@viragomann I have fixed it!

I reconfigured the tunnel to be /30 (the error I was getting before was that 'allow duplicate connections' was enabled, and it failed to start due to this). I can now communicate between Site A and Site B.

Thank you for your patience whilst I troubleshooted this.

@edigest2 said in OpenVPN client to remote machine through pfSense, with reverse traffic/routing allowed when connected:

Should I configure the PFSENSE in peer to peer SSL/TLS mode? What parameters should I configure?

Yes, if you only need this one client to connect to the OpenVPN server, the easiest way is to set the tunnel mask to /30. This ensures, that the client get a static IP, which you can use to access it.

Then enter the main servers IP into the "Local Networks" field in CIDR notation (172.19.2.10/32). This pushes to route to the client.

Since the tunnel and the routes are pushed by the server, there is no need for special settings in the client config.
If the tunnel network is, say 10.0.8.0/30, the client gets 10.0.8.2. You can use this IP on the main server to access it.
Ensure that the clients Windows firewall allows access from the remote network.

@viragomann 3bb08830-9c77-47da-8bff-64b381fe225c-image.png

Not enabled ;(

@viragomann

Please see firewall rules below from site B:

OpenVPN:
0e6387dd-1d86-458f-af8a-be16d6461f65-image.png

Tunnel Interface:
300f4805-9271-46a7-8ede-1601f50246e7-image.png

LAN:
044a0fd5-029b-48ac-af81-7eb97f75b868-image.png

Thanks
Dan

@viragomann
Now I'm there. Thank you so much. I followed the wizard and the guide on the Netgate website to configure this. From this I determined that the 'Redirect gateway' (Force all client-generated IPv4 traffic through the tunnel) was a requirement to ensure that the OpenVPN remote clients would present the internet IP address of the main site. Now I've unchecked that box, it all makes perfect sense.
Thank you very much for your patience and sticking with me. I knew it was likely something small that I had wrongly configured. Turns out it was a checkbox and as a result, I never actually saw the IPv4 Local network(s) option.
It all makes sense now. I should of led with the pictures.

Thank you kindly for all your help,

I.T._Lee

@i-t-_lee Thanks. I actually switched to pfSense around 3 years ago because of his channel. I also switched to Unifi switches and AP's because of him. I did follow the nguvu guide because I'd rather be reading than pause-playing a video on YT, but you're right, his channel is a great resource.

@viragomann your idea worked. So this is the steps that I took for anyone else trying to do a similar setup.

Disabled DHCP Server on LAN network Set LAN Interface to DHCP (Save but not applied) Whet to interface assignment and set WAN to a VLAN on parent Interface (10 in my example) Set LAN to parent interface LAN rules were configured for any any but make sure yours are too Made sure all outbound NAT rules were configured for LAN and Not WAN (That way upstream router in unaware of pfSense network) In Open VPN server I checked the box for Provide a DNS Server list to Clients. Force all Client-generated IPv4/IPv6 was already checked but make sure yours is checked to force all traffic through VPN.

That's it. Other than that, OpenVPN is setup like normal. Now I will configure Wiregaurd as a VPN option too for speed.
Thanks to @Gertjan @viragomann for your help. Glad to see that this can be done. Makes it easy to add Remote connections to send to folks.

@sami-mkaddem How do I mark this post as solved?

@viragomann

Both endpoints are running on Verizon Fios. I'll see if can get put in a ticket with Verizon.

@jimp I did also find this but it appears dead. https://redmine.pfsense.org/issues/9970

Thanks btw.

Yup. Changing it to "shared key" seems to have worked. That's bananas! All the systems I was comparing to were also 23.01 and were using peer to peer (SSL/TLS). These are all 7100 1U appliances in HA configuration. Anyway, it's now working and I met my deadline so I'm going to take a break. If anyone has any ideas why share key worked but ssl/tls didn't, I'd love to hear it.

@viragomann
I thought it might create an instance in Firewall Rules when I was connected via the VPN, but when I connect via my home network there are still 2 Open VPN interfaces In the Firewall Rules. When I look at the Status Interface page, as well as my Interface Assignments page, I have only one Open VPN interface.

@dweimer

When you change OpenVPN server settings, you have to re export the OpenVPN client file.
You've done that, right ?

@dbass A public IP can only be used once. If you use NAT then LAN gets a private IP range, and you need NAT port forwarding rules to connect to the server on LAN.

If the server actually needs a public IP then you need to get another IP range from the ISP so they can route the public IP to you.
https://docs.netgate.com/pfsense/en/latest/recipes/route-public-ip-addresses.html

@viragomann Thanks so much for your help, I've just done this and its now all working as it should.

@gertjan
The administrator of the server decided to change something based on my log dumps, and now the connection just works at the first attempt.

Thank you everyone for your help. The only thing I had to change was the syntax of the remote line as mentioned by @viragomann, then the import worked just fine.

@rubens-fontes for dns use 172.16.0.2 , x.x.x.2 is amazons DNS. I usually attach a send Network interface (on the private subnet) to the pfsense and then add that as LAN