Status:OpenVPN not showing all connected clients

[CuteBoi]

I've got my server setup, I have a site to site configuration working.  Everything is working fine, I can ping all devices on all connected networks, and those remote networks can ping back.

But when I check the Status page for the OpenVPN on the Server, it doesn't show the 200+ clients connected, I only see 10, maybe 50, maybe 150, maybe 2… and sometimes none.

It's very disturbing when I want to check the status of a client because I don't know if the interface has gone down, or something worse has happened.  I've been resorting to checking the Client's status page to get all the information.

I'm using the netgate hardware with the latest os.  I attached an image of the version I'm using.  As far as I can tell, everything is up to date. I am using ClientSpecificOrverrides, but that shouldn't be causing any issues.

Ideas?

My original expectation is I would see all connected clients and their respective stats.

[jimp]

I see you also tried to open a Redmine issue but so far there isn't sufficient evidence to confirm there is a bug in our code here.

pfSense outputs what it receives from OpenVPN using the management interface.

Is the status issue also present on pfSense 2.3?

Can you connect to the OpenVPN management interface directly from a shell (ssh or console) and issue a status request to see the output and see if it compares to your expected output and what is shown in the GUI?

: nc -U /var/etc/openvpn/server1.sock
status 1
status 2
status 3
exit

Use the appropriate socket for the server that has a status you believe to be incorrect.

If the status output form OpenVPN is identical to what is in the pfSense GUI, but neither are correct, then you should report the issue upstream to OpenVPN directly.

If the console output is OK but the GUI is not, please get us a copy of the console output and GUI output to compare.

I have closed out the Redmine report for now until/unless a bug can be confirmed.

[johnpoz]

So just for clarification you have a site to site along with road warrior connections?  A site to site would not show all the end users..

[jimp]

If it's an SSL/TLS Site-to-Site, all sites should show as connected clients.

[johnpoz]

He has 200+ site to site connections?

[jimp]

It's not unheard of, and given all the other context in the post, it would seem that is the case.

[johnpoz]

Wow, that seems nuts.. for such a large network wouldn't you normally just see a typical mpls cloud or sdn or sd-wan..  Managing 200 some s2s vpns seems nuts.