OpenVPN is not working if client is reconnected immediately

jimp

nobind also works, likely for much the same reason.

That would be viable for remote access clients but if this same issue also affects site-to-site then that wouldn't be enough to work around it.

None of the changes in the log for OpenVPN 2.5.1 appear to be related but I'm curious if it makes a difference.

jimp

I added an issue to track the upstream problem since there isn't much we can do locally (clients in pfSense already default to lport 0)
https://redmine.pfsense.org/issues/11575

I also added an issue to have the export package automatically add nobind with an option to opt out.
https://redmine.pfsense.org/issues/11574

christian.schneider

@jimp lport 0 works perfect for me, thank you!

Pippin

This post is deleted!

Pippin

@pippin said in OpenVPN is not working if client is reconnected immediately:

Will try to find the posts by OpenVPN devs...

Please see my remark:
https://redmine.pfsense.org/issues/11575

Elrick75

@jimp Hi, I noticed that nobind or lport 0 both work but it is not possible to have both in the configuration file.
Which one should be chosen between the two please? which one is better?

Pippin

The recommendation by OpenVPN is --nobind.

jimp

Generally speaking, nobind is better.

You would only need lport 0 if you had to bind to a specific IP address on the client, but wanted a random source port. Otherwise, nobind is better since it lets to OS pick the most appropriate source IP address and port.

jeff3820

@jimp Is this change coming to the client export package or has it already been implemented?

jimp

You can already get lport 0 by setting the option to randomize the local port, though I can't recall off the top of my head if that is the default. I don't think it has a way to set nobind.

If it doesn't set that by default, we should probably update the package to work that way and use nobind.