Topics

I had the problem that after the update to 19.7 all of a sudden one of my OpenVPN client interfaces was set as the the gateway instead of my WAN (which goes to a cable modem)
Described here
https://forum.opnsense.org/index.php?topic=13438.msg62208#msg62208

So I took my OPNsense router offline to debug. The setup for that is a router connected to a standalone router running OVPN which I use for my IOT devices, like this:
WAN <> OVPN-router <> Basic-Router <> OPNsense-FW for testing

The Basic-Router LAN-port was set to 172.20.20.1, and the OPNsense WAN correctly received an IP in that subnet and used 172.20.20.1 as the gateway for WAN.
After fixing the WAN/OVPN gateway assignment I had full internet again through the OPNsense box and thought I could put it back online.
Booted, internet didn't work. tried a lot of things, couldn't get it to work. Finally saw that the WAN DHCP gateway address was still stuck to the 'old' 172.20.20.1, while my WAN IP showed 24.119.xxx.4. The WAN gateway adress should have pointed to 24.119.xxx.1 - I was able to ping that address, but nothing else.

So I took it back to the test-setup described above.
1st screenshot attached: Old setup, gateway correct as 172.20.20.1 (most likely still stuck there from before)

Changed Basic-Router LAN to 172.21.21.1, rebooted that router and then rebooted OPNsense
2nd screenshot attached: new (correct) WAN IP, but gateway stuck at previous address (172.20.20.1)

Did a dhclient re1, no change.

3rd screenshot attached: tail of /var/db/dhclient.leases.re1

It shows the initial test setup with
-correct WAN IP & gateway
-changed&correct WAN IP & gateway (even though GUI still shows old/wrong gateway address)
-same WAN IP/GW after executing 'dhclient re1' - GUI still shows old/wrong gateway address

The I deleted the WAN IF & gateway in OPNsense GUI and rebooted.
Added the WAN IF back to re1 interface, had to do a DHCP 'Renew' in [Interfaces:Overview:WAN] and got the correct IP&GW addresses, and internet works.

Now I changed the Basic-Router LAN address (which should always be the OPNsense WAN gateway address) to 172.30.30.1
Rebooted the Basic-Router and then the OPNsense box and the IP & GW addresses had changed correctly.

Changed the Basic-Router LAN to 10.10.10.1
Rebooted the Basic-Router and then the OPNsense box and the IP & GW addresses had changed correctly.


TLDR:
If you lose internet connectivity down the road (because maybe your ISP changed your assigned dynamic WAN IP & gateway addresses) check if the correct gateway address is shown under [Interfaces:Overview:WAN] - it might be stuck at the old one.
If so, delete everything WAN under gateways and interfaces, reboot and re-create the WAN IF/GW

This is from a Virtualbox environment (WAN DMZ'ed to internet, LAN on VBox internal network with a few clients. Initially I tried this on 18.7.10 and then updated to the 19.x RC to see if it's different. Which it wasn't.

I set up an OpenVPN client based on some HOW-To's and posts. That all worked well enough eventually. The VPN interface created created during that setup was on ovpnc1.

I then added a second client for the same VPN-provider but using a different server of theirs. All other settings were the same so I thought I'd re-use the already created interface.
That also worked, but when I look at the VPN log (or ifconfig) it shows that the second OVPN client setup is now using ovpnc2 as interface (or network port as it is called in the GUI).
Even though I never assigned this port. Also, ovpnc2 still shows as available for assignment in the GUI.

See attachments,
- VPN-clients shows the two client set-ups I have
- VPN-log shows that the second client is using ovpnc2 as port
- IF-assignments shows that ovpnc2 is still available for assignment

ifconfig (while second client is active):

Code Select Expand

ovpnc1: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> metric 0 mtu 1500
options=80000<LINKSTATE>
inet6 fe80::a00:27ff:fe82:f87d%ovpnc1 prefixlen 64 scopeid 0x7
nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
groups: tun openvpn
ovpnc2: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> metric 0 mtu 1500
options=80000<LINKSTATE>
inet6 fe80::a00:27ff:fe82:f87d%ovpnc2 prefixlen 64 scopeid 0x8
inet 10.9.0.18 --> 10.9.0.17 netmask 0xffffffff
nd6 options=21<PERFORMNUD,AUTO_LINKLOCAL>
groups: tun openvpn
Opened by PID 57326


I stumbled upon this when trying to add multiple clients for multiple VPN providers and the assignments didn't match between CLI/log and GUI.

So the problem/question is, why did ovpnc2 get taken into use even though the GUI still shows it as unassigned ?
Is this a known bug/feature ?