VPN routing broken afer upgrade to 23.01
-
After the upgrade to 23.01 from 22.05 (SG-2440) it appears routing via site to site VPN is broken. Trying to access servers on the other site from a LAN computer doesn't work. I can however ping the same servers from the router via the Ping utility.
If i use tracert for an IP address via a LAN computer, it shows it trying to use the default route GW listed in the Routing table instead of the VPN route GW.
I will attempt to boot the previous version via Boot Environments.
-
@bambam Not a lot of details here.
What hardware is 23.01 running on?
What VPN protocol?
Are you using static routing? -
@michmoor It's running on a Netgate SG-2440. OpenVPN clients connecting to several different pfSense VMs (these haven't been upgraded). No static routing, OpenVPN creates the routing table entries. It's a multi-wan setup but in a Gateway group.
-
No issues here with site-to-site VPN, but I am using IPsec, not openVPN.
Access to devices in remote network is possible.Regards
-
It seems to ignore the routing table entries and uses the default which is the wan.
-
@bambam said in VPN routing broken afer upgrade to 23.01:
@michmoor It's running on a Netgate SG-2440. OpenVPN clients connecting to several different pfSense VMs (these haven't been upgraded). No static routing, OpenVPN creates the routing table entries. It's a multi-wan setup but in a Gateway group.
Sounds like it's matching policy routing.
-
@derelict Thanks for the info - what does this mean though, and is there anyway i can fix this?
-
@bambam You said multi-WAN. That means you are policy routing to gateway groups. Need to look at the routing rules on the interface you are trying to use for the VPN and see where the traffic is being directed.
https://docs.netgate.com/pfsense/en/latest/multiwan/policy-route.html
-
Thanks. I had the same issue and had to blow away an old multi-WAN configuration to make this work. I'm glad I found this message right away!
-
Multi-WAN is pretty simple. It's the introduction of policy routing that makes life difficult.
I haven't run policy routing (for Multi-WAN purposes) since the option was added to set a gateway group as the default route target. (System > Routing).
That's all I have done for years. Took out all the gateways on all the rules and I'm much happier for it.
-
@derelict Thanks for pointing this out - we hadn't had a rule on the previous version but added it in before the gateway rule and all is working OK again.
