pfSense

Normally in SSL/TLS with a client/server setup that has multiple clients the clients would never populate the tunnel network. If they need a static address the client wouldn't set it, it would be set in the override on the server side.

I'll have to check what might have changed here, but it probably wasn't a valid configuration before and was somehow given a pass. The only time that's typically valid is when both client and server are set to a /30 tunnel network and that's handled as a special case.

I suspect the difference might be from what changed in #11416 but I'll have to investigate.

When adding a tunnel network it makes a couple changes to the config, notably it removes the pull directive, it adds topology subnet as chosen in the GUI settings, and then it inserts an ifconfig directive, e.g. when the TN is set to 10.34.51.0/24 the config gets:

ifconfig 10.34.51.2 10.34.51.1

The problem is that syntax is only valid in p2p/net30 mode, not for subnet topology. For subnet topology that should be:

ifconfig 10.34.51.2 255.255.255.0

The actual error in the OpenVPN log is this:

Apr 13 19:40:10     openvpn     3328     /sbin/ifconfig ovpnc1 10.34.51.2/-1 mtu 1500 up 

Note that it has interpreted the second address as a "mask" of -1.

At the very least it should be detecting this case and using the correct ifconfig syntax based on the chosen topology.

The GUI text for the tunnel network should also warn more explicitly about the consequences of specifying a tunnel network on the client and why the user probably doesn't want to do that.

Applied in changeset 0ba1a7ec7871f8f6bd240a08f238a2fb1ecba16b.

Updating subject for release notes.