Update to 20.1.8 and IPSEC VPN faded away

[krempel]

Hello, sorry i'm a kind of newbie here,

Automatically Updated from 20.1.7 to 20.1.8 right now and soon a nightmare effect:
In the dashboard, IPsec part lost all the tunnels.
Okay, let's examine unter /VPN/IPsec/Tunnel Settings: There they are, also checked the "Enable IPsec".

But Status Overview is empty, strongswan is running, No IPsec traffic going to the peers.

Good luck, i just tried on my testing-car, not on the real machine, both machines are real hardware, no virtuals.

After reinstalling 20.1 from the image and let the config being fetched, all running well on 20.1.

But how do i limit the update to 20.1.7 avoiding this fatal 20.1.8?

Any suggestions?

Good evening
Krempel (from Germany)

[mimugmail]

Via CLI:

opnsense-revert -r 20.1.7 opnsense

This reverts only the GUI part to 20.1.7 while software is at 20.1.8

[mimugmail]

I can reproduce .. https://github.com/opnsense/core/issues/4189

[krempel]

First of all, many thanks for this impressively fast response :-)

Well, this resets the gui to 20.1.7 as you wrote, but it seems, the underlying IPsec is not working right anymore, so i need a limitation of the whole packages to 20.1.7, else my VPNs are dead.

So, i revert to 20.1 as a emergency act and avoid the firmware upgrade.


Happy, this got my home OPNSense only, not the "production" one in my office.

Good Night

[fightingmasta]

opnsense-patch 30a9195 worked for me. :)

[c-mu]

I got the same issue and can confirm, that opnsense-patch 30a9195 is working!

[Perun]

same issue here... how can I apply the patch?

[mimugmail]

Via cli, the command above. Hotfix will come today ...

[franco]

Looking at the issue and the fix it was caused by a third party library update (not a direct result of a core change) and only affects status display, not operation.


Cheers,
Franco

[franco]

PS: Suffice to say things like this are practically impossible to catch with a 100% success rate, especially if it does not affect operation so we have less indication that something is wrong. Nevertheless, a hotfix should be on the way to address this later today. And still for all means and purposes the opnsense-patch is more than enough to do.

[penguin44]

Thanks for all your help with this project.

Are you going to post another announcement when the hot fixes are included?

Regards,
Richard

[franco]

See reply at the original annoucement:

https://forum.opnsense.org/index.php?topic=17909.msg81445#msg81445


Cheers,
Franco