Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a pfSense openVPN tunnel problem. I have 10 sites, but sometimes some of the sites automatically go down, so I need to restart the openVPN service on the client side. What can I do to fix it?

Note: I have an unstable WAN link.

Logs

openvpn[20891]: Re-using SSL/TLS contex
openvpn[20891]: UDPv4 link local (bound):[AF_INET]10.99.62.18
openvpn[20891]: UDPv4 link remote: [AF_INET]10.89.57.5:1194
openvpn[20891]: [UNDEF] Inactivity timeout (--ping-restart), restarting
openvpn[20891]: SIGUSR1[soft,ping-restart] received, process restarting
openvpn[20891]: WARNING: NO server certificate verification method has been enable.
openvpn[20891]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
openvpn[20891]: Re-using SSL/TLS contex
openvpn[20891]: UDPv4 link local (bound):[AF_INET]10.99.62.18
openvpn[20891]: UDPv4 link remote: [AF_INET]10.89.57.5:1194
openvpn[20891]: [UNDEF] Inactivity timeout (--ping-restart), restarting
openvpn[20891]: SIGUSR1[soft,ping-restart] received, process restarting
openvpn[20891]: WARNING: NO server certificate verification method has been enable. See http://openvpn.net/howto.html#mitm for more information.
openvpn[20891]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
openvpn[20891]: Re-using SSL/TLS contex
openvpn[20891]: UDPv4 link local (bound):[AF_INET]10.99.62.18
openvpn[20891]: UDPv4 link remote: [AF_INET]10.89.57.5:1194
openvpn[20891]: [UNDEF] Inactivity timeout (--ping-restart), restarting
openvpn[20891]: SIGUSR1[soft,ping-restart] received, process restarting
openvpn[20891]: WARNING: NO server certificate verification method has been enable.
openvpn[20891]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
openvpn[20891]: Re-using SSL/TLS contex
openvpn[20891]: Preseving previous TUN/TAP instance:ovpnc1
openvpn[20891]: Initialization Sequence Completed
openvpn[20891]: Option error: route parameter netmask '255.255.240' must be an IP address
openvpn[20891]: Option error: route parameter netmask '255.255.240' must be an IP address
openvpn[20891]: Option error: route parameter netmask '255.255.240' must be an IP address
openvpn[20891]: Option error: route parameter netmask '255.255.240' must be an IP address
openvpn[20891]: Option error: route parameter netmask '255.255.240' must be an IP address
openvpn[20891]: Option error: route parameter netmask '255.255.240' must be an IP address
openvpn[20891]: Option error: route parameter netmask '255.255.240' must be an IP address
openvpn[20891]: Option error: route parameter netmask '255.255.240' must be an IP address
openvpn[20891]: Option error: route parameter netmask '255.255.240' must be an IP address
openvpn[20891]: Option error: route parameter netmask '255.255.240' must be an IP address
openvpn[20891]: Option error: route parameter netmask '255.255.240' must be an IP address
openvpn[20891]: Option error: route parameter netmask '255.255.240' must be an IP address
openvpn[20891]: Option error: route parameter netmask '255.255.240' must be an IP address
openvpn[20891]: Option error: route parameter netmask '255.255.240' must be an IP address
openvpn[20891]: Option error: route parameter netmask '255.255.240' must be an IP address
openvpn[20891]: Option error: route parameter netmask '255.255.240' must be an IP address
openvpn[20891]: Option error: route parameter netmask '255.255.240' must be an IP address
openvpn[20891]: Option error: route parameter netmask '255.255.240' must be an IP address
openvpn[20891]: OpenVPN ROUTE: cannot add more than 100 routes -- please increase the max-routes option in the client configuration file
openvpn[20891]: Exiting
openvpn[20891]: /usr/local/sbin/ovpn-linkdown ovpnc1 1500 1557 10.0.8.22 10.0.8.21 init
share|improve this question
add comment

migrated from unix.stackexchange.com Aug 1 '13 at 14:01

This question came from our site for users of Linux, FreeBSD and other Un*x-like operating systems..

1 Answer

You don't need to restart it, it'll handle that itself. You do need to fix the config problem you have there. Invalid netmask of "255.255.240" somewhere, and apparently more than 100 routes which is almost certainly excessive (if you have a lot of 10.x.x.x networks for instance, use "route 10.0.0.0 255.0.0.0" instead or similar summarization).

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.