Community discussions

MikroTik App
 
christopherve7alb
newbie
Topic Author
Posts: 26
Joined: Wed Aug 07, 2013 7:15 pm

Updated to 6.29.1 - OpenVPN server is broken

Mon Jul 06, 2015 10:29 pm

I just updated to version 6.29.1 from 6.28 and the OpenVPN server implementation is broken. I have confirmed with multiple Linux clients and confirmed that rolling back to 6.28 fixes the issue. It seems to be that clients no longer learn about the P-P address of the Mikoritk and have nowhere to route traffic to. Here's an ifconfig from an Ubuntu server connected to my Miktorik on 6.28 vs 6.29.1:

6.28:
ifconfig tun1
tun1 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.1.1.200 P-t-P:10.1.1.1 Mask:255.255.255.255
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:1776 errors:0 dropped:0 overruns:0 frame:0
TX packets:2011 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:279054 (279.0 KB) TX bytes:293546 (293.5 KB)


6.29:
ifconfig tun1
tun1 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
inet addr:10.1.1.200 P-t-P:10.1.1.200 Mask:255.255.255.252
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1
RX packets:5 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:100
RX bytes:205 (205.0 B) TX bytes:0 (0.0 B)



For reference here is my OpenVPN config on the Mikroitik server:
/ppp secret add name=OpenVPN1 password=test profile=default-encryption local-address=10.1.1.1 remote-address=10.1.1.200

/interface ovpn-server server port=1194 mode=ip netmask=30 max-mtu=1500 keepalive-timeout=60 default-profile=default-encryption certificate=OVPN require-client-certificate=no auth=sha1 cipher=aes128,aes256
 
christopherve7alb
newbie
Topic Author
Posts: 26
Joined: Wed Aug 07, 2013 7:15 pm

Re: Updated to 6.29.1 - OpenVPN server is broken

Thu Jul 09, 2015 3:17 am

And looks like I didn't read the release notes closely enough, this new behavior is by design. I managed tor restore the old behavior by setting the netmask to 32 in the ovpn server config

Who is online

Users browsing this forum: Google [Bot], GoogleOther [Bot] and 177 guests