Ever since I upgraded to pfSense 2.5.0, my NordVPN interface does not work anymore. Traffic does not get routes to the NordVPN gateway, as pfSense reports it as "down" with 100% package loss. When checking "Status -> OpenVPN" the connection is reported as UP, but the gateway is DOWN. I don't understand how this is possible, but the log provides some clues, although I don't understand what goes wrong when reading the log.
OpenVPN Log (private IPs removed):
Feb 19 07:42:59 openvpn 79266 Initialization Sequence Completed
Feb 19 07:43:58 openvpn 79266 Authenticate/Decrypt packet error: missing authentication info
Feb 19 07:44:58 openvpn 79266 Authenticate/Decrypt packet error: missing authentication info
Feb 19 07:45:58 openvpn 79266 [nl852.nordvpn.com] Inactivity timeout (--ping-restart), restarting
Feb 19 07:45:58 openvpn 79266 SIGUSR1[soft,ping-restart] received, process restarting
Feb 19 07:45:58 openvpn 79266 Restart pause, 10 second(s)
Feb 19 07:46:08 openvpn 79266 NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Feb 19 07:46:08 openvpn 79266 Outgoing Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Feb 19 07:46:08 openvpn 79266 Incoming Control Channel Authentication: Using 512 bit message hash 'SHA512' for HMAC authentication
Feb 19 07:46:08 openvpn 79266 TCP/UDP: Preserving recently used remote address: [AF_INET]194.127.172.103:1194
Feb 19 07:46:08 openvpn 79266 Socket Buffers: R=[42080->524288] S=[57344->524288]
Feb 19 07:46:08 openvpn 79266 UDPv4 link local (bound): [AF_INET]x.x.x.x:0
Feb 19 07:46:08 openvpn 79266 UDPv4 link remote: [AF_INET]y.y.y.y:1194
Feb 19 07:46:08 openvpn 79266 TLS: Initial packet from [AF_INET]y.y.y.y.z:1194, sid=2ce7940f f02613d1
Feb 19 07:46:08 openvpn 79266 VERIFY WARNING: depth=0, unable to get certificate CRL: CN=nl852.nordvpn.com
Feb 19 07:46:08 openvpn 79266 VERIFY WARNING: depth=1, unable to get certificate CRL: C=PA, O=NordVPN, CN=NordVPN CA5
Feb 19 07:46:08 openvpn 79266 VERIFY WARNING: depth=2, unable to get certificate CRL: C=PA, O=NordVPN, CN=NordVPN Root CA
Feb 19 07:46:08 openvpn 79266 VERIFY OK: depth=2, C=PA, O=NordVPN, CN=NordVPN Root CA
Feb 19 07:46:08 openvpn 79266 VERIFY OK: depth=1, C=PA, O=NordVPN, CN=NordVPN CA5
Feb 19 07:46:08 openvpn 79266 VERIFY KU OK
Feb 19 07:46:08 openvpn 79266 Validating certificate extended key usage
Feb 19 07:46:08 openvpn 79266 ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
Feb 19 07:46:08 openvpn 79266 VERIFY EKU OK
Feb 19 07:46:08 openvpn 79266 VERIFY OK: depth=0, CN=nl852.nordvpn.com
Feb 19 07:46:08 openvpn 79266 WARNING: 'link-mtu' is used inconsistently, local='link-mtu 1582', remote='link-mtu 1634'
Feb 19 07:46:08 openvpn 79266 WARNING: 'auth' is used inconsistently, local='auth [null-digest]', remote='auth SHA512'
Feb 19 07:46:08 openvpn 79266 Control Channel: TLSv1.2, cipher TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384, 4096 bit RSA
Feb 19 07:46:08 openvpn 79266 [nl852.nordvpn.com] Peer Connection Initiated with [AF_INET]194.127.172.103:1194
Feb 19 07:46:09 openvpn 79266 SENT CONTROL [nl852.nordvpn.com]: 'PUSH_REQUEST' (status=1)
Feb 19 07:46:09 openvpn 79266 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 103.86.96.100,dhcp-option DNS 103.86.99.100,sndbuf 524288,rcvbuf 524288,explicit-exit-notify,comp-lzo no,route-gateway z.z.z.z,topology subnet,ping 60,ping-restart 180,ifconfig g.g.g.g 255.255.255.0,peer-id 3'
Feb 19 07:46:09 openvpn 79266 OPTIONS IMPORT: timers and/or timeouts modified
Feb 19 07:46:09 openvpn 79266 OPTIONS IMPORT: explicit notify parm(s) modified
Feb 19 07:46:09 openvpn 79266 OPTIONS IMPORT: compression parms modified
Feb 19 07:46:09 openvpn 79266 OPTIONS IMPORT: --sndbuf/--rcvbuf options modified
Feb 19 07:46:09 openvpn 79266 Socket Buffers: R=[524288->524288] S=[524288->524288]
Feb 19 07:46:09 openvpn 79266 OPTIONS IMPORT: --ifconfig/up options modified
Feb 19 07:46:09 openvpn 79266 OPTIONS IMPORT: route options modified
Feb 19 07:46:09 openvpn 79266 OPTIONS IMPORT: route-related options modified
Feb 19 07:46:09 openvpn 79266 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Feb 19 07:46:09 openvpn 79266 OPTIONS IMPORT: peer-id set
Feb 19 07:46:09 openvpn 79266 OPTIONS IMPORT: adjusting link_mtu to 1657
Feb 19 07:46:09 openvpn 79266 Using peer cipher 'AES-256-CBC'
Feb 19 07:46:09 openvpn 79266 Data Channel: using negotiated cipher 'AES-256-CBC'
Feb 19 07:46:09 openvpn 79266 Outgoing Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Feb 19 07:46:09 openvpn 79266 Outgoing Data Channel: Using 512 bit message hash 'SHA512' for HMAC authentication
Feb 19 07:46:09 openvpn 79266 Incoming Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Feb 19 07:46:09 openvpn 79266 Incoming Data Channel: Using 512 bit message hash 'SHA512' for HMAC authentication
Feb 19 07:46:09 openvpn 79266 Preserving previous TUN/TAP instance: ovpnc8
Feb 19 07:46:09 openvpn 79266 NOTE: Pulled options changed on restart, will need to close and reopen TUN/TAP device.
Feb 19 07:46:09 openvpn 79266 Closing TUN/TAP interface
Feb 19 07:46:09 openvpn 79266 /usr/local/sbin/ovpn-linkdown ovpnc8 1500 1637 a.b.c.d 255.255.255.0 init
Feb 19 07:46:10 openvpn 79266 ROUTE_GATEWAY a.b.c.d/255.255.254.0 IFACE=re0 HWADDR=00:e2:6c:68:07:be
Feb 19 07:46:10 openvpn 79266 TUN/TAP device ovpnc8 exists previously, keep at program end
Feb 19 07:46:10 openvpn 79266 TUN/TAP device /dev/tun8 opened
Feb 19 07:46:10 openvpn 79266 /sbin/ifconfig ovpnc8 x.x.x.x y.y.y.y mtu 1500 netmask 255.255.255.0 up
Feb 19 07:46:10 openvpn 79266 /sbin/route add -net x.x.x.x x.x.x.x 255.255.255.0
Feb 19 07:46:10 openvpn 79266 /usr/local/sbin/ovpn-linkup ovpnc8 1500 1637 x.x.x.x 255.255.255.0 init
Feb 19 07:46:10 openvpn 79266 Initialization Sequence Completed
And the gateway log:
Feb 19 04:16:02 dpinger 68141 send_interval 500ms loss_interval 2000ms time_period 60000ms report_interval 0ms data_len 1 alert_interval 1000ms latency_alarm 500ms loss_alarm 20% dest_addr x.x.x.x bind_addr x.x.x.x identifier "NORDVPN_VPNV4 "
Feb 19 04:16:04 dpinger 68141 NORDVPN_VPNV4 x.x.x.x: Alarm latency 0us stddev 0us loss 100%
Feb 19 04:19:13 dpinger 16894 send_interval 500ms loss_interval 2000ms time_period 60000ms report_interval 0ms data_len 1 alert_interval 1000ms latency_alarm 500ms loss_alarm 20% dest_addr x.x.x.x bind_addr x.x.x.x identifier "WAN_DHCP "
Feb 19 04:19:13 dpinger 17398 send_interval 500ms loss_interval 2000ms time_period 60000ms report_interval 0ms data_len 1 alert_interval 1000ms latency_alarm 500ms loss_alarm 20% dest_addr x.x.x.x bind_addr x.x.x.x identifier "NORDVPN_VPNV4 "
Feb 19 04:19:15 dpinger 17398 NORDVPN_VPNV4 x.x.x.x: Alarm latency 0us stddev 0us loss 100%
In Firewall -> Rules -> LAN I adjusted the "default allow LAN to any rule" to the gateway "NordVPN". Outbound NAT is set to manual, with the top rule taking the LAN net as source and the NORDVPN interface.
Any help is appreciated. As said, the current configuration worked fine in 2.4.5 -- the latest release before upgrading to 2.5.0. I'm considering downgrading at this point.
Changed fallback DEA to AES-256-CBC from AES-256-GCM, and it's working fine
Go to VPN/OpenVPN/Client, and edit the setting "Fallback Data Encryption Algorithm"
NordVPN has posted updated documentation for pfSense 2.5.0, titled: pfSense 2.5 Setup with NordVPN.
As #NDK has mentioned in their A'er the updated docs show that you need to change the Fallback Data Encryption Algorithm to AES-256-CBC.
I have a problem with connecting to VPN. When I start up the raspberry device and connect the VPN with nmcli connection up VPN it succeceds. But if I bring the interface down and trying to bring it up again it fails. If I restart the raspberry I can connect to VPN again. What is the next step? Do you guys have any idea what has gone wrong?
In the journalctl log I get this message when it fails:
Could not determine IPv4/IPv6 protocol
Oct 23 15:56:24 raspberrypi nm-openvpn[2282]: SIGUSR1[soft,init_instance] received, process restarting
Oct 23 15:56:29 raspberrypi nm-openvpn[2282]: WARNING: --ns-cert-type is DEPRECATED. Use --remote-cert-tls instead.
Oct 23 15:56:29 raspberrypi nm-openvpn[2282]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Oct 23 15:56:29 raspberrypi nm-openvpn[2282]: RESOLVE: Cannot resolve host address: vpn.******.**:1194 (Name or service not known)
Oct 23 15:56:29 raspberrypi nm-openvpn[2282]: RESOLVE: Cannot resolve host address: vpn.*****.**:1194 (Name or service not known).
pi#raspberrypi:~ $ openvpn --version
OpenVPN 2.4.7 arm-unknown-linux-gnueabihf [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Feb 20 2019
library versions: OpenSSL 1.1.1d 10 Sep 2019, LZO 2.10
uname -a
Linux raspberrypi 5.4.51-v7+ #1333 SMP Mon Aug 10 16:45:19 BST 2020 armv7l GNU/Linux
NetworkManager --version
1.14.6
I'm trying to use Radicale via uWSGI and Apache.
After some struggle, I managed to use WSGI for radicale on Apache but I would like to offload the authentication to Apache.
So I created the apache conf as
<VirtualHost *:80>
ServerAdmin xxx#gmail.com
ServerName radicale.domain.com
ProxyPass / uwsgi://127.0.0.1:5232/
<Directory "/etc/radicale">
AllowOverride None
Require all granted
</Directory>
TransferLog /var/log/apache2/radicale_access.log
ErrorLog /var/log/apache2/radicale_error.log
</VirtualHost>
My uwsgi app is
[uwsgi]
http-socket = 127.0.0.1:5232
processes = 2
plugin = python3
#module = radicale
wsgi-file=/etc/radicale/radicale.wsgi
env = RADICALE_CONFIG=/etc/radicale/config
When I call http://radicale.domain.com, I get a generic 500 error but I can't see any errors in the apache error log or the uswgi log.
The uwsgi log shows (in verbose)
Thu May 7 17:40:39 2020 - *** Starting uWSGI 2.0.14-debian (64bit) on [Thu May 7 17:40:39 2020] ***
Thu May 7 17:40:39 2020 - compiled with version: 6.3.0 20170516 on 17 March 2018 15:41:47
Thu May 7 17:40:39 2020 - os: Linux-2.6.32-042stab128.2 #1 SMP Thu Mar 22 10:58:36 MSK 2018
Thu May 7 17:40:39 2020 - nodename: xxx
Thu May 7 17:40:39 2020 - machine: x86_64
Thu May 7 17:40:39 2020 - clock source: unix
Thu May 7 17:40:39 2020 - pcre jit disabled
Thu May 7 17:40:39 2020 - detected number of CPU cores: 8
Thu May 7 17:40:39 2020 - current working directory: /
Thu May 7 17:40:39 2020 - writing pidfile to /run/uwsgi/app/radicale/pid
Thu May 7 17:40:39 2020 - detected binary path: /usr/bin/uwsgi-core
Thu May 7 17:40:39 2020 - setgid() to 33
Thu May 7 17:40:39 2020 - set additional group 125 (redis)
Thu May 7 17:40:39 2020 - set additional group 5003 (ispapps)
Thu May 7 17:40:39 2020 - set additional group 5004 (ispconfig)
Thu May 7 17:40:39 2020 - setuid() to 33
Thu May 7 17:40:39 2020 - your processes number limit is 256137
Thu May 7 17:40:39 2020 - your memory page size is 4096 bytes
Thu May 7 17:40:39 2020 - detected max file descriptor number: 131072
Thu May 7 17:40:39 2020 - lock engine: pthread robust mutexes
Thu May 7 17:40:39 2020 - thunder lock: disabled (you can enable it with --thunder-lock)
Thu May 7 17:40:39 2020 - uwsgi socket 0 bound to UNIX address /run/uwsgi/app/radicale/socket fd 3
Thu May 7 17:40:39 2020 - uwsgi socket 1 bound to TCP address 127.0.0.1:5232 fd 5
Thu May 7 17:40:39 2020 - Python version: 3.5.3 (default, Sep 27 2018, 17:25:39) [GCC 6.3.0 20170516]
Thu May 7 17:40:39 2020 - *** Python threads support is disabled. You can enable it with --enable-threads ***
Thu May 7 17:40:39 2020 - Python main interpreter initialized at 0x7fc12c963dd0
Thu May 7 17:40:39 2020 - your server socket listen backlog is limited to 100 connections
Thu May 7 17:40:39 2020 - your mercy for graceful operations on workers is 60 seconds
Thu May 7 17:40:39 2020 - mapped 218304 bytes (213 KB) for 2 cores
Thu May 7 17:40:39 2020 - *** Operational MODE: preforking ***
Thu May 7 17:40:39 2020 - WSGI app 0 (mountpoint='') ready in 0 seconds on interpreter 0x7fc12c963dd0 pid: 23261 (defau
lt app)
Thu May 7 17:40:39 2020 - *** uWSGI is running in multiple interpreter mode ***
Thu May 7 17:40:39 2020 - spawned uWSGI master process (pid: 23261)
Thu May 7 17:40:39 2020 - spawned uWSGI worker 1 (pid: 23267, cores: 1)
Thu May 7 17:40:39 2020 - spawned uWSGI worker 2 (pid: 23268, cores: 1)
How can I debug uwsgi? How can I see why Apache returns the 500 error? Have I done anything wrong with the conf - I find the docs not very useful when it comes to error debugging or understanding how to define modules
Okay, after a week of contemplating, debugging and some swearing, I saw my quite stupid mistake :(
I configured a HTTP socket in UWSGI
http-socket = 127.0.0.1:5232
but specified the uwsgi protocol in Apache ...
ProxyPass / uwsgi://127.0.0.1:5232/
I need your help with some strange problem
We are trying to create an ifcfg-eth1 network device on our centos 7 server.
We are using the following information in the ifcfg-eth1 file;
TYPE=Ethernet
BOOTPROTO=static
DEVICE=eth1
ONBOOT=yes
IPADDR=192.168.101.61
NETMASK=255.255.255.0
GATEWAY=192.168.100.1
DNS1=8.8.8.8
DNS2=8.8.4.4
The ifcfg-eth0 work like it should, but when we create the ifcfg-eth1 we get the following error;
No suitable device found for this connection.
Full output from /var/log/messages
Oct 5 10:38:09 switch-onpremis1 network: ループバックインターフェイスを呼び込み中 [ OK ]
Oct 5 10:38:09 switch-onpremis1 network: インターフェース enp029f2u1 を活性化中: [ OK ]
Oct 5 10:38:10 switch-onpremis1 network: インターフェース eth0 を活性化中: [ OK ]
Oct 5 10:38:10 switch-onpremis1 NetworkManager[665]: <info> [1538703490.1107] audit: op="connection-activate" uuid="9c92fad9-6ecb-3e6c-eb4d-8a47c6f50c04" name="System eth1" result="fail" reason="No suitable device found for this connection."
Oct 5 10:38:10 switch-onpremis1 network: インターフェース eth1 を活性化中: エラー: 接続のアクティベーションに失敗: No suitable device found for this connection.
Oct 5 10:38:10 switch-onpremis1 network: [失敗]
Oct 5 10:38:10 switch-onpremis1 network: RTNETLINK answers: File exists
Oct 5 10:38:10 switch-onpremis1 network: RTNETLINK answers: File exists
Oct 5 10:38:10 switch-onpremis1 network: RTNETLINK answers: File exists
Oct 5 10:38:10 switch-onpremis1 network: RTNETLINK answers: File exists
Oct 5 10:38:10 switch-onpremis1 network: RTNETLINK answers: File exists
Oct 5 10:38:10 switch-onpremis1 network: RTNETLINK answers: File exists
Oct 5 10:38:10 switch-onpremis1 network: RTNETLINK answers: File exists
Oct 5 10:38:10 switch-onpremis1 network: RTNETLINK answers: File exists
Oct 5 10:38:10 switch-onpremis1 network: RTNETLINK answers: File exists
Oct 5 10:38:10 switch-onpremis1 systemd: network.service: control process exited, code=exited status=1
Oct 5 10:38:10 switch-onpremis1 systemd: Failed to start LSB: Bring up/down networking.
Oct 5 10:38:10 switch-onpremis1 systemd: Unit network.service entered failed state.
Oct 5 10:38:10 switch-onpremis1 systemd: network.service failed.
What could be the problem of this?
Has it to do with our network card maybe?
Or could the problem be somewhere else?
Our settings for ifcfg-eth0 are;
TYPE=Ethernet
PROXY_METHOD=static
BROWSER_ONLY=no
BOOTPROTO=static
DEFROUTE=yes
IPV4_FAILURE_FATAL=no
IPV6INIT=yes
IPV6_AUTOCONF=yes
IPV6_DEFROUTE=yes
IPV6_FAILURE_FATAL=no
IPV6_ADDR_GEN_MODE=stable-privacy
NAME=eth0
UUID=f3d98d60-6062-4b70-a14c-7ac4040bd403
DEVICE=eth0
ONBOOT=yes
IPADDR=192.168.100.60
PREFIX=24
GATEWAY=192.168.100.1
DNS1=8.8.8.8
Thank you for the suggestions.
Help is really appreciated.
We are already struggling with the same problem for the last three days.
Networking has changed with CentOS 7.x, Checkout the following:
Read 3. And what if I want the old naming back?
Also, check out 7. What have you done with ifconfig/netstat?
https://wiki.centos.org/FAQ/CentOS7
I have system log
Jul 28 20:37:44 pi postfix/pickup[853]: 3F4F1A2C0: uid=0 from=<root>
Jul 28 20:37:44 pi postfix/cleanup[863]: 3F4F1A2C0: message-id=<20150728183744.3F4F1A2C0#mail.domain.tld>
Jul 28 20:37:44 pi postfix/qmgr[854]: 3F4F1A2C0: from=<root#domain.tld>, size=413, nrcpt=1 (queue active)
Jul 28 20:37:44 pi postfix/local[865]: 3F4F1A2C0: to=<root#domain.tld>, relay=local, delay=0.26, delays=0.24/0/0/0.02, dsn=2.0.0, status=sent (delivered to mailbox)
Jul 28 20:37:44 pi postfix/qmgr[854]: 3F4F1A2C0: removed
But mail doesnt come to mailBox or mailDir
command mail does not show anything
I have configured Maildir
and command mail can read only mailbox.. so I must to install mutt or something else...