• 10 Votes
    23 Posts
    32k Views
    GertjanG
    @Bambos said in HEADS UP: OpenVPN deprecating shared key mode, requires TLS, deprecating cipher selection: for the remote access VPN, if is SSL/TLS + User auth, does this working with freeradius as well ? I'm using FreeRadius myself for the captive portal. Never tried to do this ... You probably want also see this one also : FreeRadius on pfSense software for Two Factor Authentication although I presume that article was written for those who wanted to "why do things the easy way if much harder is so much better ?" @Bambos said in HEADS UP: OpenVPN deprecating shared key mode, requires TLS, deprecating cipher selection: i have many 2.6 versions clients to upgrade Keep in mind that 2.6.0 uses the "old" (now completly ditched because of security) OpenVPN (and now also old OpenSSL !!) libaries. The recent pfSense uses the more modern OpenVPN and OpenSSL. All this means that some options won't work anymore. Some more options will work, but will be depreciated soon (as usual). I Use OpenVPN myself, so I always have a look at the "source" : web pages like this and the classic openvpn support forum. The OpenVPN client also changed to support the newer OpenVPN server. And yes, I agree, syncing the entire openvpn user fleet can be a hassle.
  • Scaling OpenVPN (and VPNs in general)

    Pinned
    12
    6 Votes
    12 Posts
    19k Views
    M
    I have discovered that OpenVPN implementation in PFsense is slow even without ciphering data, look at my post: link text
  • OpenVPN Documentation

    Pinned Locked
    1
    0 Votes
    1 Posts
    39k Views
    No one has replied
  • NordVPN Curiosity with 2.8.1

    5
    0 Votes
    5 Posts
    84 Views
    tinfoilmattT
    @KOM said in NordVPN Curiosity with 2.8.1: Also, I'm surprised that folks are still using OpenVPN when wireguard [ . . . ] Because they're not mutually exclusive. [ . . .] is easier to configure and faster. You know what they say about opinions...
  • Openvpn client access Rustdesk server

    1
    0 Votes
    1 Posts
    41 Views
    No one has replied
  • Having trouble accessing NAS through VPN server

    29
    0 Votes
    29 Posts
    690 Views
    A
    @the-other Ok, I made a specific rule in the OpenVPN interface to allow any to both NAS servers. [image: 1761707110778-2cd0716f-d4f0-4e63-94e8-4fc93788fd6d-image.png] Here you can see me connecting to the VPN server with my iPhone and attempting to ping both the NAS servers. The traffic passes through the firewall but the ping fails to the Synology (200.4). [image: 1761707746508-eb97e248-fbd4-43cf-977c-31d87df234ce-image.png] [image: 1761707789724-efcea745-54b9-4460-a44a-e2fffc8c5644-image.png] I can, however, successfully ping the backup NAS (200.5) but I cannot connect to that one either with the File Explorer app. BTW, the backup NAS is an old Asus AC-RT86 router in AP mode with WiFi disabled and a SAMBA SSD in the USB port.
  • write TCPv4_CLIENT: Permission Denied on OpenVPN client 24.03 RC

    Moved
    26
    0 Votes
    26 Posts
    2k Views
    G
    Posting here because I found this thread when troubleshooting the same error message, so maybe this helps someone else: In my case it was due to an asymmetric routing situation that had developed because of static routes defined within the OpenVPN "remote network" settings. I have a multiple WAN situation with failover gateway and failover VPNs defined through policy routing groups. The behavior I experienced was very similar to what you describe, which in my case was caused by return packets flowing across a different interface than the origin packets. The firewall couldn't see the return packets, and closed the state. I couldn't figure out why traffic was coming in on one interface but going out on another, despite setting up policy routing in the firewall. In my case the "aha" moment came from reading https://docs.netgate.com/pfsense/en/latest/troubleshooting/asymmetric-routing.html -- I removed the non-obvious static route in the OpenVPN settings and instantly resolved multiple issues.
  • Multiple Static Assigned Addresses FreeRadius For OpenVPN

    7
    1
    0 Votes
    7 Posts
    183 Views
    R
    So, poking around in docs, seems like maybe the weapon of choice here is the framed-pool RADIUS attribute. Look like you can assign distinct IP pools to clients using this attribute. Anyone know if this attribute is compatible with the FreeRADIUS package that is available for PFSense? Can OpenVPN use this attribute for assigning IP addresses to clients? Anyone done this successfully?
  • Comcast Business maintenace, now OpenVPN not working

    11
    0 Votes
    11 Posts
    248 Views
    B
    @SteveITS I agree 100%, I'm not complaining its working again and I have notes on it, when they do "maintenance" in the area again... Glad the onsite tech new something more than the support back at ISP office... Brian
  • 0 Votes
    1 Posts
    71 Views
    No one has replied
  • Reissue/renew certificate and change validity duration?

    1
    1
    0 Votes
    1 Posts
    61 Views
    No one has replied
  • Crash on saving after deselecting all allowed ciphers

    1
    0 Votes
    1 Posts
    76 Views
    No one has replied
  • Always-on VPN not working with Protectli and Slate AP

    7
    0 Votes
    7 Posts
    229 Views
    H
    @Gertjan I have allowed pfSense's DHCP to dole out the IP for the AP. I tried assigning an IP as you recommend but it didn't help. I've also ordered another AP to see if there is something about the software there that's causing the issue.
  • Portforword through a VPN client

    4
    6
    0 Votes
    4 Posts
    217 Views
    V
    Well, if this is correct as far, you should be close to get it working. @Udbytossen said in Portforword through a VPN client: And under the firewall rule advanced setting I'm changing the gateway to Torguard instead of default But already mentioned, that this makes no sense at all. So edit the rule and set the gateway to default. Then go to the OpenVPN rule tab and remove or disable each pass rule. Done.
  • Cannot connect to OpenVPN Server via ipv6 endpoint

    4
    0 Votes
    4 Posts
    191 Views
    JKnottJ
    Is your pfSense configured to work over both IPv4 and IPv6? I assume you have IPv6 on your WAN. 4G & 5G phones are IPv6 and Android phones use 464XLAT to access IPv4 sites. This is effectively double NAT, which can mess things up. I don't know what iPhones use, but they'd have something similar. By sticking with IPv4, you are already breaking things. IPv6 is the future, so you'd better get used to it.
  • 0 Votes
    9 Posts
    378 Views
    T
    Certificates for authentication are fine being self-signed with whatever validity you assess is good for you. The VPN-endpoint (the public address) should have a real public certificate. The CA-chain for this ertificate is part of the profile, so there is a caveat that you must check the CA-chain for changes when you renew the public endpoint cert. This however can be considered a rare event in a sense, and usually you get heads up when roots (very rare) and/or intermediates (more likely but still rare) change. If the chain changes, you must provide new profiles to all users, which can be a PITA of not prepared.
  • 0 Votes
    4 Posts
    1k Views
    M
    Hello, I have the same problem on a pfsense box. I performed a fresh install on a VM on the same site with exactly the same configuration, and... no errors at all For your information, the log line refers to a return from a "write" call. write is the name of a function; it's a system call. https://man.freebsd.org/cgi/man.cgi?write(2) " The write() system call attempts to write nbytes of data to the object referenced by the descriptor fd from the buffer pointed to by buf. " https://man.freebsd.org/cgi/man.cgi?write(2) So, for the following, fd=6 is the file descriptor where we're trying to write, and code=13 is the error code retrieved just after the write call, which returned -1. " Upon successful completion, the number of bytes which were written is returned. Otherwise, a -1 is returned, and the global variable errno is Set to indicate the error. We learn that code 13 matches the description EACCES 13 Permission denied Either the process is not authorized to write to the file not helfull but : It's a permission issue; we're not supposed to be able to touch that from the web interface, I presume. Either it's a bug, or a third-party package is putting the problem in, etc. Contrary to what Google says, this has nothing to do with firewall rules.
  • Activating IPsec-MB Crypto

    10
    2
    0 Votes
    10 Posts
    1k Views
    Z
    @McMurphy Do you have an external BSD compatible cryptodev accelerator card or device outside of your AES-NI CPU? (These devices are extremely hard to find) If not why are you telling pfSense that you do? If you don't you should only use AES-NI CPU-based Acceleration only.
  • Discrepancy Between OpenVPN routing table and genaral routing table

    2
    2
    0 Votes
    2 Posts
    115 Views
    V
    @ThaBozz No. OpenVPN just adds a route for the first client IP in the tunnel network to the system routing table. This just routes the traffic to the OpenVPN insctance. But the correct routing to the respective client IP is done inside OpenVPN. pfSense doesn't know at all, what happens there.
  • Dual-WAN access configuration

    9
    3
    0 Votes
    9 Posts
    2k Views
    P
    @chitchat Assuming the two VPN servers use all the same certs then it should be ok. In my case the single VPN server listens on Localhost. Then there's two port-forwards (one for each WAN) to the same VPN server. [image: 1759479867156-eed1a7f9-d88e-4da3-bb46-e723e73ed01e-image.png] [image: 1759479896297-6d8d4837-2ea9-43eb-95c0-08358cd644b3-image.png]
Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.