Routing or OVPN Problems

RouterOS General
1

Hi,
After years of working fine, this is the second failure within a few days.

Two different CCR1009 routers, both on 7.24.5, normally connect as OVPN clients to my router and are now unreachable. The client log is immediate, same second:

ovpn,info WW32Out: initializing...
ovpn,info WW32Out: connecting...
ovpn,info WW32Out: disconnected <poll error>
ovpn,info WW32Out: terminating... - poll error
ovpn,info WW32Out: disconnected

So the TCP session dies before the tunnel comes up. This is not a drop after minutes.

7.24 says "improved OVPN underlying SSL connection management". 7.24.5 itself has no OVPN or routing change. Do I need to change anything on the client or server after that SSL change (cipher, tls-version, certificate)?

Also, in WinBox 4, IP/Routes no longer shows unavailable routes in blue the way I am used to. Is that only a WinBox display change?

Thanks, Oliver

2

Two clients that were working for years and both start failing within a few days makes me think more about something date-related than the 7.24 update.

I would check these first:

  • Certificates: run /certificate print detail on the server and clients. If the certificates were all created around the same time some years ago, they could now be expiring one after another. An expired or not-yet-valid certificate will kill the session directly at the start, which would fit with the disconnect happening in the same second.
  • Clock: if one of the CCRs lost the correct time (no NTP, or maybe after a reboot), TLS can fail in the same way. Check /system clock on both sides.

To get the real reason instead of only “poll error”, I would enable debug logging for OVPN on the server and one client:

/system logging add topics=ovpn,debug

Normally the server side should show the TLS error more clearly.

For the WinBox 4 route colours I can’t really help, sorry.