OpenVPN 2.5 released - Overview of changes

silmor_senedlen

OpenVPN 2.5.0 just released.
Do pfSense developers already have any plans for implementation OpenVPN 2.5.0 ?

jimp

No specific plans, but we'll likely bring it into pfSense 2.5.0 once it makes its way into FreeBSD ports.

Bob.Dig

Is it safe to work with OVPN-Software 2.4.* in general or is it deprecated with this release of 2.5?

Gertjan

2.5 ( edit : pfSense 2.5.0 that is) isn't out. It's only available to be "beta tested".

If OpenVPN :

OpenVPN 2.4.9 amd64-portbld-freebsd11.3 [SSL (OpenSSL)] [LZO] [LZ4] [MH/RECVDA] [AEAD] > built on May 4 2020

wasn't 'safe', a newer version would be incorporated / back ported into pfSense 2.4.5-p1 - which would probably become 2.4.5-p2 and that's it.

Guess what ? That isn't the case !
So, I tend to say : it's safe.

For the real answers : see the OpenVPN support sites.

jimp

@Gertjan said in OpenVPN 2.5-beta 1 released - Overview of changes in 2.5:

2.5 isn't out yet. Only available to be beta tested.

No, it's released: https://openvpn.net/community-downloads/

It's backward compatible as always, but there are some potential gotchas, mostly if you rely on something super weak like not specifying a ciper and expecting BF-CBC to be used by default everywhere. I'm not sure that applies to many people in practice, though.

Gertjan

My 2.5 was short for pfSense 2.5.0, as this version would use OpenVPN 2.5.
2.4.5-p1 is using ..... well, you know.

Sorry for the confusion.

Bob.Dig

@jimp said in OpenVPN 2.5-beta 1 released - Overview of changes in 2.5:

It's backward compatible as always

So it is good practice to use OVPN 2.5 in conjunction with pfSenses OVPN 2.4.*.

Gertjan

@Bob-Dig said in OpenVPN 2.5-beta 1 released - Overview of changes in 2.5:

So it is good practice to use 2.5 in conjunction with pfSenses 2.4.*.

As a client VPN in front of pfSense ?
Or in-place upgrading of the pfSense - OpenVPN - core files ?? From 2.4.9 to 2.5.
I which you good luck - tell us how you did it ;)

JeGr

@jimp isn't the data-ciphers parameter another problem? Current export packages export configs for 2.5.0clients with data-ciphers instead of ncp-ciphers. But even the config files for the 2.4.9 buttons contain that config statement that result in a

Options error: Unrecognized option or missing or extra parameter(s) in fwl01-UDP4-1194-<username>.ovpn:5: data-ciphers (2.4.9)

Isn't that something that needs to still be fixed?

jimp

There is probably a flaw in my logic in there, I made it so that if you checked the Legacy box it changed over to ncp- rather than data- but I must have missed making it assume legacy mode when exporting 2.4.x.

JeGr

@jimp said in OpenVPN 2.5 released - Overview of changes in 2.5:

There is probably a flaw in my logic in there, I made it so that if you checked the Legacy box it changed over to ncp- rather than data- but I must have missed making it assume legacy mode when exporting 2.4.x.

Ah thought so :)
That exploded at a customers location today as the exported the config to a system that is still on 2.4.9 that threw errors. Then exported the 2.4.9 exe again - still errors. Fixed it after calling us by installing 2.5.0 over it but it's a weak point ATM. Perhaps the legacy section needs a config only point to export 2.4.x compat config. Not all admins have access to all clients' PCs or laptops. Mostly they already have ovpn installed so only send new configs that now don't work anymore but users may not be able to install new software themselves.

jimp

I found a few problems with how I was building the cipher list for pfSense 2.5.0/2.4.5 and OpenVPN 2.5.0/2.4.x. I just pushed a fix, it'll be up shortly and should hopefully work for everyone.

jimp

And just when I thought I found them all, I came up with a couple more edge cases/incompatible cases that I addressed. New package is building and will be up shortly.

Hopefully now it's impossible to create a config with an empty cipher set or incompatible ciphers. For example now you can't set CHACHA20-POLY1305 on legacy clients (OpenVPN 2.4.x and older)

Bob.Dig

OpenVPN 2.5.1 — Released 24 February, 2021

The OpenVPN community project team is proud to release OpenVPN 2.5.1. It includes several bug fixes and improvements as well as updated OpenSSL and OpenVPN GUI for Windows.

JKnott

@bob-dig

When will it be available for pfsense?

johnpoz

@jknott said in OpenVPN 2.5 released - Overview of changes:

When will it be available for pfsense?

When its ready ;) heheh

It just dropped today for gosh sake..

jimp

After we have time to properly evaluate and test it. Looking at the changelog I didn't see much that looked like it would affect many people running pfSense (positive or negative).

JKnott

@johnpoz said in OpenVPN 2.5 released - Overview of changes:

It just dropped today for gosh sake..

Well, what's taking so long?

Hopefully, it will fix the issues we're seeing.

johnpoz

@jknott said in OpenVPN 2.5 released - Overview of changes:

it will fix the issues we're seeing.

Not seeing any issues, have both outbound to open access server. And inbound from different clients.. ZERO issues.. Both outbound and inbound working with zero need to do anything after upgrade.

If you had some odd config that was causing you problems with the new version of openvpn, not sure how upgrade to 2.5.1 openvpn is going to correct whatever current configuration issue you have.

JKnott

@johnpoz

Initially, I used the config from the previous pfsense version, which worked there, but failed with 2.5.0. I then started a new config from scratch, which also didn't work. I can connect if my notebook is connected to my local LAN (yeah, real useful), but not if I connect from outside my network. This tells me the config for OpenVPN is correct, otherwise I couldn't connect at all, but something is preventing it from working from elsewhere. What that something is, I haven't a clue, as I have never seen anything like this before.

As I mentioned in another thread, I have been setting up VPNs for almost 20 years, going back to CIPE on Redhat Linux, but also IPSec in my work and OpenVPN on my home network, so I'm not exactly a newbie at this.