OpenVPN GUI remote networks field is confusing with lots of remote networks

robi

Nothing wrong with ability to use alias there… That would make editing easier sure.

Put in feature request on https://redmine.pfsense.org/

Already there, since 5 years originally by Phil Davis, added again by me about 1 year ago:
https://redmine.pfsense.org/issues/2668
https://redmine.pfsense.org/issues/6754

With the real power of aliases being nested, it would be awesome…

Derelict

It would also mean that changing an alias would have to bounce your VPN - including hostname resolution that happens every 5 minutes (by default) if any of the aliases require resolution.

robi

@Derelict:

It would also mean that changing an alias would have to bounce your VPN - including hostname resolution that happens every 5 minutes (by default) if any of the aliases require resolution.

Including a function to check if the alias being changed is present in any OpenVPN configuration, bounce only VPNs affected by that certain alias. 8)

Derelict

And so on and so on.

The real answer is a solid design and supernetting into OpenVPN with CSOs.

I would rather see something like some smarts to change from the text field to a textarea if there are more than x commas than a bunch of alias hackery.

But that's just my opinion.

johnpoz

@Derelict:

It would also mean that changing an alias would have to bounce your VPN - including hostname resolution that happens every 5 minutes (by default) if any of the aliases require resolution.

Whey is that exactly? Why would a alias that consisted of networks ever need to be resolved? And why would the resolution of fqdn in the aliases have anything to do with the vpn being up or down? Not understanding what the 2 have to do with each other..

Yes stuff in alias table gets resolved every 5 minutes. What would the resolution of aliases have to do with IPs and networks in alias used for vpn remote networks? I could see changing the alias sure.. Since that would be the same as changing the remote networks in the currently.

jimp

@johnpoz:

@Derelict:

It would also mean that changing an alias would have to bounce your VPN - including hostname resolution that happens every 5 minutes (by default) if any of the aliases require resolution.

Whey is that exactly? Why would a alias that consisted of networks ever need to be resolved? And why would the resolution of fqdn in the aliases have anything to do with the vpn being up or down? Not understanding what the 2 have to do with each other..

Yes stuff in alias table gets resolved every 5 minutes. What would the resolution of aliases have to do with IPs and networks in alias used for vpn remote networks? I could see changing the alias sure.. Since that would be the same as changing the remote networks in the currently.

If you edit the alias and save it, the VPN would have to be reset, which is counterintuitive if you don't remember that the alias is used on that VPN, for example.
Also you can use hostnames in network aliases they just get a /32 mask, so they would still have to be hooked into the same process.
And if a hostname resolved to a new address, that means the contents of the alias changed, which means that the VPN needs to be restarted to pick up the contents of the alias to use for routes.

It isn't like pf where the changes can be picked up automatically on-the-fly, since OpenVPN has to manage its own routes internally.

pete35

My main point is, that the field is too small for lots of networks
as that comma-separated field is a constant reason for false entries.

A large field list, as it exists for the alias function, will make it better. I understand that an alias
will make more waves to the whole system, but this is not needed to reduce the errors.

Jimp gives a good solution, thanks for that, just enter the routes into the advanced box.

Thanks!

johnpoz

Thanks jimp.. But I was more just thinking of it as a openvpn section under the alias section for remote networks. Where you would put networks.. You sure wouldn't put in a fqdn for a remote network even it could resolve to a /32.. To me that is not a remote network.

But I guest you could put in a host route to /32 - so guess valid point there.

Thanks for the detailed info as always - to shoo away the cobwebs of my brain not thinking that early in the morning ;)

jimp

I'd be in favor of making those network boxes larger in some way. At least longer. The problem with making it a textarea is that people will, inevitably, think that putting entries on new lines instead of using commas is the way it works.

It would be great if we could have multiple rowhelper style controls on a page but currently only one is possible.

robi

@jimp:

@johnpoz:

@Derelict:

It would also mean that changing an alias would have to bounce your VPN - including hostname resolution that happens every 5 minutes (by default) if any of the aliases require resolution.

Whey is that exactly? Why would a alias that consisted of networks ever need to be resolved? And why would the resolution of fqdn in the aliases have anything to do with the vpn being up or down? Not understanding what the 2 have to do with each other..

Yes stuff in alias table gets resolved every 5 minutes. What would the resolution of aliases have to do with IPs and networks in alias used for vpn remote networks? I could see changing the alias sure.. Since that would be the same as changing the remote networks in the currently.

If you edit the alias and save it, the VPN would have to be reset, which is counterintuitive if you don't remember that the alias is used on that VPN, for example.
Also you can use hostnames in network aliases they just get a /32 mask, so they would still have to be hooked into the same process.
And if a hostname resolved to a new address, that means the contents of the alias changed, which means that the VPN needs to be restarted to pick up the contents of the alias to use for routes.

It isn't like pf where the changes can be picked up automatically on-the-fly, since OpenVPN has to manage its own routes internally.

For such cases I would just simply put a small waring in the alias edit page: "Warning: this alias is being used in the 'name-of-the-OpenVPN-instance' OpenVPN configuration. After changing values here it is recommended to to restart 'name-of-the-OpenVPN-instance'".

So I wouldn't restart any VPN automatically, just notify the user that the alias affects OpenVPN also - and let the user decide if he/she wants to restart it (to prevent interruptions for cases when pfSense itself is being managed via the OpenVPN connection).
The warning bar at the top could also be used for this after changing the alias, reminding the user that OpenVPNs restarting is due, even if he/she moves away from the aliases config page.