Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Openvpn issue - site 2 site

    Scheduled Pinned Locked Moved 2.3-RC Snapshot Feedback and Issues - ARCHIVED
    59 Posts 3 Posters 15.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      maverick_slo
      last edited by

      one sec, trying again

      1 Reply Last reply Reply Quote 0
      • M
        maverick_slo
        last edited by

        gitsynced,rebooted and topology subnet still there.
        I deleted server and added new one, still there?

        1 Reply Last reply Reply Quote 0
        • S
          Steve_B Netgate
          last edited by

          OK. First let's make sure you really did get the updated file.

          please use Diagnostics->Edit file and open the file /etc/inc/openvpn.inc  Then using the new GoTo control, go to line 1066.

          You should see:

          // If the server is not a TLS server or it has a tunnel network CIDR less than a /30, skip this.

          If not, that file is not up to date.

          (Your CIDR is 30, so it should skip adding the topology line

          Als ik kan

          1 Reply Last reply Reply Quote 0
          • M
            maverick_slo
            last edited by

            I changed cidr to /24 does that change things?

            1 Reply Last reply Reply Quote 0
            • S
              Steve_B Netgate
              last edited by

              Yes it does. Change it back to 30 and the topology subnet should go away.

              Als ik kan

              1 Reply Last reply Reply Quote 0
              • M
                maverick_slo
                last edited by

                Ok but shouldnt it also work with 24?
                2.2.6 to 2.2.6 did just fine?

                1 Reply Last reply Reply Quote 0
                • S
                  Steve_B Netgate
                  last edited by

                  I don't know, but to get to the bottom of your issue, lets just change one thing at a time, or it gets too complicated.

                  Lets make sure that the openvpn config file in /var/etc is absolutely identical 2.2.6 vs 2.3

                  Once we get there, we know the GUI and the OpenVPN subsystem are good. About all that is left is firewall rules and route.

                  Als ik kan

                  1 Reply Last reply Reply Quote 0
                  • M
                    maverick_slo
                    last edited by

                    Steve, with /30 tunnell now works :)
                    Ssl tls.
                    Still no joy with /24
                    But we made progress :)

                    1 Reply Last reply Reply Quote 0
                    • S
                      Steve_B Netgate
                      last edited by

                      Cool

                      Als ik kan

                      1 Reply Last reply Reply Quote 0
                      • M
                        maverick_slo
                        last edited by

                        So what's next? :)

                        1 Reply Last reply Reply Quote 0
                        • S
                          Steve_B Netgate
                          last edited by

                          Now need to see all the settings from both sides when set to /24. SSL/TLS with a /24 requires a lot more setup. (Client-specific overrides with remote nets/iroutes, client can't have a tunnel network or remote networks set, server needs local network set to push routes, plus remote set for client LAN…etc)

                          We tightened up a lot of that stuff in 2.3 and you may be running afoul of that. To some extent, things that shouldn't work now don't, whereas in prior versions they might  :)

                          Als ik kan

                          1 Reply Last reply Reply Quote 0
                          • M
                            maverick_slo
                            last edited by

                            Well that explains it :)

                            1 Reply Last reply Reply Quote 0
                            • M
                              maverick_slo
                              last edited by

                              Probably this explains it why shared key worked:

                              IPv4 Tunnel Network : The suggested default in the GUI of 10.0.8.0/24 is sufficient, but any random unused network inside of the RFC1918 space is recommended. For site-to-site shared key, only a /30 is used, not a /24, even if /24 is specified.

                              Taken from: https://doc.pfsense.org/index.php/OpenVPN_Site_To_Site

                              1 Reply Last reply Reply Quote 0
                              • First post
                                Last post
                              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.