Client Launchers and Split Tunnel VPN

ryanjmclaughlin · October 6, 2020, 11:55pm

IT is working on configuring split tunnel vpn access to help speed things up. I have always been on full tunnel with Ignition (ALL network traffic is routed over VPN), but when trying out the split tunnel (only needed LAN routes go over VPN) I can’t use designer or vision clients. The launcher hangs just as if the gateway is unreachable. Fun part is, I can still access the Gateway and Perspective in a browser, so it is something specific with the launchers/Java 11 can’t map the right network route. Anyone else have similar issues or know any workarounds?

ryanjmclaughlin · October 19, 2020, 11:51pm

PGriffith · October 20, 2020, 12:24am

It’s specifically the launchers? If you run the same command they’re trying to execute in a terminal (to try to launch a client/designer directly), does it give you any informative error?

ryanjmclaughlin · October 20, 2020, 12:56am

Yes, only with the launchers. Perspective/Gateway Web works fine in Chrome.

Forgot to test the raw command line… some interesting results. The first is with the split tunnel VPN enabled. Getting a socket receive failure. The second is with no VPN whatsoever (no route to server). Getting the expected no route failure.

C:\Users\rmclaughlin>"C:\Users\rmclaughlin\.ignition\cache\resources\runtimes\11.0.7\bin\java.exe" -classpath "C:\ProgramData\Ignition Designer Launcher\.\clientlauncher-data\launchclient.jar" -Djavaws.sr.gateway.addr.0=https://myignitionhostname:443 -Djavaws.sr.launchts=1603154808066 -Djavaws.sr.main=com.inductiveautomation.ignition.designer.DesignerStartupHook -Djavaws.sr.platform.edition= -Djavaws.sr.platform.plugins= -Djavaws.ignition.sso=true -Xms64M -Xmx2048M -Djavaws.sr.memory.init=64M -Djavaws.sr.memory.max=2048M -Dsun.java2d.d3d=false -Dsun.java2d.noddraw=false -Djavaws.sr.screen=0 -Djavaws.sr.scope=D com.inductiveautomation.ignition.client.launch.BootstrapSwing
Starting Bootstrap Loader v3.0
sun.awt.image.PNGImageDecoder$PNGException: crc corruption
        at java.desktop/sun.awt.image.PNGImageDecoder.getChunk(Unknown Source)
        at java.desktop/sun.awt.image.PNGImageDecoder.getData(Unknown Source)
        at java.desktop/sun.awt.image.PNGImageDecoder.produceImage(Unknown Source)
        at java.desktop/sun.awt.image.InputStreamImageSource.doFetch(Unknown Source)
        at java.desktop/sun.awt.image.ImageFetcher.fetchloop(Unknown Source)
        at java.desktop/sun.awt.image.ImageFetcher.run(Unknown Source)
Connect Step [attempt 1] connecting to: https://myignitionhostname:443...
Downloading manifest at https://myignitionhostname:443/system/launchmf/D?os=windows&arch=x64
Connect attempt 1 for address https://myignitionhostname:443 failed.
javax.net.ssl.SSLException: Software caused connection abort: recv failed
        at java.base/sun.security.ssl.Alert.createSSLException(Unknown Source)
        at java.base/sun.security.ssl.TransportContext.fatal(Unknown Source)
        at java.base/sun.security.ssl.TransportContext.fatal(Unknown Source)
        at java.base/sun.security.ssl.TransportContext.fatal(Unknown Source)
        at java.base/sun.security.ssl.SSLTransport.decode(Unknown Source)
        at java.base/sun.security.ssl.SSLSocketImpl.decode(Unknown Source)
        at java.base/sun.security.ssl.SSLSocketImpl.readHandshakeRecord(Unknown Source)
        at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
        at java.base/sun.net.www.protocol.https.HttpsClient.afterConnect(Unknown Source)
        at java.base/sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(Unknown Source)
        at java.base/sun.net.www.protocol.https.HttpsURLConnectionImpl.connect(Unknown Source)
        at com.inductiveautomation.ignition.client.launch.steps.ConnectStep.downloadManifest(ConnectStep.java:162)
        at com.inductiveautomation.ignition.client.launch.steps.ConnectStep.downloadManifest(ConnectStep.java:104)
        at com.inductiveautomation.ignition.client.launch.steps.ConnectStep.run(ConnectStep.java:50)
        at com.inductiveautomation.ignition.client.launch.AbstractStepRunner.run(AbstractStepRunner.java:33)
        at java.base/java.lang.Thread.run(Unknown Source)
        Suppressed: java.net.SocketException: Software caused connection abort: socket write error
                at java.base/java.net.SocketOutputStream.socketWrite0(Native Method)
                at java.base/java.net.SocketOutputStream.socketWrite(Unknown Source)
                at java.base/java.net.SocketOutputStream.write(Unknown Source)
                at java.base/sun.security.ssl.SSLSocketOutputRecord.encodeAlert(Unknown Source)
                ... 15 more
Caused by: java.net.SocketException: Software caused connection abort: recv failed
        at java.base/java.net.SocketInputStream.socketRead0(Native Method)
        at java.base/java.net.SocketInputStream.socketRead(Unknown Source)
        at java.base/java.net.SocketInputStream.read(Unknown Source)
        at java.base/java.net.SocketInputStream.read(Unknown Source)
        at java.base/sun.security.ssl.SSLSocketInputRecord.read(Unknown Source)
        at java.base/sun.security.ssl.SSLSocketInputRecord.readHeader(Unknown Source)
        at java.base/sun.security.ssl.SSLSocketInputRecord.decode(Unknown Source)
        ... 12 more
javax.net.ssl.SSLException: Software caused connection abort: recv failed
        at java.base/sun.security.ssl.Alert.createSSLException(Unknown Source)
        at java.base/sun.security.ssl.TransportContext.fatal(Unknown Source)
        at java.base/sun.security.ssl.TransportContext.fatal(Unknown Source)
        at java.base/sun.security.ssl.TransportContext.fatal(Unknown Source)
        at java.base/sun.security.ssl.SSLTransport.decode(Unknown Source)
        at java.base/sun.security.ssl.SSLSocketImpl.decode(Unknown Source)
        at java.base/sun.security.ssl.SSLSocketImpl.readHandshakeRecord(Unknown Source)
        at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
        at java.base/sun.net.www.protocol.https.HttpsClient.afterConnect(Unknown Source)
        at java.base/sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(Unknown Source)
        at java.base/sun.net.www.protocol.https.HttpsURLConnectionImpl.connect(Unknown Source)
        at com.inductiveautomation.ignition.client.launch.steps.ConnectStep.downloadManifest(ConnectStep.java:162)
        at com.inductiveautomation.ignition.client.launch.steps.ConnectStep.downloadManifest(ConnectStep.java:104)
        at com.inductiveautomation.ignition.client.launch.steps.ConnectStep.run(ConnectStep.java:50)
        at com.inductiveautomation.ignition.client.launch.AbstractStepRunner.run(AbstractStepRunner.java:33)
        at java.base/java.lang.Thread.run(Unknown Source)
        Suppressed: java.net.SocketException: Software caused connection abort: socket write error
                at java.base/java.net.SocketOutputStream.socketWrite0(Native Method)
                at java.base/java.net.SocketOutputStream.socketWrite(Unknown Source)
                at java.base/java.net.SocketOutputStream.write(Unknown Source)
                at java.base/sun.security.ssl.SSLSocketOutputRecord.encodeAlert(Unknown Source)
                ... 15 more
Caused by: java.net.SocketException: Software caused connection abort: recv failed
        at java.base/java.net.SocketInputStream.socketRead0(Native Method)
        at java.base/java.net.SocketInputStream.socketRead(Unknown Source)
        at java.base/java.net.SocketInputStream.read(Unknown Source)
        at java.base/java.net.SocketInputStream.read(Unknown Source)
        at java.base/sun.security.ssl.SSLSocketInputRecord.read(Unknown Source)
        at java.base/sun.security.ssl.SSLSocketInputRecord.readHeader(Unknown Source)
        at java.base/sun.security.ssl.SSLSocketInputRecord.decode(Unknown Source)
        ... 12 more

C:\Users\rmclaughlin>"C:\Users\rmclaughlin\.ignition\cache\resources\runtimes\11.0.7\bin\java.exe" -classpath "C:\ProgramData\Ignition Designer Launcher\.\clientlauncher-data\launchclient.jar" -Djavaws.sr.gateway.addr.0=https://myignitionhostname:443 -Djavaws.sr.launchts=1603154808066 -Djavaws.sr.main=com.inductiveautomation.ignition.designer.DesignerStartupHook -Djavaws.sr.platform.edition= -Djavaws.sr.platform.plugins= -Djavaws.ignition.sso=true -Xms64M -Xmx2048M -Djavaws.sr.memory.init=64M -Djavaws.sr.memory.max=2048M -Dsun.java2d.d3d=false -Dsun.java2d.noddraw=false -Djavaws.sr.screen=0 -Djavaws.sr.scope=D com.inductiveautomation.ignition.client.launch.BootstrapSwing
Starting Bootstrap Loader v3.0
sun.awt.image.PNGImageDecoder$PNGException: crc corruption
        at java.desktop/sun.awt.image.PNGImageDecoder.getChunk(Unknown Source)
        at java.desktop/sun.awt.image.PNGImageDecoder.getData(Unknown Source)
        at java.desktop/sun.awt.image.PNGImageDecoder.produceImage(Unknown Source)
        at java.desktop/sun.awt.image.InputStreamImageSource.doFetch(Unknown Source)
        at java.desktop/sun.awt.image.ImageFetcher.fetchloop(Unknown Source)
        at java.desktop/sun.awt.image.ImageFetcher.run(Unknown Source)
sun.awt.image.PNGImageDecoder$PNGException: crc corruption
        at java.desktop/sun.awt.image.PNGImageDecoder.getChunk(Unknown Source)
        at java.desktop/sun.awt.image.PNGImageDecoder.getData(Unknown Source)
        at java.desktop/sun.awt.image.PNGImageDecoder.produceImage(Unknown Source)
        at java.desktop/sun.awt.image.InputStreamImageSource.doFetch(Unknown Source)
        at java.desktop/sun.awt.image.ImageFetcher.fetchloop(Unknown Source)
        at java.desktop/sun.awt.image.ImageFetcher.run(Unknown Source)
Connect Step [attempt 1] connecting to: https://myignitionhostname:443...
Downloading manifest at https://myignitionhostname:443/system/launchmf/D?os=windows&arch=x64
Connect attempt 1 for address https://myignitionhostname:443 failed.
java.net.UnknownHostException: myignitionhostname
        at java.base/java.net.AbstractPlainSocketImpl.connect(Unknown Source)
        at java.base/java.net.SocksSocketImpl.connect(Unknown Source)
        at java.base/java.net.Socket.connect(Unknown Source)
        at java.base/sun.security.ssl.SSLSocketImpl.connect(Unknown Source)
        at java.base/sun.net.NetworkClient.doConnect(Unknown Source)
        at java.base/sun.net.www.http.HttpClient.openServer(Unknown Source)
        at java.base/sun.net.www.http.HttpClient.openServer(Unknown Source)
        at java.base/sun.net.www.protocol.https.HttpsClient.<init>(Unknown Source)
        at java.base/sun.net.www.protocol.https.HttpsClient.New(Unknown Source)
        at java.base/sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.getNewHttpClient(Unknown Source)
        at java.base/sun.net.www.protocol.http.HttpURLConnection.plainConnect0(Unknown Source)
        at java.base/sun.net.www.protocol.http.HttpURLConnection.plainConnect(Unknown Source)
        at java.base/sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(Unknown Source)
        at java.base/sun.net.www.protocol.https.HttpsURLConnectionImpl.connect(Unknown Source)
        at com.inductiveautomation.ignition.client.launch.steps.ConnectStep.downloadManifest(ConnectStep.java:162)
        at com.inductiveautomation.ignition.client.launch.steps.ConnectStep.downloadManifest(ConnectStep.java:104)
        at com.inductiveautomation.ignition.client.launch.steps.ConnectStep.run(ConnectStep.java:50)
        at com.inductiveautomation.ignition.client.launch.AbstractStepRunner.run(AbstractStepRunner.java:33)
        at java.base/java.lang.Thread.run(Unknown Source)
java.net.UnknownHostException: myignitionhostname
        at java.base/java.net.AbstractPlainSocketImpl.connect(Unknown Source)
        at java.base/java.net.SocksSocketImpl.connect(Unknown Source)
        at java.base/java.net.Socket.connect(Unknown Source)
        at java.base/sun.security.ssl.SSLSocketImpl.connect(Unknown Source)
        at java.base/sun.net.NetworkClient.doConnect(Unknown Source)
        at java.base/sun.net.www.http.HttpClient.openServer(Unknown Source)
        at java.base/sun.net.www.http.HttpClient.openServer(Unknown Source)
        at java.base/sun.net.www.protocol.https.HttpsClient.<init>(Unknown Source)
        at java.base/sun.net.www.protocol.https.HttpsClient.New(Unknown Source)
        at java.base/sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.getNewHttpClient(Unknown Source)
        at java.base/sun.net.www.protocol.http.HttpURLConnection.plainConnect0(Unknown Source)
        at java.base/sun.net.www.protocol.http.HttpURLConnection.plainConnect(Unknown Source)
        at java.base/sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(Unknown Source)
        at java.base/sun.net.www.protocol.https.HttpsURLConnectionImpl.connect(Unknown Source)
        at com.inductiveautomation.ignition.client.launch.steps.ConnectStep.downloadManifest(ConnectStep.java:162)
        at com.inductiveautomation.ignition.client.launch.steps.ConnectStep.downloadManifest(ConnectStep.java:104)
        at com.inductiveautomation.ignition.client.launch.steps.ConnectStep.run(ConnectStep.java:50)
        at com.inductiveautomation.ignition.client.launch.AbstractStepRunner.run(AbstractStepRunner.java:33)
        at java.base/java.lang.Thread.run(Unknown Source)

C:\Users\rmclaughlin>

ryanjmclaughlin · October 20, 2020, 1:09am

Here is the error for non-SSL (stacktrace seems to be failing at similar position)

C:\Users\rmclaughlin>"C:\Users\rmclaughlin\.ignition\cache\resources\runtimes\11.0.7\bin\java.exe" -classpath "C:\ProgramData\Ignition Designer Launcher\.\clientlauncher-data\launchclient.jar" -Djavaws.sr.gateway.addr.0=http://myignitionhostname:80 -Djavaws.sr.launchts=1603154808066 -Djavaws.sr.main=com.inductiveautomation.ignition.designer.DesignerStartupHook -Djavaws.sr.platform.edition= -Djavaws.sr.platform.plugins= -Djavaws.ignition.sso=true -Xms64M -Xmx2048M -Djavaws.sr.memory.init=64M -Djavaws.sr.memory.max=2048M -Dsun.java2d.d3d=false -Dsun.java2d.noddraw=false -Djavaws.sr.screen=0 -Djavaws.sr.scope=D com.inductiveautomation.ignition.client.launch.BootstrapSwing
Starting Bootstrap Loader v3.0
sun.awt.image.PNGImageDecoder$PNGException: crc corruption
        at java.desktop/sun.awt.image.PNGImageDecoder.getChunk(Unknown Source)
        at java.desktop/sun.awt.image.PNGImageDecoder.getData(Unknown Source)
        at java.desktop/sun.awt.image.PNGImageDecoder.produceImage(Unknown Source)
        at java.desktop/sun.awt.image.InputStreamImageSource.doFetch(Unknown Source)
        at java.desktop/sun.awt.image.ImageFetcher.fetchloop(Unknown Source)
        at java.desktop/sun.awt.image.ImageFetcher.run(Unknown Source)
Connect Step [attempt 1] connecting to: http://myignitionhostname:80...
Downloading manifest at http://myignitionhostname:80/system/launchmf/D?os=windows&arch=x64
Connect attempt 1 for address http://myignitionhostname:80 failed.
java.net.SocketException: Connection reset
        at java.base/java.net.SocketInputStream.read(Unknown Source)
        at java.base/java.net.SocketInputStream.read(Unknown Source)
        at java.base/java.io.BufferedInputStream.fill(Unknown Source)
        at java.base/java.io.BufferedInputStream.read1(Unknown Source)
        at java.base/java.io.BufferedInputStream.read(Unknown Source)
        at java.base/sun.net.www.http.HttpClient.parseHTTPHeader(Unknown Source)
        at java.base/sun.net.www.http.HttpClient.parseHTTP(Unknown Source)
        at java.base/sun.net.www.http.HttpClient.parseHTTP(Unknown Source)
        at java.base/sun.net.www.protocol.http.HttpURLConnection.getInputStream0(Unknown Source)
        at java.base/sun.net.www.protocol.http.HttpURLConnection.getInputStream(Unknown Source)
        at java.base/java.net.HttpURLConnection.getResponseCode(Unknown Source)
        at com.inductiveautomation.ignition.client.launch.steps.ConnectStep.downloadManifest(ConnectStep.java:164)
        at com.inductiveautomation.ignition.client.launch.steps.ConnectStep.downloadManifest(ConnectStep.java:104)
        at com.inductiveautomation.ignition.client.launch.steps.ConnectStep.run(ConnectStep.java:50)
        at com.inductiveautomation.ignition.client.launch.AbstractStepRunner.run(AbstractStepRunner.java:33)
        at java.base/java.lang.Thread.run(Unknown Source)
java.net.SocketException: Connection reset
        at java.base/java.net.SocketInputStream.read(Unknown Source)
        at java.base/java.net.SocketInputStream.read(Unknown Source)
        at java.base/java.io.BufferedInputStream.fill(Unknown Source)
        at java.base/java.io.BufferedInputStream.read1(Unknown Source)
        at java.base/java.io.BufferedInputStream.read(Unknown Source)
        at java.base/sun.net.www.http.HttpClient.parseHTTPHeader(Unknown Source)
        at java.base/sun.net.www.http.HttpClient.parseHTTP(Unknown Source)
        at java.base/sun.net.www.http.HttpClient.parseHTTP(Unknown Source)
        at java.base/sun.net.www.protocol.http.HttpURLConnection.getInputStream0(Unknown Source)
        at java.base/sun.net.www.protocol.http.HttpURLConnection.getInputStream(Unknown Source)
        at java.base/java.net.HttpURLConnection.getResponseCode(Unknown Source)
        at com.inductiveautomation.ignition.client.launch.steps.ConnectStep.downloadManifest(ConnectStep.java:164)
        at com.inductiveautomation.ignition.client.launch.steps.ConnectStep.downloadManifest(ConnectStep.java:104)
        at com.inductiveautomation.ignition.client.launch.steps.ConnectStep.run(ConnectStep.java:50)
        at com.inductiveautomation.ignition.client.launch.AbstractStepRunner.run(AbstractStepRunner.java:33)
        at java.base/java.lang.Thread.run(Unknown Source)

Kevin.Herron · October 20, 2020, 1:11am

It might be interesting if you could capture the client launcher attempting to connect on Wireshark vs the browser.

ryanjmclaughlin · October 20, 2020, 5:31pm

Wow, this is odd… I cannot seem to capture any requests to that gateway in Wireshark at all when using the launcher. I was able to capture the traffic from Chrome no problem.

Oh… looking closer and removing my host filter, I think I see an initial SYN request on IPV6, source ::1, dest ::1… a little further down this gets to a TLS hello that fails.

If I jump back on a “full” VPN I am seeing a bunch of IPV6 traffic, then switch over to IPV4.

Is this something in the Java networking stack that is always trying IPV6 first? Any other ideas? Thanks for the help, definitely closer to figuring it out.

Kevin.Herron · October 20, 2020, 5:42pm

Add this to the existing parameters and launch via the manual command-line:

-Djava.net.preferIPv4Stack=true

Does that change anything?

ryanjmclaughlin · October 20, 2020, 5:43pm

Was JUST typing an edit. Yes, just came across that and it works in command line, but not in launchers.

Kevin.Herron · October 20, 2020, 5:48pm

Weird that it doesn’t work in launchers…

Do you see it in the logged command once you’ve added it to the JVM Arguments section in the launcher for this gateway and launched?

Kevin.Herron · October 20, 2020, 5:50pm

Ah, but I think you’d also need the launcher itself to be running with this argument…

edit:
According to this post you can add a designerlauncher.l4j.ini file next to the launcher executable and put the same -D argument into it.

Maybe try that?

ryanjmclaughlin · October 20, 2020, 5:59pm

Yes, thats the issue, It gets stuck before the launch with all the other checks the launcher does.

INFO  [GatewayConnect                ] [2020/10/20 13:48:53]: Attempting to connect to gateway https://myignitionhostname:443...
DEBUG [GatewayConnect                ] [2020/10/20 13:48:53]: checking state of gateway https://myignitionhostname:443
DEBUG [GatewayConnect                ] [2020/10/20 13:48:53]: gateway 'https://myignitionhostname:443' state: UNKNOWN
DEBUG [GatewayConnect                ] [2020/10/20 13:48:54]: checking state of gateway https://myignitionhostname:443
DEBUG [GatewayConnect                ] [2020/10/20 13:48:54]: gateway 'https://myignitionhostname:443' state: UNKNOWN

I tried adding the value in jre/conf/net.properties, but that has no effect (any prob gets overridden on a jre update)

The ini file does work (in addition to also adding the -Djava.net.preferIPv4Stack=true param into the launch arguments).

Its a bit messy, but I can live with it for now, especially to have a 10x faster internet connection when on VPN. Maybe we can get @jcoffman to add an IPV4/6 switch to the launcher configs

Kevin.Herron · October 20, 2020, 6:00pm

Ask IT to fix your VPN so it doesn’t hang up when IPv6 is used

ryanjmclaughlin · October 20, 2020, 6:00pm

Sending them this thread now! HAHA