Site-to-Site OpenVPN only works for a short time after factory reset + reconfigure
-
@nazelus said in No Site-to-Site VPN after upgrading CE from 2.6.0 to 2.7.0:
@michaelschefczyk
I will try to explain as easy as possible for you, Example i got:
Site A
192.168.1.0/24 as Default Lan on PFsense and every other PC
192.168.2.0/24 as Dedicate for Some specific PC
Site B
192.168.3.0/24 as Default LanConnecting Site2SiteVPN with P2P sharekey use to work here
Site A
192.168.1.0/24 as Default Lan
Site B
192.168.3.0/24 as Default LanLater I've upgrade to Site2SiteVPN with P2P SSL/TLS and it work finr
Site A
192.168.1.0/24 as Default Lan
Site B
192.168.3.0/24 as Default LanAfter upgrade 2.6 to 2.7
PFsense from A can connect anything to B and PFsense from B can connect anything to A BUT NOTHING ELSE Behind that PFsense work or can connect anything behind another Site.
I've try to get back to ShareKey or even try Wireguard WITH Static Route it still giving the same result which is PFsense from A can connect anything to B and PFsense from B can connect anything to A BUT NOTHING ELSE Behind that PFsense can connect anythingSolution, Some say it should work if we change all lan to example (I Din't try)
Site A
10.0.1.0/24 as Default Lan
Site B
10.0.2.0/24 as Default LanBUT I Found other solution that is seem to working now i use
Site A
192.168.2.0/24 as Dedicate for Some specific PC
Site B
192.168.3.0/24 as Default Lan
With This i can connect anything from SiteB to SiteA AS ONE WAY TRAFFIC but that is all i needed for now until i can solve this and YET PFsense on both site can connect anything and Thing behind SiteA Cannot connect anything to B.I've test to upgrade Site C and use the same setting as site B to connect to Site A and it NOT WORK! I cant Even ping Box to Box here, it just getting more fun.
Update: After Restart it can ping box to box now but not able to access Client behind the Box. -
@frater
So this sound like an upgrade issue?
Likely if we start to setup everything again from zero then it should work??
hmmm... -
ERROR: FreeBSD route add command failed: external program exited with error status: 1
Might be this
I'm on ShareKey to make this simple as possible. still no luck on it
-
@nazelus said in No Site-to-Site VPN after upgrading CE from 2.6.0 to 2.7.0:
ERROR: FreeBSD route add command failed: external program exited with error status: 1
Might be this
I'm on ShareKey to make this simple as possible. still no luck on it
This solve by remove local server subnet network, Still not solve the issue anyways.
-
@nazelus said in No Site-to-Site VPN after upgrading CE from 2.6.0 to 2.7.0:
@nazelus said in No Site-to-Site VPN after upgrading CE from 2.6.0 to 2.7.0:
ERROR: FreeBSD route add command failed: external program exited with error status: 1
Might be this
I'm on ShareKey to make this simple as possible. still no luck on it
This solve by remove local server subnet network, Still not solve the issue anyways.
My Log if anyone interesting
Jul 7 14:23:56 openvpn 27759 Initialization Sequence Completed
Jul 7 14:23:56 openvpn 27759 Peer Connection Initiated with [AF_INET]MYWAN:1194
Jul 7 14:23:55 openvpn 27759 TCPv4_CLIENT link remote: [AF_INET]MYWAN:1194
Jul 7 14:23:55 openvpn 27759 TCPv4_CLIENT link local (bound): [AF_INET]192.168.0.4:0
Jul 7 14:23:55 openvpn 27759 TCP connection established with [AF_INET]MYWAN:1194
Jul 7 14:23:55 openvpn 27759 Attempting to establish TCP connection with [AF_INET]MYWAN:1194
Jul 7 14:23:55 openvpn 27759 TCP/UDP: Preserving recently used remote address: [AF_INET]MYWAN:1194
Jul 7 14:23:55 openvpn 27759 /usr/local/sbin/ovpn-dnslinkup ovpnc1 1500 0 192.168.10.2 192.168.10.1 init
Jul 7 14:23:55 openvpn 27759 /sbin/ifconfig ovpnc1 192.168.10.2 192.168.10.1 mtu 1500 netmask 255.255.255.255 up
Jul 7 14:23:55 openvpn 27759 TUN/TAP device /dev/tun1 opened
Jul 7 14:23:55 openvpn 27759 TUN/TAP device ovpnc1 exists previously, keep at program end
Jul 7 14:23:55 openvpn 27759 Initializing OpenSSL support for engine 'rdrand'
Jul 7 14:23:55 openvpn 27759 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Jul 7 14:23:55 openvpn 27503 DCO version: FreeBSD 14.0-CURRENT #1 RELENG_2_7_0-n255866-686c8d3c1f0: Wed Jun 28 04:21:19 UTC 2023 root@freebsd:/var/jenkins/workspace/pfSense-CE-snapshots-2_7_0-main/obj/amd64/LwYAddCr/var/jenkins/workspace/pfSense-CE-snapshots-2_7_0-main/sources/FreeBSD-src-REL
Jul 7 14:23:55 openvpn 27503 library versions: OpenSSL 1.1.1t-freebsd 7 Feb 2023, LZO 2.10
Jul 7 14:23:55 openvpn 27503 OpenVPN 2.6.4 amd64-portbld-freebsd14.0 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [MH/RECVDA] [AEAD] [DCO]
Jul 7 14:23:55 openvpn 27503 DEPRECATION: No tls-client or tls-server option in configuration detected. OpenVPN 2.7 will remove the functionality to run a VPN without TLS. See the examples section in the manual page for examples of a similar quick setup with peer-fingerprint.
Jul 7 14:23:55 openvpn 27503 DEPRECATED OPTION: The option --secret is deprecated.I've try Both UDP/TCP Same result
-
@frater
I Got Custom box and Purchase box from Netgate
One site that i use Netgate box was S2S Broken 1-2 version early but i manage to set it to use 1 specific ip i need with /32 (/24 will not work) so i dint bother it since i'm on other thing too.
After CE 2.7 arrive i update it and forgot what happen with Netgate box and yes it break the S2S and i'm not even able to use /32 to solve the issue like Netgate box
I got one custom box 2.6 Client connect to 2.7 Server and it not work too.To Reset everything i can try But i believe both you and me will find it very difficult to do it since we hesitate to do.
Anyway i'll plan to try it ASAP, Could take a day or two. I'll start with VM it first.PS. i setup following Netgate Doc before and it work fine, After the incident I"ve try many option and solution as i can for a few days now and end up with sharekey to make it simple and cut out the SSL/TSL
-
@frater
all of my Box can ping anything from both side without issue. just anything behind those box are NOT
-
@frater
I Got it to work too by Reset default on Client.
I Manually config everything again and it work fine.
I'm going to try to restore the config and see if it still work. -
@nazelus said in No Site-to-Site VPN after upgrading CE from 2.6.0 to 2.7.0:
@frater
I Got it to work too by Reset default on Client.
I Manually config everything again and it work fine.
I'm going to try to restore the config and see if it still work.It broken again after restore backup config,
I've try to reset the NAT but still not help.
Anyway i'll continue to solve this by reset all client now.
Thank you everyone for sharing. -
@frater said in No Site-to-Site VPN after upgrading CE from 2.6.0 to 2.7.0:
I didn't create a screenshot of the outbound rules for 192.168.1.0/24 and because I removed those entries I can't make one now, but my config still has this orphaned outbound ruleset
Another network which doesn't exist anymore on this box.
I have no reason to return to the old config as the "shared key" seems to be deprecated, so I will leave it like this.
I wonder what the culprit is on your boxes.
Do take a peak at the outbound NAT rules and see if there are any orphans..Im too excited and i forgot to confirm pinging from behind server side to behind client side is not working, Its one way connection now.
Seem like i need to reset my server side too.
Sorry, I already clear those NAT long ago too since prob start. -
I'm Just passing by to confirm that everything back to work after i Reset factory default the server and the client side. If they are far from each other then you going to need a Third hand to help you with it.
SO i Nothing wrong with the config here it just upgrade that causing the prob.Good luck.
-
@michaelschefczyk
Hi, the backup config will cause it to broken again. if you want you can try to spend time to find out which one of them make it broken. I dont want to spend time finding it out since i have to spend time re config everything again.
Oh, i did sync my pfblock and snort config to my client then i sync them back to my server without issue after vpn is setup -
And it happen again after a few days.....
-
@nazelus said in No Site-to-Site VPN after upgrading CE from 2.6.0 to 2.7.0:
And it happen again after a few days.....
Reset Factory default on all Server and Client without backup config
For a few days prob is back again suddenly, Client and PC behind can ping and connect anything to server. Server can ping to client but None of the PC behind server can ping and connect to client. -
I'm So Done with this, I'll Rollback to 2.6 and update everyone later if it working or not.
If Netgate not clarify anything about this mean i wont be able to upgrade and might have to throw away 1000$ netgate box and move to something else.
that box is the way I showing respect to Netgate team and i really hope i dont waste it. -
@nazelus said in No Site-to-Site VPN after upgrading CE from 2.6.0 to 2.7.0:
I'm So Done with this, I'll Rollback to 2.6 and update everyone later if it working or not.
If Netgate not clarify anything about this mean i wont be able to upgrade and might have to throw away 1000$ netgate box and move to something else.
that box is the way I showing respect to Netgate team and i really hope i dont waste it.If something worked and then stopped, and then worked again after a factory reset, it's still probably something in your settings. Not much changes dynamically like that, but if something messes with your routing after some kind of event (e.g. WAN failure/DHCP renew, VPN disconnect/reconnect) then it's most likely something else that needs set right to recover properly, or an invalid setting that only becomes apparent later.
That's not the same as OPs problem, though. So far no two people in this thread have had the same problem, each of these should really be separate threads, it's getting very confusing to follow.
-
@jimp said in No Site-to-Site VPN after upgrading CE from 2.6.0 to 2.7.0:
And so far I haven't seen anyone that has followed my troubleshooting suggestions from earlier in the thread:
Please. I even did this before you've told. these information and solution are available via netgate documents and i've go through all of them repeat for a week now.
I can't roll thing back right now due to its a working day, i'll Plan to do it later ASAP
I've been using PFsense MORE THAN 10 years. Everything seem to work last weekend and it just start to not work on the Monday morning.
Its something trigger some other thing here and everything really look normal all the route are there and etc.
I can even ping some behind the box some time and then a hour later it gone!
It Really Frustrating.If you need any information Please just ask and i'll provide them if you willing to help.
-
If you have an ongoing case with TAC then you can keep handling it there -- again your situation is not the same as the OP and mixing your info in here is only leading to confusion. The thread is already huge and trying to track multiple different problems and conversations is only resulting in frustration to all involved.
If you are submitting info via TAC, take a status report (from
/status.phpin the GUI) while trying to ping both when it works and again when it doesn't work, and submit both to TAC. The differences in the status report should reveal what is happening in your case. We don't suggest posting those publicly in forum threads because of the potential for sensitive info inside, but TAC is private so those concerns do not apply there. -
I forked this off into a new thread so it would all be together since it's likely a different issue than the post it was on before.
Something else I thought of that might kick in after it's been running a while is that it may have downloaded a bogons update. A fresh install may not have bogons content yet, and then if any of your interfaces have "Block bogon networks" enabled that may kick in later once the firewall downloads the bogons data. Similar results may come about from packages like pfBlocker or snort downloading updates.
But I still think comparing the contents of the status output when it works vs when it doesn't work would be the most helpful.
I asked TAC about your case but they didn't see anything under this name, but that would make sense if your account isn't using the same name/alias/e-mail as the forum.
-
FYI, Just To update you to know that i seem to able to find all the reason behind this now but i need a few more test to confirm and will get back to you later this week.
