OpenVPN with Radius not working correctly with HA
I have set-up 2 pfsense-boxes with CARP/HA, SYNC and XMLRPC. Everything is working fine, including IPsec and OpenVPN.
However, I notice one flaw with OpenVPN: I have OpenVPN configured with the locally installed FreeRADIUS-package configured with Google Authenticator:
During normal operations I can authenticate successfully with OpenVPN and FreeRadius/Google Authenticator on the MASTER-pfsense.
During this time the OpenVPN Server is running on MASTER and down on BACKUP. This is expected behaviour because the OpenVPN Server is configured on the WAN CARP IP
If I pull the plug on MASTER the BACKUP becomes MASTER and the OpenVPN Server gets started on the new MASTER. This is exactly what should happen, however, now I can't connect with the remote OpenVPN-client anymore!
The cause seems to be that the OpenVPN Server gets started correctly on the new MASTER, but as soon as this happens the RADIUS-server goes down on the new MASTER !?!
I noticed this by logging in on BACKUP with SSH and checking the RADIUS-ports 1812 and 1813: while in BACKUP-mode RADIUS is running normally and OpenVPN is down (as expected).
As soon as I stop MASTER and BACKUP becomes the new MASTER the OpenVPN-server gets started but RADIUS stops/gets killed !?!
Could this be a bug? Or did I make an error during set-up?
I found the problem: I've configured Radius on the loopback-interface 127.0.0.1 as mentioned in multiple blogs and documents.
After changing 127.0.0.1 to the CARP LAN IP everywhere in the Radius and Authentication Server configuration everything is working again as it's supposed to....
I spoke too soon, it's still not working 100% of the time.
When the backup-pfsense is entering MASTER-status, not all of the time Radius gets started correctly, sometimes I see the following in the Radius-logfile, right afster started it gets stopped again:
Mon Apr 15 14:16:21 2019 : Info: Ready to process requests
Mon Apr 15 14:16:21 2019 : Info: Signalled to terminate
Mon Apr 15 14:16:21 2019 : Info: Exiting normally