Messages

I'll start by saying that my internet has high latency of around 150ms or more and that the ISP will randomly have slow downs and high packet loss. I have been able to verify this shouldn't be my opnsense setup by using the router provided by the ISP to test with.

My OPNsense hardware is running on an AMD Epyc 3000, 32gb ram, nvme drive, 1GBe interface to ISP ONT, and a 10GBe network to my 10GBe switch. I know it's overkill but the small machine was meant for something else that I never got around to doing.

My OPNsense configuration, has 3-4 VLANs for management, users, guests, iot like things and the OPNsense does the routing.

Normally this setup works pretty well without issues but when my ISP drops packets or it's connection, all of my intraVLAN traffic suffers. I was using Plex from one VLAN to another (waiting on another interface card for Plex server to avoid this) and it wouldn't play because of how much buffer it had to do. I did a couple of tests like manually down the WAN interface and unplug the WAN interface, both of these "fixed" the internal network issues and Plex streamed across the router without an issue. I have the same issue with SMB shares dropping connections if I am trying to transfer a file.

I wanted to see if anyone had some thoughts or ideas to help me troubleshoot.

Thanks

Thanks, I was also able to

Code Select Expand

cat /var/etc/openvpn/client1.conf | sort to get an idea of duplicates.

Was able to remove 3-4 options, to bad none of those will really speed it up. Express recommends that comp-lzo be turned off, I think it was on in the advanced settings but it was just listed as "comp-lzo" and not "comp-lzo no". Anyways the tunnel is still coming up and it more closely matches the .ovpn from Express.

Ok, so the changing of the Interface worked. I also used the very handy configuration diff feature (just found it) and looked back for changes in the openvpn config and it was over a month ago that the Interface was changed from WAN to ExpressVPN. It must have been a typo but I'm not sure why it didn't mess up until now. previously it hadn't been rebooted in over 45 days.

I have also removed some of the windows and redundant options. I'm going to have to do some googling to see which ones are redundant

I'm a little shocked those are in there because this was the config from Express for pfSense. They do have a disclaimer that it was community developed and Express doesn't provided support for routers like pfSense and OPNSense at this time.

Thank you both for the help!

Will give that a shot.

I have attached the client config options that are used. I haven't changed these since the upgrade and all of these used to work. The server config is hosted by ExpressVPN and I only have the ovpn file that they provide with the settings provided for pfSense that also work fairly well for OPNSense.

I currently have verb set to 7 and can't change it back to 4 because I get the error in the first picture when I try to save anything.

I've also tried to reboot the router to see if something is stuck.

Thanks

Even though I didn't change anything in the configuration besides updating from 10.7.1 to 10.7.2, there must have been a configuration change or corruption during the upgrade.

I found the previous cipher issue below but could not make the required change because I get an error when I click apply. I can not make any changes to the openvpn configuration because: An IPv4 protocol was selected, but the selected interface has no IPv4 address. Which is how Nord and ExpressVPN require their openvpn configs to be setup.

I exported the configuration and made changes to the cipher type and restored the configuration. This fixed the cipher issues but the connection still does not work.

I would like to stress that this was working for weeks with a reboot or two and only broke when I upgrade from 10.7.1 to 10.7.2. This could be a fluke but I need to get openvpn working.

Code Select Expand

2020-09-18T22:28:07 openvpn[76917] /usr/local/etc/inc/plugins.inc.d/openvpn/ovpn-linkup ovpnc1 1500 1557 10.171.0.34 10.171.0.33 init
2020-09-18T22:28:07 openvpn[76917] /sbin/ifconfig ovpnc1 10.171.0.34 10.171.0.33 mtu 1500 netmask 255.255.255.255 up
2020-09-18T22:28:07 openvpn[76917] TUN/TAP device /dev/tun1 opened
2020-09-18T22:28:07 openvpn[76917] TUN/TAP device ovpnc1 exists previously, keep at program end
2020-09-18T22:28:07 openvpn[76917] ROUTE_GATEWAY 101.108.0.1/255.255.255.255 IFACE=pppoe0 HWADDR=00:00:00:00:00:00
2020-09-18T22:28:07 openvpn[76917] Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2020-09-18T22:28:07 openvpn[76917] Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2020-09-18T22:28:07 openvpn[76917] Data Channel: using negotiated cipher 'AES-256-GCM'
2020-09-18T22:28:07 openvpn[76917] OPTIONS IMPORT: data channel crypto options modified
2020-09-18T22:28:07 openvpn[76917] OPTIONS IMPORT: adjusting link_mtu to 1629
2020-09-18T22:28:07 openvpn[76917] OPTIONS IMPORT: peer-id set
2020-09-18T22:28:07 openvpn[76917] OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
2020-09-18T22:28:07 openvpn[76917] OPTIONS IMPORT: route options modified
2020-09-18T22:28:07 openvpn[76917] OPTIONS IMPORT: --ifconfig/up options modified
2020-09-18T22:28:07 openvpn[76917] OPTIONS IMPORT: compression parms modified
2020-09-18T22:28:07 openvpn[76917] OPTIONS IMPORT: timers and/or timeouts modified
2020-09-18T22:28:07 openvpn[76917] PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 10.171.0.1,comp-lzo no,route 10.171.0.1,topology net30,ping 10,ping-restart 60,ifconfig 10.171.0.34 10.171.0.33,peer-id 7,cipher AES-256-GCM'
2020-09-18T22:28:07 openvpn[76917] SENT CONTROL [Server-6885-0a]: 'PUSH_REQUEST' (status=1)
2020-09-18T22:28:06 openvpn[76917] [Server-6885-0a] Peer Connection Initiated with [AF_INET]174.128.240.186:1195
2020-09-18T22:28:06 openvpn[76917] Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
2020-09-18T22:28:05 openvpn[76917] VERIFY OK: depth=0, C=VG, ST=BVI, O=ExpressVPN, OU=ExpressVPN, CN=Server-6885-0a, emailAddress=support@expressvpn.com
2020-09-18T22:28:05 openvpn[76917] VERIFY X509NAME OK: C=VG, ST=BVI, O=ExpressVPN, OU=ExpressVPN, CN=Server-6885-0a, emailAddress=support@expressvpn.com
2020-09-18T22:28:05 openvpn[76917] VERIFY EKU OK
2020-09-18T22:28:05 openvpn[76917] ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
2020-09-18T22:28:05 openvpn[76917] Validating certificate extended key usage
2020-09-18T22:28:05 openvpn[76917] VERIFY KU OK
2020-09-18T22:28:05 openvpn[76917] VERIFY OK: depth=1, C=VG, ST=BVI, O=ExpressVPN, OU=ExpressVPN, CN=ExpressVPN CA, emailAddress=support@expressvpn.com
2020-09-18T22:28:05 openvpn[76917] WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
2020-09-18T22:28:05 openvpn[76917] TLS: Initial packet from [AF_INET]174.128.240.186:1195, sid=7d9bc67d 848b5e8a
2020-09-18T22:28:05 openvpn[76917] MANAGEMENT: Client disconnected
2020-09-18T22:28:05 openvpn[76917] MANAGEMENT: CMD 'state all'
2020-09-18T22:28:05 openvpn[76917] MANAGEMENT: Client connected from /var/etc/openvpn/client1.sock
2020-09-18T22:28:05 openvpn[76917] UDPv4 link remote: [AF_INET]174.128.240.186:1195
2020-09-18T22:28:05 openvpn[76917] UDPv4 link local: (not bound)
2020-09-18T22:28:05 openvpn[76917] Socket Buffers: R=[42080->524288] S=[57344->524288]
2020-09-18T22:28:05 openvpn[76917] TCP/UDP: Preserving recently used remote address: [AF_INET]174.128.240.186:1195
2020-09-18T22:28:04 openvpn[76917] Incoming Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
2020-09-18T22:28:04 openvpn[76917] Outgoing Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
2020-09-18T22:28:04 openvpn[76917] NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2020-09-18T22:28:04 openvpn[76917] MANAGEMENT: unix domain socket listening on /var/etc/openvpn/client1.sock
2020-09-18T22:28:04 openvpn[45976] library versions: OpenSSL 1.1.1g 21 Apr 2020, LZO 2.10
2020-09-18T22:28:04 openvpn[45976] OpenVPN 2.4.9 amd64-portbld-freebsd12.1 [SSL (OpenSSL)] [LZO] [LZ4] [MH/RECVDA] [AEAD] built on Jul 28 2020
2020-09-18T22:28:04 openvpn[45976] WARNING: file '/var/etc/openvpn/client1.up' is group or others accessible

I just upgraded from 20.7.1 to 20.7.2, after a reboot my openvpn stopped working. I've included some of the logs that I can find. Willing to grab other logs as needed to help troubleshoot the issue. It looks like the connection is partially successful but then fails with error codes and shows as down in the gateways. I am using expressvpn and have change the endpoint and validated what configurations are needed in the client config.

I see a section that shows cannot assign address and I've confirmed that nothing in my network is in that range either.

Client Instance Status:
ExpressVPN UDP4    Unable to contact daemon    Service not running?

Code Select Expand

2020-09-17T23:23:50 openvpn[28094] Exiting due to fatal error
2020-09-17T23:23:50 openvpn[28094] TCP/UDP: Socket bind failed on local address [AF_INET]10.151.0.98:0: Can't assign requested address (errno=49)
2020-09-17T23:23:50 openvpn[28094] Socket Buffers: R=[42080->524288] S=[57344->524288]
2020-09-17T23:23:50 openvpn[28094] TCP/UDP: Preserving recently used remote address: [AF_INET]70.39.102.162:1195
2020-09-17T23:23:50 openvpn[28094] Incoming Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
2020-09-17T23:23:50 openvpn[28094] Outgoing Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
2020-09-17T23:23:50 openvpn[28094] NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2020-09-17T23:23:50 openvpn[28094] MANAGEMENT: unix domain socket listening on /var/etc/openvpn/client1.sock
2020-09-17T23:23:50 openvpn[74407] library versions: OpenSSL 1.1.1g 21 Apr 2020, LZO 2.10
2020-09-17T23:23:50 openvpn[74407] OpenVPN 2.4.9 amd64-portbld-freebsd12.1 [SSL (OpenSSL)] [LZO] [LZ4] [MH/RECVDA] [AEAD] built on Jul 28 2020
2020-09-17T23:23:50 openvpn[74407] WARNING: file '/var/etc/openvpn/client1.up' is group or others accessible
2020-09-17T23:23:50 openvpn[96840] SIGTERM[hard,] received, process exiting
2020-09-17T23:23:50 openvpn[96840] /usr/local/etc/inc/plugins.inc.d/openvpn/ovpn-linkdown ovpnc1 1500 1557 10.151.0.98 10.151.0.97 init
2020-09-17T23:23:50 openvpn[96840] Closing TUN/TAP interface
2020-09-17T23:21:49 openvpn[96840] /usr/local/etc/inc/plugins.inc.d/openvpn/ovpn-linkup ovpnc1 1500 1557 10.151.0.98 10.151.0.97 init
2020-09-17T23:21:49 openvpn[96840] /sbin/ifconfig ovpnc1 10.151.0.98 10.151.0.97 mtu 1500 netmask 255.255.255.255 up
2020-09-17T23:21:49 openvpn[96840] TUN/TAP device /dev/tun1 opened
2020-09-17T23:21:49 openvpn[96840] TUN/TAP device ovpnc1 exists previously, keep at program end
2020-09-17T23:21:49 openvpn[96840] ROUTE_GATEWAY 101.108.0.1/255.255.255.255 IFACE=pppoe0 HWADDR=00:00:00:00:00:00
2020-09-17T23:21:49 openvpn[96840] Incoming Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2020-09-17T23:21:49 openvpn[96840] Outgoing Data Channel: Cipher 'AES-256-GCM' initialized with 256 bit key
2020-09-17T23:21:49 openvpn[96840] OPTIONS IMPORT: data channel crypto options modified
2020-09-17T23:21:49 openvpn[96840] OPTIONS IMPORT: adjusting link_mtu to 1629
2020-09-17T23:21:49 openvpn[96840] OPTIONS IMPORT: peer-id set
2020-09-17T23:21:49 openvpn[96840] OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
2020-09-17T23:21:49 openvpn[96840] OPTIONS IMPORT: route options modified
2020-09-17T23:21:49 openvpn[96840] OPTIONS IMPORT: --ifconfig/up options modified
2020-09-17T23:21:49 openvpn[96840] OPTIONS IMPORT: compression parms modified
2020-09-17T23:21:49 openvpn[96840] OPTIONS IMPORT: timers and/or timeouts modified
2020-09-17T23:21:49 openvpn[96840] PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 10.151.0.1,comp-lzo no,route 10.151.0.1,topology net30,ping 10,ping-restart 60,ifconfig 10.151.0.98 10.151.0.97,peer-id 25,cipher AES-256-GCM'
2020-09-17T23:21:49 openvpn[96840] SENT CONTROL [Server-6883-0a]: 'PUSH_REQUEST' (status=1)
2020-09-17T23:21:48 openvpn[96840] [Server-6883-0a] Peer Connection Initiated with [AF_INET]70.39.102.170:1195
2020-09-17T23:21:48 openvpn[96840] Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
2020-09-17T23:21:48 openvpn[96840] WARNING: 'auth' is used inconsistently, local='auth [null-digest]', remote='auth SHA512'
2020-09-17T23:21:48 openvpn[96840] WARNING: 'cipher' is used inconsistently, local='cipher AES-256-GCM', remote='cipher AES-256-CBC'
2020-09-17T23:21:48 openvpn[96840] WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1554', remote='link-mtu 1606'
2020-09-17T23:21:48 openvpn[96840] VERIFY OK: depth=0, C=VG, ST=BVI, O=ExpressVPN, OU=ExpressVPN, CN=Server-6883-0a, emailAddress=support@expressvpn.com
2020-09-17T23:21:48 openvpn[96840] VERIFY X509NAME OK: C=VG, ST=BVI, O=ExpressVPN, OU=ExpressVPN, CN=Server-6883-0a, emailAddress=support@expressvpn.com
2020-09-17T23:21:48 openvpn[96840] VERIFY EKU OK
2020-09-17T23:21:48 openvpn[96840] ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
2020-09-17T23:21:48 openvpn[96840] Validating certificate extended key usage
2020-09-17T23:21:48 openvpn[96840] VERIFY KU OK
2020-09-17T23:21:48 openvpn[96840] VERIFY OK: depth=1, C=VG, ST=BVI, O=ExpressVPN, OU=ExpressVPN, CN=ExpressVPN CA, emailAddress=support@expressvpn.com
2020-09-17T23:21:48 openvpn[96840] WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
2020-09-17T23:21:48 openvpn[96840] TLS: Initial packet from [AF_INET]70.39.102.170:1195, sid=f859e7f5 bcbb7064
2020-09-17T23:21:48 openvpn[96840] MANAGEMENT: Client disconnected
2020-09-17T23:21:48 openvpn[96840] MANAGEMENT: CMD 'state all'
2020-09-17T23:21:48 openvpn[96840] MANAGEMENT: Client connected from /var/etc/openvpn/client1.sock
2020-09-17T23:21:47 openvpn[96840] UDPv4 link remote: [AF_INET]70.39.102.170:1195
2020-09-17T23:21:47 openvpn[96840] UDPv4 link local: (not bound)
2020-09-17T23:21:47 openvpn[96840] Socket Buffers: R=[42080->524288] S=[57344->524288]
2020-09-17T23:21:47 openvpn[96840] TCP/UDP: Preserving recently used remote address: [AF_INET]70.39.102.170:1195
2020-09-17T23:21:47 openvpn[96840] Incoming Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
2020-09-17T23:21:47 openvpn[96840] Outgoing Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
2020-09-17T23:21:47 openvpn[96840] NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2020-09-17T23:21:47 openvpn[96840] MANAGEMENT: unix domain socket listening on /var/etc/openvpn/client1.sock
2020-09-17T23:21:47 openvpn[82953] library versions: OpenSSL 1.1.1g 21 Apr 2020, LZO 2.10
2020-09-17T23:21:47 openvpn[82953] OpenVPN 2.4.9 amd64-portbld-freebsd12.1 [SSL (OpenSSL)] [LZO] [LZ4] [MH/RECVDA] [AEAD] built on Jul 28 2020
2020-09-17T23:21:47 openvpn[82953] WARNING: file '/var/etc/openvpn/client1.up' is group or others accessible

I would also like check for anyone with full pictures of the configs minus their key info.

Like the majority of people here I've been running all my traffic or individual VLANs through an OpenVPN server and don't have an issue with it. I've tried to follow the guides listed in the manual and have several issues with things missing or labeled wrong.

The manual below doesn't say anything about the Interfaces section or the Gateways:Single section.
https://wiki.opnsense.org/manual/how-tos/wireguard-client-mullvad.html

For instance in the NAT Outbound rules you are told to use the Interface: Wireguard... what's the different between this interface that exists that I can't see anywhere else and the actual Interfaces interface with a name that was given like "Mullvad_Wireguard" which also shows up in the list.

I also have the named "Mullvad_Wireguard Interface in the Firewall:Rules and the "WireGuard", not sure what this means or where it comes from as I'm looking at having multiple Wireguard connection which will need different rules.

From the manual: "To do this, go to System %u2023 Gateways %u2023 Single and add a new gateway. Choose the relevant WireGuard interface and set the Gateway to dynamic." In Gateways:Single there is no option to set it as Dynamic.. maybe meaning in the actual interfaces section.

When I ping something like 1.1.1.1, my VLAN gateway response with a positive ping result. I'm not sure but guessing that I have a NAT issue.

I have just recently moved over from pfSense to OPNsense and have been happy so far. I have a few questions that I'll break up into their own topics.

The first one is that I have several vlans that each have their own DHCP service running. They all seem to be working but the status icon isn't showing as such. I've included a picture of what I mean. Please let me know which logs would be best to check / upload to help with the troubleshooting.

Thanks