From b6abe23ba2d2a5d5055afd203bc3e60ee20bf757 Mon Sep 17 00:00:00 2001 From: Antonio Quartulli Date: Thu, 24 Sep 2026 16:32:15 +0200 Subject: openvpn: T9363: multiply the site-to-site keepalive timeout "failure-count" counts missed intervals, so the timeout it describes is interval * failure-count. Server mode renders and verifies it that way; site-to-site passed the bare count to "ping-restart", where it lands as seconds - 60s instead of 600s with the defaults. Render the product. That puts a timeout past the 86400 "ping-restart" accepts within reach, so verify() rejects it and the 5-to-6 migration clamps configurations already beyond it. This changes behaviour on upgrade: site-to-site tunnels now tolerate a longer silence, 600 seconds instead of 60 with the defaults. --- data/templates/openvpn/server.conf.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'data') diff --git a/data/templates/openvpn/server.conf.j2 b/data/templates/openvpn/server.conf.j2 index 6bd5291c8..999af5086 100644 --- a/data/templates/openvpn/server.conf.j2 +++ b/data/templates/openvpn/server.conf.j2 @@ -142,7 +142,7 @@ bind ipv6only {% endif %} {% if keep_alive.interval | int > 0 %} ping {{ keep_alive.interval }} -ping-restart {{ keep_alive.failure_count }} +ping-restart {{ keep_alive.interval | int * keep_alive.failure_count | int }} {% endif %} {% if device_type == 'tap' %} -- cgit v1.2.3