Bug #11793
closedOpenVPN client starts when CARP VIP is in BACKUP status when bound to Virtual IP aliased to CARP VIP
100%
Description
If an OpenVPN client is bound to a virtual IP which is an IP Alias for a CARP IP, the OpenVPN client (e.g. ovpnc1) gets started when the parent CARP interface's state is BACKUP.
With a site-to-site UDP OpenVPN tunnel where the client sits on a redundant pair of pfSense hosts, this causes the stand-by to steal the OpenVPN connection from the active firewall and as a result, traffic received by the active firewall destined for the OpenVPN tunnel is dropped. This continues until a ping activity timeout occurs and restarts the OpenVPN service on the active firewall. The OpenVPN tunnel will then remain up for some time (usually minutes) until once again, a ping activity timeout occurs and restarts the OpenVPN service on the standby firewall.
With a TCP OpenVPN tunnel, the client on the standby firewall will receive a TCP timeout. However, we think we see some knock-on with TCP tunnel connection quality (dropped packets) whilst the standby firewall's OpenVPN process attempts to make the connection.
I think this statement in openvpn.inc needs changing to also check whether the bound interface is virtual IP aliased to a CARP IP before proceeding to call restart_openvpn:
if (($a_groups[$settings['interface']][0]['vip'] <> "") && (!in_array(get_carp_interface_status($a_groups[$settings['interface']][0]['vip']), array("MASTER", ""))))
[[https://github.com/pfsense/pfsense/blob/a7086b04cae21ca742fdeefd1019ee1401b6dded/src/etc/inc/openvpn.inc#L1500]]
I am raising this as high priority because it has been a significant issue for us in a production environment where we would ideally use a seperate IP for VPN versus customer traffic (other wise face the peril of colo providers DDOS protection system) and we would ideally keep the number of CARP addresses to a minimum so that we don't have IP addresses failing over independently.
Updated by Viktor Gurov over 3 years ago
Updated by Jim Pingle over 3 years ago
- Status changed from New to Pull Request Review
- Priority changed from High to Normal
- Target version set to 2.6.0
Updated by Anonymous over 3 years ago
- Status changed from Pull Request Review to Feedback
Updated by Viktor Gurov over 3 years ago
- % Done changed from 0 to 100
Applied in changeset 70d797668245d8070782912d6bcdf0939aea7c62.
Updated by Jim Pingle over 3 years ago
- Subject changed from OpenVPN client starts on CARP Backup when bound to Virtual IP aliased to CARP address to OpenVPN client starts in CARP Backup status when bound to Virtual IP aliased to CARP VIP
Updating subject for release notes.
Updated by Jim Pingle about 3 years ago
- Target version changed from 2.6.0 to 2.5.2
Updated by Jim Pingle about 3 years ago
- Subject changed from OpenVPN client starts in CARP Backup status when bound to Virtual IP aliased to CARP VIP to OpenVPN client starts when CARP VIP is in BACKUP status when bound to Virtual IP aliased to CARP VIP
Fixing up subject