OpenVPN keeps disconnecting

Common symptoms and what they mean

• Frequent disconnects with short reconnects: often network jitter, aggressive keep-alive settings, or server-side timeouts.
• Disconnects only on certain networks: may indicate NAT, firewall, or ISP-related drops.
• Reconnects after a few minutes: could be session expiry, certificate rotation, or idle timeout settings.
• Connected but with intermittent DNS or routing failures: may point to DNS leaks, wrong routes, or firewall interference.

Start with the basics: network stability

Before diving into VPN-specific settings, verify your underlying connection:

• Wired vs wireless: wireless connections are more prone to drops. Test with a wired Ethernet link.
• Consistent latency: run a continuous ping to a stable host (e.g., 8.8.8.8) for several minutes to observe packet loss or spikes.
• Local network devices: reboot modem and router to clear transient issues.
• Other devices: check if other devices on the same network experience VPN issues.

If your base connection is unstable, OpenVPN will have a hard time maintaining a tunnel, regardless of configuration tweaks.

Check keep-alive and timeout settings

OpenVPN relies on keep-alive messages to detect a dead tunnel. Mismatched or overly aggressive settings can cause drops.

• Keep Alive Interval (server/client): how often the server and client exchange keep-alive pings.
• Keep Alive Timeout: how long to wait before deeming the connection dead after missing a ping.

What to review and adjust:

• Ensure the client and server agree on keep-alive intervals. Common ranges:
• Interval around 10-15 seconds
• Timeout around 60 seconds
• If you experience frequent disconnects, raise the timeout slightly (e.g., keep-alive timeout 120 seconds) and observe stability.
• For mobile clients or flaky networks, a longer interval with a longer timeout can reduce false disconnects.

Note: Some environments (e.g., OpenVPN GUI on Windows, certain router firmware) expose these as separate fields. In config files, they may appear as: Nordpass extension not working

• tls-auth or tls-auth file handling is separate. Not a keep-alive directly but can influence disconnections if misconfigured.
• ping, ping-restart, and ping-timer-rem are alternate mechanisms used in older/OpenVPN configurations.

Inspect server and client configuration for timers and retries

Configuration issues that commonly cause disconnect/reconnect cycles:

• ping and ping-restart: if ping fails beyond the restart threshold, the client restarts the tunnel.
• Explicit timeouts: session or data channel timeouts on either side can drop a tunnel if data ceases to flow for a period.
• Status/management interfaces: misconfigured status files or management interfaces can confuse the client about the session state.
• Protocol and port mismatches: UDP vs TCP in the wrong context can lead to aggressive re-transmits and perceived disconnects.

What to do:

• Compare client and server ping and ping-restart values. Align them or increase them modestly.
• If using a firewall, allow OpenVPN traffic (commonly UDP/1194 or your chosen port), and ensure 양 NAT translations are stable.
• Check for duplicate routes or split-tunnel misconfigurations that could cause the client to drop the tunnel under certain routes.

Certificates, keys, and authentication

OpenVPN relies on proper TLS handshakes and certificate validity. Drops can occur if the TLS session cannot be renegotiated cleanly or if the server rejects a reconnect due to certificate or token issues.

• Ensure certificates are valid and not expired.
• If using TLS-auth or TLS-crypt, confirm the shared key is identical on both sides.
• For OpenVPN Access Server and some managed appliances, reissue or rotate auth tokens as recommended by the platform.
• If you upgraded server software, re-export and reinstall client certificates if the old chain no longer matches.

Special cases:

• auth-gen-token or dynamic-token methods: some discussions point to needing an updated token or relying on auth-gen-token in advanced server options. If your server environment uses such methods, verify token generation and refresh behavior according to your platform (e.g., pfSense/OpenVPN Server with certain auth plugins).

Logs and diagnostics: how to pinpoint the problem

Logs are your best friend when diagnosing disconnects. Collect them from both client and server sides.

What to collect:

• Client logs: connection start, TLS handshake messages, ping intervals, any error codes.
• Server logs: TLS handshake success/failure, auth events, and any disconnections due to timeouts.
• System logs: if the VPN tunnel is dropped by the OS, check the system event log.

What to look for:

• Recurrent TLS handshake failures or certificate errors.
• Repeated ping-restart messages without a clear network outage.
• Messages indicating “AUTH failed,” “TLS handshake timeout,” or “ACK timeout.”

Practical fixes and adjustment checklist

• Start with a controlled environment: test with a stable network, one client, and minimal conflicting software.
• Align keep-alive settings: set a modest keep-alive interval (e.g., 15 seconds) and a longer timeout (e.g., 60-120 seconds). Adjust based on observed stability.
• Verify DNS handling: ensure DNS resolution over VPN works and doesn’t cause delays that appear as disconnects.
• Review firewall/NAT behavior: enable NAT-T if using behind NAT, and ensure UDP ports are open. If you’re on a consumer router, disable any aggressive DPI or security features that could intermittently interrupt VPN traffic.
• Update and patch: ensure both server and client applications are up to date. Some disconnect issues are resolved by bug fixes in newer releases.
• Consider a different transport mode: if you’re using UDP and have persistent drops, test with TCP to see if reliability improves (note: TCP can add overhead and latency, and is not recommended for pure VPN performance, but it helps diagnose network issues).
• Test with a different server/location: if the disconnects only occur when connected to a specific server, the issue might be server-side load, routing, or certificate distribution.
• If on pfSense/OPNsense: check advanced options such as “auth-gen-token” or token-based authentication settings, and review any recent changes in the OpenVPN server configuration that coincide with the issue.

Comparison at a glance: which factor is most often to blame

Example scenarios and how to approach them

• Scenario A: OpenVPN disconnects every minute on a home wireless network Asus VPN fusion not working

• Likely cause: keep-alive timeout too aggressive or wireless instability.

• Action: increase ping-restart timeout, test with a wired connection, and ensure router firmware is current.

• Scenario B: OpenVPN connects briefly, then drops on a mobile network

• Likely cause: mobile networks can change IPs and impose NAT timeouts.

• Action: enable longer keep-alive intervals, consider using a TCP fallback for unreliable mobile networks, and ensure the client uses a stable VPN profile. Android auto not working with VPN

• Scenario C: OpenVPN sputters for 3–5 minutes after startup, then stays up

• Likely cause: token or certificate validation hiccup or server-side rate limiting.

• Action: validate token generation, confirm server certificate chain, and check server logs for authentication-related errors.

Final recommendation

If you’re dealing with an OpenVPN keeps disconnecting issue, approach it in a structured way: verify basic network stability first, then tune keep-alive and timeout settings, verify server and client certificates and authentication configuration, and inspect logs for concrete error codes. In many cases the culprit is a mismatch or overly aggressive timers that misclassify a healthy lull in traffic as a dropped connection. Start with small, incremental changes and test each adjustment to isolate the root cause. If the problem persists after these steps, share your logs with the community or vendor support, as the issue may be specific to your OpenVPN version, platform, or hardware.