Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    OpenVPN Stops working

    Scheduled Pinned Locked Moved OpenVPN
    16 Posts 3 Posters 14.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • B
      Beach
      last edited by

      No no, I just wanted to tell you that my home PfSense works perfect with road warriors.
      I never stops, just runs fine.

      It’s my PfSense for the company witch stops frequently, and the log is from this machine.
      It looks like ifconfig wont work for OpenVPN and then no road warriors can connect.
      The error is in the top of the log.
      It has worked to connect now for two days since last reboot.

      Could it be that I have 2 OpenVPN instances running on 2 different ports 1194 and 1195?
      So I will gladly give you more information but I’m not sure that config-files for both will help.
      Please let me know what you need more.

      1 Reply Last reply Reply Quote 0
      • GruensFroeschliG
        GruensFroeschli
        last edited by

        What i mean is the logoutput from the machine where the error occurs tells me that you're running 2 instances of OpenVPN runneing (You have tun0 and tun1)

        This line
        Jul 25 20:34:22 openvpn[418]: /sbin/ifconfig tun0 xx.xx.xx.xx xx.xx.xx.xx mtu 1500 netmask 255.255.255.255 up
        Seems a bit strange.
        I'm not sure, but maybe a /32 ifconfig could lead to the problem you describe.
        What do you have in the config file of the tun0 interface?

        We do what we must, because we can.

        Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

        1 Reply Last reply Reply Quote 0
        • B
          Beach
          last edited by

          Ifconfig (for the moment when it works):
          tun0: flags=8051 <up,pointopoint,running,multicast>mtu 1500
          inet6 fe80::215:17ff:fe62:a3e4%tun0 prefixlen 64 scopeid 0xb
          inet xxx.xxx.x5x.1 –> xxx.xxx.x5x.2 netmask 0xffffffff
          Opened by PID 418
          tun1: flags=8051 <up,pointopoint,running,multicast>mtu 1500
          inet6 fe80::215:17ff:fe62:a3e4%tun1 prefixlen 64 scopeid 0xc
          inet xxx.xxx.x6x.1 --> xxx.xxx.x6x.2 netmask 0xffffffff
          Opened by PID 431

          OpemVPN log
          Aug 21 10:22:56 openvpn[431]: Initialization Sequence Completed
          Aug 21 10:22:56 openvpn[431]: TCPv4_SERVER link remote: [undef]
          Aug 21 10:22:56 openvpn[431]: TCPv4_SERVER link local (bound): [undef]:1195
          Aug 21 10:22:56 openvpn[431]: Listening for incoming TCP connection on [undef]:1195
          Aug 21 10:22:56 openvpn[418]: Initialization Sequence Completed
          Aug 21 10:22:56 openvpn[418]: TCPv4_SERVER link remote: [undef]
          Aug 21 10:22:56 openvpn[418]: TCPv4_SERVER link local (bound): [undef]:1194
          Aug 21 10:22:56 openvpn[418]: Listening for incoming TCP connection on [undef]:1194
          Aug 21 10:22:56 openvpn[431]: /etc/rc.filter_configure tun1 1500 1544 xxx.xxx.x6x.1 xxx.xxx.x6x.2 init
          Aug 21 10:22:56 openvpn[431]: /sbin/ifconfig tun1 xxx.xxx.x6x.1 xxx.xxx.x6x.2 mtu 1500 netmask 255.255.255.255 up
          Aug 21 10:22:56 openvpn[431]: TUN/TAP device /dev/tun1 opened
          Aug 21 10:22:56 openvpn[431]: gw xxx.xxx.xxx.xxx
          Aug 21 10:22:56 openvpn[431]: WARNING: file '/var/etc/openvpn_server1.key' is group or others accessible
          Aug 21 10:22:56 openvpn[418]: /etc/rc.filter_configure tun0 1500 1544 xxx.xxx.x5x.1 xxx.xxx.x5x.2 init
          Aug 21 10:22:56 openvpn[418]: /sbin/ifconfig tun0 xxx.xxx.x5x.1 xxx.xxx.x5x.2 mtu 1500 netmask 255.255.255.255 up
          Aug 21 10:22:56 openvpn[418]: TUN/TAP device /dev/tun0 opened
          Aug 21 10:22:56 openvpn[418]: gw xxx.xxx.xxx.xxx
          Aug 21 10:22:56 openvpn[418]: WARNING: file '/var/etc/openvpn_server0.key' is group or others accessible
          Aug 21 10:22:55 openvpn[431]: OpenVPN 2.0.6 i386-portbld-freebsd6.2 [SSL] [LZO] built on Sep 13 2007
          Aug 21 10:22:55 openvpn[431]: SIGHUP[hard,] received, process restarting

          Thanks in advance

          1194.JPG
          1194.JPG_thumb
          1195.JPG
          1195.JPG_thumb</up,pointopoint,running,multicast></up,pointopoint,running,multicast>

          1 Reply Last reply Reply Quote 0
          • K
            kpa
            last edited by

            You're using the same network for local network and address pool, that is not going to work (or may work until something breaks because of conflicts in address spaces). Make up some private address space networks for the address pools (for example 10.10.5.0/24 and 10.10.6.0/24) that do not overlap with the LAN address spaces.

            1 Reply Last reply Reply Quote 0
            • B
              Beach
              last edited by

              Hi!

              Nope it's not the same fx. 10.11.150.0/24 and 10.11.15.0/24

              1 Reply Last reply Reply Quote 0
              • K
                kpa
                last edited by

                Ok sorry, you were just masking the addresses in a way that it looked like they were the same  8) Btw, no need to mask private addresses in screenshots, nobody will be able to use them anyway since they are private to your own network.

                1 Reply Last reply Reply Quote 0
                • B
                  Beach
                  last edited by

                  Ok, no problem!
                  I'll keep that in mind.

                  1 Reply Last reply Reply Quote 0
                  • K
                    kpa
                    last edited by

                    One thing came to my mind, have you tried with UDP instead of TCP? UDP is potentially more secure (with tls-auth key) and faster.

                    1 Reply Last reply Reply Quote 0
                    • B
                      Beach
                      last edited by

                      Thanks!
                      No I haven't tried that, and I'm not so sure that it's the problem with ipconfig.
                      Do you think that I should try it?

                      1 Reply Last reply Reply Quote 0
                      • K
                        kpa
                        last edited by

                        Ok I forgot about those ifconfig errors… I would redo the tunnels from scratch, first delete both of them and then reboot the firewall to make sure nothing is left dangling behind and then recreate them with the same details and then see if it starts working.

                        1 Reply Last reply Reply Quote 0
                        • B
                          Beach
                          last edited by

                          Thanks m8!

                          I will try this, but I can't do it until tomorrow (it's 19:11 here and I'm not a work)
                          I suppose that it will take some days to see any results, but I'll be back!

                          1 Reply Last reply Reply Quote 0
                          • B
                            Beach
                            last edited by

                            Hi again!

                            After I deleted the settings and rebooted, I configurerd it again with the same settings.
                            It's still working after nearly 3 weeks, so I hope that this was the solution.

                            Thanks to kpa and GruensFroeschli for helping me!!!

                            Regards
                            Beach

                            1 Reply Last reply Reply Quote 0
                            • B
                              Beach
                              last edited by

                              Hi folks!

                              Same problem again, I haven't done anything with the FW since my last post.
                              So my solution now is to remove one instance of OpenVPN and only use one.

                              I have another PfSense with OpenVPN at home that has been working with one instance since march this year.

                              So it could be a limit in OpenVPN, and hopefully it will be solved in 1.2.1 or 1.3.

                              Regards
                              Beach

                              1 Reply Last reply Reply Quote 0
                              • First post
                                Last post
                              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.