Openvpn not working after upgrade to 2.0-RC3 (i386) built on Wed Aug 3 01:54:50

tommie

Dear,

I am using the RC3 release for some weeks and without any problem. We have upgraded 2 of our offside sites without any problem. However we are now upgrading our main pfsenses at HQ (which were on RC1) which are the openvpn servers for site-to-site vpns.

We upgraded our secondary and tried to establish a connection but it fails. On the remote site, I found something different in the logs…

When we connect to our HQ RC1 pfsense, we find the following in the logs:


Aug 3 19:57:26 	openvpn[31106]: TUN/TAP device /dev/tun1 opened
Aug 3 19:57:26 	openvpn[31106]: do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Aug 3 19:57:26 	openvpn[31106]: /sbin/ifconfig ovpnc1 10.1.3.2 10.1.3.1 mtu 1500 netmask 255.255.255.255 up
Aug 3 19:57:26 	openvpn[31106]: /usr/local/sbin/ovpn-linkup ovpnc1 1500 1557 10.1.3.2 10.1.3.1 init
Aug 3 19:57:26 	openvpn[31106]: ERROR: FreeBSD route add command failed: external program exited with error status: 1
Aug 3 19:57:26 	openvpn[31106]: Initialization Sequence Completed

However after we upgraded the pfsense at HQ to RC3, we find the following:


Aug 3 19:46:15 	openvpn[1105]: TUN/TAP device /dev/tun1 opened
Aug 3 19:46:15 	openvpn[1105]: do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Aug 3 19:46:15 	openvpn[1105]: /sbin/ifconfig ovpnc1 10.1.3.6 10.1.3.5 mtu 1500 netmask 255.255.255.255 up
Aug 3 19:46:15 	openvpn[1105]: /usr/local/sbin/ovpn-linkup ovpnc1 1500 1557 10.1.3.6 10.1.3.5 init
Aug 3 19:46:15 	openvpn[1105]: ERROR: FreeBSD route add command failed: external program exited with error status: 1
Aug 3 19:46:15 	openvpn[1105]: Initialization Sequence Completed

It is using other ips (10.1.3.6 and not 10.1.3.2) than before so what am I missing here. What has changed?

If I look on the RC3 at HQ I find:


openvpn[44520]: xxx.xxx.xxx.xxx:10030 SENT CONTROL [vpn]: 'PUSH_REPLY,route 10.1.0.0 255.255.255.0,route 10.1.3.1,topology net30,ping 10,ping-restart 60,ifconfig 10.1.3.6 10.1.3.5' (status=1)

The subnet mask used is 10.1.3.0/29

So maybe I am missing sth here?

Thanks!

jimp

Are you using SSL/TLS? For a tunnel between two sites only? Then you should be using a /30 subnet there, not /29.