Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Does OVPN transition correctly from 2.2.2 to 2.3.4, and then from 2.3.4 to 2.4.x

    Scheduled Pinned Locked Moved OpenVPN
    5 Posts 3 Posters 1.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • T Offline
      TeknikL
      last edited by

      I have moved all my ipsec to ovpn and been SO happy because none of the crappy ipsec issues seem to plague me anymore.

      One of my servers is till 2.2.2 or 2.2.3, will that one upgrade properly to 2.3.4 without breaking the ovpn?

      and same for the beta testers, does ovpn carry through OK?

      I'm just using l2l with certs copied and pasted on both ends, nothing special.

      Thanks!

      M

      1 Reply Last reply Reply Quote 0
      • jimpJ Offline
        jimp Rebel Alliance Developer Netgate
        last edited by

        OpenVPN is very good about both backwards and forwards compatibility. In nearly all cases, you can connect different versions of OpenVPN without any trouble, unless the server is newer and you have enabled options that only exist in the newer version. Even then, it still could work depending on the context.

        If your settings are the same, it should keep working. I've seen even 2.1 and older clients connect to 2.3.4 without issue with basic settings.

        When it comes to 2.4 you still should be OK so long as you don't turn on some incompatible option on the server side that doesn't exist on the client side. For example if you upgrade the server to 2.4 and leave it alone it would be fine, but if you turn on TLS Crypt (new in 2.4, doesn't exist on older versions), then the clients would also have to be 2.4.

        Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

        Need help fast? Netgate Global Support!

        Do not Chat/PM for help!

        1 Reply Last reply Reply Quote 0
        • T Offline
          TeknikL
          last edited by

          Sorry for not being clear.

          When I upgrade the older pfsesne firewall using openvpn will the configurations transition properly during the upgrades from older versions to newer versions or do I need to reconfigure tunnels after the upgrades in some cases?

          1 Reply Last reply Reply Quote 0
          • jimpJ Offline
            jimp Rebel Alliance Developer Netgate
            last edited by

            That's even easier. Everything will come through properly, no need to worry about that. If any changes are necessary, we handle them in upgrade code.

            I've got some OpenVPN instances that have been carried over as-is from 1.2.x that still work without changes.

            Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

            Need help fast? Netgate Global Support!

            Do not Chat/PM for help!

            1 Reply Last reply Reply Quote 0
            • johnpozJ Offline
              johnpoz LAYER 8 Global Moderator
              last edited by

              "but if you turn on TLS Crypt (new in 2.4, doesn't exist on older versions), then the clients would also have to be 2.4."

              QFT! This drove me nuts for a bit trying to figure out why my phone could connect to the udp session but not the tcp session.. Seems I had manipulated the settings in the tcp settings and enabled tls-crypt.  While the udp did not have it on ;)

              The openvpn connect app on the iphone does not support tls-crypt as of yet.  Was like WTF.. My pc connects no issues, but why was the phone not working..

              I normally have never had to make any adjustments to the openvpn clients as upgraded over the years.  Currently running 2.4 beta and could connect no problem.  But wanting to check out the settings that were new I did make some adjustments to my tcp settings.  PC clients all working just fine - had not connected from phone in a while using tcp.  But then wanted to connected from work on the wifi and there is proxy.  So you have to use tcp for that - had forgot about the tweaks I had made.  So it threw me for a loop for a bit.

              So I have highlighted jimp statement - as it could throw you for a loop if you do not pay attention ;)

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              1 Reply Last reply Reply Quote 0
              • First post
                Last post
              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.