Troubleshooting OpenVPN

Configuration guides, troubleshooting and practical advice for AZTCOFW.

Articles

14 results

Cannot route to clients on an SSL/TLS site-to-site tunnel

If an SSL/TLS site-to-site tunnel is used and all of the routes appear correct but traffic still cannot flow properly, check the tunnel network size. If this is a site-to-site setup between only two locations, the tunnel

Check Firewall Log

If a VPN connection does not establish, or does establish but does not pass traffic, check the firewall logs under Status System Logs on the Firewall tab. If traffic for the tunnel itself is being blocked, such as traffi

Check OpenVPN Status

The first place to look is Status > OpenVPN . The connection status for each VPN is shown there. If a VPN is connected, waiting, reconnecting, etc, it would be indicated on that screen. For more information,

Check the OpenVPN logs

Browse to Status > System Logs and click the OpenVPN tab to view the OpenVPN logs. Upon connecting, OpenVPN will log messages similar to the following example: openvpn[32194]: UDPv4 link remote: 1.2.3.4:1194 openvpn[3219

Check the system routing table

Browse to Diagnostics > Routes and review the routes known by the firewall. For site-to-site VPNs, routes will be present for the remote network(s) to the appropriate tun or tap interface. If the routes are missing or in

Client Specific Override iroute entry seems to have no effect

When configuring a site-to-site PKI OpenVPN setup, an iroute statement must be configured using the Remote Network fields on the Client Specific Overrides entry set for the common name of the client certificate. First, e

Ensure no overlapping IPsec connections

Because of the way IPsec ties into the FreeBSD kernel, any enabled IPsec connection matching the local and remote subnets that exists when IPsec is enabled (even if it is not up) will cause that traffic to never be route

Importing OpenVPN DH Parameters

When importing an existing OpenVPN setup into AZTCO-FW, there is no need to import DH Parameters. DH parameters are not specific to a given setup in the way that certificates or keys are. To put it simply, the DH paramet

Routes will not push to a client

When attempting to use the Local Network setting or a push statement to push routes to a client, and the client isn’t receiving them properly, a couple things could be happening: Check that an SSL/TLS server setup is use

Some hosts work, but not all

If traffic between some hosts over the VPN functions properly, but some hosts do not, this is commonly one of four things. Missing, incorrect or ignored default gateway If the device does not have a default gateway, or h

Test from different vantage points

If the connection appears to be up according to the logs, but it doesn’t work from the LAN, try it from the firewall itself. These tests may be easily performed using the Diagnostics > Ping page on the firewall. First te

Trace the traffic with packet captures

Using packet captures to determine where the traffic is or isn’t flowing is one of the most helpful troubleshooting techniques. Start with the internal interface (commonly LAN) on the side where the traffic is being init

Why can’t I ping some OpenVPN adapter addresses?

In SSL/TLS server mode using a net30 style Topology , OpenVPN will not respond to ping on certain virtual addresses used solely for routing endpoints. Do not rely on pinging the OpenVPN endpoint addresses as a means of d

Why do OpenVPN clients all get the same IP address?

If the same certificate is used for all clients, which we strongly discourage, then the clients are all assigned the same IP address when they connect. To work around this, check Duplicate Connections on the server confi