VPN remote access route add no longer works.

londonfire93

I have had an openvpn server running on my PFsense firewall for a couple of years now. I have a Site to site vpn and a client remote access vpn configured. After the heartbleed vulnerability i updated both the firewall to pfsense 2.1.2 and clients to openGVPN gui v5. The client vpn no longer works properly. The clients are able to connect to the server, perform all of the necessary handshakes and acquires an ip address the only thing that doesn't work is the updating of the routing table. The gui is ran as administrator and all clients are running on windows 7 and windows 8.1u1 64bit. If anyone could help with this issue it will be greatly appreciated. i notice this in the connection process
ROUTE: route addition failed using CreateIpForwardEntry: The parameter is incorrect. [status=87 if_index=34].

This what i get while establising vpn

Wed Apr 30 10:58:33 2014 OpenVPN 2.3.3 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Apr 14 2014
Wed Apr 30 10:58:44 2014 Control Channel Authentication: using 'pfsense-udp-1194-dkrachtus-tls.key' as a OpenVPN static key file
Wed Apr 30 10:58:44 2014 UDPv4 link local (bound): [undef]
Wed Apr 30 10:58:44 2014 UDPv4 link remote: [AF_INET]76.*.*.*:1194
Wed Apr 30 10:58:44 2014 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Wed Apr 30 10:58:45 2014 [LCSDNet-Server] Peer Connection Initiated with [AF_INET]76.*.*.*:1194
Wed Apr 30 10:58:48 2014 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Apr 30 10:58:48 2014 open_tun, tt->ipv6=0
Wed Apr 30 10:58:48 2014 TAP-WIN32 device [Local Area Connection] opened: \\.\Global\{0FC96DBD-586E-4684-8D21-057588DE883D}.tap
Wed Apr 30 10:58:48 2014 Notified TAP-Windows driver to set a DHCP IP/netmask of 192.168.5.10/255.255.255.0 on interface {0FC96DBD-586E-4684-8D21-057588DE883D} [DHCP-serv: 192.168.5.0, lease-time: 31536000]
Wed Apr 30 10:58:48 2014 Successful ARP Flush on interface [34] {0FC96DBD-586E-4684-8D21-057588DE883D}
Wed Apr 30 10:58:53 2014 Warning: address 192.168.5.1 is not a network address in relation to netmask 255.255.255.0
Wed Apr 30 10:58:53 2014 ROUTE: route addition failed using CreateIpForwardEntry: The parameter is incorrect.   [status=87 if_index=34]
Wed Apr 30 10:58:53 2014 env_block: add PATH=C:\Windows\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Wed Apr 30 10:58:53 2014 Initialization Sequence Completed

user config

dev tap
persist-tun
persist-key
cipher AES-128-CBC
auth SHA1
tls-client
client
resolv-retry infinite
remote 76.*.*.* 1194 udp
lport 0
verify-x509-name "LCSDNet-Server" name
auth-user-pass
pkcs12 pfsense-udp-1194-dkrachtus.p12
tls-auth pfsense-udp-1194-dkrachtus-tls.key 1
ns-cert-type server
comp-lzo

Server Config

dev ovpns1
dev-type tap
dev-node /dev/tap1
writepid /var/run/openvpn_server1.pid
#user nobody
#group nobody
script-security 3
daemon
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
proto udp
cipher AES-128-CBC
up /usr/local/sbin/ovpn-linkup
down /usr/local/sbin/ovpn-linkdown
client-connect /usr/local/sbin/openvpn.attributes.sh
client-disconnect /usr/local/sbin/openvpn.attributes.sh
local 76.*.*.*
tls-server
server-bridge 192.168.5.1 255.255.255.0 192.168.5.10 192.168.5.20
auth-user-pass-verify /var/etc/openvpn/server1.php via-env
tls-verify /var/etc/openvpn/server1.tls-verify.php
lport 1194
management /var/etc/openvpn/server1.sock unix
max-clients 2
push "route 192.168.5.1 255.255.255.0"
client-to-client
duplicate-cn
ca /var/etc/openvpn/server1.ca 
cert /var/etc/openvpn/server1.cert 
key /var/etc/openvpn/server1.key 
dh /etc/dh-parameters.1024
tls-auth /var/etc/openvpn/server1.tls-auth 0
comp-lzo
persist-remote-ip
float
push "route 192.168.10.0 255.255.255.0"

londonfire93

debbie10t wrote
londonfire93 wroteServer Config:
Code:
server-bridge 192.168.5.1 255.255.255.0 192.168.5.10 192.168.5.20
push "route 192.168.5.1 255.255.255.0"
... causes this on your client:
londonfire93 wroteThis what i get while establising vpn:
Code:
Wed Apr 30 10:58:53 2014 Warning: address 192.168.5.1 is not a network address in relation to netmask 255.255.255.0
Wed Apr 30 10:58:53 2014 ROUTE: route addition failed using CreateIpForwardEntry: The parameter is incorrect. [status=87 if_index=34]
Because you are pushing incorrect parameters for route.

Also, you are using dev tap and server-bridge so you are using OSI-Layer 2 which means you not need any routing for this setup (presuming your Operating System Bridge is setup correctly and presuming you do not require access to other LANS).

Remove the line: push "route 192.168.5.1 255.255.255.0" from your server config.

I tried removing the the line: push "route 192.168.5.1 255.255.255.0" from your server config. and still get the same results.

Also i don need to be able to access other LANs that's why i have a push "route 192.168.10.0 255.255.255.0" in my configuration.

The thing that i don't understand is why did it stop working all of the sudden i didn't change any of the configuration just updated the server.

londonfire93

debbie10t wrote
londonfire93 wroteI tried removing the the line: push "route 192.168.5.1 255.255.255.0" from your server config. and still get the same results
Please stop and start your server completely ...

I tried that the warning is no longer there but i cant access anything over the vpn.

Wed Apr 30 16:00:36 2014 OpenVPN 2.3.3 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Apr 14 2014
Wed Apr 30 16:00:49 2014 Control Channel Authentication: using 'pfsense-udp-1194-dkrachtus-tls.key' as a OpenVPN static key file
Wed Apr 30 16:00:49 2014 UDPv4 link local (bound): [undef]
Wed Apr 30 16:00:49 2014 UDPv4 link remote: [AF_INET]76.*.*.*:1194
Wed Apr 30 16:00:50 2014 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Wed Apr 30 16:00:52 2014 [LCSDNet-Server] Peer Connection Initiated with [AF_INET]76.*.*.*:1194
Wed Apr 30 16:00:54 2014 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Wed Apr 30 16:00:54 2014 open_tun, tt->ipv6=0
Wed Apr 30 16:00:54 2014 TAP-WIN32 device [Local Area Connection] opened: \\.\Global\{0FC96DBD-586E-4684-8D21-057588DE883D}.tap
Wed Apr 30 16:00:54 2014 Notified TAP-Windows driver to set a DHCP IP/netmask of 192.168.5.10/255.255.255.0 on interface {0FC96DBD-586E-4684-8D21-057588DE883D} [DHCP-serv: 192.168.5.0, lease-time: 31536000]
Wed Apr 30 16:00:54 2014 Successful ARP Flush on interface [34] {0FC96DBD-586E-4684-8D21-057588DE883D}
Wed Apr 30 16:00:59 2014 Initialization Sequence Completed

londonfire93

debbie10t wrote
londonfire93 wroteServer Config

Code:
up /usr/local/sbin/ovpn-linkup
down /usr/local/sbin/ovpn-linkdown
What does ovpn-linkup do ?

here is the code in the ovpn-linkup file. The configuration file was made using the Pfsense gui.

#!/bin/sh

# let the configuration system know that the ip has changed.
#/usr/local/sbin/pfSctl -c "interface newip $interface"

if [ "${dev_type}" = "tun" ]; then
	if [ "" != "$route_vpn_gateway" ]; then
		/bin/echo $route_vpn_gateway > /tmp/$1_router
	else
		/bin/echo $5 > /tmp/$1_router
	fi
fi

/usr/bin/touch /tmp/$1up
# reload filter 
/usr/local/sbin/pfSctl -c "interface newip $1"
exit 0