OpenVPN Gateways getting marked down

  • Hi,
    I have an issue with the OpenVPN gateways to AirVPN getting marked down. My configuration is as follows.

    5 VPN connections to AirVPN. The gateway groups are setup as follows:

    All OpenVPN clients establish connections, get ip's and routes.

    The Gateway status is:

    The routing table is as follows:

    Destination        Gateway            Flags     Netif Expire
    default          UGS         ix0           UGS      ovpnc4          UGHS        lo0         link#12            UHS         lo0           UGS      ovpnc3           UGHS        lo0          link#11            UHS         lo0           UGS      ovpnc2           UGHS        lo0          link#10            UHS         lo0         UGS      ovpnc6        UGHS        lo0        link#13            UHS         lo0        link#14            UHS         lo0        UGHS        lo0        UGHS        ix0     link#1             U           ix0
    98.239.76.X        link#1             UHS         lo0          link#6             UH          lo0    link#2             U           ix1       link#2             UHS         lo0       UGS      ovpns1       link#9             UHS         lo0       link#9             UH       ovpns1

    I SSH'd into the router to try to ping the gateways of the "downed" gateways and got the following from ping

    36 bytes from localhost ( Redirect Host(New addr:
    Vr HL TOS  Len   ID Flg  off TTL Pro  cks      Src      Dst
     4  5  00 0054 ffdd   0 0000  02  01 0000 

    I am able to ping all the remote sides of the gateways from the LAN network

    $ ping
    PING ( 56(84) bytes of data.
    64 bytes from icmp_seq=1 ttl=63 time=17.7 ms
    64 bytes from icmp_seq=2 ttl=63 time=17.0 ms
    64 bytes from icmp_seq=3 ttl=63 time=19.6 ms

    I have firewall rules on the LAN interface to route IPv4 traffic out via the VPN_GROUP_IPV4 gateway group and IPv6 traffic via the VPN_GROUP_IPV6.
    IPv4 works:

    $ traceroute
    traceroute to (, 64 hops max, 52 byte packets
     1 (  162.564 ms  372.407 ms  161.059 ms
     2 (  161.691 ms  162.250 ms  161.911 ms
     3 (  165.386 ms  163.760 ms  164.435 ms
     4 (  163.000 ms (  164.660 ms  164.478 ms
     5 (  168.381 ms (  305.556 ms (  163.684 ms
     6 (  163.140 ms  164.492 ms  163.072 ms

    IPv6 works as well:

    $ traceroute6 2001:4860:4860::8888
    traceroute6 to 2001:4860:4860::8888 (2001:4860:4860::8888) from 2601:205:c0XX:XXXX:XXXX:XXXX:XXXX:af65, 64 hops max, 12 byte packets
     1  router  2.019 ms  0.872 ms  0.823 ms
     2  * * *
     3  * * *
     4  * * *
     5  * * *
     6  * * *
     7  2001:4860:0:1::836  16.998 ms
        2001:4860:0:1::1c18  26.802 ms
        2001:4860:0:1::1cce  26.343 ms
     8  2001:4860:0:1::2c5  17.408 ms
        2001:4860:0:1::14df  16.544 ms
        2001:4860:0:1::1509  17.081 ms
     9  16.356 ms  15.682 ms  16.642 ms

    The outbound NAT rules are

    I am thinking that the issue with pinging the gateways from the pfsense box with the Redirect Host message is probably the cause of dpinger marking them down. The only info I could find on that was to do with overlapping subnets. Although VPN4 and VPN5 (ipv4) have the same subnets, the routing looks okay for it.

    Does anyone have any suggestions on what I've done wrong?

    Any help is greatly appreciated.

  • If i change the monitoring IP to an external IP instead of the gateway IP, it shows the gateways as up, but then the RTT is not going to be accurate.

    Any ideas?

  • You can't use AirVPN gateway to monitor with dpinger. You need to use an external gateway. It used to work, but something has changed either from AirVPN side or from Pfsense since 2.3.x