Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    OpenVPN Stops working

    Scheduled Pinned Locked Moved
    OpenVPN
    3
    16
    14.2k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • GruensFroeschliG
      GruensFroeschli
      last edited by

      You seem to be using 2 server/clients at the same time.

      Can you post the config-files for both?

      Also a diagramm of which subnet where, what connected to what, the ultimate goal with this setup, generally more infos than just this log, would be nice :)

      We do what we must, because we can.

      Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

      1 Reply Last reply Reply Quote 0
      • B
        Beach
        last edited by

        No no, I just wanted to tell you that my home PfSense works perfect with road warriors.
        I never stops, just runs fine.

        It’s my PfSense for the company witch stops frequently, and the log is from this machine.
        It looks like ifconfig wont work for OpenVPN and then no road warriors can connect.
        The error is in the top of the log.
        It has worked to connect now for two days since last reboot.

        Could it be that I have 2 OpenVPN instances running on 2 different ports 1194 and 1195?
        So I will gladly give you more information but I’m not sure that config-files for both will help.
        Please let me know what you need more.

        1 Reply Last reply Reply Quote 0
        • GruensFroeschliG
          GruensFroeschli
          last edited by

          What i mean is the logoutput from the machine where the error occurs tells me that you're running 2 instances of OpenVPN runneing (You have tun0 and tun1)

          This line
          Jul 25 20:34:22 openvpn[418]: /sbin/ifconfig tun0 xx.xx.xx.xx xx.xx.xx.xx mtu 1500 netmask 255.255.255.255 up
          Seems a bit strange.
          I'm not sure, but maybe a /32 ifconfig could lead to the problem you describe.
          What do you have in the config file of the tun0 interface?

          We do what we must, because we can.

          Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

          1 Reply Last reply Reply Quote 0
          • B
            Beach
            last edited by

            Ifconfig (for the moment when it works):
            tun0: flags=8051 <up,pointopoint,running,multicast>mtu 1500
            inet6 fe80::215:17ff:fe62:a3e4%tun0 prefixlen 64 scopeid 0xb
            inet xxx.xxx.x5x.1 –> xxx.xxx.x5x.2 netmask 0xffffffff
            Opened by PID 418
            tun1: flags=8051 <up,pointopoint,running,multicast>mtu 1500
            inet6 fe80::215:17ff:fe62:a3e4%tun1 prefixlen 64 scopeid 0xc
            inet xxx.xxx.x6x.1 --> xxx.xxx.x6x.2 netmask 0xffffffff
            Opened by PID 431

            OpemVPN log
            Aug 21 10:22:56 openvpn[431]: Initialization Sequence Completed
            Aug 21 10:22:56 openvpn[431]: TCPv4_SERVER link remote: [undef]
            Aug 21 10:22:56 openvpn[431]: TCPv4_SERVER link local (bound): [undef]:1195
            Aug 21 10:22:56 openvpn[431]: Listening for incoming TCP connection on [undef]:1195
            Aug 21 10:22:56 openvpn[418]: Initialization Sequence Completed
            Aug 21 10:22:56 openvpn[418]: TCPv4_SERVER link remote: [undef]
            Aug 21 10:22:56 openvpn[418]: TCPv4_SERVER link local (bound): [undef]:1194
            Aug 21 10:22:56 openvpn[418]: Listening for incoming TCP connection on [undef]:1194
            Aug 21 10:22:56 openvpn[431]: /etc/rc.filter_configure tun1 1500 1544 xxx.xxx.x6x.1 xxx.xxx.x6x.2 init
            Aug 21 10:22:56 openvpn[431]: /sbin/ifconfig tun1 xxx.xxx.x6x.1 xxx.xxx.x6x.2 mtu 1500 netmask 255.255.255.255 up
            Aug 21 10:22:56 openvpn[431]: TUN/TAP device /dev/tun1 opened
            Aug 21 10:22:56 openvpn[431]: gw xxx.xxx.xxx.xxx
            Aug 21 10:22:56 openvpn[431]: WARNING: file '/var/etc/openvpn_server1.key' is group or others accessible
            Aug 21 10:22:56 openvpn[418]: /etc/rc.filter_configure tun0 1500 1544 xxx.xxx.x5x.1 xxx.xxx.x5x.2 init
            Aug 21 10:22:56 openvpn[418]: /sbin/ifconfig tun0 xxx.xxx.x5x.1 xxx.xxx.x5x.2 mtu 1500 netmask 255.255.255.255 up
            Aug 21 10:22:56 openvpn[418]: TUN/TAP device /dev/tun0 opened
            Aug 21 10:22:56 openvpn[418]: gw xxx.xxx.xxx.xxx
            Aug 21 10:22:56 openvpn[418]: WARNING: file '/var/etc/openvpn_server0.key' is group or others accessible
            Aug 21 10:22:55 openvpn[431]: OpenVPN 2.0.6 i386-portbld-freebsd6.2 [SSL] [LZO] built on Sep 13 2007
            Aug 21 10:22:55 openvpn[431]: SIGHUP[hard,] received, process restarting

            Thanks in advance

            1194.JPG
            1194.JPG_thumb
            1195.JPG
            1195.JPG_thumb</up,pointopoint,running,multicast></up,pointopoint,running,multicast>

            1 Reply Last reply Reply Quote 0
            • K
              kpa
              last edited by

              You're using the same network for local network and address pool, that is not going to work (or may work until something breaks because of conflicts in address spaces). Make up some private address space networks for the address pools (for example 10.10.5.0/24 and 10.10.6.0/24) that do not overlap with the LAN address spaces.

              1 Reply Last reply Reply Quote 0
              • B
                Beach
                last edited by

                Hi!

                Nope it's not the same fx. 10.11.150.0/24 and 10.11.15.0/24

                1 Reply Last reply Reply Quote 0
                • K
                  kpa
                  last edited by

                  Ok sorry, you were just masking the addresses in a way that it looked like they were the same  8) Btw, no need to mask private addresses in screenshots, nobody will be able to use them anyway since they are private to your own network.

                  1 Reply Last reply Reply Quote 0
                  • B
                    Beach
                    last edited by

                    Ok, no problem!
                    I'll keep that in mind.

                    1 Reply Last reply Reply Quote 0
                    • K
                      kpa
                      last edited by

                      One thing came to my mind, have you tried with UDP instead of TCP? UDP is potentially more secure (with tls-auth key) and faster.

                      1 Reply Last reply Reply Quote 0
                      • B
                        Beach
                        last edited by

                        Thanks!
                        No I haven't tried that, and I'm not so sure that it's the problem with ipconfig.
                        Do you think that I should try it?

                        1 Reply Last reply Reply Quote 0
                        • K
                          kpa
                          last edited by

                          Ok I forgot about those ifconfig errors… I would redo the tunnels from scratch, first delete both of them and then reboot the firewall to make sure nothing is left dangling behind and then recreate them with the same details and then see if it starts working.

                          1 Reply Last reply Reply Quote 0
                          • B
                            Beach
                            last edited by

                            Thanks m8!

                            I will try this, but I can't do it until tomorrow (it's 19:11 here and I'm not a work)
                            I suppose that it will take some days to see any results, but I'll be back!

                            1 Reply Last reply Reply Quote 0
                            • B
                              Beach
                              last edited by

                              Hi again!

                              After I deleted the settings and rebooted, I configurerd it again with the same settings.
                              It's still working after nearly 3 weeks, so I hope that this was the solution.

                              Thanks to kpa and GruensFroeschli for helping me!!!

                              Regards
                              Beach

                              1 Reply Last reply Reply Quote 0
                              • B
                                Beach
                                last edited by

                                Hi folks!

                                Same problem again, I haven't done anything with the FW since my last post.
                                So my solution now is to remove one instance of OpenVPN and only use one.

                                I have another PfSense with OpenVPN at home that has been working with one instance since march this year.

                                So it could be a limit in OpenVPN, and hopefully it will be solved in 1.2.1 or 1.3.

                                Regards
                                Beach

                                1 Reply Last reply Reply Quote 0
                                • First post
                                  Last post