OpenVPN TCP in 2.4.5-p1 not working
-
Thanks all for the help sharing this info!
I have several OpenVPN servers using only TCP, and had this issue, only with the site-to-site VPN from a pfsense 2.4.5-RELEASE-p1 server to a 2.4.5-RELEASE-p1 client, being the pfsense client the last one being updated.
-
So I just updated a client in my home lab, and got locked out of the vpn to work. I'm trying to follow the fix, but obviously I'm not getting something. I'm assuming I need to edit /src/etc/inc/openvpn.inc to add/change the lines in the fix, but I can't find the /src folder when I SSH into my firewall. I have disabled the default admin account, so I'm logged in as a user I created who should have admin permissions.
Could someone step me through the process from either the HTTP interface or through an SSH connection?
Or do I need to have a keyboard/monitor attached to the computer this is running on?
{EDIT} Found my way into /etc/inc and found the openvpn.inc file, just need to figure out where to put the lines from the fix. I'm using vi and not real familiar with it, so no line numbers.
-
@Greg_E Alright, persistence paid off, got it patched. Thanks for the info on the patch.
-
I just ran into this last night while debugging a throughput issue. I had been using UDP all along, but I could only get 10Mbps out of it. Having read that some ISPs throttle UDP, I tried switching to TCP only to find I could no longer connect. Really unfortunate that this major bug gets reported and months later nothing has changed, and the user is expected to hack around trying to fix it.
-
Well this bug crept into 2.4.5-p1 and we had no update since.
-Rico
-
@KOM you can also try https://redmine.pfsense.org/issues/10311#note-3 to improve openvpn speed
-
@viktor_g Thanks. I'm running pfSense on both ends, router to router. Would this fix need to be applied to the server end, or both?
-
@KOM said in OpenVPN TCP in 2.4.5-p1 not working:
@viktor_g Thanks. I'm running pfSense on both ends, router to router. Would this fix need to be applied to the server end, or both?
it's better to check both ways
-
@KOM said in OpenVPN TCP in 2.4.5-p1 not working:
I just ran into this last night while debugging a throughput issue. I had been using UDP all along, but I could only get 10Mbps out of it. Having read that some ISPs throttle UDP, I tried switching to TCP only to find I could no longer connect. Really unfortunate that this major bug gets reported and months later nothing has changed, and the user is expected to hack around trying to fix it.
It was fixed in the repository the same day it was reported. You can apply a single patch with the System Patches package to get the fix. It's not exactly "hacking around". It's not worth making a whole new release for a small bug like this, and almost nobody should be using TCP with OpenVPN anyhow.
-
@viktor_g Hmmm, I don't seem to have a loader.conf.local, only loader.conf. And the references to hw.em.rxd etc, is the em specific for the EM-1000 series of NICs? Should it be replaced with hw.vmx.rxd if you're using VMX NICs under VMware?
@jimp First you would have to stumble upon this forum thread, or an entry in Redmine if you even had an inkling this was a bug as opposed to a user config error. Then you have to install the System Patches package which should be something that nobody already has installed. Then you go to that bug in Redmine and you see that there are two patches listed from the same day with different IDs, and you're not sure which one to use. Not exactly simple or intuitive.
-
I had help pointing me here.
Going to have to read up on the system patches module, didn't know it existed and didn't figure it out while trying to fix my problem, so thanks for the tip.
-
@KOM said in OpenVPN TCP in 2.4.5-p1 not working:
It's not worth making a whole new release for a small bug like this, and almost nobody should be using TCP with OpenVPN anyhow.
Sir, could you please explain why? I have more than 10 openvpn site-to-site using TCP, all with netgate sg1000. What is the reason not to use it?
-
I am running 2.4.5p1, and have openvpn running on tcp..
I just validated, and don't see any issues with it.
I didn't install any patches.. Was this only a problem if you were running tcp on both ipv4 and ipv6? Mine has always been called tcp on ipv4 only.
-
@chipbr said in OpenVPN TCP in 2.4.5-p1 not working:
Sir, could you please explain why? I have more than 10 openvpn site-to-site using TCP, all with netgate sg1000. What is the reason not to use it?
- The OpenVPN protocol is designed to run over UDP.
- UDP is faster / less overhead
- It's not a good idea to wrap TCP packets in TCP packets. You can run in situations with compounded loss, which means OpenVPN is retransmitting lost TCP packets at the VPN layer while lost TCP packets inside the tunnel (say your client loading a HTTPS website) is also retransmitting at the same time.
TCP should be your second choice for OpenVPN if you can't do UDP for some reason.
-Rico
-
I agree, unless there is a specific reason to run tcp for your openvpn, it is better to use udp.
That being said, there are some valid reason(s) why you might need/want to run it on tcp as well. The reason I do, is that not all locations allow for UDP 1194 outbound.. But its pretty much a given that tcp 443 will be allowed out, even if you have to auth to a proxy.. You can still get your vpn connection.
So I run standard 1194 udp, as well as a tcp 443 instance.. If udp 1194 doesn't work, then try the 443 tcp one.
-
I totally see the reason for TCP 443 RAS, like sneaking out the hotels wifi with any but the common ports blocked.
But for site to site VPNs? Bad idea.... maybe if you need to establish a connection between the US and China or something like this. ;-)-Rico
-
I'm one of those cases. I run a network behind a network at a college, pfsense is the firewall I use to get out of my network. And my college IT department won't open UDP for me, even though I know it is the better choice.
To johnpoz, I think this might have only been a site to site issue, not client to site like you show on your phone. Not positive, but possible. In my case, I'm also on a non-standard port, it was already open and I "snuck" this into service when we were all sent to work from home. I did seek permission and never got that permission, but I never got denied either. I spoke to several people about this VPN and they had several chances to tell me to turn it off, even earlier this week. So that turns it into permission by omission.
-
@Greg_E said in OpenVPN TCP in 2.4.5-p1 not working:
So that turns it into permission by omission.
Which is always the funnest kind - you didn't tell me I couldn't do that ;)
-
There are UDP ports you can use to try and evade some filters (53, 123, 5060, 500, 4500) TCP should only be used as a last resort if all other access is blocked.
-
Completely agree but almost always those UDPs are blocked when your behind a proxy.. Which was my case back when had to go to the office every day ;)
You know it was kind of under that - hey you didn't actually say I couldn't connect to my home vpn, Im going thru the proxy and you didn't block the destination IP ;) sort of permission things that @Greg_E mentioned ;)
