My IPSEC service hangs

jdemmer

@romczak Thanks for the update, I am going to disable all keepalives and see how it goes

romczak

@jdemmer Just to clarify. If the VPN is up, the keepalives are not a problem. We had issues only when the VPN was not able to be established due to external connectivity issues.

Flukester

@david11717 said in My IPSEC service hangs:

@flukester I made the same changes you detailed above and the issue still happens for me. At this point I've stopped playing with it and my cron job fixes the issue within about 60 seconds of it happening. It's kind of ridiculous, honestly.

Thanks, still happening for us on 23.01-RELEASE if we leave a VPN trying to connect for any period of time. (easy to forget you were working on one and leave it)

Can you detail how to install your script ?, very much a beginner

Cheers mate

glreed735

@flukester - Someone else on the board created the script to address this, so credit is due to that person, but here's how you can set it up on your router.

First, enable ssh access in System > Advanaced > Enable Secure shell

I use putty for my ssh client, available for general download on the Internet
Use putty to login to your router with your web admin credentials and select '8'.
Next you have to use an editor to put the script in place. I use 'vi'.

vi /usr/local/bin/pfsense_charon_fix
Insert the script contents
#!/bin/sh

queueLength=$(netstat -Lan | grep charon.vici | cut -c 7)

if [ $((queueLength)) -gt 0 ]; then

            /usr/bin/killall -9 charon
            /usr/local/sbin/pfSsh.php playback restartipsec; sleep 20; /usr/local/sbin/pfSsh.php playback restartipsec
            echo "Process ran @ `date`" >>/var/log/ipsec_restart.log

else

fi

Save the file.

Now, set execute permissions on this file with this command
chmod 0755 /usr/local/bin/pfsense_charon_fix
Next step is to add this routine to the cron scheduler, using vi again to edit a file
vi /etc/crontab

Add this line to bottom of the file
*/1 * * * * root /usr/local/bin/pfsense_charon_fix

You'll need to leave a blank line after that entry too.

Save this file.

Logout and reboot the router.
I'd recommend going back to System > Advanced and turning off ssh access until you need it again.

This has been working really well for me for quite a while. It's not perfect, but it's better than status quo.

Flukester

@glreed735 many thanks for the detailed guide to setting up, very much appreciated.

This 'QueueLength', if it's over 0 is IPsec in 'meltdown mode' and essentially broken. Reason for asking is we have around 70 IPsec VPNs and don't want everything falling into some IPsec restart loop.

glreed735

@flukester - That's correct. The script does a hard reset of the IPSEC service only, the other router functions are unaffected. Since I put this in place, my router has been up for over 152 days, I've got about 300 VPNs on this instance. The script has been triggered 41 times to date. The only disruption is VPNs getting reestablished, if it happens after hours no one notices, but it can occur at any time.

Flukester

@glreed735 thanks

Having issue with this, created the file fine in right place and set permissions on a test PF with a active VPN

As soon as I reboot even without CRON job though the test VPN is fully up p2 no longer receives traffic or can send

#!/bin/sh
queueLength=$(netstat -Lan | grep charon.vici | cut -c 7)
if [ $((queueLength)) -gt 0 ]; then
/usr/bin/killall -9 charon
/usr/local/sbin/pfSsh.php playback restartipsec; sleep 20; /usr/local/sbin/pfSsh.php playback restartipsec
echo "Process ran @ date" >>/var/log/ipsec_restart.log
else
fi

If I delete the file and reboot everything works again.

edit: on a 2nd test, even deleting file after reboot having same issue, very strange, ended up just replacing root volume from snapshot in AWS to fix

glreed735

@flukester The existence of a script will have no effect on operation if it's not called. It's just another file on disk. In theory, garbling he crontab might some operational consequences, but not on VPN connections. Executing the script should result in no action for the overwhelming majority of the time, it's set to run every minute with that entry in crontab. Only when the queue gets backed up will it try the hard reset of the IPSEC service.

ScottSelf

Will the fix here be implemented into pfSense as it seems to have fixed the issue?

https://redmine.pfsense.org/issues/13014

rcoleman-netgate

@scottself said in My IPSEC service hangs:

https://redmine.pfsense.org/issues/13014

It says on the redmine where it will be implented.

Plus Target Version:
23.05