pfSense

I can't replicate this as stated. Is there a forum thread with more info? Or do you have some more detail about the config of that server?

Have you checked with ps to see if it's actually running but not reflecting that in the GUI? (logs would also indicate the port is already in use, for example). If that is the case that would fall under #4642 instead.

NOYB NOYB wrote:

On a fresh install the first OpenVPN server instance won't start. Create a 2nd instance an it runs fine. Or import just the OpenVPN section from a backup works fine too.

Noticed that the first instance that does not work has a few of the fields in confg as for ex: <ipaddr></ipaddr> rather than <ipaddr/> like the 2nd instance and restored instances that work.

Several of the empty fields are different like this.

I have the same issue.
Networks behind openvpn client 1 are reachable but gui dashboard, service status show that it's not working. I did update from 2.2.4 -> 2.3
After disabling openvpn client 1 and creating a second client configuration with identical settings the GUI dashboard show everything as normal...

Update, during 15 min the 2nd openvpn client has been unstable...

Apr 13 17:37:33 openvpn 42510 Initialization Sequence Completed
Apr 13 17:37:32 openvpn 42510 Peer Connection Initiated with [AF_INET]x.x.x.x:1194
Apr 13 17:37:31 openvpn 42510 UDPv4 link remote: [AF_INET]x.x.x.x:1194
Apr 13 17:37:31 openvpn 42510 UDPv4 link local (bound): [AF_INET]y.y.y.y
Apr 13 17:37:31 openvpn 42510 Preserving previous TUN/TAP instance: ovpnc2
Apr 13 17:37:31 openvpn 42510 Re-using pre-shared static key
Apr 13 17:37:31 openvpn 42510 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Apr 13 17:37:29 openvpn 42510 SIGUSR1[soft,ping-restart] received, process restarting
Apr 13 17:37:29 openvpn 42510 Inactivity timeout (--ping-restart), restarting
Apr 13 17:36:31 openvpn 61410 Initialization Sequence Completed
Apr 13 17:36:30 openvpn 61410 Peer Connection Initiated with [AF_INET]x.x.x.x:1194
Apr 13 17:36:30 openvpn 61410 UDPv4 link remote: [AF_INET]x.x.x.x:1194
Apr 13 17:36:30 openvpn 61410 UDPv4 link local (bound): [AF_INET]y.y.y.y
Apr 13 17:36:30 openvpn 61410 Preserving previous TUN/TAP instance: ovpnc1
Apr 13 17:36:30 openvpn 61410 Socket Buffers: R=[42080->42080] S=[57344->57344]
Apr 13 17:36:30 openvpn 61410 Re-using pre-shared static key
Apr 13 17:36:30 openvpn 61410 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Apr 13 17:36:28 openvpn 61410 Restart pause, 2 second(s)
Apr 13 17:36:28 openvpn 61410 SIGUSR1[soft,ping-restart] received, process restarting
Apr 13 17:36:28 openvpn 61410 Inactivity timeout (--ping-restart), restarting
Apr 13 17:35:30 openvpn 42510 Initialization Sequence Completed
Apr 13 17:35:30 openvpn 42510 Peer Connection Initiated with [AF_INET]x.x.x.x:1194
Apr 13 17:35:28 openvpn 42510 UDPv4 link remote: [AF_INET]x.x.x.x:1194
Apr 13 17:35:28 openvpn 42510 UDPv4 link local (bound): [AF_INET]y.y.y.y
Apr 13 17:35:28 openvpn 42510 Preserving previous TUN/TAP instance: ovpnc2
Apr 13 17:35:28 openvpn 42510 Re-using pre-shared static key
Apr 13 17:35:28 openvpn 42510 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Apr 13 17:35:26 openvpn 42510 SIGUSR1[soft,ping-restart] received, process restarting
Apr 13 17:35:26 openvpn 42510 Inactivity timeout (--ping-restart), restarting
Apr 13 17:34:31 openvpn 61410 Initialization Sequence Completed
Apr 13 17:34:30 openvpn 61410 Peer Connection Initiated with [AF_INET]x.x.x.x:1194
Apr 13 17:34:30 openvpn 61410 UDPv4 link remote: [AF_INET]x.x.x.x:1194
Apr 13 17:34:30 openvpn 61410 UDPv4 link local (bound): [AF_INET]y.y.y.y
Apr 13 17:34:30 openvpn 61410 Preserving previous TUN/TAP instance: ovpnc1
Apr 13 17:34:30 openvpn 61410 Socket Buffers: R=[42080->42080] S=[57344->57344]
Apr 13 17:34:30 openvpn 61410 Re-using pre-shared static key
Apr 13 17:34:30 openvpn 61410 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Apr 13 17:34:28 openvpn 61410 Restart pause, 2 second(s)
Apr 13 17:34:28 openvpn 61410 SIGUSR1[soft,ping-restart] received, process restarting
Apr 13 17:34:28 openvpn 61410 Inactivity timeout (--ping-restart), restarting
Apr 13 17:34:15 openvpn 42510 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #35237 / time = (1460551950) Wed Apr 13 15:52:30 2016 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Apr 13 17:34:15 openvpn 42510 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #35236 / time = (1460551950) Wed Apr 13 15:52:30 2016 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings
Apr 13 17:33:38 openvpn 42510 Initialization Sequence Completed
Apr 13 17:33:38 openvpn 42510 Peer Connection Initiated with [AF_INET]x.x.x.x:1194
Apr 13 17:33:30 openvpn 42510 UDPv4 link remote: [AF_INET]x.x.x.x:1194
Apr 13 17:33:30 openvpn 42510 UDPv4 link local (bound): [AF_INET]y.y.y.y
Apr 13 17:33:30 openvpn 42510 Preserving previous TUN/TAP instance: ovpnc2
Apr 13 17:33:30 openvpn 42510 Re-using pre-shared static key
Apr 13 17:33:30 openvpn 42510 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Apr 13 17:33:28 openvpn 42510 SIGUSR1[soft,ping-restart] received, process restarting

UPDATE2:
After I removed the client1 configuration and rebooted the fw the GUI is once again broken for the 2nd client confguration. Gui shows as OpenVPN not working / running . The service is running based on ps and networks routable for the moment.

ps aux| grep open

root 40757 0.0 0.1 12620 4332 - Ss 6:22PM 0:00.28 /usr/local/sbin/openvpn --config /var/etc/openvpn/client2.conf

UPDATE3:
[2.3-RELEASE][root@pluto.x.local]/root: cat /var/run/openvpn_client2.pid
77332
[2.3-RELEASE][root@pluto.x.local]/root:
[2.3-RELEASE][root@pluto.x.local]/root: kill -9 40757
[2.3-RELEASE][root@pluto.x.local]/root: rm /var/run/openvpn_client2.pid
[2.3-RELEASE][root@pluto.x.local]/root: ps aux| grep open
root 52810 0.0 0.1 10260 1900 0 S+ 6:31PM 0:00.00 grep open
[2.3-RELEASE][root@pluto.x.local]/root: ps aux | grep open
root 53236 0.0 0.1 12620 4588 - Ss 6:31PM 0:00.01 /usr/local/sbin/openvpn --config /var/etc/openvpn/client2.conf
root 68127 0.0 0.1 10260 1900 0 S+ 6:32PM 0:00.00 grep open
[2.3-RELEASE][root@pluto.x.local]/root: cat /var/run/openvpn_client2.pid
53236
[2.3-RELEASE][root@pluto.x.local]/root:

After this the gui is back. Please, howto fix this?

"If that is the case that would fall under #4642 instead."
That shows as fixed?

What about the reconnection issues as seen in my logs..

I think the issue is subject, similar to #6160 for strongswan. If you launch OpenVPN twice really close together you get into a PID mess, which breaks the status page. That's been going on for a while in some difficult to replicate edge cases.

NOYB and Juha, can you try this change and report back please:

--- a/src/etc/inc/openvpn.inc
+++ b/src/etc/inc/openvpn.inc
@@ -1298,8 +1298,10 @@ function openvpn_delete_csc(& $settings) {

 // Resync the configuration and restart the VPN
 function openvpn_resync($mode, $settings) {
+       $openvpn_resync_lock = lock('openvpnresync', LOCK_EX);
        openvpn_reconfigure($mode, $settings);
        openvpn_restart($mode, $settings);
+       unlock($openvpn_resync_lock);
 }

After i upgraded 2.3 -> 2.3.1, i have same issue.
After Pfsense boot, Widget doesn't show OpenVpn connection, but tunnel is working

I kill OpenVpn process and start again through web interface, after this steps widget work

if someone can get me access to a box that exhibits this issue, that would help greatly (email cmb at pfsense dot org and we can arrange something). This isn't easy to replicate.

The root issue can still be a problem. Probably ought to put a lock around it, but long-term needs a better service management framework to properly handle things.

PR has been merged