[SOLVED] 21.1.8 openvpn server startup failure

[agh1701]

Hi All,

I jus upgraded from 21.1.7 to 21.1.8 and my openvpn server faild to start with the below log.

My subnet is a /29 so the startup command should be

Code Select Expand

/sbin/ifconfig ovpns1 192.168.1.241 192.168.1.246 mtu 1500 netmask 255.255.255.255 up

But this is what is happening.

Code Select Expand

2021-07-08T20:16:53 openvpn[5628] /usr/local/etc/inc/plugins.inc.d/openvpn/ovpn-linkdown ovpns1 1500 1622 192.168.1.241 192.168.1.242 init
2021-07-08T20:16:53 openvpn[5628] Exiting due to fatal error
2021-07-08T20:16:53 openvpn[5628] IPv4 pool size is too small (1), must be at least 2
2021-07-08T20:16:53 openvpn[5628] UDPv4 link remote: [AF_UNSPEC]
2021-07-08T20:16:53 openvpn[5628] UDPv4 link local (bound): [AF_INET]65.185.18.45:1194
2021-07-08T20:16:53 openvpn[5628] Could not determine IPv4/IPv6 protocol. Using AF_INET
2021-07-08T20:16:51 openvpn[5628] /usr/local/etc/inc/plugins.inc.d/openvpn/ovpn-linkup ovpns1 1500 1622 192.168.1.241 192.168.1.242 init
2021-07-08T20:16:51 openvpn[5628] /sbin/ifconfig ovpns1 192.168.1.241 192.168.1.242 mtu 1500 netmask 255.255.255.255 up
2021-07-08T20:16:51 openvpn[5628] TUN/TAP device /dev/tun1 opened
2021-07-08T20:16:51 openvpn[5628] TUN/TAP device ovpns1 exists previously, keep at program end
2021-07-08T20:16:51 openvpn[5628] NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
2021-07-08T20:16:51 openvpn[94954] library versions: OpenSSL 1.1.1k 25 Mar 2021, LZO 2.10
2021-07-08T20:16:51 openvpn[94954] OpenVPN 2.5.3 amd64-portbld-freebsd12.1 [SSL (OpenSSL)] [LZO] [LZ4] [MH/RECVDA] [AEAD] built on Jul 6 2021
2021-07-08T20:16:51 openvpn[94954] DEPRECATED OPTION: --cipher set to 'AES-128-CBC' but missing in --data-ciphers (AES-256-GCM:AES-128-GCM). Future OpenVPN version will ignore --cipher for cipher negotiations. Add 'AES-128-CBC' to --data-ciphers or change --cipher 'AES-128-CBC' to --data-ciphers-fallback 'AES-128-CBC' to silence this warning.
2021-07-08T20:16:51 openvpn[94954] WARNING: --topology net30 support for server configs with IPv4 pools will be removed in a future release. Please migrate to --topology subnet as soon as possible.
2021-07-08T20:16:51 openvpn[94954] WARNING: Compression for receiving enabled. Compression has been used in the past to break encryption. Sent packets are not compressed unless "allow-compression yes" is also set.

Please note the 192.168.1.241 instead of 192.168.1.246.

Thanks

[mimugmail]

Do you have anything in Advanced Options?

[agh1701]

Yes

Code Select Expand

push "route 192.168.100.0 255.255.255.0"

[Fright]

you really need to use '--topology net30' with /29 tunnel?
can you change tunnel  network to /28 or (its better imho) switch to '--topology subnet'?

[agh1701]

@mimugmail it makes no difference if ii remove the advance command or not.  Parsing problem?

[agh1701]

@Fright, Thank you checking the topology box solved the problem.  I'm getting slow in my old age.