I'm using the Always-on VPN feature of Android to ensure a VPN connection. Whether I'm using OpenVPN or Strongswan as a client I always have connection issues on Android if the network node changes. Either I have to wait for a random time (1min - 30min) until it works by itself or I have to reconnect manually.

Strongswan is worse than OpenVPN because it literally happens every single time the node changes. Sometimes the client even reconnects by itself, as I can see on the elapsed time being reset, but I still have to reconnect manually afterwards to use the network. This is really annoying but I have no idea how to troubleshoot this problem. I tried searching CatLog for VPN entries but I didn't found any warnings or errors.

How could I troubleshoot issues like that?

  • For mobile use with changing IP addresses I would assume that an UDP based VPN system works best as it simplifies the hand-over and should not require to reconnect the VPN. I know that OpenVPN can be configured to use TCP or UDP - check your config. – Robert Mar 20 at 12:00
  • Ok that seems to be the reason why OpenVPN works much better than StrongSwan, the connection on OpenVPN is via UDP. But even OpenVPN with UDP has those issues. – dun Mar 20 at 12:17
  • OpenVPN should always be configured with UDP, except in the following two scenarios: (1) Troubleshooting; or (2) If receiving high packet loss. All OpenVPN packets are TCP and TCP cannot efficiently encapsulate itself, which is why OpenVPN encapsulates the TCP packets within UDP packets (if configured with UDP); If OpenVPN is configured with TCP, a substantial performance hit on throughput occurs. – JW0914 Mar 20 at 12:33
  • strongSwan uses UDP too (IKEv2 and UDP encapsulated ESP). The app should also be able to easily switch from one IP to another (using the MOBIKE protocol). You should really debug what's going on during such a network change (i.e. read the logs). However, it might be a problem with the system image (so information on the device and Android version could help). – ecdsa Mar 20 at 14:22
  • I'm kinda stupid... I didn't check OpenVPN and StrongSwan properly. Both apps provide logs. The cause of my issue with OpenVPN is TLS Error: local/remote TLS keys are out of sync. Now I'm going to see what causes the issue for StrongSwan. – dun Mar 20 at 15:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.