From: Arne Schwabe References: <53a21cf3f4e04fcf5d6b9798e04be3ce.squirrel@...2257...> <20170404064534.GC93896@...1296...> <6b3b8a029cd8761642ac3f8174238aa2.squirrel@...2260...> <063244418e0b88138db5b490037cb7a4.squirrel@...2257...> <20170405065745.GI93896@...1296...> Message-ID: <85b77b9a-a206-5a73-39fc-bffae999a50c@...1227...> Date: Wed, 5 Apr 2017 18:15:43 +0200 MIME-Version: 1.0 In-Reply-To: Content-Language: en-US Subject: Re: [Openvpn-devel] [PATCH v2] Add per session pseudo-random component to --reneg-sec intervals List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit To: Simon Matter , "openvpn-devel@lists.sourceforge.net" would probably be a good idea to enable that. > As I understand it client and server have 60 min. by default. Whatever is > configured, the smaller value wins. That means, bad clients can set their > reneg-sec to very low values and trash the server on the other end. From > the server side this looks more or less like a DDOS. > > In our environment we have set reneg-sec=0 on all clients because we want > the server to have control over it. That's fine because we have only > trusted clients. Making it pushable could be a solution to overwrite bad > settings in clients. A more radical solution was to just remove the option > on the client side. At its heart OpenVPN is still p2p instead of client of server, (Actually client is p2p mode). So removing a client setting removes it also for p2p. I would also say have a 5% random component by default (makes 3 minutes for the 1h default) but let the user specify it as explicit range when then second (optional) parameter is present. Either reneg-sec 3600 3500 for 3500s-3600s (absolute) or reneg-sec 3600 100 for 3500s-3600s (relative) I think percent based for user inputs are always creating confusion. Arne