Solved OpenVPN: natd blocks traffic to/from bge0 after upgrading from 13.5 to 15.0

[pollito_cpc]

Hi all. I've got a strange issue that I hope someone can help with.

I have had an OpenVPN server running on 13.5-RELEASE for many years, and I recently decided it was time to update to 15.0-RELEASE.

Everything went fine, but when I rebooted I couldn't look up any hostnames, or even ping local machines on my LAN. Nor could I ssh to the box from another machine.

By process of elimination, I worked out that natd was responsible. Here is the relevant part of my rc.conf with the natd parts commented out:

# OpenVPN
firewall_enable="YES"
firewall_type="open"
firewall_logging="NO"
gateway_enable="YES"
#natd_enable="YES"
#natd_interface="bge0"
#natd_flags="-dynamic -m"
openvpn_enable="YES"
openvpn_configfile="/usr/local/etc/openvpn/server/server.conf"

OpenVPN still accepts connections with natd disabled, but nothing is routed (as expected).

net.inet.ip.forwarding is set as follows:

net.inet.ip.forwarding: 1

Does anyone know how to fix this? Has natd maybe changed between FreeBSD 13.x and 15.x?

I've attached my server.conf in case it helps.

If anyone has any suggestions, they would be greatly appreciated.

 

[pollito_cpc]

Solved it. First of all, enabling natd after the OpenVPN daemon stopped the original issue which prevented connectivity with bge0:

# OpenVPN
firewall_enable="YES"
firewall_type="open"
firewall_logging="NO"
gateway_enable="YES"
openvpn_enable="YES"
openvpn_configfile="/usr/local/etc/openvpn/server/server.conf"
natd_enable="YES"
natd_interface="bge0"
natd_flags="-dynamic -m"

I then decided to ditch natd, as I have random disconnects when using OpenVPN, which it could be responsible for. I am now using pf instead, which seems to be the modern way of doing things.

The relevant part of /etc/pf.conf looks like this:

ext_if = "bge0"
ov_net = "10.8.0.0/24"
set skip on lo
scrub in on $ext_if all fragment reassemble
nat on $ext_if from $ov_net to any -> ($ext_if)

And the relevant part of /etc/rc.conf now looks like this:

# OpenVPN
gateway_enable="YES"
openvpn_enable="YES"
openvpn_configfile="/usr/local/etc/openvpn/server/server.conf"
pf_enable="YES"