openvpn client misbehaving

strangegopher

PF is still blocking openvpn but I have no idea what to do about this.

strangegopher

I created a bug report https://redmine.pfsense.org/issues/8541

Derelict

Not convinced it's a bug. Probably a misconfiguration somewhere. Just because it's a mystery right now does not mean it's a bug. Steps to reproduce from a plain install would be the first step.

strangegopher

@Derelict Should "Reset all states if WAN IP Address changes" be enabled?

Derelict

@strangegopher If that's what you want to have happen.

strangegopher

@Derelict Did a bit of reading about Asymmetric Routing https://doc.pfsense.org/index.php/Asymmetric_Routing_and_Firewall_Rules

I wonder if that is what is causing this.

Derelict

Could be. Do you have an asymmetric routing situation? Draw out the pieces involved and it's usually obvious. That can certainly be a cause of out-of-state blocks like you are seeing.

strangegopher

Finally figured out a workaround that limits the write TCPv4_CLIENT: Permission denied (code=13) message to 10 seconds max. I added keepalive 3 10; to custom options and I get this message for 10 seconds before ping-restart and then it connects. I have turned every setting I can think of on and off other than ramdisk and but for now I will live with this quirk.

strangegopher

fixed the error by changing to hostname instead of ip address, I compared the system logs and openvpn logs and noticed openvpn tried to connect before wan interface was up so I changed it to hostname, now it starts before wan is up but won't connect until it can resolve the hostname.

extra options:

remote-cert-tls server;
auth-nocache;
auth-retry nointeract;
tun-mtu 1500;
tun-mtu-extra 32;
mssfix 1400;
mlock;
pull-filter ignore "redirect-gateway";
pull-filter ignore "dhcp-option";

strangegopher

error came back but went away when I uninstalled pfblockerng-devel, only caused issues with tcp connections