Open VPN - problem with failover



  • Hello - i have such scheme:
    SITE A  LAN –- PFSENSE --- WAN/OPVN1.A  ------------------------ WAN/OVPN1.B --- PFSENSE --- LAN SITE B
                                      |--- WAN/OPVN2.A  ------------------------WAN/OVPN2.B  --

    I'm trying to set up failover using openvpn and quagga.
    I picked up 2 channels openvpn between 2 offices.
    In the settings Openvpn not recorded local or remote Networks (they are blank) - routing makes quagga
    But occasionally VPN tunnels drops and in the services I see the following picture - attachment 1
    In the service i see that one of two openvpn tunnel is stopped, I try to run it - but it does not run. In logs i see error - attachment 2
    The i stop the second tunnel - and after that i am able to start both tunnels.

    Whats wrong? (i tried on clear new install of pfsense 2.0.1 - had same problem)






  • Hi

    I guess you have also a CARP IP for public routing/failover?

    => use this IP as OpenVPN Server/Client Interface - so you need only one OpenVPN Server on both sides ;)
    OpenVPN Server/Client is then automatically only started on the master firewall on each side…

    In newest Quagga package there is also a  - I think/hope not final - solution to bind /start Quagga only on CARP master ...

    EDIT: Here the Post with Failover found: http://forum.pfsense.org/index.php/topic,58776.0.html

    (I found this thread search for a solution why my Quagga won't bind on my OpenVPN server side interface :( )

    Bests

    Reiner



  • Hello,
    I don't use CARP. The problem is why openvpn fails to in such configuration start? see attached errors



  • your log is not very helpful… Because of

    kernel: ifa_add_loopback_route:insertion failed

    I guess you also run into this problem/bug: http://forum.pfsense.org/index.php/topic,60231.0.html
    where this fix could help - if he is made correctly… actually he has problems on server side (but you can test it on client side)
    http://forum.pfsense.org/index.php/topic,60231.msg330670.html#msg330670


Log in to reply