• Client Outbound on OPT1

    Locked
    11
    0 Votes
    11 Posts
    5k Views
    K

    Yep, I was able to test it after my office closed today. Just popping the static route in when I need it works for me.

  • Routing Problems

    Locked
    2
    0 Votes
    2 Posts
    2k Views
    jimpJ

    What do your firewall rules look like on LAN?

    What about the remote openvpn server? Does it have a route back to your LAN subnet? (either via route for shared key, or route/iroute for PKI)

  • OpenVPN site to site from Host to Client not working

    Locked
    2
    0 Votes
    2 Posts
    3k Views
    jimpJ

    With site-to-site PKI, the "remote network" doesn't really work like that. The Remote Network box is only for Shared Key.

    You need to do two things to get site-to-site PKI to route back to the client network:

    a) Add a "route 192.168.x.0 255.255.255.0;" line in custom options, one for each remote site.
    b) Add a Client-Specific Config entry for each site, using the site's common name of their certificate. In the custom options for this site, add "iroute 192.168.x.0 255.255.255.0;"

  • Openvpn on 2 win–help its for my graduation :)

    Locked
    5
    0 Votes
    5 Posts
    2k Views
    J

    Server:

    local 192.168.10.18

    port 1194

    proto udp

    dev tun

    dev-node MyTap

    ca ca.crt
    cert key.crt
    key key.key

    dh dh1024.pem

    server 10.8.0.0 255.255.255.0

    ifconfig-pool-persist ipp.txt

    push "route 192.168.10.0 255.255.255.0"
    push "route 192.168.0.0 255.255.255.0"

    client-config-dir ccd
    route 192.168.0.0 255.255.255.0
    #iroute 192.168.0.0 255.255.255.0

    push "192.168.10.1"
    push "dhcp-option DNS 10.8.0.1"
    push "dhcp-option WINS 10.8.0.1"

    tls-auth ta.key 0
    comp-lzo

    max-clients 100
    persist-key
    persist-tun

    verb 3

    mute 20

    Client:

    client

    dev tun

    dev-node MyTap

    proto udp

    remote 110.60.20.217 1194

    resolv-retry infinite

    nobind

    persist-key

    persist-tun

    mute-replay-warnings

    ca ca.crt
    cert client1.crt
    key client1.key

    ns-cert-type server

    tls-auth ta.key 1

    comp-lzo

    mute 20

  • Cannot reach LAN from "Address Pool"

    Locked
    2
    0 Votes
    2 Posts
    3k Views
    jimpJ

    Not sure about ubuntu clients, but on Win7 were you running the client as Administrator?

    When connected, go to a CMD prompt, and type "route print" and see if you have a route to your home network that has an IP in the OpenVPN address pool as its gateway.

  • MOVED: Is this possible, pfsens to Anonine VPN

    Locked
    1
    0 Votes
    1 Posts
    2k Views
    No one has replied
  • 0 Votes
    2 Posts
    8k Views
    jimpJ

    The client doesn't need dh parameters.

    As for the other problem, on the road warrior server config, in the custom options, put:

    push route 192.168.2.0 255.255.255.0;

    And then on the site2 client for site-to-site, in the custom options, put:

    route 10.0.0.0 255.255.255.0;

    The first part should tell the clients that they can reach site2 via the OpenVPN connection. The second part will tell site2 how to route back to the OpenVPN road warrior subnet.

  • 0 Votes
    1 Posts
    4k Views
    No one has replied
  • OpenVPN routing

    Locked
    7
    0 Votes
    7 Posts
    6k Views
    K

    and the other part of my config

    4.jpg
    4.jpg_thumb
    5.jpg
    5.jpg_thumb
    6.jpg
    6.jpg_thumb
    7.jpg
    7.jpg_thumb

  • SquidGuard and OpenVPN - Web Filtering

    Locked
    1
    0 Votes
    1 Posts
    2k Views
    No one has replied
  • Client-specific configuration, static IP

    Locked
    2
    0 Votes
    2 Posts
    3k Views
    jimpJ

    A few simple tests could confirm this behavior, but I'm not sure offhand.

    I haven't tried this myself, but you could require having a CSC entry, and use the directive

    ccd-exclusive;

    In the custom options to enforce the requirement that a client exists on the CSC tab before they can connect.

    The OpenVPN man page doesn't really clarify whether or not the ifconfig-push directives for the CSC entries are taken into account during general pool assignment.

  • Pinging hosts over OPENVPN tunnel

    Locked
    5
    0 Votes
    5 Posts
    5k Views
    P

    Thx i think i got it now. I ve changed Address pool to 10.0.8.0/24 (on servers side) an on client side Interface IP: to 10.0.8.0/24 and now i can ping from hosts on A site to host on B site. Now I am going to play with DNS. Thx once again.

  • Dns not working

    Locked
    6
    0 Votes
    6 Posts
    3k Views
    J

    It's resolved. There were two different problems. One was with Tunnelblick. I switched to a different VPN client on the Mac (Viscosity) which worked right away. The problem with the Windows PC was that I was using a different VPN config, who's alias was mistakingly being blocked from DNS via a firewall rule.

  • MOVED: Multiple clients to pfSense 2.0 OpenVPN

    Locked
    1
    0 Votes
    1 Posts
    1k Views
    No one has replied
  • PfSense site-to-site PKI: can ping to one site, not the other

    Locked
    3
    0 Votes
    3 Posts
    2k Views
    jimpJ

    This was solved on IRC, I believe. He switched to using a real PKI setup (not shared key/PSK), and adding route/iroute statements as needed, and it started to work.

  • What encoding is used on the OVPN certificates and keys in config.xml?

    Locked
    2
    0 Votes
    2 Posts
    2k Views
    B

    Never mind, I figured it out. It is base64 encoded, just without line breaks. I just removed all the line breaks from my encoded string.

  • Create Userkeys with minimal serverkeys

    Locked
    7
    0 Votes
    7 Posts
    4k Views
    jimpJ

    I'm not sure how it goes on Windows, but on unix, you have to run a different program first that sets variables that makes sure it's reading all of the proper files and such.

  • OpenVPN works but Local network unreachable

    Locked
    13
    0 Votes
    13 Posts
    8k Views
    jimpJ

    Can you try some packet captures to see if the traffic makes it across the tunnel on tun0 and actually leaves (and re-enters) your LAN interface?

  • Firewall rules multi LAN

    Locked
    2
    0 Votes
    2 Posts
    2k Views
    V

    Never mind ,
    i will skip the VPN settings for now

  • Client-config-dir files being deleted

    Locked
    3
    0 Votes
    3 Posts
    3k Views
    V

    Thanks ,
    it works , i was thinking i could just copy them  :-
    anyway thanks again , it solved the problem

Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.