Misconfigured OpenVPN breaks routing

[kgleason]

I recently installed OPNSense, and I was working on creating an OpenVPN. I misconfigured the tunnel settings but using 192.168.100.1/24 for my tunnel network, and 10.0.0.1/24 for my Local Network. These are obviously invalid network definitions, but I didn't catch it up front.

Every time I attempted to start the OpenVPN server, all routing from within my network would stop. I tested multiple times by rebooting OPNSense, opening a ping (8.8.8.8), and then attempting to start the OpenVPN server. As soon as I tried to start the OpenVPN server, my ping would die.

I was always able to ping from the OPNSense box itself, but nothing from within my network.

My network set up is dead simple: Cable Modem -> OPNSense -> Switched Network, no VLANs.

The OpenVPN logs led me to my error. Once I fixed it, then everything proceeded to work as normal.

I am running OPNsense 15.1.11.1-amd64.

Please let me know if you need any additional information.

[kgleason]

It looks like this might be related to this:

http://lists.freebsd.org/pipermail/freebsd-net/2015-January/040798.html

I'm making an assumption that adding a new VPN creates a new interface.

If so, then please feel free to close this issue as it is an upstream bug.

[fichtner]

So /etc/rc.d/routing fiddles with the forwarding sysctls. Confirmed, but not sure what to do just yet. The suggested workaround in the thread is not suitable for OPNsense, because we handle the sysctls ourselves, meaning we'll have to prevent routing from kicking in. Thanks so far!

[fichtner]

this probably causes the chain reaction... Can override via own devd rules :) https://github.com/opnsense/src/blob/master/etc/devd.conf#L64-71

[fichtner]

The fix won't make it into 15.1.11.2 today, but is worth a 15.1.11.3 tomorrow or the day after. Needs some more testing, but looks promising.

[fichtner]

@kgleason did this help at all? :)

[fichtner]

@lattera @kgleason close this maybe?

[lattera]

On my end, this can be closed.

[fichtner]

Closing this: no more feedback (which is mostly good).