search

opnsense / core

OPNsense GUI, API and systems backend
https://opnsense.org/
BSD 2-Clause "Simplified" License
3.21k stars 718 forks source link

OPNsense 22.1.x OpenVPN clients are tied together in traffic reporting #5614

Closed biggt closed 2 years ago

biggt commented 2 years ago

Important notices

Before you add a new report, we ask you kindly to acknowledge the following:

Describe the bug

In OPNsense 22.1.x I have noticed that if a VPN client connection goes down, when restarted, all VPN clients will show the same traffic. This behavior was not occurring in 21.4 all through 21.7.

To clarify, today one of my 2 current VPN clients was down and not passing traffic through. When I restarted the failed VPN client, the OpenVPN Connection Status page shows the amount of traffic passing through the 2 interfaces is nearly identical. When I check Reporting > Traffic and have my WAN connection and the 2 OpenVPN connections selected, the two VPN connections are showing the same amount of traffic. I have firewall rules in place for specific servers to only go out on the Switzerland VPN, and other servers going out over the USA VPN. These rules work until one of the connections drops and then I restart the failed VPN connection.

The USA VPN client connection does not have a significant amount of traffic flowing through it at any one time. The Switzerland VPN client connection often has a higher throughput, which would be the bulk of the WAN traffic. Only the Switzerland VPN client connection should be showing a similar traffic pattern as WAN, and should be the only one that is having significant traffic being accounted for in the Connection Status Page.

To Reproduce

Steps to reproduce the behavior:

  1. Wait for failed VPN Client connection
  2. Restart the failed VPN Client Connection
  3. Watch Bytes Received and Bytes Sent on Connection Status page increase in tandem with each other. (https://10.0.0.1/status_openvpn.php)
  4. Go to Reporting: Traffic and watch the two Outbound interfaces show the same traffic. (https://10.0.0.1/ui/diagnostics/traffic)

Expected behavior Only traffic that is actually exiting the desired interface should be showing a traffic spike that would relatively follow WAN based on download patterns.

Describe alternatives you considered

Restarting all VPN clients seems to work after a while, but no hard evidence on this.

Screenshots

Reporting: Traffic image

OpenVPN Connection Status image Refreshed this same page 5 seconds later image The Bytes Sent and Bytes Received follow each other. image

NAT: Outbound image

Firewall: LAN image

Environment

OPNsense 22.1.1_3-amd64 FreeBSD 13.0-STABLE OpenSSL 1.1.1m 14 Dec 2021 Intel(R) Xeon(R) CPU E5-2690 v3 @ 2.60GHz (6 cores, 6 threads) Network Intel® I350 VMware ESXi 6.7Update2

biggt commented 2 years ago

I realized quickly after starting this issue that I was Out of Date. I updated to

OPNsense 22.1.2_1-amd64 FreeBSD 13.0-STABLE OpenSSL 1.1.1m 14 Dec 2021

I will keep monitoring this issue to see if it continues.

biggt commented 2 years ago

Just this morning around 3:57am EST one of the VPN connections appears to have been reset and again, when looking at all the traffic streams, it appears that the two VPN interfaces are showing the same traffic stats and behavior.

OPNsense-bot commented 2 years ago

This issue has been automatically timed-out (after 180 days of inactivity).

For more information about the policies for this repository, please read https://github.com/opnsense/core/blob/master/CONTRIBUTING.md for further details.

If someone wants to step up and work on this issue, just let us know, so we can reopen the issue and assign an owner to it.