OpenVPN Data Channel Offload (DCO) failure, service does not start after upgrade to version 22.05-RELEASE (amd64)

gdp

I've recently upgraded to version 22.05-RELEASE (amd64).
The system is a Netgate/pfsense 5100

After that, I can't start OpenVPN service anymore.
In system logs, I found this:

Process: php-fpm
Message: /status_services.php: The command '/usr/local/sbin/openvpn --config '/var/etc/openvpn/server1/config.ovpn'' returned exit code '1', the output was 'Options error: Unrecognized option or missing or extra parameter(s) in /var/etc/openvpn/server1/config.ovpn:2: disable-dco (2.5.4) Use --help for more information.'

I've found this documentation https://docs.netgate.com/pfsense/en/latest/vpn/openvpn/dco.html
So, how can I get a workaround to this matter.

Thanks in advance. Kind Regards

gdp

@gdp

Workaround 1st step.

I've deleted the line disable-dco in /var/etc/openvpn/server1/config.ovpn. After that I can start the service from WebGUI/Command Prompt with the following command: /usr/local/sbin/openvpn --config '/var/etc/openvpn/server1/config.ovpn'. So, how can I prevent the system to write this line in config.ovpn?

gdp

@gdp

I've edited the file /etc/inc/openvpn.inc, and I've commented the instructions set between lines 950 and 952. This prevents the creation of the line disable-dco in config.ovpn and the service start without problem.

Another thing I've found is that after upgrade, Data Encryption Algorithms in OpenVPN/Servers are changed too.

FlavienR

Thank you gdp, you saved my evening !

jimp

If you see this, your system did not fully complete the upgrade to 22.05. You should run pfSense-upgrade -dy from an SSH or serial console shell prompt.

gdp

@jimp Hi,

Thanks for your answer!

Eyedol-X

@jimp said in OpenVPN Data Channel Offload (DCO) failure, service does not start after upgrade to version 22.05-RELEASE (amd64):

If you see this, your system did not fully complete the upgrade to 22.05. You should run pfSense-upgrade -dy from an SSH or serial console shell prompt.

I had a fresh install from 2.6.0 > 22.01 > 22.05 and this issue appeared.

This was the solution to the issue.