I have followed instructions here (with slight adaptations, as listed below) to set up OpenVPN on an OpnSense router, but clients are not able to connect.
Differences:
- I set Local port to 1179
- I set IPv4 Tunnel Network to 10.79.0.0/24 - I believe this is arbitrary?
- I was forced to disable Redirect Gateway, because without it the "IPv4 Local Network" option was hidden, and (AFAICT) that value must be set to the IP range of my home network in order to permit access to that network from VPN-connected devices - and without that access, what would be the point of a VPN in the first place?
- The IP Addresses assigned by DHCP server (also running on the OpnSense router) to devices on the network are
192.168.1.0/24. I do acknowledge that using this CIDR can be problematic if it causes clashes with other private networks' configurations, but at this point I've set up too many other devices and services on the network for it to be simple to redefine HCP - I'd like to rule out all other sources of error before taking that step.
- The IP Addresses assigned by DHCP server (also running on the OpnSense router) to devices on the network are
- I enabled "DNS Servers" (not mentioned in the original guide) and set the value to the IP address of the DNS Server on the private network (that is - my OpnSense router). I also set "Force DNS Cache Update".
Configuration
Server
dev ovpns1
verb 1
dev-type tun
dev-node /dev/tun1
writepid /var/run/openvpn_server1.pid
script-security 3
daemon
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
proto udp
cipher AES-128-CBC
auth SHA512
up /usr/local/etc/inc/plugins.inc.d/openvpn/ovpn-linkup
down /usr/local/etc/inc/plugins.inc.d/openvpn/ovpn-linkdown
multihome
client-disconnect "/usr/local/etc/inc/plugins.inc.d/openvpn/attributes.sh server1"
tls-server
server 10.79.0.0 255.255.255.0
client-config-dir /var/etc/openvpn-csc/1
username-as-common-name
auth-user-pass-verify "/usr/local/etc/inc/plugins.inc.d/openvpn/ovpn_auth_verify user 'Local Database' 'false' 'server1'" via-env
tls-verify "/usr/local/etc/inc/plugins.inc.d/openvpn/ovpn_auth_verify tls 'OpenVPN+Cert' 1"
lport 1179
management /var/etc/openvpn/server1.sock unix
push "route 192.168.1.0 255.255.255.0"
push "dhcp-option DNS 192.168.1.1"
push "register-dns"
ca /var/etc/openvpn/server1.ca
cert /var/etc/openvpn/server1.cert
key /var/etc/openvpn/server1.key
dh /usr/local/etc/dh-parameters.4096.sample
tls-auth /var/etc/openvpn/server1.tls-auth 0
persist-remote-ip
float
topology subnet
Client
Exported with "Client Export"
dev tun
persist-tun
persist-key
cipher AES-128-CBC
auth SHA512
client
resolv-retry infinite
remote vpn.scubbo.org 1179 udp
lport 0
verify-x509-name "C=US, ST=CA, L=Berkeley, O=Avril, [email protected], CN=OpenVPN Cert" subject
remote-cert-tls server
auth-user-pass
<ca>
-----BEGIN CERTIFICATE-----
REDACTED
-----END CERTIFICATE-----
</ca>
<cert>
-----BEGIN CERTIFICATE-----
REDACTED
-----END CERTIFICATE-----
</cert>
<key>
-----BEGIN PRIVATE KEY-----
REDACTED
-----END PRIVATE KEY-----
</key>
<tls-auth>
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
REDACTED
-----END OpenVPN Static key V1-----
</tls-auth>
key-direction 1
Logfiles
Server
<27>1 2023-10-24T19:26:40-07:00 OPNsense.avril openvpn 91882 - [meta sequenceId="1"] event_wait : Interrupted system call (code=4)
<29>1 2023-10-24T19:26:40-07:00 OPNsense.avril openvpn 91882 - [meta sequenceId="2"] /usr/local/etc/inc/plugins.inc.d/openvpn/ovpn-linkdown ovpns1 1500 1621 10.79.0.1 255.255.255.0 init
<29>1 2023-10-24T19:26:40-07:00 OPNsense.avril openvpn 91882 - [meta sequenceId="3"] SIGTERM[hard,] received, process exiting
<28>1 2023-10-24T19:26:40-07:00 OPNsense.avril openvpn 27558 - [meta sequenceId="4"] DEPRECATED OPTION: --cipher set to 'AES-128-CBC' but missing in --data-ciphers (AES-256-GCM:AES-128-GCM). Future OpenVPN version will ignore --cipher for cipher negotiations. Add 'AES-128-CBC' to --data-ciphers or change --cipher 'AES-128-CBC' to --data-ciphers-fallback 'AES-128-CBC' to silence this warning.
<29>1 2023-10-24T19:26:40-07:00 OPNsense.avril openvpn 27558 - [meta sequenceId="5"] OpenVPN 2.5.7 amd64-portbld-freebsd13.0 [SSL (OpenSSL)] [LZO] [LZ4] [MH/RECVDA] [AEAD] built on Jul 6 2022
<29>1 2023-10-24T19:26:40-07:00 OPNsense.avril openvpn 27558 - [meta sequenceId="6"] library versions: OpenSSL 1.1.1q 5 Jul 2022, LZO 2.10
<28>1 2023-10-24T19:26:40-07:00 OPNsense.avril openvpn 27799 - [meta sequenceId="7"] NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
<29>1 2023-10-24T19:26:40-07:00 OPNsense.avril openvpn 27799 - [meta sequenceId="8"] TUN/TAP device ovpns1 exists previously, keep at program end
<29>1 2023-10-24T19:26:40-07:00 OPNsense.avril openvpn 27799 - [meta sequenceId="9"] TUN/TAP device /dev/tun1 opened
<29>1 2023-10-24T19:26:40-07:00 OPNsense.avril openvpn 27799 - [meta sequenceId="10"] /sbin/ifconfig ovpns1 10.79.0.1 10.79.0.2 mtu 1500 netmask 255.255.255.0 up
<29>1 2023-10-24T19:26:40-07:00 OPNsense.avril openvpn 27799 - [meta sequenceId="11"] /usr/local/etc/inc/plugins.inc.d/openvpn/ovpn-linkup ovpns1 1500 1621 10.79.0.1 255.255.255.0 init
<28>1 2023-10-24T19:26:40-07:00 OPNsense.avril openvpn 27799 - [meta sequenceId="12"] Could not determine IPv4/IPv6 protocol. Using AF_INET6
<29>1 2023-10-24T19:26:40-07:00 OPNsense.avril openvpn 27799 - [meta sequenceId="13"] setsockopt(IPV6_V6ONLY=0)
<29>1 2023-10-24T19:26:40-07:00 OPNsense.avril openvpn 27799 - [meta sequenceId="14"] UDPv6 link local (bound): [AF_INET6][undef]:1179
<29>1 2023-10-24T19:26:40-07:00 OPNsense.avril openvpn 27799 - [meta sequenceId="15"] UDPv6 link remote: [AF_UNSPEC]
<29>1 2023-10-24T19:26:40-07:00 OPNsense.avril openvpn 27799 - [meta sequenceId="16"] Initialization Sequence Completed
There are no logging messages at the time of attempted connection - these were logged at service startup, then nothing else is logged after that despite repeated connection attempts.
I do note Could not determine IPv4/IPv6 protocol. Using AF_INET6 which looks like an error even though this comment suggests that it's not. In any case, I added proto udp4 to the server configuration and restarted the server, and connection attempts still failed in the same way.
Client
[Oct 24, 2023, 19:33:47] OpenVPN core 3.6.7 mac x86_64 64-bit built on Nov 28 2022 04:35:53
⏎[Oct 24, 2023, 19:33:47] Frame=512/2048/512 mssfix-ctrl=1250
⏎[Oct 24, 2023, 19:33:47] UNUSED OPTIONS
1 [persist-tun]
2 [persist-key]
6 [resolv-retry] [infinite]
8 [lport] [0]
⏎[Oct 24, 2023, 19:33:47] EVENT: RESOLVE ⏎[Oct 24, 2023, 19:33:47] Contacting 23.93.75.229:1179 via UDP
⏎[Oct 24, 2023, 19:33:47] EVENT: WAIT ⏎[Oct 24, 2023, 19:33:47] UnixCommandAgent: transmitting bypass route to /var/run/agent_ovpnconnect.sock
{
"host" : "23.93.75.229",
"ipv6" : false,
"pid" : 87514
}
⏎[Oct 24, 2023, 19:33:47] Connecting to [vpn.scubbo.org]:1179 (23.93.75.229) via UDPv4
⏎[Oct 24, 2023, 19:33:57] EVENT: CONNECTION_TIMEOUT BYTES_OUT : 860
PACKETS_OUT : 10
CONNECTION_TIMEOUT : 1
⏎[Oct 24, 2023, 19:33:57] EVENT: DISCONNECTED ⏎[Oct 24, 2023, 19:33:59] Raw stats on disconnect:
BYTES_OUT : 860
PACKETS_OUT : 10
CONNECTION_TIMEOUT : 1
⏎[Oct 24, 2023, 19:33:59] Performance stats on disconnect:
CPU usage (microseconds): 39543785
Network bytes per CPU second: 21
Tunnel bytes per CPU second: 0
Debugging steps
Is your domain name/IP Address correct?
Yes: the response to curl ifconfig.io from the router matches the result of nslookup vpn.scubbo.org from a client.
Are your Firewall rules set correctly?
I think so? I followed the instructions in the guide. In any case, "Firewall > Log Files > Live View" in OpnSense, filtered to "Action=Block", does not show results correlated with connection attempts.
