Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Openvpn not working after upgrade to 2.1

    Scheduled Pinned Locked Moved OpenVPN
    23 Posts 7 Posters 9.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      s0dhi
      last edited by

      I am experiencing a similar scenario.  I also used the OpenVPN Exporter prior to the upgrade to configure the clients.

      OpenVPN was working well prior to the upgrade but post upgrade, it works but no longer forces all traffic through the VPN as it used to.  In general, all of the resources on my network are still accessible as before, just the traffic is not properly forced through the VPN.  :-\

      1 Reply Last reply Reply Quote 0
      • K
        kejianshi
        last edited by

        Yeah - I might go to my server configuration and click the:

        redirect gateway:  Force all client generated traffic through the tunnel.

        1 Reply Last reply Reply Quote 0
        • S
          s0dhi
          last edited by

          @kejianshi:

          Yeah - I might go to my server configuration and click the:

          redirect gateway:  Force all client generated traffic through the tunnel.

          I've tried it both ways and it doesn't appear to be working as before.  I've also tried the command:

          push "redirect-gateway def1"

          in the advanced section but the results are the same either way.

          1 Reply Last reply Reply Quote 0
          • K
            kejianshi
            last edited by

            No idea - So far 2 people have settings posed - may as well make it three.

            Its hard to know whats up without settings.

            1 Reply Last reply Reply Quote 0
            • P
              phil.davis
              last edited by

              @vradelos:

              And the rules

              The rule on the OpenVPN tab is pushing the traffic out to WANGW. There should be no gateway specified there. Edit the rule and remove the gateway selection from the advanced section.
              The same thing seems to have happen to a rule on WAN - but that rule probably doesn't break anything because the traffic that matches it is the incoming connects to the OpenVPN server on the firewall itself, so the real packets are probably beinf delivered locally to the OpenVPN server and not getting processed out back to WANGW. You should remove the gateway from that also, just to be sure.
              It would be very interesting to see what these rules looked like in 2.0.n before the upgrade. Is there something in the upgrade that is picking selecting a gateway all by itself? or what?

              As the Greek philosopher Isosceles used to say, "There are 3 sides to every triangle."
              If I helped you, then help someone else - buy someone a gift from the INF catalog http://secure.inf.org/gifts/usd/

              1 Reply Last reply Reply Quote 0
              • V
                vradelos
                last edited by

                That was the problem Phil thank you! I really can't remember what the rules looked like before the upgrade. The thing is that the rules were created with the wizard and since everything worked before the upgrade,they had to be correct right?So something during the upgrade messed the rules up.

                1 Reply Last reply Reply Quote 0
                • P
                  phil.davis
                  last edited by

                  Do you have a backup of the config from 2.0.n?
                  It would be good to see what the rules were like previously - rules section and the interfaces and gateways section.

                  As the Greek philosopher Isosceles used to say, "There are 3 sides to every triangle."
                  If I helped you, then help someone else - buy someone a gift from the INF catalog http://secure.inf.org/gifts/usd/

                  1 Reply Last reply Reply Quote 0
                  • V
                    vradelos
                    last edited by

                    Below is a chunk of the 2.0.3 backup containing the openvpn wizard rules(if i'm not mistaken).It looks like the gateway was not set  to WANGW before the upgrade.

                    • <rule><id><type>pass</type>
                        <interface>openvpn</interface>
                        <tag><tagged><max><max-src-nodes><max-src-conn><max-src-states><statetimeout><statetype>keep state</statetype>
                        <os>- <source>
                        <any>- <destination><any></any></destination>

                    • <descr>-   ]]></descr>
                        <associated-rule-id>nat_51e92376013d09.00644968</associated-rule-id></any></os></statetimeout></max-src-states></max-src-conn></max-src-nodes></max></tagged></tag></id></rule>

                    • <filter>- <rule><id><type>pass</type>
                        <interface>wan</interface>
                        <tag><tagged><max><max-src-nodes><max-src-conn><max-src-states><statetimeout><statetype>keep state</statetype>
                        <os><protocol>udp</protocol>

                    • <source>
                        <any>- <destination><network>wanip</network>
                        <port>1194</port></destination>

                    • <descr>-   ]]></descr></any></os></statetimeout></max-src-states></max-src-conn></max-src-nodes></max></tagged></tag></id></rule></filter>

                    1 Reply Last reply Reply Quote 0
                    • H
                      Honeybadger
                      last edited by

                      I am sorry, a little lost by the solution.

                      OpenVPN tab? and do what? In there I see gateway in advanced but have the options of default or ppoe…

                      How do I select "none"?

                      1 Reply Last reply Reply Quote 0
                      • P
                        phil.davis
                        last edited by

                        @Honeybadger:

                        I am sorry, a little lost by the solution.

                        OpenVPN tab? and do what? In there I see gateway in advanced but have the options of default or ppoe…

                        How do I select "none"?

                        Rules on the OpenVPN tab apply to incoming traffic from the client/s to the server. In the advanced section of the rule(s) the gateway should normally just be "default" (there is no "none"). "default" will send the packets to the ordinary routing table, which is what you usually want.

                        As the Greek philosopher Isosceles used to say, "There are 3 sides to every triangle."
                        If I helped you, then help someone else - buy someone a gift from the INF catalog http://secure.inf.org/gifts/usd/

                        1 Reply Last reply Reply Quote 0
                        • H
                          Honeybadger
                          last edited by

                          Oh, darn.

                          Hoped this would fix my OpenVPN setup that stopped working post 2.1 upgrade.

                          Looks like the same set up as these guys.

                          1 Reply Last reply Reply Quote 0
                          • K
                            kejianshi
                            last edited by

                            Whats wrong with yours?

                            1 Reply Last reply Reply Quote 0
                            • H
                              Honeybadger
                              last edited by

                              Was working before 2.1 upgrade…

                              Not I don't think it even sees the attemp to link, the log doesn't show any attempt:
                              Sep 24 13:37:30 openvpn[306]: Initialization Sequence Completed
                              Sep 24 13:37:30 openvpn[306]: UDPv4 link remote: [undef]
                              Sep 24 13:37:30 openvpn[306]: UDPv4 link local (bound): [AF_INET]93.222.11.20:1194
                              Sep 24 13:37:30 openvpn[98937]: /usr/local/sbin/ovpn-linkup ovpns1 1500 1558 192.168.200.1 192.168.200.2 init
                              Sep 24 13:37:30 openvpn[98937]: /sbin/ifconfig ovpns1 192.168.200.1 192.168.200.2 mtu 1500 netmask 255.255.255.255 up
                              Sep 24 13:37:30 openvpn[98937]: do_ifconfig, tt->ipv6=1, tt->did_ifconfig_ipv6_setup=0
                              Sep 24 13:37:30 openvpn[98937]: TUN/TAP device /dev/tun1 opened
                              Sep 24 13:37:30 openvpn[98937]: TUN/TAP device ovpns1 exists previously, keep at program end
                              Sep 24 13:37:30 openvpn[98937]: Control Channel Authentication: using '/var/etc/openvpn/server1.tls-auth' as a OpenVPN static key file
                              Sep 24 13:37:29 openvpn[98937]: NOTE: the current –script-security setting may allow this configuration to call user-defined scripts
                              Sep 24 13:37:29 openvpn[98937]: OpenVPN 2.3.2 i386-portbld-freebsd8.3 [SSL (OpenSSL)] [LZO] [eurephia] [MH] [IPv6] built on Jul 24 2013
                              Sep 24 13:37:28 openvpn[62798]: SIGTERM[hard,] received, process exiting
                              Sep 24 13:37:28 openvpn[62798]: /usr/local/sbin/ovpn-linkdown ovpns1 1500 1558 192.168.200.1 192.168.200.2 init
                              Sep 24 13:37:28 openvpn[62798]: event_wait : Interrupted system call (code=4)
                              Sep 24 13:36:12 openvpn[62798]: Initialization Sequence Completed
                              Sep 24 13:36:12 openvpn[62798]: UDPv4 link remote: [undef]
                              Sep 24 13:36:12 openvpn[62798]: UDPv4 link local (bound): [AF_INET]93.222.11.20:1194
                              Sep 24 13:36:11 openvpn[61611]: /usr/local/sbin/ovpn-linkup ovpns1 1500 1558 192.168.200.1 192.168.200.2 init
                              Sep 24 13:36:11 openvpn[61611]: /sbin/ifconfig ovpns1 192.168.200.1 192.168.200.2 mtu 1500 netmask 255.255.255.255 up
                              Sep 24 13:36:11 openvpn[61611]: do_ifconfig, tt->ipv6=1, tt->did_ifconfig_ipv6_setup=0
                              Sep 24 13:36:11 openvpn[61611]: TUN/TAP device /dev/tun1 opened
                              Sep 24 13:36:11 openvpn[61611]: TUN/TAP device ovpns1 exists previously, keep at program end
                              Sep 24 13:36:11 openvpn[61611]: Control Channel Authentication: using '/var/etc/openvpn/server1.tls-auth' as a OpenVPN static key file
                              Sep 24 13:36:10 openvpn[61611]: NOTE: the current –script-security setting may allow this configuration to call user-defined scripts
                              Sep 24 13:36:10 openvpn[61611]: OpenVPN 2.3.2 i386-portbld-freebsd8.3 [SSL (OpenSSL)] [LZO] [eurephia] [MH] [IPv6] built on Jul 24 2013
                              Sep 24 13:36:10 openvpn[59284]: SIGTERM[hard,] received, process exiting
                              Sep 24 13:36:09 openvpn[59284]: /usr/local/sbin/ovpn-linkdown ovpns1 1500 1558 192.168.200.1 192.168.200.2 init
                              Sep 24 13:36:09 openvpn[59284]: event_wait : Interrupted system call (code=4)

                              Thanks for asking and helping!

                              1 Reply Last reply Reply Quote 0
                              • I
                                Indigo64
                                last edited by

                                I normally only post to these forums when I have a problem, so I feel pretty excited that I can post a possible fix for OpenVPN issues.  I realize this isn't going to be a catch-all fix, but be sure you don't change too much if you have problems with 2.1 after upgrading.

                                In my case, I have pfsense at my house and my mom's house - the link works fine on 2.x and I had it working flawlessly for several months.  A friend of mine says "hey, 2.1 is out, and I've been running fine" - so being like most geeks that take their friends at face value, I said "OKAY!"

                                I upgraded my mom's connection first - all was well.  the VPN link still worked fine.  So I upgraded mine.  Fark.  That broke the OpenVPN link.  Both sides would report the link as being down.

                                Fortunately I had a Dynamic DNS client installed on a management PC on her network and I connected to discover that the link was indeed down.

                                Turns out that the upgrade had ONLY wiped the configuration data under  VPN > OpenVPN > Client > Edit > Advanced was empty

                                I followed the tooltip there and entered the remote IP of MY network (the "host" network) plus the OpenVPN port of 1194 and hit save.  Within mere seconds the link was restored.

                                I realize this may not work for everyone, but keep in mind the first rule of troubleshooting - start with the easiest solution first and go from there.

                                1 Reply Last reply Reply Quote 0
                                • H
                                  Honeybadger
                                  last edited by

                                  I don't seem to have a client section at all, blank.

                                  Don't remember if I did have anything there.

                                  1 Reply Last reply Reply Quote 0
                                  • K
                                    kejianshi
                                    last edited by

                                    It depends.  Your server is pfsense, but is the client like a windows machine or linux or something or is the client another pfsense?

                                    If the client is pfsense, one end will have a server config and the client side will have a client config.

                                    If not, then your pfsense will only have a server config and the client runs on windows or whatever.

                                    1 Reply Last reply Reply Quote 0
                                    • K
                                      kejianshi
                                      last edited by

                                      I'd need to see your server configuration to know what is wrong.  Also, what kind of OS is the client?

                                      1 Reply Last reply Reply Quote 0
                                      • H
                                        Honeybadger
                                        last edited by

                                        Never mind all, turned out to be some weird problem updating between my server and my DDNS service.

                                        All solved now and thanks!

                                        1 Reply Last reply Reply Quote 0
                                        • First post
                                          Last post
                                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.