Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    OpenVPN with Radius not working correctly with HA

    Scheduled Pinned Locked Moved
    HA/CARP/VIPs
    1
    3
    447
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • H
      Hans70
      last edited by

      I have set-up 2 pfsense-boxes with CARP/HA, SYNC and XMLRPC. Everything is working fine, including IPsec and OpenVPN.
      However, I notice one flaw with OpenVPN: I have OpenVPN configured with the locally installed FreeRADIUS-package configured with Google Authenticator:

      • During normal operations I can authenticate successfully with OpenVPN and FreeRadius/Google Authenticator on the MASTER-pfsense.

      • During this time the OpenVPN Server is running on MASTER and down on BACKUP. This is expected behaviour because the OpenVPN Server is configured on the WAN CARP IP

      • If I pull the plug on MASTER the BACKUP becomes MASTER and the OpenVPN Server gets started on the new MASTER. This is exactly what should happen, however, now I can't connect with the remote OpenVPN-client anymore!

      The cause seems to be that the OpenVPN Server gets started correctly on the new MASTER, but as soon as this happens the RADIUS-server goes down on the new MASTER !?!
      I noticed this by logging in on BACKUP with SSH and checking the RADIUS-ports 1812 and 1813: while in BACKUP-mode RADIUS is running normally and OpenVPN is down (as expected).
      As soon as I stop MASTER and BACKUP becomes the new MASTER the OpenVPN-server gets started but RADIUS stops/gets killed !?!

      Could this be a bug? Or did I make an error during set-up?

      1 Reply Last reply Reply Quote 0
      • H
        Hans70
        last edited by Hans70

        I found the problem: I've configured Radius on the loopback-interface 127.0.0.1 as mentioned in multiple blogs and documents.

        After changing 127.0.0.1 to the CARP LAN IP everywhere in the Radius and Authentication Server configuration everything is working again as it's supposed to....

        1 Reply Last reply Reply Quote 0
        • H
          Hans70
          last edited by

          I spoke too soon, it's still not working 100% of the time.

          When the backup-pfsense is entering MASTER-status, not all of the time Radius gets started correctly, sometimes I see the following in the Radius-logfile, right afster started it gets stopped again:

          Mon Apr 15 14:16:21 2019 : Info: Ready to process requests
          Mon Apr 15 14:16:21 2019 : Info: Signalled to terminate
          Mon Apr 15 14:16:21 2019 : Info: Exiting normally

          1 Reply Last reply Reply Quote 0
          • First post
            Last post
          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.