Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    iPhone/iPad no longer works after update

    OpenVPN
    3
    12
    1.2k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • pfSenseTestP
      pfSenseTest
      last edited by

      Maybe this.?
      https://forums.openvpn.net/viewtopic.php?f=36&t=27186

      2x SG-5100 | MBT-4220 (retired) | SG-1000 (retired)

      IsaacFLI 1 Reply Last reply Reply Quote 0
      • DerelictD
        Derelict LAYER 8 Netgate
        last edited by

        I would start by deleting the profiles on the devices, making sure the openvpn client export package is current, re-exporting, and re-importing the config to the devices.

        Chattanooga, Tennessee, USA
        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
        Do Not Chat For Help! NO_WAN_EGRESS(TM)

        IsaacFLI 1 Reply Last reply Reply Quote 0
        • IsaacFLI
          IsaacFL @pfSenseTest
          last edited by

          @pfsensetest said in iPhone/iPad no longer works after update:

          Maybe this.?
          https://forums.openvpn.net/viewtopic.php?f=36&t=27186

          this fixed it. iPhone compression.

          IsaacFLI pfSenseTestP 2 Replies Last reply Reply Quote 0
          • IsaacFLI
            IsaacFL @IsaacFL
            last edited by

            While futzing around before I found the compression setting on the iPhone. I have found that the DNS on the ipv6 side in the VPN doesn't work.

            If I set the DNS server to the pfsense ipv4 address (192.168.70.1) on the OpenVPN interface, DNS works fine.
            If I set the DNS server to the ipv6 address (myprefix::1) then DNS query is refused.

            1 Reply Last reply Reply Quote 0
            • pfSenseTestP
              pfSenseTest @IsaacFL
              last edited by

              @isaacfl said in iPhone/iPad no longer works after update:

              @pfsensetest said in iPhone/iPad no longer works after update:

              Maybe this.?
              https://forums.openvpn.net/viewtopic.php?f=36&t=27186

              this fixed it. iPhone compression.

              Best to remove the compression line completely from server and client config because of Voracle.
              https://community.openvpn.net/openvpn/wiki/VORACLE

              2x SG-5100 | MBT-4220 (retired) | SG-1000 (retired)

              IsaacFLI 1 Reply Last reply Reply Quote 0
              • IsaacFLI
                IsaacFL @pfSenseTest
                last edited by

                @pfsensetest said in iPhone/iPad no longer works after update:

                @isaacfl said in iPhone/iPad no longer works after update:

                @pfsensetest said in iPhone/iPad no longer works after update:

                Maybe this.?
                https://forums.openvpn.net/viewtopic.php?f=36&t=27186

                this fixed it. iPhone compression.

                Best to remove the compression line completely from server and client config because of Voracle.
                https://community.openvpn.net/openvpn/wiki/VORACLE

                This is what I did. I turned it off on the server.

                1 Reply Last reply Reply Quote 0
                • IsaacFLI
                  IsaacFL @Derelict
                  last edited by

                  @derelict said in iPhone/iPad no longer works after update:

                  I would start by deleting the profiles on the devices, making sure the openvpn client export package is current, re-exporting, and re-importing the config to the devices.

                  I am not sure if it is a bug I have found, maybe I should start a new post?

                  The pfsense DNS Resolver will not respond to DNS queries over ipv6 from OpenVPN clients.
                  I can assign it to use an outside DNS server (i.e. 2001:4860:4860::8888) but can't use the pfsense DNS server ipv6 address. I am using the address of the vpn subnet ::1)

                  1 Reply Last reply Reply Quote 0
                  • DerelictD
                    Derelict LAYER 8 Netgate
                    last edited by

                    You'll have to be more specific. There is nothing "Special" about OpenVPN vs direct traffic. It is all routed.

                    Your VPN would need to be configured to pass IPv6 traffic and the unbound would need to be listening and have the IPv6 tunnel network address passed in the ACLs, etc.

                    Chattanooga, Tennessee, USA
                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                    IsaacFLI 1 Reply Last reply Reply Quote 0
                    • IsaacFLI
                      IsaacFL @Derelict
                      last edited by

                      @Derelict
                      I am using 192.168.70.0/24 and 2605:xxxx:xxxx:9570::0/64 as my Tunnel networks.

                      I have the OpenVPN server set to provide a DNS server list to clients. It says that addresses may be IPv4 or IPv6, so I have:

                      DNS Server 1 192.168.70.1
                      DNS Server 2 2605:xxxx:xxxx:9570::1

                      When the client connects to the OpenVPN server, I see in its ipconfig that the client is using the above dns servers.

                      On a PC if I do an nslookup with 192.168.70.1 as the server I get the expected response.

                      If I do an nslookup with 2605:xxxx:xxxx:9570::1 as the server, I get query refused.

                      In the firewall I see the query to 2605:xxxx:xxxx:9570::1 get passed to 53, so it isn't the firewall blocking it.

                      Unbound is not listening on address 2605:xxxx:xxxx:9570::1 but I can't see why it would not be, as in the DNS resolver I have "All" selected for the Network interfaces.

                      1 Reply Last reply Reply Quote 0
                      • DerelictD
                        Derelict LAYER 8 Netgate
                        last edited by

                        Have a look at Services > DNS Resolver, Access Lists and see if adding the tunnel network to an Allow list there doesn't start allowing queries.

                        Chattanooga, Tennessee, USA
                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                        IsaacFLI 1 Reply Last reply Reply Quote 0
                        • IsaacFLI
                          IsaacFL @Derelict
                          last edited by

                          @derelict said in iPhone/iPad no longer works after update:

                          Have a look at Services > DNS Resolver, Access Lists and see if adding the tunnel network to an Allow list there doesn't start allowing queries.

                          That fixed it. Thanks,

                          1 Reply Last reply Reply Quote 0
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.