Site-to-Site OpenVPN only works for a short time after factory reset + reconfigure

nazelus

@nazelus said in No Site-to-Site VPN after upgrading CE from 2.6.0 to 2.7.0:

@nazelus said in No Site-to-Site VPN after upgrading CE from 2.6.0 to 2.7.0:

ERROR: FreeBSD route add command failed: external program exited with error status: 1

Might be this

I'm on ShareKey to make this simple as possible. still no luck on it

This solve by remove local server subnet network, Still not solve the issue anyways.

My Log if anyone interesting

Jul 7 14:23:56 openvpn 27759 Initialization Sequence Completed
Jul 7 14:23:56 openvpn 27759 Peer Connection Initiated with [AF_INET]MYWAN:1194
Jul 7 14:23:55 openvpn 27759 TCPv4_CLIENT link remote: [AF_INET]MYWAN:1194
Jul 7 14:23:55 openvpn 27759 TCPv4_CLIENT link local (bound): [AF_INET]192.168.0.4:0
Jul 7 14:23:55 openvpn 27759 TCP connection established with [AF_INET]MYWAN:1194
Jul 7 14:23:55 openvpn 27759 Attempting to establish TCP connection with [AF_INET]MYWAN:1194
Jul 7 14:23:55 openvpn 27759 TCP/UDP: Preserving recently used remote address: [AF_INET]MYWAN:1194
Jul 7 14:23:55 openvpn 27759 /usr/local/sbin/ovpn-dnslinkup ovpnc1 1500 0 192.168.10.2 192.168.10.1 init
Jul 7 14:23:55 openvpn 27759 /sbin/ifconfig ovpnc1 192.168.10.2 192.168.10.1 mtu 1500 netmask 255.255.255.255 up
Jul 7 14:23:55 openvpn 27759 TUN/TAP device /dev/tun1 opened
Jul 7 14:23:55 openvpn 27759 TUN/TAP device ovpnc1 exists previously, keep at program end
Jul 7 14:23:55 openvpn 27759 Initializing OpenSSL support for engine 'rdrand'
Jul 7 14:23:55 openvpn 27759 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Jul 7 14:23:55 openvpn 27503 DCO version: FreeBSD 14.0-CURRENT #1 RELENG_2_7_0-n255866-686c8d3c1f0: Wed Jun 28 04:21:19 UTC 2023 root@freebsd:/var/jenkins/workspace/pfSense-CE-snapshots-2_7_0-main/obj/amd64/LwYAddCr/var/jenkins/workspace/pfSense-CE-snapshots-2_7_0-main/sources/FreeBSD-src-REL
Jul 7 14:23:55 openvpn 27503 library versions: OpenSSL 1.1.1t-freebsd 7 Feb 2023, LZO 2.10
Jul 7 14:23:55 openvpn 27503 OpenVPN 2.6.4 amd64-portbld-freebsd14.0 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [MH/RECVDA] [AEAD] [DCO]
Jul 7 14:23:55 openvpn 27503 DEPRECATION: No tls-client or tls-server option in configuration detected. OpenVPN 2.7 will remove the functionality to run a VPN without TLS. See the examples section in the manual page for examples of a similar quick setup with peer-fingerprint.
Jul 7 14:23:55 openvpn 27503 DEPRECATED OPTION: The option --secret is deprecated.

I've try Both UDP/TCP Same result

nazelus

@frater
I Got Custom box and Purchase box from Netgate
One site that i use Netgate box was S2S Broken 1-2 version early but i manage to set it to use 1 specific ip i need with /32 (/24 will not work) so i dint bother it since i'm on other thing too.
After CE 2.7 arrive i update it and forgot what happen with Netgate box and yes it break the S2S and i'm not even able to use /32 to solve the issue like Netgate box
I got one custom box 2.6 Client connect to 2.7 Server and it not work too.

To Reset everything i can try But i believe both you and me will find it very difficult to do it since we hesitate to do.
Anyway i'll plan to try it ASAP, Could take a day or two. I'll start with VM it first.

PS. i setup following Netgate Doc before and it work fine, After the incident I"ve try many option and solution as i can for a few days now and end up with sharekey to make it simple and cut out the SSL/TSL

nazelus

@frater
all of my Box can ping anything from both side without issue. just anything behind those box are NOT

nazelus

@frater
I Got it to work too by Reset default on Client.
I Manually config everything again and it work fine.
I'm going to try to restore the config and see if it still work.

nazelus

@nazelus said in No Site-to-Site VPN after upgrading CE from 2.6.0 to 2.7.0:

@frater
I Got it to work too by Reset default on Client.
I Manually config everything again and it work fine.
I'm going to try to restore the config and see if it still work.

It broken again after restore backup config,
I've try to reset the NAT but still not help.
Anyway i'll continue to solve this by reset all client now.
Thank you everyone for sharing.

nazelus

@frater said in No Site-to-Site VPN after upgrading CE from 2.6.0 to 2.7.0:

I didn't create a screenshot of the outbound rules for 192.168.1.0/24 and because I removed those entries I can't make one now, but my config still has this orphaned outbound ruleset

Another network which doesn't exist anymore on this box.

I have no reason to return to the old config as the "shared key" seems to be deprecated, so I will leave it like this.

I wonder what the culprit is on your boxes.
Do take a peak at the outbound NAT rules and see if there are any orphans..

Im too excited and i forgot to confirm pinging from behind server side to behind client side is not working, Its one way connection now.
Seem like i need to reset my server side too.
Sorry, I already clear those NAT long ago too since prob start.

nazelus

I'm Just passing by to confirm that everything back to work after i Reset factory default the server and the client side. If they are far from each other then you going to need a Third hand to help you with it.
SO i Nothing wrong with the config here it just upgrade that causing the prob.

Good luck.

nazelus

@michaelschefczyk
Hi, the backup config will cause it to broken again. if you want you can try to spend time to find out which one of them make it broken. I dont want to spend time finding it out since i have to spend time re config everything again.
Oh, i did sync my pfblock and snort config to my client then i sync them back to my server without issue after vpn is setup

nazelus

And it happen again after a few days.....

nazelus

@nazelus said in No Site-to-Site VPN after upgrading CE from 2.6.0 to 2.7.0:

And it happen again after a few days.....

Reset Factory default on all Server and Client without backup config
For a few days prob is back again suddenly, Client and PC behind can ping and connect anything to server. Server can ping to client but None of the PC behind server can ping and connect to client.

nazelus

I'm So Done with this, I'll Rollback to 2.6 and update everyone later if it working or not.
If Netgate not clarify anything about this mean i wont be able to upgrade and might have to throw away 1000$ netgate box and move to something else.
that box is the way I showing respect to Netgate team and i really hope i dont waste it.

jimp

@nazelus said in No Site-to-Site VPN after upgrading CE from 2.6.0 to 2.7.0:

I'm So Done with this, I'll Rollback to 2.6 and update everyone later if it working or not.
If Netgate not clarify anything about this mean i wont be able to upgrade and might have to throw away 1000$ netgate box and move to something else.
that box is the way I showing respect to Netgate team and i really hope i dont waste it.

If something worked and then stopped, and then worked again after a factory reset, it's still probably something in your settings. Not much changes dynamically like that, but if something messes with your routing after some kind of event (e.g. WAN failure/DHCP renew, VPN disconnect/reconnect) then it's most likely something else that needs set right to recover properly, or an invalid setting that only becomes apparent later.

That's not the same as OPs problem, though. So far no two people in this thread have had the same problem, each of these should really be separate threads, it's getting very confusing to follow.

nazelus

@jimp said in No Site-to-Site VPN after upgrading CE from 2.6.0 to 2.7.0:

And so far I haven't seen anyone that has followed my troubleshooting suggestions from earlier in the thread:

https://forum.netgate.com/post/1114468

Please. I even did this before you've told. these information and solution are available via netgate documents and i've go through all of them repeat for a week now.
I can't roll thing back right now due to its a working day, i'll Plan to do it later ASAP
I've been using PFsense MORE THAN 10 years. Everything seem to work last weekend and it just start to not work on the Monday morning.
Its something trigger some other thing here and everything really look normal all the route are there and etc.
I can even ping some behind the box some time and then a hour later it gone!

It Really Frustrating.

If you need any information Please just ask and i'll provide them if you willing to help.

jimp

If you have an ongoing case with TAC then you can keep handling it there -- again your situation is not the same as the OP and mixing your info in here is only leading to confusion. The thread is already huge and trying to track multiple different problems and conversations is only resulting in frustration to all involved.

If you are submitting info via TAC, take a status report (from /status.php in the GUI) while trying to ping both when it works and again when it doesn't work, and submit both to TAC. The differences in the status report should reveal what is happening in your case. We don't suggest posting those publicly in forum threads because of the potential for sensitive info inside, but TAC is private so those concerns do not apply there.

jimp

I forked this off into a new thread so it would all be together since it's likely a different issue than the post it was on before.

Something else I thought of that might kick in after it's been running a while is that it may have downloaded a bogons update. A fresh install may not have bogons content yet, and then if any of your interfaces have "Block bogon networks" enabled that may kick in later once the firewall downloads the bogons data. Similar results may come about from packages like pfBlocker or snort downloading updates.

But I still think comparing the contents of the status output when it works vs when it doesn't work would be the most helpful.

I asked TAC about your case but they didn't see anything under this name, but that would make sense if your account isn't using the same name/alias/e-mail as the forum.

nazelus

@jimp

FYI, Just To update you to know that i seem to able to find all the reason behind this now but i need a few more test to confirm and will get back to you later this week.

nazelus

After keep on going research for the issue I found some topic that Jimp Mention to someone with some other issue that they should try to lock the package and only send them to destinated location only.
My issue seem to be the to be this behave

With 2.6
Source Lan Net >> Destination Address >> Any available gateway that is correct automatic = Result is a ping

But 2.7
Source Lan Net >> Destination Address >> Any available gateway that is available automatic = Result is not able to ping

I Got Multi Wan and Multi Lan here so that is the reason that the package was send out to wrong interface gateway.

I'm not found any document of these available in Netgate but found them in some Youtube channel, It is to create Interface Gateway from VPN so i did Create a Gateway by adding VPN interface on both side But still not able to ping.
After i read Jimp comment so i adapt it to my use by

Source Lan Net >> Destination VPN Lan Net >> Force to use VPN Gateway
and keep this on Top of any Rule from both client and server site

And Yet, Everything is Work again like 2.6 now

I'm not sure anyone else will have the same issue as i did or not since we have a bit complicated setup here with 4 VPN server for 4 client with Site to Site Setup and Remote for Client connection Plus 2 Wireguard Gateway Interface.

Thank you and Kind Regard

michaelschefczyk

@nazelus Could you please be so kind to add a screenshot showing where you made the key changes? In how far is outbound NAT involved? Which network are the firewall rules in question assigned to - source LAN net?

nazelus

@michaelschefczyk
I Did not touch any NAT Here.

Simply add a Interface gate way from the Interface Assignments Menu first and add Then Select and add a VPN, Enable it without any setting here you will get a new Gateway.
At Firewall Rule from your LAN, Add a new rule with S: Lan Net > D: Network VPN Address >> Specific VPN Gateway from first step.