OpenVPN fails to start

[bartjsmit]

These are the last log lines:

openvpn[53655]: OpenVPN 2.3.11 amd64-portbld-freebsd10.2 [SSL (OpenSSL)] [LZO] [MH] [IPv6] built on May 17 2016
openvpn[53655]: library versions: OpenSSL 1.0.2h 3 May 2016, LZO 2.09
openvpn[59622]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
openvpn[59622]: Control Channel Authentication: using '/var/etc/openvpn/server1.tls-auth' as a OpenVPN static key file
openvpn[13821]: RESOLVE: Cannot resolve host address: <WAN IPv6 address>: hostname nor servname provided, or not known
openvpn[13821]: Exiting due to fatal error

I've added the WAN IP to /etc/hosts with the short name and FQDN of the firewall. I've also added ::1 localhost but the error persists.

Bart...

[bartjsmit]

I can get the OpenVPN server to start (and work) by selecting 'Disable IPv6' under tunnel settings. This stops OpenVPN dying on the WAN IPv6 resolution.

Counterintuitively, this still tunnels IPv6.

Bart...

[franco]

Hi Bart,

It tries to pick up an IPv6-only host or address, but then won't resolve/accept.

Can you let me know which server mode this is and the IPv6 (privately), maybe the validation fails. I've seen this happen for an IPv6 subnet not so long ago.


Cheers,
Franco

[bartjsmit]

Hi Franco,

Even though I was getting a tunnel with IPv6 disabled, it wasn't routing traffic outside the LAN. I reverted to my internal OpenVPN server and disabled the OPNsense VPN server.

While preparing my reply to you, I switched back to the OPNsense VPN. Lo and behold, it works now with the IPv6 enabled and is merrily tunnelling public and private traffic over dual stack.

I'll keep an eye out for any future Gremlins and I will take you up on your offer to look at the non-redacted logs if this rears its head again.

Bart...

[franco]

Ok, thanks. There's a good chance this will be back eventually, but glad it works now.