pfSense 2.5.1 multi-WAN routing trouble

theone · Apr 22, 2021, 1:31 PM

Hail Folks, I'm experiencing something like this... On my PFSense Server I use OpenVPN + Radius Connection, everything was working good, but after update from 2.5.0 to 2.5.1 every connection wich comes from my second (WAN - OPT) works for a minute and the connection get drop. There's no reason for it.. cuz, I Haven't change anything on firewall... If anyone have any clue to me.. I will appreciate a lot. Thanks in advance.

peterzy · Apr 27, 2021, 4:18 PM

@theone The only workaround I have found so far(in case someone needs it)
System >> Advanced >> Firewall & NAT

Bypass firewall rules for traffic on the same interface

This is workaround but definitely a bug in 2.5.1

spgr · Apr 28, 2021, 9:46 AM

@peterzy To my regret I don't have static routes. Policy based only.

makq · Apr 28, 2021, 1:03 PM

@digdug3 How did you reverted to 2.5.0 ?

digdug3 · Apr 28, 2021, 1:03 PM

@makq I have pfSense installed as a VM, so I can just roll back.
Otherwise, if you still have a backup of an older pfsense config file, you can reinstall pfSense and restore the backup of the config file.

4o4rh · May 14, 2021, 8:31 AM

ok. this really has become a problem, i have tried a number of things but i need to revert back to 2.5.0.

Is the config.xml backward compatible with 2.5.0 ?

Can i simply re-install and restore the 2.5.1 xml?

michaelschefczyk · May 14, 2021, 9:53 AM

@gwaitsi I am unable to answer your question. As I backup my configuration nighly on a server in my LAN, I did just roll back to the last configuration before going to 2.5.1.

The biggest problem in my view is that the Netgate team does not communicate at all about perspectives to resolve this. The choice now is either no real multi-WAN or a risky version of OpenSSL.

I did make a trip to the other end of my VPN to downgrade there to get everything working again. My personal next step will be to move from CARP-HA to two single routers and then convert one in the stack to OPNsense. It might be safer to have two options.

raudraido · May 14, 2021, 9:55 AM

@gwaitsi for me, revert did not work. Did clean install

vjizzle · May 14, 2021, 9:57 AM

@gwaitsi Hi. The config should be backwards compatible. I have done this and imported my backup from 2.5 to 2.4.5 p1. However this was not on my production unit but my testlab pfSense. It did work but my Openvpn clients were messed up and my routing groups were not working properly. I had to manually fix that. Again, this was just an exercise for me and not something I will do on my production unit.

As always I have backups before I upgrade so in the end I just installed 2.4.5 p1 on my production unit and restored the config from that version.

peterzy · May 14, 2021, 9:58 AM

I think with the attitude they have PfSense is https://www.youtube.com/watch?v=tH2w6Oxx0kQ

4o4rh · May 14, 2021, 10:09 AM

@peterzy i haven't given up on them, but when they say it is a kernel fix and can't be deployed as a patch, given the severity, it is very disheartening to see they don't release 2.5.1p1 to fix this issue.

Have started looking at untangle, but that is not a fair comparison because you have to pay to get the same features that are including in pfsense CE.

fireodo · May 14, 2021, 10:14 AM

@gwaitsi said in pfSense 2.5.1 multi-WAN routing trouble:

2.5.1p1 to fix this issue.

It seems there is a 2.5.2 in the pipeline:

Redmine Roadmap 2.5.2

digdug3 · May 14, 2021, 10:12 AM

@gwaitsi Mostly the problem is with OpenVPN not beeing compatible.
Edit the config.xml en remove the OpenVPN sections. Only thing left to do after installing is recreating OpenVPN.
If it still won't work, also remove the packages sections.

digdug3 · May 14, 2021, 10:13 AM

@fireodo Great spotting that!

vjizzle · May 14, 2021, 10:16 AM

@gwaitsi Hi. I have looked and testen Untangle as-well after this whole fiasco with Netgate. Unfortunately I could not get multi-wan port forwarding with OpenVPN to work there and from what I have read on their forums others have failed there as well. Besides They ask a lot of money if you want to have Wireguard...150 USD a year! Wtf

For the scenario I have I still believe pfSense is the best there is. Now I just wait for the next version which will fix the bugs we have and in the meantime I enjoy the stability and performance of 2.4.5 p1.

slu · May 14, 2021, 10:16 AM

@fireodo said in pfSense 2.5.1 multi-WAN routing trouble:

It seems there is a 2.5.2 in the pipeline:

Redmine Roadmap 2.5.2

This would be good news!

peterzy · May 14, 2021, 10:18 AM

They have a fix already: https://reviews.freebsd.org/R10:41063b40168b69b38e92d8da3af3b45e58fd98ca . The problem is that they did not fix it for the CE version.

geniepro · May 19, 2021, 1:08 PM

I'm sure not everybody in my situation, by I have a few OpenVPN clients configured on the router and a single real WAN Gateway.

I ran into the problem reported here and after some troubleshooting I noticed that OpenVPN was adding a route to "0.0.0.0/1". Once I manually removed it, "route del 0.0.0.0/1" I noticed that my NAT started working. After further research I noticed that once of my OpenVPN Clients didn't have the "Don't pull routes" checked. After fixing this the issue is gone.

Hopefully this will help at least a few of those that are hitting this painful bug.

vjizzle · May 19, 2021, 1:22 PM

@geniepro Hi! That is great news! I have a couple of questions:

does it survive a reboot?
does port forwarding from your OpenVPN client now work?

Thank you for your help.

geniepro · May 19, 2021, 1:31 PM

@vjizzle, no need to reboot anything, all I needed was NAT to form for the real WAN. I use OpenVPN only for some devices in my network to connect to the internet - bypass the ISP traffic sniffing.

If you have a single OpenVPN client, or you need NAT for a single OpenVPN connection, you could maybe manually add a route, something like "route add 0.0.0.0/1 XXX.XXX.XXX" pretty much you need to update your routes to have your connection that you want to NAT to be the default one. I don't know if there is an option to adjust the routes form GUI, or only through SSH.