diff options
| author | Antonio Quartulli <antonio@mandelbit.com> | 2026-09-24 16:32:15 +0200 |
|---|---|---|
| committer | Christian Breunig <christian@breunig.cc> | 2026-09-29 20:40:44 +0200 |
| commit | b6abe23ba2d2a5d5055afd203bc3e60ee20bf757 (patch) | |
| tree | ce870f87bd932badb71c34c820bceae88b232d4e /data | |
| parent | 46d5702af546ce2f1d97d4cc145292a895e620fd (diff) | |
| download | vyos-1x-b6abe23ba2d2a5d5055afd203bc3e60ee20bf757.tar.gz vyos-1x-b6abe23ba2d2a5d5055afd203bc3e60ee20bf757.zip | |
openvpn: T9363: multiply the site-to-site keepalive timeout
"failure-count" counts missed intervals, so the timeout it describes is
interval * failure-count. Server mode renders and verifies it that way;
site-to-site passed the bare count to "ping-restart", where it lands as
seconds - 60s instead of 600s with the defaults.
Render the product. That puts a timeout past the 86400 "ping-restart"
accepts within reach, so verify() rejects it and the 5-to-6 migration
clamps configurations already beyond it.
This changes behaviour on upgrade: site-to-site tunnels now tolerate a
longer silence, 600 seconds instead of 60 with the defaults.
Diffstat (limited to 'data')
| -rw-r--r-- | data/templates/openvpn/server.conf.j2 | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/data/templates/openvpn/server.conf.j2 b/data/templates/openvpn/server.conf.j2 index 6bd5291c8..999af5086 100644 --- a/data/templates/openvpn/server.conf.j2 +++ b/data/templates/openvpn/server.conf.j2 @@ -142,7 +142,7 @@ bind ipv6only {% endif %} {% if keep_alive.interval | int > 0 %} ping {{ keep_alive.interval }} -ping-restart {{ keep_alive.failure_count }} +ping-restart {{ keep_alive.interval | int * keep_alive.failure_count | int }} {% endif %} {% if device_type == 'tap' %} |