Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    OpenVPN Not Connecting - Unable To Contact Daemon

    OpenVPN
    2
    41
    3.7k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • P
      panzerscope
      last edited by panzerscope

      Hey guys,

      I am in the process of setting up a VPN client on PfSense using the PureVPN service. I have set everything up exactly as per the guide here: https://support.purevpn.com/router/how-to-set-up-purevpn-on-pfsense-router

      Granted it was written for an older of PfSense version but it seems the majority is applicable, the only setting I could not find as per the guide was "Enable Data Encryption Negotiation: Checked" perhaps this has been removed since newer versions of PfSense.

      In any case, my VPN is not starting, when I look at Status>OpenVPN I am getting the following:

      218345a4-253c-47bb-bc42-ee9db86fb3f0-image.png

      Upon looking at the OpenVPN system logs I am receiving the following.

      bed26956-e3fe-48f3-b3f4-fd2174660b27-image.png

      I assume the issue is related to this specific entry.

      ee96eefe-a7c4-44ed-81a6-d7f6a1820f36-image.png

      However this does not mean an awful lot, could someone help me to diagnose ?

      Many thanks,
      P

      V 1 Reply Last reply Reply Quote 0
      • V
        viragomann @panzerscope
        last edited by

        @panzerscope
        I don't expect this error message, when setting up the client according to the guide.

        Maybe we can get closer to the issue, when you show, what you did, not what you should do.

        P 1 Reply Last reply Reply Quote 0
        • P
          panzerscope @viragomann
          last edited by

          @viragomann said in OpenVPN Not Connecting - Unable To Contact Daemon:

          @panzerscope
          I don't expect this error message, when setting up the client according to the guide.

          Maybe we can get closer to the issue, when you show, what you did, not what you should do.

          Please see the config below that is currently setup under OpenVPN>Clients

          7746ca6b-27c4-4c0c-be5e-1cfa807f5dbe-image.png
          b56a02ba-0f67-4793-b321-0b3c4d77fc76-image.png
          58f1cb0d-7df3-4dd6-a877-ca2627c111b2-image.png
          761e417a-d554-4e61-964d-d454133fac2f-image.png
          85515971-55ed-49c9-9f0a-02afab9626ce-image.png
          82cb8618-004e-4a79-9807-978bdc865213-image.png

          V 1 Reply Last reply Reply Quote 0
          • V
            viragomann @panzerscope
            last edited by

            @panzerscope
            Looks well though. Never met this issue.

            Seems that there is something wrong with the password file.
            Check if the username and password are written correctly into the file.
            It should be stored in /var/etc/openvpn/client1/up.

            P 1 Reply Last reply Reply Quote 1
            • P
              panzerscope @viragomann
              last edited by

              @viragomann said in OpenVPN Not Connecting - Unable To Contact Daemon:

              @panzerscope
              Looks well though. Never met this issue.

              Seems that there is something wrong with the password file.
              Check if the username and password are written correctly into the file.
              It should be stored in /var/etc/openvpn/client1/up.

              Curious, I just browsed to the location as per below

              b1d76e97-cb7c-4882-9b30-f7fb1b1504cd-image.png

              I do not have an "Up" directory. It is possibly worth mentioning that the CA and CSC folders are empty, unless Pfsense hides files which is unlikely. Could you show me what is in your "UP" folder as I may have to manually create it and its contents with respects to the username/password.

              Many thanks,
              P

              V 1 Reply Last reply Reply Quote 0
              • V
                viragomann @panzerscope
                last edited by

                @panzerscope
                "up" is an ASCII file. It just contains the username in the first row and the password in the second.

                You can try to create it. But possibly it gets overwritten by the GUI. In this case, maybe a write protection can help. There was already a thread regarding this in the past, as far as I can remember.

                However, were the other files created in the client1 folder?
                Mine looks like this:
                5b4da966-a537-45c9-a49b-00fac6f14b92-grafik.png

                P 1 Reply Last reply Reply Quote 0
                • P
                  panzerscope @viragomann
                  last edited by

                  @viragomann said in OpenVPN Not Connecting - Unable To Contact Daemon:

                  @panzerscope
                  "up" is an ASCII file. It just contains the username in the first row and the password in the second.

                  You can try to create it. But possibly it gets overwritten by the GUI. In this case, maybe a write protection can help. There was already a thread regarding this in the past, as far as I can remember.

                  However, were the other files created in the client1 folder?
                  Mine looks like this:
                  5b4da966-a537-45c9-a49b-00fac6f14b92-grafik.png

                  Ok so after wiping the slate clean and starting again, I am now seeing more files in the aforementioned directory, so that is good

                  324a1b66-3210-4797-9ba8-2f1636133d7b-image.png

                  I looked in the "UP" File and it had my username noted on line 1, but no password. So I popped the password in on line 2 and saved. Tried reconnecting and still get the same error in my OpenVPN system logs. What I am going to do is remove the password from the UP file so that it is as originally configured and speak with PureVPN as I believe they offer remote assistance and may also be able to lend a hand.

                  Any more ideas welcome though as it "should" be working as far as I can see.

                  P 1 Reply Last reply Reply Quote 0
                  • P
                    panzerscope @panzerscope
                    last edited by panzerscope

                    I fixed it.

                    So I noticed that when going back to the UP file, the password has been removed, likely by the GUI (even though I did not access the VPN settings). The password was definitely in there as I had checked after I made the initial edit. This lead me to believe that when you initially save the config via the GUI, it commits the username to the "UP" file but not the password. So I went back into the client config and re-entered the password into the password field via the GUI, saved and voila, VPN connection success and the password is not committed to the UP file.

                    Seems like something is a little buggy as I would not expect to have to edit the config after the initial save to input the password so that it sticks.

                    V 1 Reply Last reply Reply Quote 0
                    • V
                      viragomann @panzerscope
                      last edited by

                      @panzerscope
                      In addition to the username and password in the up file, you can try to enter "akspass" into the advanced options box.

                      P 1 Reply Last reply Reply Quote 1
                      • P
                        panzerscope @viragomann
                        last edited by

                        @viragomann said in OpenVPN Not Connecting - Unable To Contact Daemon:

                        @panzerscope
                        In addition to the username and password in the up file, you can try to enter "akspass" into the advanced options box.

                        Thanks, I will give that a go if I have issues down the road.

                        So, I noticed something. When I have the VPN connected, even though my machines are not running through the VPN (Nothing is at the moment) I noticed the internet drops out with the classic "DNS Probe" error in the browser. As soon as I disconnect the VPN, The internet functions normally. I would not expect that to happen as the WAN interface should not be affected by the OpenVPN interface.

                        Any ideas ?

                        V 1 Reply Last reply Reply Quote 0
                        • V
                          viragomann @panzerscope
                          last edited by

                          @panzerscope
                          Most VPN provider push the default route to the clients. Hence any traffic, which is not policy-routed to the WAN gateway goes out over the VPN.
                          This naturally also concerns DNS requests from pfSense itself.

                          Check Status > gateways, to see which is the default.

                          If you don't want OpenVPN to set the default route to this VPN provider, go into the settings and check "Don't pull routes".
                          Then you can policy route desired traffic to the VPN gateway. Remember also to route DNS request from concerned machines over the VPN to avoid DNS leaks.

                          P 1 Reply Last reply Reply Quote 1
                          • P
                            panzerscope @viragomann
                            last edited by panzerscope

                            @viragomann said in OpenVPN Not Connecting - Unable To Contact Daemon:

                            @panzerscope
                            Most VPN provider push the default route to the clients. Hence any traffic, which is not policy-routed to the WAN gateway goes out over the VPN.
                            This naturally also concerns DNS requests from pfSense itself.

                            Check Status > gateways, to see which is the default.

                            If you don't want OpenVPN to set the default route to this VPN provider, go into the settings and check "Don't pull routes".
                            Then you can policy route desired traffic to the VPN gateway. Remember also to route DNS request from concerned machines over the VPN to avoid DNS leaks.

                            So I checked the Gateways and my defaults are correct as below

                            cd7fa1ab-ef78-41c7-b72a-e45e6962f3c3-image.png

                            I also checked the VPN client config and pulling DNS is already disabled as per:

                            c4bd6a7b-64c5-4494-867b-a5ef14fe68ab-image.png

                            I noted my internet connection died out again when enabling the VPN, so something is still up.

                            V 1 Reply Last reply Reply Quote 0
                            • V
                              viragomann @panzerscope
                              last edited by

                              @panzerscope said in OpenVPN Not Connecting - Unable To Contact Daemon:

                              So I checked the Gateways and my defaults are correct as below

                              Was the VPN client enabled, when you checked this?

                              P 1 Reply Last reply Reply Quote 1
                              • P
                                panzerscope @viragomann
                                last edited by

                                @viragomann said in OpenVPN Not Connecting - Unable To Contact Daemon:

                                @panzerscope said in OpenVPN Not Connecting - Unable To Contact Daemon:

                                So I checked the Gateways and my defaults are correct as below

                                Was the VPN client enabled, when you checked this?

                                Hey again,

                                So after some additional reading and messing around, I think I am almost there. The reason for the DNS issues was that I was not indicating which gateways particular rules are using. I made the mistake of leaving these on "Default". So that issue is now solved.

                                The one I face now is my firewall rules. I either end up with all my devices going over VPN WAN or all of them going over my WAN. I followed this guide (although old got me where I needed to be mostly) https://pixelsandwidgets.com/2014/10/setup-pfsense-openvpn-client-specific-devices/

                                My rules for Interfaces are currently setup as below

                                VPNWAN

                                c64bfcda-ba66-4637-9af4-3c94f94d8419-image.png

                                OpenVPN

                                feafb23e-3910-4485-8511-960fa1465954-image.png

                                LAN

                                a1289e14-c1c6-476f-987b-76aae3d3cfd9-image.png

                                Now, the key as to whether I end up with all devices going through VPN WAN or WAN is based on whether or not I have the below LAN rule enabled.

                                5e43d9e3-67eb-44a3-b13e-07cb3eed074a-image.png

                                So far as I was concerned, based on the ordering of my rules with the above being enabled, my configuration should put my VALAK Server & Valak Server Apps devices through VPN WAN and the rest of my devices on my LAN through the standard WAN.

                                Any ideas where I have gone wrong ?

                                Many thanks as always.
                                P

                                V 1 Reply Last reply Reply Quote 0
                                • V
                                  viragomann @panzerscope
                                  last edited by

                                  @panzerscope
                                  Remember the path of DNS resolution. Which DNS server do your local devices use?

                                  Policy routing rules direct any matching traffic to the stated gateway. This means, if your device is configured to use a local DNS, e.g. pfSense, it would not be able to access the DNS server, because your rule pass any traffic to the VPN or WAN gateway.
                                  If your devices use a public DNS and your route it over the VPN, you have to ensure, that the DNS is responding if the requests come from the VPN provider.

                                  To resolve this issue, you have to add rules above of the policy routing for exception-traffic.
                                  E.g. for allowing DNS to pfSense: source = LAN subnets, destination = LAN address, dest. port = 53

                                  Aside from this, best practice to handle DNS traffic is to port forward it.
                                  E.g. to avoid DNS leaks on devices going over VPN, these should use the VPN providers DNS or at all the DNS should go over the VPN.
                                  So add a port forwarding rule on the LAN: source = your VPN devices alias, dest = any, dest port = 53, redirect target = desired DNS server, port = 53.

                                  BTW: firewall pass rules on the VPN interface allow traffic coming in from the VPN. You might want traffic let in later, when your provider forward it to you, but not "any"! This is dangerous.

                                  And a gateway in a rule on the OpenVPN makes no sense at all.

                                  P 1 Reply Last reply Reply Quote 1
                                  • P
                                    panzerscope @viragomann
                                    last edited by

                                    @viragomann said in OpenVPN Not Connecting - Unable To Contact Daemon:

                                    @panzerscope
                                    Remember the path of DNS resolution. Which DNS server do your local devices use?

                                    Policy routing rules direct any matching traffic to the stated gateway. This means, if your device is configured to use a local DNS, e.g. pfSense, it would not be able to access the DNS server, because your rule pass any traffic to the VPN or WAN gateway.
                                    If your devices use a public DNS and your route it over the VPN, you have to ensure, that the DNS is responding if the requests come from the VPN provider.

                                    To resolve this issue, you have to add rules above of the policy routing for exception-traffic.
                                    E.g. for allowing DNS to pfSense: source = LAN subnets, destination = LAN address, dest. port = 53

                                    Aside from this, best practice to handle DNS traffic is to port forward it.
                                    E.g. to avoid DNS leaks on devices going over VPN, these should use the VPN providers DNS or at all the DNS should go over the VPN.
                                    So add a port forwarding rule on the LAN: source = your VPN devices alias, dest = any, dest port = 53, redirect target = desired DNS server, port = 53.

                                    BTW: firewall pass rules on the VPN interface allow traffic coming in from the VPN. You might want traffic let in later, when your provider forward it to you, but not "any"! This is dangerous.

                                    And a gateway in a rule on the OpenVPN makes no sense at all.

                                    Thanks for the info.

                                    I use remote DNS, namely cloudflare @ 1.1.1.1 on my PfSense config for resolution. I have configured it on my VPN Client that it pulls the VPN DNS, to avoid any leaks for any devices going out over the VPN. This should be all I need to do correct?

                                    Yes, noted regarding the Pass Rule on the VPN Interface, this is setup as I will be port forwarding traffic through the VPN for Plex reasons, 32400 specifically. I had just not locked this down yet and was trying a pass all.

                                    The issue I am facing is per my last post where disabling or enabling the Lan Subnet rule (as per the last screenshot) will either force all my clients over VPN, or none of them.

                                    V 1 Reply Last reply Reply Quote 0
                                    • V
                                      viragomann @panzerscope
                                      last edited by

                                      @panzerscope said in OpenVPN Not Connecting - Unable To Contact Daemon:

                                      I use remote DNS, namely cloudflare @ 1.1.1.1 on my PfSense config for resolution.

                                      The question is, which DNS the concerned devices are using.

                                      I have configured it on my VPN Client that it pulls the VPN DNS, to avoid any leaks for any devices going out over the VPN

                                      The screenshot above is showing something different.
                                      Anyway, this setting affects pfSense only.

                                      So which DNS server is configured on the devices??

                                      Do you forward DNS?

                                      Still waiting for a screenshot of the gateway statues, when the VPN is connected.

                                      So I checked the Gateways and my defaults are correct as below

                                      Was the VPN client enabled, when you checked this?

                                      P 1 Reply Last reply Reply Quote 0
                                      • P
                                        panzerscope @viragomann
                                        last edited by

                                        @viragomann said in OpenVPN Not Connecting - Unable To Contact Daemon:

                                        @panzerscope said in OpenVPN Not Connecting - Unable To Contact Daemon:

                                        I use remote DNS, namely cloudflare @ 1.1.1.1 on my PfSense config for resolution.

                                        The question is, which DNS the concerned devices are using.

                                        I have configured it on my VPN Client that it pulls the VPN DNS, to avoid any leaks for any devices going out over the VPN

                                        The screenshot above is showing something different.
                                        Anyway, this setting affects pfSense only.

                                        So which DNS server is configured on the devices??

                                        Do you forward DNS?

                                        Still waiting for a screenshot of the gateway statues, when the VPN is connected.

                                        So I checked the Gateways and my defaults are correct as below

                                        Was the VPN client enabled, when you checked this?

                                        The devices on my network are set to either Auto/192.168.1.1 which either way will get the DNS from PfSense which is currently configured on PfSense to look remotely at 1.1.1.1.

                                        DNS Forwarding is not enabled on my PfSense.

                                        Here is the screenshot of the Gateway Status when VPN is enabled and connected :

                                        0759a574-d4be-4579-b339-671dba316101-image.png

                                        Many thanks !

                                        V 1 Reply Last reply Reply Quote 0
                                        • V
                                          viragomann @panzerscope
                                          last edited by

                                          @panzerscope said in OpenVPN Not Connecting - Unable To Contact Daemon:

                                          The devices on my network are set to either Auto/192.168.1.1 which either way will get the DNS from PfSense

                                          So they try to request pfSense. But the LAN ruleset does not allow this, as long as the is no floating rule passing it, as I tried hard to explain above.

                                          which is currently configured on PfSense to look remotely at 1.1.1.1.

                                          What pfSense does on its own, is another part.
                                          In fact it passes out requests to the default gateway, which is WAN according to gateway status.

                                          DNS Forwarding is not enabled on my PfSense.

                                          I also tried to explain the benefit of this and behavior and drawback without.

                                          The issue I am facing is per my last post where disabling or enabling the Lan Subnet rule (as per the last screenshot) will either force all my clients over VPN, or none of them.

                                          From your rules and gateway status I have no idea why this should be the case, if it's not on DNS.
                                          In which case is the traffic passing over the VPN?
                                          Ans as you said any, I assume, this concerns any LAN device.

                                          From one of the devices included in the VPN alias try to simply ping 1.1.1.1 and 8.8.8.8 in both cases, VPN connected and disconnected.
                                          What do you get?

                                          P 1 Reply Last reply Reply Quote 0
                                          • P
                                            panzerscope @viragomann
                                            last edited by

                                            @viragomann said in OpenVPN Not Connecting - Unable To Contact Daemon:

                                            @panzerscope said in OpenVPN Not Connecting - Unable To Contact Daemon:

                                            The devices on my network are set to either Auto/192.168.1.1 which either way will get the DNS from PfSense

                                            So they try to request pfSense. But the LAN ruleset does not allow this, as long as the is no floating rule passing it, as I tried hard to explain above.

                                            which is currently configured on PfSense to look remotely at 1.1.1.1.

                                            What pfSense does on its own, is another part.
                                            In fact it passes out requests to the default gateway, which is WAN according to gateway status.

                                            DNS Forwarding is not enabled on my PfSense.

                                            I also tried to explain the benefit of this and behavior and drawback without.

                                            The issue I am facing is per my last post where disabling or enabling the Lan Subnet rule (as per the last screenshot) will either force all my clients over VPN, or none of them.

                                            From your rules and gateway status I have no idea why this should be the case, if it's not on DNS.
                                            In which case is the traffic passing over the VPN?
                                            Ans as you said any, I assume, this concerns any LAN device.

                                            From one of the devices included in the VPN alias try to simply ping 1.1.1.1 and 8.8.8.8 in both cases, VPN connected and disconnected.
                                            What do you get?

                                            Ok, so I went back and added the rule you suggested on LAN tab regarding DNS as seen below.

                                            a7b02d7a-6d40-4269-864e-5b4bb06e1a33-image.png

                                            Look ok to you ?

                                            I re-read your responses, but I cannot see anything mentioning the setup of any DNS Forwarding.

                                            Yes all my LAN devices will use the VPN, assuming I have disabled the following rule.

                                            482057f9-91be-45db-9cdf-5c594c96db92-image.png

                                            I can ping 1.1.1.1 or 8.8.8.8 from any device on my network whether its running over the connected VPN or over standard WAN.

                                            V 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.