Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Openvpn site to site traffic issue

    Scheduled Pinned Locked Moved OpenVPN
    17 Posts 3 Posters 2.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • B
      Betahelix @viragomann
      last edited by

      @viragomann

      OK, guess when it says ip address is 0.0.0.0 it is wrong.
      The client states this:

      Jun 16 22:12:35 ovpn-client1[30181]: OpenVPN ROUTE: OpenVPN needs a gateway parameter for a --route option and no default was specified by either --route-gateway or --ifconfig options
      Jun 16 22:12:35 ovpn-client1[30181]: OpenVPN ROUTE: failed to parse/resolve route for host/network: 192.168.10.0
      Jun 16 22:12:35 ovpn-client1[30181]: OpenVPN ROUTE: OpenVPN needs a gateway parameter for a --route option and no default was specified by either --route-gateway or --ifconfig options
      Jun 16 22:12:35 ovpn-client1[30181]: OpenVPN ROUTE: failed to parse/resolve route for host/network: 192.168.10.0

      it says its connected, but no traffic are working though the tunnel

      V 1 Reply Last reply Reply Quote 0
      • V
        viragomann @Betahelix
        last edited by

        @betahelix
        Seems like there is something other wrong in the client configuration. But without insight, it's hard to say what.

        B 1 Reply Last reply Reply Quote 0
        • B
          Betahelix @viragomann
          last edited by Betahelix

          @viragomann
          this is the ovpn file i used:

          dev tun
          persist-tun
          persist-key
          data-ciphers AES-256-GCM:AES-128-GCM:AES-256-CBC
          data-ciphers-fallback AES-256-CBC
          auth SHA256
          tls-client
          client
          resolv-retry infinite
          remote *removed 11944 udp4
          nobind
          verify-x509-name "removed" name
          remote-cert-tls server
          explicit-exit-notify

          <ca>
          -----BEGIN CERTIFICATE-----
          removed
          -----END CERTIFICATE-----
          </ca>
          <cert>
          -----BEGIN CERTIFICATE-----
          removed
          -----END CERTIFICATE-----
          </cert>
          <key>
          -----BEGIN PRIVATE KEY-----
          removed
          -----END PRIVATE KEY-----
          </key>
          key-direction 1
          <tls-auth>

          2048 bit OpenVPN static key

          -----BEGIN OpenVPN Static key V1-----
          Removed
          -----END OpenVPN Static key V1-----
          </tls-auth>

          with these custom settings:

          data-ciphers AES-256-GCM:AES-128-GCM:AES-256-CBC
          data-ciphers-fallback AES-256-CBC
          tls-client
          resolv-retry infinite
          remote-cert-tls server
          explicit-exit-notify
          route 192.168.10.0 255.255.255.0

          V 1 Reply Last reply Reply Quote 0
          • J
            Jarhead @Betahelix
            last edited by

            @betahelix Just put an allow all on the OpenVPN tab for now to get it working, then you can adjust the rule as needed. You'll need this on both sites. No rule needed on the LAN as long as you already have an allow all on it.
            I make all my site to site VPN's a /31, doubles the ip space available.
            The only other rule you'll need is on the server side WAN to allow the client to connect.

            You have something wrong in your config, best to post pics of it.

            B 1 Reply Last reply Reply Quote 1
            • B
              Betahelix @Jarhead
              last edited by Betahelix

              @jarhead thanks. I tried tuning off my fw (yes not advised) when the setup was on /24, but still No traffic.

              I Will post my config tomorrow and Hope you can Help. Thanks alot

              J 1 Reply Last reply Reply Quote 0
              • J
                Jarhead @Betahelix
                last edited by Jarhead

                @betahelix No problem. Using a /24 is a waste of IP's but it will still work so that's not causing the problem you're having.
                There's a detailed example Netgate has (I'll find it after typing this) that you can follow and you'll probably get it going on your own after that.

                Here it is, they actually use a /24 too, but can't understand why anyone would since you literally only need two IP's for a site to site, hence the /31's I use.

                https://docs.netgate.com/pfsense/en/latest/recipes/openvpn-s2s-tls.html

                Edit: Just noticed they are connecting 3 sites, that's why they didn't use a /30 or /31. Either way, the /24 still isn't causing your issue.

                1 Reply Last reply Reply Quote 0
                • V
                  viragomann @Betahelix
                  last edited by

                  @betahelix said in Openvpn site to site traffic issue:

                  with these custom settings:
                  data-ciphers AES-256-GCM:AES-128-GCM:AES-256-CBC
                  data-ciphers-fallback AES-256-CBC
                  tls-client
                  resolv-retry infinite
                  remote-cert-tls server
                  explicit-exit-notify
                  route 192.168.10.0 255.255.255.0

                  I guess the last line requires a gateway. But this again will require an ifconfig line.
                  So you might have to add this line to the client config:

                  ifconfig 192.168.72.2 192.168.72.1
                  B 1 Reply Last reply Reply Quote 0
                  • B
                    Betahelix @viragomann
                    last edited by

                    @viragomann

                    Hello.
                    I have now added the following to site B:
                    ifconfig 192.168.72.1 192.168.72.2
                    route 192.168.10.0 255.255.255.0 192.168.72.1

                    When connecting the client on Site B says its connecte.
                    No traffic is routed

                    On site A (pfsense) traffic works for 1 min.
                    I can access sites on network B, but only for 1 min, and everything times out.

                    J 1 Reply Last reply Reply Quote 0
                    • J
                      Jarhead @Betahelix
                      last edited by

                      @betahelix You still didn't post your config...

                      B 1 Reply Last reply Reply Quote 0
                      • B
                        Betahelix @Jarhead
                        last edited by

                        @jarhead sorry about that.

                        I found this: /var/etc/openvpn/server1/config.ovpn

                        or do you want screenshots?

                        dev ovpns1
                        verb 1
                        dev-type tun
                        dev-node /dev/tun1
                        writepid /var/run/openvpn_server1.pid
                        #user nobody
                        #group nobody
                        script-security 3
                        daemon
                        keepalive 10 60
                        ping-timer-rem
                        persist-tun
                        persist-key
                        proto udp4
                        auth SHA256
                        up /usr/local/sbin/ovpn-linkup
                        down /usr/local/sbin/ovpn-linkdown
                        local ip removed
                        engine rdrand
                        tls-server
                        ifconfig 192.168.72.1 192.168.72.2
                        tls-verify "/usr/local/sbin/ovpn_auth_verify tls 'Cert' 1"
                        lport 11941
                        management /var/etc/openvpn/server1/sock unix
                        push "route 192.168.10.0 255.255.255.0"
                        remote-cert-tls client
                        route 192.168.6.0 255.255.255.0
                        capath /var/etc/openvpn/server1/ca
                        cert /var/etc/openvpn/server1/cert
                        key /var/etc/openvpn/server1/key
                        dh /etc/dh-parameters.2048
                        tls-auth /var/etc/openvpn/server1/tls-auth 0
                        data-ciphers AES-256-GCM:AES-128-GCM:AES-256-CBC
                        data-ciphers-fallback AES-256-CBC
                        allow-compression no
                        persist-remote-ip
                        float

                        J 1 Reply Last reply Reply Quote 0
                        • J
                          Jarhead @Betahelix
                          last edited by

                          @betahelix Nothing really sticks out as a problem but you can try turning off hardware crypto.

                          The other thing is viragomann's suggestion.
                          You have:
                          ifconfig 192.168.72.1 192.168.72.2
                          route 192.168.10.0 255.255.255.0 192.168.72.1

                          Should be on the client side:
                          ifconfig 192.168.72.2 192.168.72.1
                          route 192.168.10.0 255.255.255.0

                          Other than that, my guess is something on the Asus which I know nothing about. Might check if they have some kind of support forum too.

                          1 Reply Last reply Reply Quote 0
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.