Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Can't connect site to site OpenVPN after server cert expired and renewed.

    Scheduled Pinned Locked Moved OpenVPN
    14 Posts 2 Posters 612 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • R
      ronlee
      last edited by

      Hi folks,

      I have a site to site OpenVPN setup, with one client. The server client expired, breaking the connection, so I renewed it, but the connection is still broken. Have restarted OpenVPN on both ends, then restarted the pfSense machines on both ends. I'm at the limits of my experience here--help?

      Thanks,
      Ron

      V 1 Reply Last reply Reply Quote 0
      • V
        viragomann @ronlee
        last edited by

        @ronlee
        Maybe the CA cert has expired as well? Or the client cert?

        Provide some more details, what exactly happens on a connection attempt.
        There should be something related in the client log.

        R 1 Reply Last reply Reply Quote 0
        • R
          ronlee @viragomann
          last edited by

          @viragomann Thanks very much for the reply. Here's what I see in the client log:

          May 28 01:07:00 openvpn 83050 [UNDEF] Inactivity timeout (--ping-restart), restarting
          May 28 01:07:00 openvpn 83050 SIGUSR1[soft,ping-restart] received, process restarting
          May 28 01:12:00 openvpn 83050 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
          May 28 01:12:00 openvpn 83050 TCP/UDP: Preserving recently used remote address: [AF_INET]198.0.75.73:1194
          May 28 01:12:00 openvpn 83050 UDPv4 link local (bound): [AF_INET]192.168.0.6:0
          May 28 01:12:00 openvpn 83050 UDPv4 link remote: [AF_INET]198.0.75.73:1194

          All of the certs look current. I'll send screenshots.

          V 1 Reply Last reply Reply Quote 0
          • V
            viragomann @ronlee
            last edited by

            @ronlee
            What's happening then? Does it simply time out?

            R 2 Replies Last reply Reply Quote 0
            • R
              ronlee @viragomann
              last edited by

              @viragomann I'm not sure. I'm only seeing the effect that the tunnel isn't working (can't connect to resources on the other side of the tunnel). Where else should I look?

              Also, with apologies for the newbie forum request, but when I post links to images in my Google Drive, they come up broken. What is the proper way to post images here?

              V 1 Reply Last reply Reply Quote 0
              • R
                ronlee @viragomann
                last edited by

                @viragomann Also, I see that I typoed in my original message. I'm sure you sorted it, but, to be clear, I meant to type "The server cert (not client) expired, breaking the connection, so I renewed it..."

                1 Reply Last reply Reply Quote 0
                • V
                  viragomann @ronlee
                  last edited by

                  @ronlee said in Can't connect site to site OpenVPN after server cert expired and renewed.:

                  I'm only seeing the effect that the tunnel isn't working (can't connect to resources on the other side of the tunnel). Where else should I look?

                  You don't have access to the client site?
                  That would be bad. The connection is established by the client. So this is where you have to start troubleshooting.

                  Maybe something in the server log then?

                  when I post links to images in my Google Drive, they come up broken. What is the proper way to post images here?

                  Did you try to insert the screenshot here directly from the clipboard?

                  Also there is a button for linking images:
                  dbe8db26-42ea-4e88-a5eb-ecdde4f26193-grafik.png

                  R 1 Reply Last reply Reply Quote 0
                  • R
                    ronlee @viragomann
                    last edited by

                    @viragomann I have access to both sites. I sent you these client log entries:

                    May 28 01:07:00 openvpn 83050 [UNDEF] Inactivity timeout (--ping-restart), restarting
                    May 28 01:07:00 openvpn 83050 SIGUSR1[soft,ping-restart] received, process restarting
                    May 28 01:12:00 openvpn 83050 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
                    May 28 01:12:00 openvpn 83050 TCP/UDP: Preserving recently used remote address: [AF_INET]198.0.75.73:1194
                    May 28 01:12:00 openvpn 83050 UDPv4 link local (bound): [AF_INET]192.168.0.6:0
                    May 28 01:12:00 openvpn 83050 UDPv4 link remote: [AF_INET]198.0.75.73:1194

                    Thanks for the image clues. Let me try some screenshots here:

                    c1c4aada-9d71-44f8-9a57-b0f6b45cc4ee-cert authorities.JPG

                    Client certs:
                    19ead5b0-cb3f-403a-9bf4-264694ce7436-certs client.jpg

                    Server certs:
                    e4f6a497-7018-4b65-b767-ffa08417fbb0-certs server.JPG

                    V 1 Reply Last reply Reply Quote 0
                    • V
                      viragomann @ronlee
                      last edited by

                      @ronlee said in Can't connect site to site OpenVPN after server cert expired and renewed.:

                      May 28 01:07:00 openvpn 83050 [UNDEF] Inactivity timeout (--ping-restart), restarting
                      May 28 01:07:00 openvpn 83050 SIGUSR1[soft,ping-restart] received, process restarting
                      May 28 01:12:00 openvpn 83050 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
                      May 28 01:12:00 openvpn 83050 TCP/UDP: Preserving recently used remote address: [AF_INET]198.0.75.73:1194
                      May 28 01:12:00 openvpn 83050 UDPv4 link local (bound): [AF_INET]192.168.0.6:0
                      May 28 01:12:00 openvpn 83050 UDPv4 link remote: [AF_INET]198.0.75.73:1194

                      As mentioned, I'm expecting to see some more lines following this, either a "timeout" or an "Initialization Sequence Completed".

                      R 1 Reply Last reply Reply Quote 0
                      • R
                        ronlee @viragomann
                        last edited by

                        @viragomann Ah, sorry, I was a bit slow to understand. I'm pretty sure I gave you everything before it went back to the same sequence of events, but here's a more complete version:

                        May 28 01:07:00 openvpn 83050 [UNDEF] Inactivity timeout (--ping-restart), restarting
                        May 28 01:07:00 openvpn 83050 SIGUSR1[soft,ping-restart] received, process restarting
                        May 28 01:12:00 openvpn 83050 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
                        May 28 01:12:00 openvpn 83050 TCP/UDP: Preserving recently used remote address: [AF_INET]198.0.75.73:1194
                        May 28 01:12:00 openvpn 83050 UDPv4 link local (bound): [AF_INET]192.168.0.6:0
                        May 28 01:12:00 openvpn 83050 UDPv4 link remote: [AF_INET]198.0.75.73:1194
                        May 28 01:13:00 openvpn 83050 [UNDEF] Inactivity timeout (--ping-restart), restarting
                        May 28 01:13:00 openvpn 83050 SIGUSR1[soft,ping-restart] received, process restarting
                        May 28 01:18:00 openvpn 83050 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
                        May 28 01:18:00 openvpn 83050 TCP/UDP: Preserving recently used remote address: [AF_INET]198.0.75.73:1194
                        May 28 01:18:00 openvpn 83050 UDPv4 link local (bound): [AF_INET]192.168.0.6:0
                        May 28 01:18:00 openvpn 83050 UDPv4 link remote: [AF_INET]198.0.75.73:1194
                        May 28 01:19:01 openvpn 83050 [UNDEF] Inactivity timeout (--ping-restart), restarting
                        May 28 01:19:01 openvpn 83050 SIGUSR1[soft,ping-restart] received, process restarting
                        May 28 01:24:01 openvpn 83050 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
                        May 28 01:24:01 openvpn 83050 TCP/UDP: Preserving recently used remote address: [AF_INET]198.0.75.73:1194
                        May 28 01:24:01 openvpn 83050 UDPv4 link local (bound): [AF_INET]192.168.0.6:0
                        May 28 01:24:01 openvpn 83050 UDPv4 link remote: [AF_INET]198.0.75.73:1194
                        May 28 01:25:01 openvpn 83050 [UNDEF] Inactivity timeout (--ping-restart), restarting
                        May 28 01:25:01 openvpn 83050 SIGUSR1[soft,ping-restart] received, process restarting
                        May 28 01:30:01 openvpn 83050 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
                        May 28 01:30:01 openvpn 83050 TCP/UDP: Preserving recently used remote address: [AF_INET]198.0.75.73:1194
                        May 28 01:30:01 openvpn 83050 UDPv4 link local (bound): [AF_INET]192.168.0.6:0
                        May 28 01:30:01 openvpn 83050 UDPv4 link remote: [AF_INET]198.0.75.73:1194
                        May 28 01:31:01 openvpn 83050 [UNDEF] Inactivity timeout (--ping-restart), restarting
                        May 28 01:31:01 openvpn 83050 SIGUSR1[soft,ping-restart] received, process restarting
                        May 28 01:36:01 openvpn 83050 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
                        May 28 01:36:01 openvpn 83050 TCP/UDP: Preserving recently used remote address: [AF_INET]198.0.75.73:1194
                        May 28 01:36:01 openvpn 83050 UDPv4 link local (bound): [AF_INET]192.168.0.6:0
                        May 28 01:36:01 openvpn 83050 UDPv4 link remote: [AF_INET]198.0.75.73:1194
                        May 28 01:37:01 openvpn 83050 [UNDEF] Inactivity timeout (--ping-restart), restarting
                        May 28 01:37:01 openvpn 83050 SIGUSR1[soft,ping-restart] received, process restarting
                        May 28 01:42:01 openvpn 83050 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
                        May 28 01:42:01 openvpn 83050 TCP/UDP: Preserving recently used remote address: [AF_INET]198.0.75.73:1194
                        May 28 01:42:01 openvpn 83050 UDPv4 link local (bound): [AF_INET]192.168.0.6:0
                        May 28 01:42:01 openvpn 83050 UDPv4 link remote: [AF_INET]198.0.75.73:1194
                        May 28 01:43:02 openvpn 83050 [UNDEF] Inactivity timeout (--ping-restart), restarting
                        May 28 01:43:02 openvpn 83050 SIGUSR1[soft,ping-restart] received, process restarting
                        May 28 01:48:02 openvpn 83050 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
                        May 28 01:48:02 openvpn 83050 TCP/UDP: Preserving recently used remote address: [AF_INET]198.0.75.73:1194
                        May 28 01:48:02 openvpn 83050 UDPv4 link local (bound): [AF_INET]192.168.0.6:0
                        May 28 01:48:02 openvpn 83050 UDPv4 link remote: [AF_INET]198.0.75.73:1194
                        May 28 01:49:02 openvpn 83050 [UNDEF] Inactivity timeout (--ping-restart), restarting
                        May 28 01:49:02 openvpn 83050 SIGUSR1[soft,ping-restart] received, process restarting
                        May 28 01:54:02 openvpn 83050 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
                        May 28 01:54:02 openvpn 83050 TCP/UDP: Preserving recently used remote address: [AF_INET]198.0.75.73:1194
                        May 28 01:54:02 openvpn 83050 UDPv4 link local (bound): [AF_INET]192.168.0.6:0
                        May 28 01:54:02 openvpn 83050 UDPv4 link remote: [AF_INET]198.0.75.73:1194
                        May 28 01:55:02 openvpn 83050 [UNDEF] Inactivity timeout (--ping-restart), restarting
                        May 28 01:55:02 openvpn 83050 SIGUSR1[soft,ping-restart] received, process restarting
                        May 28 02:00:02 openvpn 83050 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
                        May 28 02:00:02 openvpn 83050 TCP/UDP: Preserving recently used remote address: [AF_INET]198.0.75.73:1194
                        May 28 02:00:02 openvpn 83050 UDPv4 link local (bound): [AF_INET]192.168.0.6:0
                        May 28 02:00:02 openvpn 83050 UDPv4 link remote: [AF_INET]198.0.75.73:1194
                        May 28 02:01:02 openvpn 83050 [UNDEF] Inactivity timeout (--ping-restart), restarting
                        May 28 02:01:02 openvpn 83050 SIGUSR1[soft,ping-restart] received, process restarting
                        May 28 02:06:02 openvpn 83050 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
                        May 28 02:06:02 openvpn 83050 TCP/UDP: Preserving recently used remote address: [AF_INET]198.0.75.73:1194
                        May 28 02:06:02 openvpn 83050 UDPv4 link local (bound): [AF_INET]192.168.0.6:0
                        May 28 02:06:02 openvpn 83050 UDPv4 link remote: [AF_INET]198.0.75.73:1194
                        May 28 02:07:02 openvpn 83050 [UNDEF] Inactivity timeout (--ping-restart), restarting
                        May 28 02:07:02 openvpn 83050 SIGUSR1[soft,ping-restart] received, process restarting
                        May 28 02:12:02 openvpn 83050 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
                        May 28 02:12:02 openvpn 83050 TCP/UDP: Preserving recently used remote address: [AF_INET]198.0.75.73:1194
                        May 28 02:12:02 openvpn 83050 UDPv4 link local (bound): [AF_INET]192.168.0.6:0
                        May 28 02:12:02 openvpn 83050 UDPv4 link remote: [AF_INET]198.0.75.73:1194
                        May 28 02:13:02 openvpn 83050 [UNDEF] Inactivity timeout (--ping-restart), restarting
                        May 28 02:13:02 openvpn 83050 SIGUSR1[soft,ping-restart] received, process restarting
                        May 28 02:18:02 openvpn 83050 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
                        May 28 02:18:02 openvpn 83050 TCP/UDP: Preserving recently used remote address: [AF_INET]198.0.75.73:1194
                        May 28 02:18:02 openvpn 83050 UDPv4 link local (bound): [AF_INET]192.168.0.6:0
                        May 28 02:18:02 openvpn 83050 UDPv4 link remote: [AF_INET]198.0.75.73:1194
                        May 28 02:19:02 openvpn 83050 [UNDEF] Inactivity timeout (--ping-restart), restarting
                        May 28 02:19:02 openvpn 83050 SIGUSR1[soft,ping-restart] received, process restarting
                        May 28 02:24:02 openvpn 83050 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
                        May 28 02:24:02 openvpn 83050 TCP/UDP: Preserving recently used remote address: [AF_INET]198.0.75.73:1194
                        May 28 02:24:02 openvpn 83050 UDPv4 link local (bound): [AF_INET]192.168.0.6:0

                        V 1 Reply Last reply Reply Quote 0
                        • V
                          viragomann @ronlee
                          last edited by

                          @ronlee
                          Not clear, what's going on there. Neither a failure nor a success message is logged.

                          Do you see any connection attempt from the client in the server log?

                          R 1 Reply Last reply Reply Quote 0
                          • R
                            ronlee @viragomann
                            last edited by

                            @viragomann I'm assuming that the connection attempts would show in the OpenVPN portion of the logs, yes? There is nothing there.

                            V 1 Reply Last reply Reply Quote 0
                            • V
                              viragomann @ronlee
                              last edited by

                              @ronlee
                              Yes, the OpenVPN log. If there is nothing I think, there is no packet arriving on its WAN interface.

                              You can run a packet capture on WAN to verify.

                              R 1 Reply Last reply Reply Quote 0
                              • R
                                ronlee @viragomann
                                last edited by

                                @viragomann I lost patience and just rebuilt the OpenVPN tunnel completely. In hindsight, I suspect that merely reimporting the TLS key from the server on the client side would've done it. Thanks very much for your help.

                                1 Reply Last reply Reply Quote 0
                                • First post
                                  Last post
                                Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.