Netgate m1n1wall

Author Topic: Open VPN - problem with failover  (Read 1154 times)

0 Members and 1 Guest are viewing this topic.

Offline tomas1@list.ru

  • Newbie
  • *
  • Posts: 8
    • View Profile
Open VPN - problem with failover
« on: April 09, 2013, 05:45:06 am »
Hello - i have such scheme:
SITE A  LAN --- PFSENSE --- WAN/OPVN1.A  ------------------------ WAN/OVPN1.B --- PFSENSE --- LAN SITE B
                                  |--- WAN/OPVN2.A  ------------------------WAN/OVPN2.B  ---|

I'm trying to set up failover using openvpn and quagga.
I picked up 2 channels openvpn between 2 offices.
In the settings Openvpn not recorded local or remote Networks (they are blank) - routing makes quagga
But occasionally VPN tunnels drops and in the services I see the following picture - attachment 1
In the service i see that one of two openvpn tunnel is stopped, I try to run it - but it does not run. In logs i see error - attachment 2
The i stop the second tunnel - and after that i am able to start both tunnels.

Whats wrong? (i tried on clear new install of pfsense 2.0.1 - had same problem) 

Offline Reiner030

  • Full Member
  • ***
  • Posts: 270
    • View Profile
Re: Open VPN - problem with failover
« Reply #1 on: April 26, 2013, 05:50:52 pm »
Hi

I guess you have also a CARP IP for public routing/failover?

=> use this IP as OpenVPN Server/Client Interface - so you need only one OpenVPN Server on both sides ;)
OpenVPN Server/Client is then automatically only started on the master firewall on each side...

In newest Quagga package there is also a  - I think/hope not final - solution to bind /start Quagga only on CARP master ...

EDIT: Here the Post with Failover found: http://forum.pfsense.org/index.php/topic,58776.0.html

(I found this thread search for a solution why my Quagga won't bind on my OpenVPN server side interface :( )


Bests


Reiner
« Last Edit: April 26, 2013, 06:04:45 pm by Reiner030 »

Offline tomas1@list.ru

  • Newbie
  • *
  • Posts: 8
    • View Profile
Re: Open VPN - problem with failover
« Reply #2 on: April 26, 2013, 10:30:45 pm »
Hello,
I don't use CARP. The problem is why openvpn fails to in such configuration start? see attached errors

Offline Reiner030

  • Full Member
  • ***
  • Posts: 270
    • View Profile
Re: Open VPN - problem with failover
« Reply #3 on: April 29, 2013, 09:31:52 am »
your log is not very helpful... Because of

kernel: ifa_add_loopback_route:insertion failed

I guess you also run into this problem/bug: http://forum.pfsense.org/index.php/topic,60231.0.html
where this fix could help - if he is made correctly... actually he has problems on server side (but you can test it on client side)
http://forum.pfsense.org/index.php/topic,60231.msg330670.html#msg330670