How stable is OpenVPN?
-
@dominikhoffmann We were discussing something different than the OpenVPN crashing issue.
What we are talking about is policy routing.
Our PFsense firewall is an OpenVPN client to a OpenVPN server (Nordvpn or PIA or insert 3rd party].
As that OpenVPN server is now enabled as a gateway, we can direct clients to that gateway via firewall rules , aka, policy routing.
So now users on our LAN or GuestNet or whichever interface will be routed out the OpenVPN connection. Any user that goes against our network policy will only be hurting the IP reputation of the VPN provider and leaving our IP that we own (or assigned to us) alone.
Its really not a bad idea. -
@michmoor: I get it now
Is there a tutorial somewhere, that you know of, that you would recommend, on how to set up a pfSense box as an OpenVPN client?
-
@dominikhoffmann said in How stable is OpenVPN?:
pfSense box as an OpenVPN client?
To where? Pretty much every vpn service has some "guide" on how to connect to their service - most of them have a section for pfsense.
-
Not crashing.
62444 was signaled to stop. For the usual reasons like : an interface (WAN ?) went down.
I agree : it should restart when the that interface came back.edit : to see what happened, look in the main system log for events at that moment.
-
@gertjan said in How stable is OpenVPN?:
Not crashing.
62444 was signaled to stop.Correct! That was, when I restarted the service.
-
@dominikhoffmann
Ah, ok, so the openvpn server 62444 stayed silent - no log lines since last 24 December.
Do you have enforced your openvpn server vpn rule, like not using port 1194, or limited to a known list op source IPs ?
Normally, for a openvpn server, you would see ones in a while some log lines because your openvpn is "scanned". A bit scary at first, but actually quiet handy as you could see these tests as a sort of 'I'm still alive' tests.
Or, true : openvpn was running but not listening anymore, which is close to a dead process. -
@gertjan said in How stable is OpenVPN?:
Do you have enforced your openvpn server vpn rule, like not using port 1194, or limited to a known list op source IPs ?
The firewall rule is the default one generated by the setup wizard:
So, the answer is, no.
-
It went down again in the last couple of days. The OpenVPN logs did not show anything. Is there anything else I should check for?
-
D DominikHoffmann referenced this topic on
-
D DominikHoffmann referenced this topic on
-
When you try to connect with an external client do you see states created on the WANfor the incoming connection attempts?
I'm not aware of any issue in OpenVPN itself that behaves like that.
Steve
-
@stephenw10: I am not familiar with what states are and what that list would signify.
Do you mean entries like these:
I don’t believe that there were any entries in the states table showing evidence of my failed attempts to connect to the OpenVPN server, before I restarted the service. However, I will need to verify this, when I encounter it being down the next time.
-
Nope, those are states on the OpenVPN interface, so inside the tunnel. What I would expect to see are states on the WAN on whatever port you're running OpenVPN on, UDP 1194 by default.
If you don't see those states then the VPN traffic from the clients is not arriving which would explain why there are no logs for connection attempts. -
@stephenw10: … And if a restart of the OpenVPN server fixes things, then that’s a sign that there was nothing else wrong upstream from the gateway, I would think.
-
Except that we've seen in the other thread that doing so is triggering, at least, dpinger to restart. So it could be doing more than you think.
