UNDEF] Inactivity timeout (--ping-restart), restarting
Dec 16 13:12:18 nuc8i7 ovpn-AirVPN_Europe_UDP-443[3257]: SIGUSR1[soft,ping-restart] received, process restarting
Dec 16 13:12:18 nuc8i7 ovpn-AirVPN_Europe_UDP-443[3257]: Restart pause, 5 second(s)
====>  FOREVER LOOP, ifconfig returns the same tun with the same address, VPN network is not available

 

But everything seems work OK with the option is commented out:

Dec 16 13:19:37 nuc8i7 ovpn-AirVPN_Europe_UDP-443[4094]: /sbin/ip route add 0.0.0.0/1 via 10.16.228.1
Dec 16 13:19:37 nuc8i7 ovpn-AirVPN_Europe_UDP-443[4094]: /sbin/ip route add 128.0.0.0/1 via 10.16.228.1
Dec 16 13:19:37 nuc8i7 ovpn-AirVPN_Europe_UDP-443[4094]: Initialization Sequence Completed  <=== CONNECTED, EVERYTHING IS OK, BUT LET'S TURN OFF INTERFACE
Dec 16 13:21:23 nuc8i7 ovpn-AirVPN_Europe_UDP-443[4094]: [Fomalhaut] Inactivity timeout (--ping-restart), restarting  
Dec 16 13:21:23 nuc8i7 ovpn-AirVPN_Europe_UDP-443[4094]: /sbin/ip route del 185.206.225.50/32
Dec 16 13:21:23 nuc8i7 ovpn-AirVPN_Europe_UDP-443[4094]: ERROR: Linux route delete command failed: external program exited with error status: 2
Dec 16 13:21:23 nuc8i7 ovpn-AirVPN_Europe_UDP-443[4094]: /sbin/ip route del 0.0.0.0/1
Dec 16 13:21:23 nuc8i7 ovpn-AirVPN_Europe_UDP-443[4094]: /sbin/ip route del 128.0.0.0/1
Dec 16 13:21:23 nuc8i7 ovpn-AirVPN_Europe_UDP-443[4094]: Closing TUN/TAP interface                      
Dec 16 13:21:23 nuc8i7 ovpn-AirVPN_Europe_UDP-443[4094]: /sbin/ip addr del dev tun0 10.16.228.15/24
Dec 16 13:21:23 nuc8i7 ovpn-AirVPN_Europe_UDP-443[4094]: SIGUSR1[soft,ping-restart] received, process restarting
Dec 16 13:21:23 nuc8i7 ovpn-AirVPN_Europe_UDP-443[4094]: Restart pause, 5 second(s)      <== CONNECTION IS RESTORING USING ANOTHER NETWORK INTERFACE
Dec 16 13:21:28 nuc8i7 ovpn-AirVPN_Europe_UDP-443[4094]: TCP/UDP: Preserving recently used remote address: [AF_INET]185.206.225.50:443
Dec 16 13:21:28 nuc8i7 ovpn-AirVPN_Europe_UDP-443[4094]: Socket Buffers: R=[212992->212992] S=[212992->212992]
Dec 16 13:21:28 nuc8i7 ovpn-AirVPN_Europe_UDP-443[4094]: UDP link local: (not bound)
Dec 16 13:21:28 nuc8i7 ovpn-AirVPN_Europe_UDP-443[4094]: UDP link remote: [AF_INET]185.206.225.50:443
Dec 16 13:21:28 nuc8i7 ovpn-AirVPN_Europe_UDP-443[4094]: TLS: Initial packet from [AF_INET]185.206.225.50:443, sid=8ae117b3 025005dd
Dec 16 13:21:28 nuc8i7 ovpn-AirVPN_Europe_UDP-443[4094]: VERIFY OK: depth=1, C=IT, ST=IT, L=Perugia, O=airvpn.org, CN=airvpn.org CA, emailAddress=info@airvpn.org
Dec 16 13:21:28 nuc8i7 ovpn-AirVPN_Europe_UDP-443[4094]: VERIFY KU OK
Dec 16 13:21:28 nuc8i7 ovpn-AirVPN_Europe_UDP-443[4094]: Validating certificate extended key usage
...
====> EVERYTHING IS OK, VPN CONNECTION IS RESTORED

 

Is it OK to use AIRVpn configuration without 'persist-tun' ?

[OpenSourcerer 1441]

It's not because your traffic flows unencrypted via your ISP while OpenVPN tries to reconnect.

 

Sent via Tapatalk.

[vitaly.dvd 0]

It's not because your traffic flows unencrypted via your ISP while OpenVPN tries to reconnect.

Thanks for reply!

 

Realized the motivation to keep the option in config: it's some sort of 'kill switch'.

 

My primary use case is to access server behind NAT with AirVPN port forwarding enabled. 

 

It sounds like, there are two (may be) contradictionary requirements:

1) Connection should be restored automatically

2) traffic 'leaks' should be prevented

 

So, In my case the option can be removed. It satisfies the requirement 1, sure, for expense of potential traffic 'leaks'.

 

It there a better solution? 

[OpenSourcerer 1441]

Yes. Dig deeper and get to the root of the problem, because it works for everybody but you at this point. If I get to a computer I will try suggesting a few things. For now, try searching the net a bit.

 

Sent via Tapatalk.