Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Windows OpenVPN Disconnects After 1 Hour Despite reneg-sec Settings

    OpenVPN
    4
    14
    262
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • V
      viragomann @mcury
      last edited by

      @mcury
      Works pretty well.

      Doesn't your Windows client renegotiation anyway without this?
      I didn't succeed with only setting a high reneg time on the server.

      Is this setting compatible with 2.7.2 pfSense version ?

      To be honest, I have set this on OPNsense with OpenVPN 2.6.13. So I guess, it might work in pfSense 2.7.2 as well.

      M 1 Reply Last reply Reply Quote 0
      • P
        philippe richard
        last edited by

        Thank you all for your quick help. I'll try that right away and get back to you.

        1 Reply Last reply Reply Quote 0
        • M
          mcury @viragomann
          last edited by mcury

          @viragomann said in Windows OpenVPN Disconnects After 1 Hour Despite reneg-sec Settings:

          Doesn't your Windows client renegotiation anyway without this?

          I just configured openVPN, still in the implementation phase, so I wouldn't know about renegotiation, I'll be looking for that in the logs now.

          Also, no information about that auth-gen-token option in Netgate documentation.

          I configured auth-gen-token; only, with no parameters to test.

          dead on arrival, nowhere to be found.

          V 1 Reply Last reply Reply Quote 0
          • V
            viragomann @mcury
            last edited by

            @mcury said in Windows OpenVPN Disconnects After 1 Hour Despite reneg-sec Settings:

            Also, no information about that auth-gen-token option in Netgate documentation.

            The option useful, when using 2FA with TOTP. Maybe it's not mentioned in the docs, because pfsense doesn't support OTP authentication natively.
            Without this option the client use the password for the renegotiation. However, the TOTP is considered a part of the password and is not valid anymore then. Hence you would have to enter a now OTP.

            M P 2 Replies Last reply Reply Quote 1
            • M
              mcury @viragomann
              last edited by

              @viragomann said in Windows OpenVPN Disconnects After 1 Hour Despite reneg-sec Settings:

              Without this option the client use the password for the renegotiation. However, the TOTP is considered a part of the password and is not valid anymore then. Hence you would have to enter a now OTP.

              I removed reneg-sec and now using auth-gen-token to test.
              Currently using freeradius OTP googleauth for openvpn clients using the tutorial mentioned above, I'll be watching closely for any complaints and will report back if I see something.

              Really thanks viargomann 👍
              Learning something new everyday =)

              dead on arrival, nowhere to be found.

              1 Reply Last reply Reply Quote 0
              • P
                philippe richard @viragomann
                last edited by

                @viragomann

                I'm back, thank you very much. The 'auth-gen-token 57600' command works perfectly. My Windows OpenVPN client is still connected after 1 hour and 30 minutes of connection.

                1 Reply Last reply Reply Quote 0
                • P
                  philippe richard @viragomann
                  last edited by

                  @viragomann
                  Hello,
                  I'd like to know if this command is compatible with 'Client Specific Overrides' if I need to configure custom disconnection settings for individual clients.

                  Thank you.

                  V 1 Reply Last reply Reply Quote 0
                  • V
                    viragomann @philippe richard
                    last edited by

                    @philippe-richard
                    I cannot think of any reason, why this should not be compatible with CSO. It just changes the authentication renegotiation process to use an auth token instead of OTP+password.

                    P P 2 Replies Last reply Reply Quote 1
                    • P
                      philippe richard @viragomann
                      last edited by

                      @viragomann
                      Thank you for your help.

                      1 Reply Last reply Reply Quote 0
                      • P
                        phil80 @viragomann
                        last edited by

                        @viragomann said in Windows OpenVPN Disconnects After 1 Hour Despite reneg-sec Settings:

                        @philippe-richard
                        I cannot think of any reason, why this should not be compatible with CSO. It just changes the authentication renegotiation process to use an auth token instead of OTP+password.

                        Thank you for the help
                        By the way, at least in Android, you cannot currently set this option in the client, it gets ignored with an out of context error in logs
                        Also, I cannot get OpenVPN Connect app to work properly with it. However, OpenVPN for Android app does work

                        This is discussed in this redmine issue:
                        https://redmine.pfsense.org/issues/12466#change-76474

                        And further dscussion about reneg-sec is here:
                        https://redmine.pfsense.org/issues/13293#change-76475

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.