Send `RESTART,[P]:` instead of bare `RESTART` on server-initiated restart/exit
Author: kkalevCreated Aug 31, 2026Updated Aug 31, 2026
Environment
- Debian Trixie
- OpenVPN server version: 2.7.5-1~bpo13+1
- Clients: OpenVPN 2 community (
2.7.2) and OpenVPN Connect 3 (3.11.3) - Plugin: OpenVPN auth oAuth2 plugin version
2.0.1 - Use authentication tokens and persistent HHAC keys (directives
auth-gen-token 86400andauth-gen-token-secret [keyfile]
Description / Problem Statement:
When an OpenVPN server initiates a restart/reset (e.g., via SIGUSR1 or explicit management signals), it currently transmits a bare RESTART control message.
This causes inconsistent behavior across client implementations:
- OpenVPN 2.x (Community): Reuses the active
auth-tokenstored in memory and reconnects transparently. - OpenVPN Connect 3 (OpenVPN 3 Core): Interprets bare
RESTARTas a full session reset, purging ephemeral session tokens. Since the oauth2 plugin is in use, this forces users to re-enter credentials/OTP manually with the SSO server (unless the SSO session is already active) rather than completing a seamless background reconnection.
Proposed Solution / Feature Request:
- Update server restart signal emission to send
RESTART,[P]:by default to preserve pushed authentication tokens across restarts. - Alternatively, provide a configurable server directive to toggle between
RESTARTandRESTART,[P]:/RESTART,[PN]:behavior.
Impact: Aligns session persistence across both OpenVPN 2.x and OpenVPN 3 core engines, preventing unnecessary authentication during graceful server restarts or maintenance.
Source: OpenVPN/openvpn