Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Openvpn issue - site 2 site

    Scheduled Pinned Locked Moved 2.3-RC Snapshot Feedback and Issues - ARCHIVED
    59 Posts 3 Posters 15.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      maverick_slo
      last edited by

      Shared key works for me, SSL/TLS not.

      1 Reply Last reply Reply Quote 0
      • M
        maverick_slo
        last edited by

        In addition, when changing modes (shared key to ssl/tls) firefox needs like 15 seconds to display other options while IE changes options instantly.

        EDIT:
        This only happens on firefox NIGHTLY build, so nevermind that.

        1 Reply Last reply Reply Quote 0
        • M
          maverick_slo
          last edited by

          Configs:

          Working shared key server config:

          dev ovpns2
verb 1
dev-type tun
tun-ipv6
dev-node /dev/tun2
writepid /var/run/openvpn_server2.pid
#user nobody
#group nobody
script-security 3
daemon
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
proto udp
cipher AES-128-CBC
auth SHA1
up /usr/local/sbin/ovpn-linkup
down /usr/local/sbin/ovpn-linkdown
local MY WAN IP
ifconfig 172.16.91.1 172.16.91.2
lport 1199
management /var/etc/openvpn/server2.sock unix
push "route 10.10.0.0 255.255.255.0"
route 192.168.1.0 255.255.255.0
secret /var/etc/openvpn/server2.secret 
comp-lzo adaptive

          Not working SSL/TLS config:

          dev ovpns2
verb 1
dev-type tun
tun-ipv6
dev-node /dev/tun2
writepid /var/run/openvpn_server2.pid
#user nobody
#group nobody
script-security 3
daemon
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
proto udp
cipher AES-128-CBC
auth SHA1
up /usr/local/sbin/ovpn-linkup
down /usr/local/sbin/ovpn-linkdown
local MY WAN IP
tls-server
ifconfig 172.16.91.1 172.16.91.2
lport 1199
management /var/etc/openvpn/server2.sock unix
push "route 10.10.0.0 255.255.255.0"
route 192.168.1.0 255.255.255.0
ca /var/etc/openvpn/server2.ca 
cert /var/etc/openvpn/server2.cert 
key /var/etc/openvpn/server2.key 
dh /etc/dh-parameters.1024
crl-verify /var/etc/openvpn/server2.crl-verify 
tls-auth /var/etc/openvpn/server2.tls-auth 0
comp-lzo adaptive
topology subnet
          1 Reply Last reply Reply Quote 0
          • C
            cmb
            last edited by

            @maverick_slo:

            Guys I found the error.
            Look at screenshot.
            Shared key and ssl/tls don`t have same settings under tunnel options.

            They're not supposed to have all the same settings. Which specific setting are you referring to?

            1 Reply Last reply Reply Quote 0
            • M
              maverick_slo
              last edited by

              Local subnet for example

              1 Reply Last reply Reply Quote 0
              • M
                maverick_slo
                last edited by

                Tunnell settings MUST be same only encryption should vary. 2.2.6 has same tunnell settings for both methods and encryption different which is ok.
                Clearly there is something wrong with openvpn gui and how it generates config.
                Between 2.2.6 no problem at all.

                1 Reply Last reply Reply Quote 0
                • S
                  Steve_B Netgate
                  last edited by

                  There is a difference between the Tunnel settings display (Peer to peer (Shared Key) ) 2.2.x vs 2.3

                  I will correct that. I'm sure it will make a difference to the shared configuration though. I will make a note here once a correction has been pushed and perhaps you would let me know if you see any improvement.

                  Thanks for continuing to work on this!

                  Als ik kan

                  1 Reply Last reply Reply Quote 0
                  • M
                    maverick_slo
                    last edited by

                    Thanks Steve!

                    I sure will test it because I need it :)

                    1 Reply Last reply Reply Quote 0
                    • S
                      Steve_B Netgate
                      last edited by

                      Researching this further I find that although the IPv4 Local network(s) and IPv6 Local network(s) controls are hidden when "Peer to peer (shared Key)" is selected, that is the desired behavior since they make no sense in a peer to peer environment. Whether they are hidden or not, the values are ignored so it really makes no difference.

                      There was a display bug in 2.2.x that caused the controls to be displayed.

                      So if we are to track down a potential GUI problem, the best approach would be to set up identical server configurations in 2.2.6 and in 2.3 and to then compare the /cf/conf/config.xml files looking at the <openvpn-server>section.

                      Is that something you could do?</openvpn-server>

                      Als ik kan

                      1 Reply Last reply Reply Quote 0
                      • M
                        maverick_slo
                        last edited by

                        On it.

                        1 Reply Last reply Reply Quote 0
                        • M
                          maverick_slo
                          last edited by

                          @Steve_B:

                          Researching this further I find that although the IPv4 Local network(s) and IPv6 Local network(s) controls are hidden when "Peer to peer (shared Key)" is selected, that is the desired behavior since they make no sense in a peer to peer environment. Whether they are hidden or not, the values are ignored so it really makes no difference.

                          What about force all traffic trough gateway? This is also hidden in shared key peer2peer.
                          Are you sure local networks on SERVER pae should be hidden?

                          1 Reply Last reply Reply Quote 0
                          • M
                            maverick_slo
                            last edited by

                            Here we go, configs attached.

                            SHARED226.txt
                            SHARED230.txt
                            TLS226.txt
                            TLS230.txt

                            1 Reply Last reply Reply Quote 0
                            • S
                              Steve_B Netgate
                              last edited by

                              perfect. Thanks.

                              Als ik kan

                              1 Reply Last reply Reply Quote 0
                              • S
                                Steve_B Netgate
                                last edited by

                                The only differences I see between the two TLS files are these:

                                2.2.6: <topology_subnet>2.3:    <topology>subnet</topology>

                                But that is deliberate and is accommodated in the system.

                                So I don't think we have a GUI issue.

                                I'll check elsewhere.

                                Here: https://forum.pfsense.org/index.php?topic=105341.msg588703#msg588703 you posted your OpenVPN config files. Could you do the same again but from 2.2.6 SSL/TLS (working) and from 2.3 SSL/TLS (NOT working) ?

                                That way we can check the XML -> OpenVPN translation.</topology_subnet>

                                Als ik kan

                                1 Reply Last reply Reply Quote 0
                                • M
                                  maverick_slo
                                  last edited by

                                  Attached

                                  230notworking.txt
                                  226working.txt

                                  1 Reply Last reply Reply Quote 0
                                  • M
                                    maverick_slo
                                    last edited by

                                    I don`t get it any more.

                                    Why the hell shared works and SSL gives me this in logs:

                                    Jan 21 17:25:24 	openvpn[75325]: Initialization Sequence Completed
Jan 21 17:25:24 	openvpn[75325]: /usr/local/sbin/ovpn-linkup ovpnc2 1500 1557 172.16.26.2 255.255.255.0 init
Jan 21 17:25:24 	openvpn[75325]: /sbin/ifconfig ovpnc2 172.16.26.2 172.16.26.1 mtu 1500 netmask 255.255.255.0 up
Jan 21 17:25:24 	openvpn[75325]: do_ifconfig, tt->ipv6=1, tt->did_ifconfig_ipv6_setup=0
Jan 21 17:25:24 	openvpn[75325]: TUN/TAP device /dev/tun2 opened
Jan 21 17:25:24 	openvpn[75325]: TUN/TAP device ovpnc2 exists previously, keep at program end
Jan 21 17:25:22 	openvpn[75325]: [nabiralnik.eu] Peer Connection Initiated with [AF_INET]212.18.40.185:1199
Jan 21 17:25:21 	openvpn[75325]: UDPv4 link remote: [AF_INET]SERVERIP:1199
Jan 21 17:25:21 	openvpn[75325]: UDPv4 link local (bound): [AF_INET]CLIENTIP
Jan 21 17:25:21 	openvpn[75325]: Control Channel Authentication: using '/var/etc/openvpn/client2.tls-auth' as a OpenVPN static key file
Jan 21 17:25:21 	openvpn[75325]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Jan 21 17:25:21 	openvpn[75325]: WARNING: No server certificate verification method has been enabled. See http://openvpn.net/howto.html#mitm for more info.
Jan 21 17:25:21 	openvpn[75325]: WARNING: using --pull/--client and --ifconfig together is probably not what you want
Jan 21 17:25:21 	openvpn[75109]: library versions: OpenSSL 1.0.1l-freebsd 15 Jan 2015, LZO 2.09
Jan 21 17:25:21 	openvpn[75109]: OpenVPN 2.3.8 i386-portbld-freebsd10.1 [SSL (OpenSSL)] [LZO] [MH] [IPv6] built on Aug 21 2015
Jan 21 17:25:21 	openvpn[73428]: SIGTERM[hard,] received, process exiting
Jan 21 17:25:21 	openvpn[73428]: /usr/local/sbin/ovpn-linkdown ovpnc2 1500 1557 172.16.26.2 255.255.255.0 init

                                    And tunnel shows as up in status -> openvpn.

                                    I really don`t get it anymore.

                                    1 Reply Last reply Reply Quote 0
                                    • S
                                      Steve_B Netgate
                                      last edited by

                                      Looks like there is a problem in that "topology subnet" is being added to the config when it should not. There is a dependency on the tunnel network size that may be broken. We are testing now.

                                      Als ik kan

                                      1 Reply Last reply Reply Quote 0
                                      • M
                                        maverick_slo
                                        last edited by

                                        Please confirm my problems if you dont Im probably crazy :)
                                        Ah at least friday is here :)

                                        1 Reply Last reply Reply Quote 0
                                        • M
                                          maverick_slo
                                          last edited by

                                          About topology…
                                          Mentioned it here: https://forum.pfsense.org/index.php?topic=105341.msg587367#msg587367 but nobody bite it :)

                                          1 Reply Last reply Reply Quote 0
                                          • S
                                            Steve_B Netgate
                                            last edited by

                                            Fix was just pushed.

                                            Please gitsync and let me know if it helped

                                            Als ik kan

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.