Egregoros

For some reason, I can't seem to ssh into the Ubuntu system. It just hangs. Never experienced this before.

@lattera where do you get to with a -v?

There is a bit of an MTU smell here, especially as you seem to be crossing a tun interface but then your client is sending 1460 MSS. But, then again, the far end is advertising a smaller 1400 MSS.

The far end never ACKs your larger 1388-length segment, though: it only ever ACKs up to seq 23 (relative).

@hugo CC'ing a couple others who replied:

@rowens @acirep

@hugo @rowens @acirep sorry, I should've mentioned 10.8.0.1 is the HardenedBSD system running the OpenVPN server and 10.8.0.2 is the Ubuntu client system.

@lattera I'm assuming you don't have access to the remote side by other means for a capture there, yea?

The debug output somewhat reinforces the MTU black hole smell here. You can get the banner (small payload), but things stall on larger payload (key exchange).

What's your MTU config on both ends for the openvpn tun interface?

@hugo holy cow! you were right about the MTU config! I left both sides as the default of 1500. I just adjusted both sides to 1200 and it's working!

thank you so much for that hint!

@lattera @hugo SSH hanging here or immediately after the shell is almost always MTU. Once you hit it you'll never forget about it