[Nexus 5 Q&A, Help & Troubleshooting] bruceau:
Hey guys,

I was just wondering if anyone else has had issues with VPNs on their Nexus 5? I should add that every one of these settings works flawlessly on my Nexus 7. So anyway, here's my situation:

L2TP/IPSec PSK

Works fine for a while but will eventually time out, anywhere from a few minutes to over an hour after connecting (yet still remains "connected" according to the phone - have to reboot to fix it).

L2TP/IPSec PSK "Always-on"

I get "connected" yet no data is transmitted, at all. Could this have something to do with it (can't post links - code dot google dot com/p/android/issues/detail?id=61948)?

OpenVPN (same result with various clients)

Connects fine for a while - anywhere from a few minutes to over an hour, just as with L2TP - but eventually times out. Here is part of a recent log file from when it starts to go wrong (looks like it gets an 'inactivity timeout'). The red text is where the problem begins. Note that the same thing happens even when plugged in & with the 'always-on screen' developer setting enabled so my phone isn't going to sleep.

Running on Nexus 5 (hammerhead) google, Android API 19, version 0.5.46, official build
Building configuration…
started Socket Thread
P:Initializing Google Breakpad!
P:eek:penVPN 2.3.2+dspatch4 android-14-armeabi-v7a [SSL (OpenSSL)] [LZO] [SNAPPY] [EPOLL] [MH] [IPv6] built on Sep 12 2013
P:MANAGEMENT: Connected to management server at /data/data/de.blinkt.openvpn/cache/mgmtsocket
P:MANAGEMENT: CMD 'hold release'
P:MANAGEMENT: CMD 'bytecount 2'
P:MANAGEMENT: CMD 'state on'
Network Status: CONNECTED to WIFI "redacted"
P:MANAGEMENT: CMD 'username 'Auth' redacted'
P:MANAGEMENT: CMD 'password [...]'
P:MANAGEMENT: CMD 'proxy NONE'
P:Deprecated TLS cipher name 'DHE-RSA-AES256-SHA', please use IANA name 'TLS-DHE-RSA-WITH-AES-256-CBC-SHA'
P:Deprecated TLS cipher name 'DHE-DSS-AES256-SHA', please use IANA name 'TLS-DHE-DSS-WITH-AES-256-CBC-SHA'
P:Deprecated TLS cipher name 'AES256-SHA', please use IANA name 'TLS-RSA-WITH-AES-256-CBC-SHA'
P:MANAGEMENT: >STATE:1383797854,RESOLVE,,,
P:Socket Buffers: R=[163840->131072] S=[163840->131072]
P:Protecting socket fd 4
P:MANAGEMENT: CMD 'needok 'PROTECTFD' ok'
P:UDP link local: (not bound)
P:UDP link remote: [AF_INET]173.245.209.2:443
P:MANAGEMENT: >STATE:1383797854,WAIT,,,
P:MANAGEMENT: >STATE:1383797854,AUTH,,,
P:TLS: Initial packet from [AF_INET]173.245.209.2:443, sid=5baec2e6 9c0dfbdd
P:WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
P:VERIFY OK: depth=1, C=US, ST=FL, L=Winter Park, O=IPVanish, OU=IPVanish VPN, CN=IPVanish CA, emailAddress=support@ipvanish.com
P:VERIFY X509NAME OK: C=US, ST=FL, L=Winter Park, O=IPVanish, OU=IPVanish VPN, CN=syd-a01.ipvanish.com, emailAddress=support@ipvanish.com
P:VERIFY OK: depth=0, C=US, ST=FL, L=Winter Park, O=IPVanish, OU=IPVanish VPN, CN=syd-a01.ipvanish.com, emailAddress=support@ipvanish.com
P:Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
P:Data Channel Encrypt: Using 256 bit message hash 'SHA256' for HMAC authentication
P:Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
P:Data Channel Decrypt: Using 256 bit message hash 'SHA256' for HMAC authentication
P:Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
P:[syd-a01.ipvanish.com] Peer Connection Initiated with [AF_INET]173.245.209.2:443
P:MANAGEMENT: >STATE:1383797857,GET_CONFIG,,,
P:SENT CONTROL [syd-a01.ipvanish.com]: 'PUSH_REQUEST' (status=1)
P:PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 198.18.0.1,dhcp-option DNS 198.18.0.2,rcvbuf 262144,explicit-exit-notify 5,route-gateway 172.20.32.1,topology subnet,ping 20,ping-restart 40,ifconfig 172.20.32.206 255.255.248.0'
P:eek:PTIONS IMPORT: timers and/or timeouts modified
P:eek:PTIONS IMPORT: explicit notify parm(s) modified
P:eek:PTIONS IMPORT: --sndbuf/--rcvbuf options modified
P:Socket Buffers: R=[131072->524288] S=[131072->131072]
P:eek:PTIONS IMPORT: --ifconfig/up options modified
P:eek:PTIONS IMPORT: route options modified
P:eek:PTIONS IMPORT: route-related options modified
P:eek:PTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
P:ROUTE_GATEWAY 192.168.0.1/255.255.255.0 IFACE=wlan0 HWADDR=bc:f5:ac:f2:a5:c2
P:ROUTE6: default_gateway=UNDEF
P:eek:penVPN ROUTE6: OpenVPN needs a gateway parameter for a --route-ipv6 option and no default was specified by either --route-ipv6-gateway or --ifconfig-ipv6 options
P:eek:penVPN ROUTE: failed to parse/resolve route for host/network: ::/0
P:do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
P:MANAGEMENT: >STATE:1383797858,ASSIGN_IP,,172.20.32.206,
P:MANAGEMENT: CMD 'needok 'IFCONFIG' ok'
P:MANAGEMENT: CMD 'needok 'ROUTE' ok'
P:MANAGEMENT: CMD 'needok 'ROUTE' ok'
P:MANAGEMENT: CMD 'needok 'ROUTE' ok'
P:MANAGEMENT: >STATE:1383797858,ADD_ROUTES,,,
P:MANAGEMENT: CMD 'needok 'ROUTE' ok'
P:MANAGEMENT: CMD 'needok 'DNSSERVER' ok'
P:MANAGEMENT: CMD 'needok 'DNSSERVER' ok'
Opening tun interface:
Local IPv4: 172.20.32.206/21 IPv6: null MTU: 1500
DNS Server: 198.18.0.1, 198.18.0.2, Domain: null
Routes: 173.245.209.2/32, 0.0.0.0/1, 128.0.0.0/1, 0.0.0.0/0
Routes IPv6:
P:MANAGEMENT: CMD 'needok 'OPENTUN' ok'
P:Initialization Sequence Completed
P:MANAGEMENT: >STATE:1383797859,CONNECTED,SUCCESS,172.20.32.206,173.245.209.2
[COLOR="Red"]P:[syd-a01.ipvanish.com] Inactivity timeout (--ping-restart), restarting[/COLOR]
P:SIGUSR1[soft,ping-restart] received, process restarting
P:MANAGEMENT: >STATE:1383799065,RECONNECTING,ping-restart,,
P:MANAGEMENT: CMD 'hold release'
P:MANAGEMENT: CMD 'bytecount 2'
P:MANAGEMENT: CMD 'state on'
P:MANAGEMENT: CMD 'proxy NONE'
P:Deprecated TLS cipher name 'DHE-RSA-AES256-SHA', please use IANA name 'TLS-DHE-RSA-WITH-AES-256-CBC-SHA'
P:Deprecated TLS cipher name 'DHE-DSS-AES256-SHA', please use IANA name 'TLS-DHE-DSS-WITH-AES-256-CBC-SHA'
P:Deprecated TLS cipher name 'AES256-SHA', please use IANA name 'TLS-RSA-WITH-AES-256-CBC-SHA'
P:TCP/UDP: Preserving recently used remote address: [AF_INET]173.245.209.2:443
P:Socket Buffers: R=[163840->524288] S=[163840->131072]
P:Protecting socket fd 4
P:MANAGEMENT: CMD 'needok 'PROTECTFD' ok'
P:UDP link local: (not bound)
P:UDP link remote: [AF_INET]173.245.209.2:443
P:MANAGEMENT: >STATE:1383799081,WAIT,,,
P:[UNDEF] Inactivity timeout (--ping-restart), restarting
P:SIGUSR1[soft,ping-restart] received, process restarting
P:MANAGEMENT: >STATE:1383799152,RECONNECTING,ping-restart,,
P:MANAGEMENT: CMD 'hold release'
P:MANAGEMENT: CMD 'bytecount 2'
P:MANAGEMENT: CMD 'state on'
P:MANAGEMENT: CMD 'proxy NONE'
P:Deprecated TLS cipher name 'DHE-RSA-AES256-SHA', please use IANA name 'TLS-DHE-RSA-WITH-AES-256-CBC-SHA'
P:Deprecated TLS cipher name 'DHE-DSS-AES256-SHA', please use IANA name 'TLS-DHE-DSS-WITH-AES-256-CBC-SHA'
P:Deprecated TLS cipher name 'AES256-SHA', please use IANA name 'TLS-RSA-WITH-AES-256-CBC-SHA'
P:TCP/UDP: Preserving recently used remote address: [AF_INET]173.245.209.2:443
P:Socket Buffers: R=[163840->524288] S=[163840->131072]
P:Protecting socket fd 4
P:MANAGEMENT: CMD 'needok 'PROTECTFD' ok'
P:UDP link local: (not bound)
P:UDP link remote: [AF_INET]173.245.209.2:443
P:MANAGEMENT: >STATE:1383799153,WAIT,,,
P:[UNDEF] Inactivity timeout (--ping-restart), restarting
P:SIGUSR1[soft,ping-restart] received, process restarting
P:MANAGEMENT: >STATE:1383799213,RECONNECTING,ping-restart,,
P:MANAGEMENT: CMD 'hold release'
P:MANAGEMENT: CMD 'bytecount 2'
P:MANAGEMENT: CMD 'state on'
P:MANAGEMENT: CMD 'proxy NONE'
P:Deprecated TLS cipher name 'DHE-RSA-AES256-SHA', please use IANA name 'TLS-DHE-RSA-WITH-AES-256-CBC-SHA'
P:Deprecated TLS cipher name 'DHE-DSS-AES256-SHA', please use IANA name 'TLS-DHE-DSS-WITH-AES-256-CBC-SHA'
P:Deprecated TLS cipher name 'AES256-SHA', please use IANA name 'TLS-RSA-WITH-AES-256-CBC-SHA'
P:TCP/UDP: Preserving recently used remote address: [AF_INET]173.245.209.2:443
P:Socket Buffers: R=[163840->524288] S=[163840->131072]
P:Protecting socket fd 4
P:MANAGEMENT: CMD 'needok 'PROTECTFD' ok'
P:UDP link local: (not bound)
P:UDP link remote: [AF_INET]173.245.209.2:443
P:MANAGEMENT: >STATE:1383799214,WAIT,,,
P:MANAGEMENT: >STATE:1383799230,AUTH,,,
P:TLS: Initial packet from [AF_INET]173.245.209.2:443, sid=a3743100 cabdef57
P:VERIFY OK: depth=1, C=US, ST=FL, L=Winter Park, O=IPVanish, OU=IPVanish VPN, CN=IPVanish CA, emailAddress=support@ipvanish.com
P:VERIFY X509NAME OK: C=US, ST=FL, L=Winter Park, O=IPVanish, OU=IPVanish VPN, CN=syd-a01.ipvanish.com, emailAddress=support@ipvanish.com
P:VERIFY OK: depth=0, C=US, ST=FL, L=Winter Park, O=IPVanish, OU=IPVanish VPN, CN=syd-a01.ipvanish.com, emailAddress=support@ipvanish.com
P:Data Channel Encrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
P:Data Channel Encrypt: Using 256 bit message hash 'SHA256' for HMAC authentication
P:Data Channel Decrypt: Cipher 'AES-256-CBC' initialized with 256 bit key
P:Data Channel Decrypt: Using 256 bit message hash 'SHA256' for HMAC authentication
P:Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
P:[syd-a01.ipvanish.com] Peer Connection Initiated with [AF_INET]173.245.209.2:443
P:MANAGEMENT: >STATE:1383799243,GET_CONFIG,,,
P:SENT CONTROL [syd-a01.ipvanish.com]: 'PUSH_REQUEST' (status=1)
P:PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 198.18.0.1,dhcp-option DNS 198.18.0.2,rcvbuf 262144,explicit-exit-notify 5,route-gateway 172.20.32.1,topology subnet,ping 20,ping-restart 40,ifconfig 172.20.32.206 255.255.248.0'
P:eek:PTIONS IMPORT: timers and/or timeouts modified
P:eek:PTIONS IMPORT: explicit notify parm(s) modified
P:eek:PTIONS IMPORT: --sndbuf/--rcvbuf options modified
P:Socket Buffers: R=[524288->524288] S=[131072->131072]
P:eek:PTIONS IMPORT: --ifconfig/up options modified
P:eek:PTIONS IMPORT: route options modified
P:eek:PTIONS IMPORT: route-related options modified
P:eek:PTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
P:ROUTE_GATEWAY 192.168.0.1/255.255.255.0 IFACE=wlan0 HWADDR=bc:f5:ac:f2:a5:c2
P:ROUTE6: default_gateway=UNDEF
P:eek:penVPN ROUTE6: OpenVPN needs a gateway parameter for a --route-ipv6 option and no default was specified by either --route-ipv6-gateway or --ifconfig-ipv6 options
P:eek:penVPN ROUTE: failed to parse/resolve route for host/network: ::/0
P:do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
P:MANAGEMENT: >STATE:1383799244,ASSIGN_IP,,172.20.32.206,
P:MANAGEMENT: CMD 'needok 'IFCONFIG' ok'
P:MANAGEMENT: CMD 'needok 'ROUTE' ok'
P:MANAGEMENT: CMD 'needok 'ROUTE' ok'
P:MANAGEMENT: CMD 'needok 'ROUTE' ok'
P:MANAGEMENT: >STATE:1383799244,ADD_ROUTES,,,
P:MANAGEMENT: CMD 'needok 'ROUTE' ok'
P:MANAGEMENT: CMD 'needok 'DNSSERVER' ok'
P:MANAGEMENT: CMD 'needok 'DNSSERVER' ok'
Opening tun interface:
Local IPv4: 172.20.32.206/21 IPv6: null MTU: 1500
DNS Server: 198.18.0.1, 198.18.0.2, Domain: null
Routes: 173.245.209.2/32, 0.0.0.0/1, 128.0.0.0/1, 0.0.0.0/0
Routes IPv6:
Failed to open the tun interface
Error: command '86 interface fwmark uid add tun1 0 99999' failed with '400 86 Failed to add uid rule (Invalid argument)'
On some custom ICS images the permission on /dev/tun might be wrong, or the tun module might be missing completely. For CM9 images try the fix ownership option under general settings
P:MANAGEMENT: CMD 'needok 'OPENTUN' cancel'
P:MANAGEMENT: Client disconnected
P:ERROR: Cannot open TUN
P:Exiting due to fatal error
P:Sorry, deleting routes on Android is not possible. The VpnService API allows routes to be set on connect only.
P:Sorry, deleting routes on Android is not possible. The VpnService API allows routes to be set on connect only.
P:Sorry, deleting routes on Android is not possible. The VpnService API allows routes to be set on connect only.
P:Closing TUN/TAP interface
MGMT:Got unrecognized command>FATAL:ERROR: Cannot open TUN
Process exited with exit value 1

Any help would be greatly appreciated. Cheers.