Huge packet loss with multiple gateways.
-
With PfSense I use four separate OpenVPN client connections with four gateway interfaces to provide a failover if a vpn connection goes down. Up through version 2.5.1.r.20210403.0300 this has worked flawlessly using the VPN endpoint IP as the monitor IP. The VPN gateway interfaces would come up quickly stabilizing at 0% packet loss on all four connections. Without making any configuration changes upgrading to version 2.51 immediately causes 80%-100% packet loss on all four VPN gateway interfaces. Occasionally one of the connections will drop below the 15% threshold and become active but this rarely lasts more than a minute or so. There is also a huge hit on Web Gui performance as it takes 30+ seconds to display any page. When I disable gateway monitoring on these everything works but I lose any failover capability. I'm using default dpinger settings. and as I said before no config changes were made.
I have also discovered that I can enable gateway monitoring on only one or two of VPN gateway interfaces and packet loss is minimized but when I enable more gateways the packet loss gets progressively worse and the gateway soon reports 100% loss all while the VPN connections remains connected. I've tried setting the monitor IP to 8.8.8.8 and other addresses known to respond to pings with the same results. This issue also persists with the most recent 2.6.0 developer version.
At first glance one would think that the monitor IP's were simply not sending reliable ping replies but that doesn't explain why the problem completely disappears when rolling back to the previous release candidate. I've seen a lot of discussion about problems with OpenVPN & gateway routing with version 2.50+ but nothing that seem to fit this specific issue. I'm willing to provide a bug report but unsure of how to provide the technical information needed. -
I attempted to submit this as a bug on this issue but it was rejected blaming it on my configuration or my provider. the problem doesn't exist with release candidate 2.5.1.r.20210403.0300. As I stated no config changes were made. The configuration has worked for several years However with version 2.5.1 and later the packet loss issues appear. I roll back to the release candidate or older all works as before. I've installed from scratch & attempted multiple configuration changes with no success. Is there anyone using multiple OpenVpn clients in a similar failover fashion confirm that this problem stated above does or does not exist for them? When community forums aren't helpful and bug reports are rejected where does one turn? OPNSense?