Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Site2Site Not Quite Working

    Scheduled Pinned Locked Moved OpenVPN
    20 Posts 2 Posters 1.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • X
      Ximulate @viragomann
      last edited by

      @viragomann

      Thank you for your continued help with this.

      I restarted the client connection, and now see a route on the Server to the client LAN (192.168.12.0/24), but connection is still failing (still unable to load resources on client side from server side. For example, from a machine (192.168.11.11) on the server LAN (192.168.11.0/24), I'm unable to access the web admin page of the client router 192.168.12.1)

      In the OpenVPN logs on the Client, I see:

      openvpn 	52317 	ERROR: FreeBSD route add command failed: external program exited with error status: 1
      

      Routes for server
      server.jpg

      Routes for client
      client.jpg

      V 1 Reply Last reply Reply Quote 0
      • V
        viragomann @Ximulate
        last edited by

        @ximulate
        As mentioned, check the OpenVPN log on the server to find out if the CSO is applied properly.
        Routing to clients on an access server with CSO is somewhat more complicated. pfSense has to add the route and additionally OpenVPN has to add a route for the client internally (iroute), since it's capable to handle multiple clients.

        In the OpenVPN logs on the Client, I see:

        openvpn 52317 ERROR: FreeBSD route add command failed: external program exited with error status: 1

        Some more information on this in the log?
        Since the client has added the route, it should work from the point of the client. But possibly there is something else wrong in the settings.

        Also ensure that you need a firewall rule permitting the access on all incoming interfaces. So for access from the clients LAN to the servers LAN, these are: clients LAN, servers OpenVPN

        X 2 Replies Last reply Reply Quote 0
        • X
          Ximulate @viragomann
          last edited by Ximulate

          @viragomann

          As mentioned, check the OpenVPN log on the server to find out if the CSO is applied properly.

          The above mentioned settings were input into CSO, and saved. Not sure what else to do. I don't see anything in the log to confirm CSO is applied

          server OpenVPN log shows the following, repeatedly:
          server-openvpn-log.jpg

          Firewall Rules on both server and client for OpenVPN:

          Pass IPv4 Source: * Destination: *
          

          On server, firewall rules for LAN include:

          Pass IPv4 Source: *, Destination 192.168.12.0/24 Port:* Gateway: *
          
          V 1 Reply Last reply Reply Quote 0
          • X
            Ximulate @viragomann
            last edited by

            Some more information on this in the log?

            I don't see anymore information regarding this in the log.

            1 Reply Last reply Reply Quote 0
            • V
              viragomann @Ximulate
              last edited by

              @ximulate
              Okay, even noticed that the CSO part is not logged with default log level.
              So I changed the log level in the server setting to 3, then I got the info:
              a4024a9f-eb7c-478c-9101-ecbb7caea170-grafik.png

              X 1 Reply Last reply Reply Quote 0
              • X
                Ximulate @viragomann
                last edited by

                @viragomann
                Client side OpenVPN log, at verbosity 3:
                client OpenVPN Logs.jpg

                two things stand out to me:

                Error: FreeBSD rout add command failed
                

                I see this warning on the server side OpenVPN logs also:

                Verify Warning: unable to get certificate
                
                V 1 Reply Last reply Reply Quote 0
                • V
                  viragomann @Ximulate
                  last edited by

                  @ximulate said in Site2Site Not Quite Working:

                  Client side OpenVPN log, at verbosity 3:

                  The server log is way more of interesting here. The CSO part can only be found in the server log.

                  Error: FreeBSD rout add command failed

                  This is due the server is pushing a route for the clients LAN network, which cannot be added naturally.
                  That's why I don't like this setup method as mentioned above. I'd rather add the remote networks in the client config.
                  However, it should work anyway.

                  Verify Warning: unable to get certificate

                  The whole warning says "Verify Warning: unable to get certificate CRL" (Certificate Revocation List).
                  This is normal. The client complains that he cannot pull the CRL, since it is not provided in the internet.

                  X 1 Reply Last reply Reply Quote 0
                  • X
                    Ximulate @viragomann
                    last edited by

                    @viragomann
                    One the Server side verbosity 3, I'm now see this:
                    server_logs.png

                    V 1 Reply Last reply Reply Quote 0
                    • V
                      viragomann @Ximulate
                      last edited by

                      @ximulate
                      Need to see the section, when the client establishes the connection.

                      X 1 Reply Last reply Reply Quote 0
                      • X
                        Ximulate @viragomann
                        last edited by Ximulate

                        @viragomann

                        Server side logs (after reboot of client router)...
                        server_logs.j (pg

                        At

                        Jul 20 10:17:04, MANAGEMENT: .......
                        

                        Those management messages repeat as shown in previous post

                        V 1 Reply Last reply Reply Quote 0
                        • V
                          viragomann @Ximulate
                          last edited by

                          @ximulate
                          So there is no note of the CSO in the log. Hence the route within OpenVPN won't work.

                          As mentioned above in post #8 check if the common name in the CSO and server settings are correct.

                          X 1 Reply Last reply Reply Quote 0
                          • X
                            Ximulate @viragomann
                            last edited by

                            @viragomann
                            That was it! Its now working. Thank you for your help and patience

                            1 Reply Last reply Reply Quote 0
                            • First post
                              Last post
                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.