From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.haj.ipfire.org (localhost [IPv6:::1]) by mail02.haj.ipfire.org (Postfix) with ESMTP id 4fGyqk2W9nz33gk for ; Thu, 19 Feb 2026 16:04:18 +0000 (UTC) Received: from mail01.ipfire.org (mail01.haj.ipfire.org [172.28.1.202]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature ECDSA (secp384r1 raw public key) server-digest SHA384 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mail01.haj.ipfire.org", Issuer "R12" (not verified)) by mail02.haj.ipfire.org (Postfix) with ESMTPS id 4fGyqf6cK8z2xHh for ; Thu, 19 Feb 2026 16:04:14 +0000 (UTC) Received: from [127.0.0.1] (localhost [127.0.0.1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange x25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by mail01.ipfire.org (Postfix) with ESMTPSA id 4fGyqf1nYmz3m8; Thu, 19 Feb 2026 16:04:14 +0000 (UTC) DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003ed25519; t=1771517054; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Ur1178lIQgixNbs16BhoijHByZw5qB/pKbRMhrlpiUY=; b=9yTjJYvTkfAhupt2Olod0jt8R8YSl//qsyAEdn+vUIlx+Bfk3BDkqEbH0bysuTGVfpU2CY zQReNhe7fGgUcgBA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=202003rsa; t=1771517054; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Ur1178lIQgixNbs16BhoijHByZw5qB/pKbRMhrlpiUY=; b=bcE575fFr6Orm9iLKoViMJ2VeXJfDgBCirWdX0C+TcWRXR+inTnbB7FT4p1k3OK+9s1cQE XrdvZsDLMNkEmbDZErUwYFLordcMV6izgo9OtBJS4PqS9Mez3nGfydUo+gA2p5Z86LZjzn VNdk88aZtnVivnp9U2WQt5w4srrzdLogGpnZra091XEiNWSwH3agQCJD58OGKUU3Z4QgX/ qV0oPMIyKC4cTqEvc8hTHkh7XAX0e2X9xFkWkp7odw/G6m7y7/L9ZOkTK4UIEgCf3NfsP4 nNCXTvSsydE5ONSqdrSrEKM7NwnMuvcKte2b+Hq1HP0sF/6hhhDBrahWslwcKg== Message-ID: <7b53160b-eb3a-4b1b-b068-94057bd680e1@ipfire.org> Date: Thu, 19 Feb 2026 17:04:11 +0100 Precedence: list List-Id: List-Subscribe: , List-Unsubscribe: , List-Post: List-Help: Sender: Mail-Followup-To: MIME-Version: 1.0 Subject: Re: openvpn-2.7_rc1 To: ummeegge References: <4247a605-6aac-4c9c-93c8-db236c2cb769@ipfire.org> <414d5c1c72ceabb0f3051ba917bb45ff7de3f90f.camel@ipfire.org> Content-Language: en-GB Cc: "IPFire: Development-List" From: Adolf Belka In-Reply-To: <414d5c1c72ceabb0f3051ba917bb45ff7de3f90f.camel@ipfire.org> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Hi Erik, On 19/02/2026 16:03, ummeegge wrote: > Hi all, > > since OpenVPN 2.7.0 was released last week, I’ve done some more testing > with the new DCO flag. > > ``` > @@ -73,10 +73,10 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) > cd $(DIR_APP) && ./configure \ > --prefix=/usr \ > --sysconfdir=/var/ipfire/ovpn \ > - --enable-iproute2 \ > --enable-plugins \ > --enable-plugin-auth-pam \ > - --enable-plugin-down-root > + --enable-plugin-down-root \ > + --enable-dco > ``` > > I’ve found a couple of other issues: > > There have been some changes in the management interface, and a > protocol prefix is now included (e.g. udp4:). > As a result, the old regex patterns for > a) OpenVPN Connection Statistics and > b) Connection Status > no longer update or show data. This shouldn’t be hard to fix. I already have patch fixes for this from my testing of the alpha3, beta1 and rc1. If you go to my IPFire git repo (link at end of this mail) the patch is in that rc1 branch. There is also the removal of the deprecated persist-key which is now always enabled by default. Regards, Adolf. > > With OpenVPN 2.7.0, a MULTI ERROR appears when creating a client with > “redirect-gateway”. Example message: > > ``` > Feb 19 13:34:36 ipfire-prime openvpnserver[7329]: > PeterForden/udp4:192.168.110.10:38103 MULTI ERROR: primary virtual IP > for PeterForden/udp4:192.168.110.10:38103 (10.12.52.2) violates tunnel > network/netmask constraint (10.73.104.0/255.255.255.0) > ``` > > The connection still works fine, but the log entries don’t look good. > This happens because older setups used `redirect-gateway def1` in the > advanced options, and remnants of this are still present in server.conf > (push "redirect-gateway def1"), even though the checkbox for this > option has disappeared. > > When creating a new client, enabling redirect-gateway (here without > def1) now triggers this MULTI ERROR (“violates tunnel network/netmask > constraint”). > > Using redirect-gateway def1 might actually be the better and more > modern approach, since it adds two more specific routes (0.0.0.0/1 and > 128.0.0.0/1) instead of replacing the original default route — keeping > it available as a fallback. > > → Should `redirect-gateway def1` therefore be pushed globally for all > clients? If not explicitly configured otherwise, it would still apply. > > So far, DCO seems to makes his job. > > Some smaller issues have been noticed, but I think these are the key > points so far. > > Hope this mail isn’t **too long**, but I thought it might be useful to > share. > > Best, > > Erik > > Am Donnerstag, dem 06.11.2025 um 22:19 +0100 schrieb Adolf Belka: >> Hi All, >> >> Follow-on from my previous mails about testing openvpn-2.7_alpha3. >> >> Since then I have tested out openvpn-2.7_beta1 and today I tested out >> openvpn-2.7_rc1 >> >> It built without any problems and I also tested it on my vm system >> and confirmed that my android phone and linux laptop road warriors >> worked without any problems. >> I also tested out the n2 connection with openvpn-2.7_rc1 at one end >> and openvpn-2.6.15 at the other end and it connected without any >> issues. >> >> So the rc1 version has performed as the previous alpha3 and beta1 >> versions. >> >> I have merged the build branch into my ipfire repo >> >> https://git.ipfire.org/?p=people/bonnietwin/ipfire-2.x.git;a=shortlog;h=refs/heads/openvpn-2.7_rc1 >> >> Regards, >> >> Adolf. >