Todo #17079
Updated by Marcos M 2 days ago
The @kill@ command for client instances connected to the OpenVPN Server changed to require the protocol as a prefix without the address family:
https://github.com/OpenVPN/openvpn/commit/10a82b1f2fe3cf295a4a44dac1f61fdf750c172a
{{collapse
<pre>
[26.10-DEVELOPMENT][admin@gw]/root: echo "status 1" | socat - unix-connect:/var/etc/openvpn/server1/sock
>INFO:OpenVPN Management Interface Version 6 -- type 'help' for more info
OpenVPN CLIENT LIST
Updated,2026-09-08 12:31:36
Common Name,Real Address,Bytes Received,Bytes Sent,Connected Since
testuser,udp4:10.0.100.102:54507,335877,507740,2026-09-08 11:33:18
ROUTING TABLE
Virtual Address,Common Name,Real Address,Last Ref
172.25.1.2,testuser,udp4:10.0.100.102:54507,2026-09-08 11:33:20
fc00:172:25:1::1000,testuser,udp4:10.0.100.102:54507,2026-09-08 11:33:20
GLOBAL STATS
Max bcast/mcast queue length,0
END
[26.10-DEVELOPMENT][admin@gw]/root: echo "kill udp4:10.0.100.102:54507" | socat - unix-connect:/var/etc/openvpn/server1/sock
>INFO:OpenVPN Management Interface Version 6 -- type 'help' for more info
ERROR: port number or protocol out of range: 54507 udp4
[26.10-DEVELOPMENT][admin@gw]/root: echo "kill 10.0.100.102:54507" | socat - unix-connect:/var/etc/openvpn/server1/sock
>INFO:OpenVPN Management Interface Version 6 -- type 'help' for more info
ERROR: common name '10.0.100.102' not found
[26.10-DEVELOPMENT][admin@gw]/root: echo "kill udp:10.0.100.102:54507" | socat - unix-connect:/var/etc/openvpn/server1/sock
>INFO:OpenVPN Management Interface Version 6 -- type 'help' for more info
SUCCESS: 1 client(s) at address udp:10.0.100.102:54507 killed
</pre>
}}
Additionally the option does not support IPv6 clients:
https://community.openvpn.net/openvpn/ticket/280
{{collapse
<pre>
[26.10-DEVELOPMENT][admin@gw]/root: echo "status 2" | socat - unix-connect:/var/etc/openvpn/server4/sock
>INFO:OpenVPN Management Interface Version 6 -- type 'help' for more info
TITLE,OpenVPN 2.7.5 amd64-portbld-freebsd16.0 [SSL (OpenSSL)] [LZO] [LZ4] [PKCS11] [MH/RECVDA] [AEAD] [DCO]
TIME,2026-09-08 13:03:19,1788894199
HEADER,CLIENT_LIST,Common Name,Real Address,Virtual Address,Virtual IPv6 Address,Bytes Received,Bytes Sent,Connected Since,Connected Since (time_t),Username,Client ID,Peer ID,Data Channel Cipher
CLIENT_LIST,testuser,udp6:[2001:470:ba1e:100:987:5cab:5c8f:4ae7]:45597,172.25.2.2,fc00:172:25:2::1000,9637,22904,2026-09-08 13:02:04,1788894124,testuser,1,0,CHACHA20-POLY1305
HEADER,ROUTING_TABLE,Virtual Address,Common Name,Real Address,Last Ref,Last Ref (time_t)
ROUTING_TABLE,fc00:172:25:2::1000,testuser,udp6:[2001:470:ba1e:100:987:5cab:5c8f:4ae7]:45597,2026-09-08 13:02:06,1788894126
ROUTING_TABLE,172.25.2.2,testuser,udp6:[2001:470:ba1e:100:987:5cab:5c8f:4ae7]:45597,2026-09-08 13:02:06,1788894126
GLOBAL_STATS,Max bcast/mcast queue length,0
GLOBAL_STATS,dco_enabled,1
END
[26.10-DEVELOPMENT][admin@gw]/root: echo "kill udp6:[2001:470:ba1e:100:987:5cab:5c8f:4ae7]:45597" | socat - unix-connect:/var/etc/openvpn/server4/sock
>INFO:OpenVPN Management Interface Version 6 -- type 'help' for more info
ERROR: error parsing IP address: [2001
[26.10-DEVELOPMENT][admin@gw]/root: echo "kill udp:[2001:470:ba1e:100:987:5cab:5c8f:4ae7]:45597" | socat - unix-connect:/var/etc/openvpn/server4/sock
>INFO:OpenVPN Management Interface Version 6 -- type 'help' for more info
ERROR: error parsing IP address: [2001
[26.10-DEVELOPMENT][admin@gw]/root: echo "kill udp:2001:470:ba1e:100:987:5cab:5c8f:4ae7:45597" | socat - unix-connect:/var/etc/openvpn/server4/sock
>INFO:OpenVPN Management Interface Version 6 -- type 'help' for more info
ERROR: client at address udp:0.0.7.209:470 not found
[26.10-DEVELOPMENT][admin@gw]/root: echo "kill udp:2001:470:ba1e:100:987:5cab:5c8f:4ae7[:45597]" | socat - unix-connect:/var/etc/openvpn/server4/sock
>INFO:OpenVPN Management Interface Version 6 -- type 'help' for more info
ERROR: client at address udp:0.0.7.209:470 not found
</pre>
}}
This option hasn't worked for some time due to a regression in https://redmine.pfsense.org/issues/15856
Rather than continuing to maintain this option which doesn't work for IPv6, remove it in favor of the @client-kill@ option which still works and does support IPV6 clients.
Also see: https://redmine.pfsense.org/issues/12416