Messages

Hi team, since the legacy OpenVPN module is being retired, I am in the process to convert my 2 OpenVPN clients to the new OpenVPN client "instances".

However, it seems the new OpenVPN client "instances" are not feature-comptible with the legacy OpenVPN.

The issues I have encountered so far:
1. It seems we cannot specify an "interface" for the VPN connection (I specified "WAN" as the interface for my legacy OpenVPN connection)
2. There is no "Don't add/remove routes" option - I believe this is the default behavior for the new OpenVPN client?
3. The "Compression" dropdown box is gone, and this is where I got stuck - I need to set it to "Partial" (e.g. --compress) for the connection to my VPN provider to work
4. I was also setting extra options like: `remote-cert-tls server`, `fast-io`, `sndbuf 524288`, `rcvbuf 524288` etc. but doesn't seem like the new OpenVPN module allows me to do that

Any ideas how I can get the new OpenVPN clients up and running?

Thanks!

I have started seeing a huge bunch of "IPv6 RFC4890 requirements (ICMP)" being BLOCKED after upgraded to 25.1.1/25.1.2.

Code Select Expand

EGRESS0        2025-03-01T20:38:44    fd97:xxxx:xxxx:15::1    fd97:xxxx:xxxx:15::2    ipv6-icmp    IPv6 RFC4890 requirements (ICMP)
EGRESS0        2025-03-01T20:38:40    fd97:xxxx:xxxx:15::f0   fd97:xxxx:xxxx:15::2    ipv6-icmp    IPv6 RFC4890 requirements (ICMP)
(fd97:xxxx:xxxx:15::f0 is the OPNSense gateway)

Strangely, all "IPv6 RFC4890 requirements (ICMP)" rules are "Automatically generated rules", and apparently they are all first match ALLOWED rules.

Does it mean there are some hidden BLOCKED rules being generated and are not shown on the UI?

Also there is no way for me to workaround this at the moment, because I cannot create any rules that are applied before those "Automatically generated rules"... >_<

The "hv_sock0" messages could be related to this:
https://reviews.freebsd.org/D24061

Did you enable the "Integration Services -> Guest Services" for your OPNSense VM? If so try to disable it and see if it can fix this issue.