disable "Dynamic state reset" for VPN

[Wired Life]

Hey, i'm facing the same issue described here
https://forum.opnsense.org/index.php?topic=14946.0
is there a way to fix this?

thanks!

[Fright]

Hi
have you tried disabling "Dynamic state reset" option? is this causing any problem?

[Wired Life]

I need to keep this enabled because of VoIP.
The connections need to be killed on new IP but only on PPPoE not on VPN.

[Fright]

I need to keep this enabled because of VoIP.

I understand this, but some changes have been made and this option may no longer be needed

[franco]

*on 22.1

[Wired Life]

*on 22.1

On 22.1 what happens? Is there a solution to our problem?
Can you describe what has been changed and how to use it?

[franco]

I'll defer this question to 22.1-RC1 release notes...


Cheers,
Franco

[chemlud]

I'll defer this question to 22.1-RC1 release notes...


Cheers,
Franco

ETA in sight? :-)

[Fright]

@franco
oops. my bad. did not check

[franco]

ETA in sight? :-)

Wednesday :)

[franco]

So working on the release notes what changed is the following:

The kill state on gateway failure option is no longer available due to heavy-handed disruption of the implementation leading to a number of support issues over the years. It was since switched to disabled by default, but we haven't seen a good use case for it so now it will be removed for good. The GUI IP change full state killing doing the same thing when a WAN IPv4 changes, however, will remain for the time being.

On the other hand, the default state killing on a WAN IPv4 change when said option is not enabled will change as follows:

1. The cache file used to determine which address was previously configured is now exclusive to the script handling the address change meaning it will never miss an address change which was previously possible. This already helps in some cases to make it function properly.

2. In addition to killing all states from said cached address the default function will now also kill all states with the address as the destination, which should fix cases where the state kill triggered but wasn't working for incoming connections which led to use of the IP address change GUI option which kills every state of the firewall (also not optimal obviously).


Cheers,
Franco