Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    v21.02 Broke all ExpressVPN Gateways

    Scheduled Pinned Locked Moved OpenVPN
    44 Posts 8 Posters 8.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • T
      thaddeusf
      last edited by

      I've been working for months with FW Rules routing traffic to ExpressVPN Gateways.

      After an upgrade to v21.02, none of the rules are routing to the gateways. The ExpressVPNs are all up, but all Gateways are offline.

      I've re-enable the default LAN to any rule (gateway is * (WAN_DHCP)) to be online.

      I can find no related topics since 2017 - and the problem solution doesn't apply.

      Can someone please advise?
      Thanks!

      1 Reply Last reply Reply Quote 1
      • T
        thaddeusf
        last edited by

        I'm going through the logs and I'm finding this in the OpenVPN logs:

        Feb 17 23:45:35 openvpn 18775 Options error: option 'redirect-gateway' cannot be used in this context ([PUSH-OPTIONS])
        Feb 17 23:45:35 openvpn 18775 Options error: option 'dhcp-option' cannot be used in this context ([PUSH-OPTIONS])
        Feb 17 23:45:35 openvpn 18775 Options error: option 'route' cannot be used in this context ([PUSH-OPTIONS])

        Related? How is this configured?

        GertjanG 1 Reply Last reply Reply Quote 0
        • GertjanG
          Gertjan @thaddeusf
          last edited by

          @thaddeusf said in v21.02 Broke all ExpressVPN Gateways:

          How is this configured?

          Compare with what Expr*xxVPN proposes :

          dev tun
fast-io
persist-key
persist-tun
nobind
remote xxxxxxxxxxxxxxxxxxx.expressnetw.com 1195

remote-random
pull
comp-lzo no
tls-client
verify-x509-name Server name-prefix
ns-cert-type server
key-direction 1
route-method exe
route-delay 2
tun-mtu 1500
fragment 1300
mssfix 1200
verb 3
cipher AES-256-CBC
keysize 256
auth SHA512
sndbuf 524288
rcvbuf 524288
auth-user-pass

......

          with your actual OpenVPN client config file here /var/etc/openvpn/

          Also check oit https://forum.netgate.com/topic/146681/expressvpn-connection-options-error-option-dhcp-option-route-redirect-gateway

          No "help me" PM's please. Use the forum, the community will thank you.
          Edit : and where are the logs ??

          1 Reply Last reply Reply Quote 0
          • L
            limis
            last edited by

            I have same issue with another VPN provider. Same orror messegaes in OpenVPN log.

            Actually I had perfectly working pfs 2.4.5-p1 before I desided to do upgrade to pfs 2.5.0.

            After I did upgrade to pfs 2.5.0 on first reboot I noticed that my default gateway was removed (WAN) and I had no internet vconnectivuty.

            After I changed default gw manually to be my WAN interface Internet and enabled "Disable Gateway Monitoring Action" my Internet was up and running.

            But not VPN client connection.

            Routing table simply does not have routes to VPN provider as I see it

            1 Reply Last reply Reply Quote 0
            • T
              thaddeusf
              last edited by thaddeusf

              This problem is certainly a bug. I would suggest to anyone running VPNs terminating at pfsense not to upgrade until this is specifically addressed.

              The only way I've been able to recover is by editing the specific VPN gateway
              System/Routing/Gateways/Edit

              Disable Gateway Monitoring
              or
              Disable Gateway Monitoring Action

              Allows the interface/gateway to work again. I do not know the complete impact of the choices.

              While I have recreated all interfaces, VPN, etc., I have not completely reset the FW to default. Perhaps this would resolve?

              Any additional insight is welcome. This has been a garbage upgdate.

              T 1 Reply Last reply Reply Quote 0
              • T
                thaddeusf @thaddeusf
                last edited by

                @thaddeusf

                I wonder if it's possible the 'Serviced Watchdog' is causing the problem? Testing.

                T 1 Reply Last reply Reply Quote 0
                • T
                  thaddeusf @thaddeusf
                  last edited by thaddeusf

                  @thaddeusf

                  Nothing has worked. I've just now completely reset the NetGate and starting from scratch - not even restoring from backup.

                  Have been working on it for hours because of the complexity of my static DHCP addressing.

                  I cannot BELIEVE how much crap this upgrade has caused. I do NOT recommend doing it.

                  I just hope the VPN Gateways work once I finishing rebuilding everything.

                  T 1 Reply Last reply Reply Quote 0
                  • T
                    thaddeusf @thaddeusf
                    last edited by

                    @thaddeusf

                    I've flashed the system to '21.02-RELEASE-p1' and while the system is behaving better (and much faster), the Gateway problem still exists.

                    I've restored from 2.4 backup and turned Gateway Monitoring off on all ExpressVPNs and I seem to be back up working as before the upgrade.

                    Can anyone explain the specifics of disabling Gateway Monitoring?

                    This have been a very rough experience.

                    Thanks.

                    1 Reply Last reply Reply Quote 0
                    • A
                      AB5G
                      last edited by

                      +1 on this with ExpressVPN. I've been rocking ExpressVPN with a single tunnel on pfsense 2.5 from Jan . Yesterday night, I cloned the existing config and added another tunnel to a different geo. The gateway monitoring widget wasn't showing the gateway up so I added 1.1.1.1 as the monitoring IP through the tunnel - with this the gateway came up and with the Policy based routing my IOT devices got working.

                      Somewhere in the night, the entire network started to behave slow (main LAN and IOT). I thought it was the DNS so I restarted unbound. Didn't help, then I thought it was the ISP and went to bed. Woke up in the morning and the same issue. I traced my steps back - deleted the new tunnel, interface and the gateway and things were back to normal.

                      I have some openvpn logs if someone wants to look through.

                      1 Reply Last reply Reply Quote 0
                      • T
                        thaddeusf
                        last edited by

                        After flashing to 21-02-RELEASE-p1, it appeared the SG-3100 was working again. However through the night, the system completely fell apart again.

                        At this point I've removed all VPN configuration and rules. And for some reason the FW is only NATting IPv6 inconsistently and no IPv4.

                        None of this makes sense and the logs aren't providing much insight.

                        sigh....

                        1 Reply Last reply Reply Quote 0
                        • T
                          thaddeusf
                          last edited by

                          I've once again done a complete fresh install.

                          If I set it up as a pricey Linksys router, it seems to be stable.

                          I don't yet know what specific configuration causes it to fall over.

                          1 Reply Last reply Reply Quote 0
                          • B
                            bod
                            last edited by

                            Yep - With Gateway monitoring enabled on my Private Internet Access VPN it takes multiple OpenVPN service restarts to get it working. Anything from 1 to 10.

                            1 Reply Last reply Reply Quote 0
                            • viktor_gV
                              viktor_g Netgate
                              last edited by

                              Try to install the System Patches pkg https://docs.netgate.com/pfsense/en/latest/development/system-patches.html
                              and apply Patch ID 969574b6dbb124e98595ca537c0d176d908707d0

                              See https://redmine.pfsense.org/issues/11448

                              T 1 Reply Last reply Reply Quote 1
                              • B
                                bod
                                last edited by

                                Thanks - didn't resolve the issue with Gateway Action. If I have Gateway Action enabled it fails to connect randomly.

                                1 Reply Last reply Reply Quote 0
                                • T
                                  thaddeusf @viktor_g
                                  last edited by

                                  @viktor_g Unfortunately this does not fix the problem

                                  Additionally I've manually loaded the identical configuration on an x86 pfsense system and it has the same problem of failed gateway monitoring.

                                  Please prioritize - I cannot imaging this is not effecting quite a number of upgraders.

                                  1 Reply Last reply Reply Quote 0
                                  • T
                                    thaddeusf
                                    last edited by

                                    I have done another completely clean install and this time it is the 2.5 pfsense community edition on a ProtectLI.

                                    The bottom line is that I can create an ExpressVPN interface but the Gateway to the interface if marked 'Offline, Packetloss: 100%"

                                    A monitor IP is listed and is the same as the Gateway IP.

                                    If I turn Gateway monitoring off (system/routing/gateways) in the configuration of the ExpressVPN interface, the entire firewall stops passing traffic.

                                    This is not precisely the same behavior I saw on the SG-3100, but it's close. The 3100 would start passing traffic with gateway monitoring off, but the performance would tank.

                                    This is pretty obviously a bug. Is there additional information (logs, etc) I can provide?

                                    B 1 Reply Last reply Reply Quote 0
                                    • B
                                      bcruze @thaddeusf
                                      last edited by

                                      https://openvpn.net/community-downloads/

                                      Under important notices states it pretty clear

                                      The service providers are at fault not Netgate

                                      T 1 Reply Last reply Reply Quote 1
                                      • T
                                        thaddeusf @bcruze
                                        last edited by

                                        @bcruze
                                        The only thing I am complaining about is that Netgate is not making 2.4.5 available for the SG-3100 when I specifically requested it.

                                        It was my own damn fault for rashly upgrading it.

                                        What could possibly be a valid reason not making it available?

                                        1 Reply Last reply Reply Quote 0
                                        • B
                                          bod
                                          last edited by

                                          Well looks like I found the solution with regards to Private Internet Access. A user has found that using the config below will work. I have even turned gateway monitoring on and multiple service restarts and it works everytime.

                                          https://www.privateinternetaccess.com/forum/discussion/38389/aes-256-gcm-with-asus-wrt-merlin-386-1-final-on-pia#latest

                                          Force AES-256-GCM
                                          Put in "NCP-disable" in Custom Options.

                                          Will let you know tomorrow if it's all still going well.

                                          B T 2 Replies Last reply Reply Quote 0
                                          • B
                                            bcruze @bod
                                            last edited by

                                            @bod said in v21.02 Broke all ExpressVPN Gateways:

                                            Well looks like I found the solution with regards to Private Internet Access. A user has found that using the config below will work. I have even turned gateway monitoring on and multiple service restarts and it works everytime.

                                            https://www.privateinternetaccess.com/forum/discussion/38389/aes-256-gcm-with-asus-wrt-merlin-386-1-final-on-pia#latest

                                            Force AES-256-GCM
                                            Put in "NCP-disable" in Custom Options.

                                            Will let you know tomorrow if it's all still going well.

                                            its been posted a few times it will work. then speeds will go to a grinding halt. my previous provider would also work for a while. but if I restarted the tunnel. or rebooted the router it stopped working again. please let us know either way

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.