4

I'm trying to setup a peer-to-peer OpenVPN between two pfsense servers running 2.0.1-RELEASE, but the client keeps getting the connection dropped, with a status of "reconnecting; ping-restart" and nothing appears to be routing between them. Both these firewalls are also doing PPTP VPNs that are working correctly.

FW01 ("server")
=======================
LAN: 10.1.1.2/24
WAN: xx.xx.126.34/27
ServerMode: Peer to Peer (Shared Key)
Protocol: UDP
DeviceMode: tun
Interface: WAN
Port 1194
Tunnel: 10.0.8.1/30
Local Network: 10.1.1.0/24
Remote Network: 192.168.1.0/24
Firewall Rule in OpenVPN tab: UDP   *   *   *   *   *   none      

FW03 (client)
LAN: 192.168.1.2/24
WAN: xx.xx.9.66/27
ServerMode: Peer to Peer (Shared Key)
Protocol: UDP
DeviceMode: tun
Interface: WAN
Server Host: xx.xx.126.34
Tunnel:  -- also tried 10.1.8.0/24
Remote Network: 10.1.1.0/24

Client Logs:

System Log
Apr 6 18:00:08  kernel:  ... Restarting packages.
Apr 6 18:00:13  check_reload_status: Starting packages
Apr 6 18:00:19  php: : Restarting/Starting all packages.
Apr 6 18:00:56  kernel: ovpnc1: link state changed to DOWN
Apr 6 18:00:56  check_reload_status: Reloading filter
Apr 6 18:00:57  check_reload_status: Reloading filter
Apr 6 18:00:57  kernel: ovpnc1: link state changed to UP
Apr 6 18:00:57  check_reload_status: rc.newwanip starting ovpnc1
Apr 6 18:00:57  check_reload_status: Syncing firewall
Apr 6 18:01:02  php: : rc.newwanip: Informational is starting ovpnc1.
Apr 6 18:01:02  php: : rc.newwanip: on (IP address: ) (interface: ) (real interface: ovpnc1).
Apr 6 18:01:02  php: : rc.newwanip: Failed to update IP, restarting...
Apr 6 18:01:02  php: : send_event: sent interface reconfigure got ERROR: incomplete command. all  reload  reconfigure  restart  newip  linkup  sync 
Client OpenVPN log
Apr 6 18:39:14  openvpn[12177]: Inactivity timeout (--ping-restart), restarting
Apr 6 18:39:14  openvpn[12177]: SIGUSR1[soft,ping-restart] received, process restarting
Apr 6 18:39:16  openvpn[12177]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Apr 6 18:39:16  openvpn[12177]: Re-using pre-shared static key
Apr 6 18:39:16  openvpn[12177]: Preserving previous TUN/TAP instance: ovpnc1
Apr 6 18:39:16  openvpn[12177]: UDPv4 link local (bound): [AF_INET]64.94.9.66
Apr 6 18:39:16  openvpn[12177]: UDPv4 link remote: [AF_INET]64.74.126.34:1194
Server OpenVPN log
Apr 6 14:40:36  openvpn[22117]: UDPv4 link remote: [undef]
Apr 6 14:40:36  openvpn[22117]: UDPv4 link local (bound): [AF_INET]xx.xx.126.34:1194
Apr 6 14:40:36  openvpn[21006]: /usr/local/sbin/ovpn-linkup ovpns1 1500 1557 10.1.8.1 10.1.8.2 init
Apr 6 14:40:36  openvpn[21006]: /sbin/ifconfig ovpns1 10.1.8.1 10.1.8.2 mtu 1500 netmask 255.255.255.255 up
Apr 6 14:40:36  openvpn[21006]: do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Apr 6 14:40:36  openvpn[21006]: TUN/TAP device /dev/tun1 opened
Apr 6 14:40:36  openvpn[21006]: Control Channel Authentication: using '/var/etc/openvpn/server1.tls-auth' as a OpenVPN static key file
Apr 6 14:40:36  openvpn[21006]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Apr 6 14:40:36  openvpn[21006]: OpenVPN 2.2.0 amd64-portbld-freebsd8.1 [SSL] [LZO2] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Aug 11 2011
Apr 6 14:40:36  openvpn[17171]: SIGTERM[hard,] received, process exiting
Apr 6 14:40:36  openvpn[17171]: /usr/local/sbin/ovpn-linkdown ovpns1 1500 1557 10.1.8.1 10.1.8.2 init
Apr 6 14:40:36  openvpn[17171]: ERROR: FreeBSD route delete command failed: external program exited with error status: 1
Apr 6 14:40:36  openvpn[17171]: event_wait : Interrupted system call (code=4)
Apr 6 14:06:32  openvpn[17171]: Initialization Sequence Completed
Apr 6 14:06:32  openvpn[17171]: UDPv4 link remote: [undef]
Apr 6 14:06:32  openvpn[17171]: UDPv4 link local (bound): [AF_INET]xx.xx.126.34:1194

1 Answer 1

5

Most likely because the client can't communicate with the server on UDP 1194. Why, there are a number of possibilities to check, two most common:

  • no firewall rule permitting the traffic
  • 1:1 NAT or port forward forwarding that traffic somewhere else
3
  • I have a firewall rule on the Server (OpenVPN interface) as "UDP * * * * * none" There is a NAT rule for port 80, but nothing for 1194
    – John P
    Apr 7, 2012 at 0:40
  • 1
    Turns out it was a firewall issue. You need a rule on the WAN tab of the firewall, in addition to the OpenVPN site. Adding Pass/UDP/1194 to the WAN side of the "server" allowed it to connect
    – John P
    Apr 7, 2012 at 1:43
  • yes that's exactly what I meant, blocking the client's connection. Apr 7, 2012 at 2:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .