Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    OpenVPN for 2 LAN sites fail to connect each other

    Scheduled Pinned Locked Moved OpenVPN
    19 Posts 2 Posters 13.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • Y
      yce_kelvin
      last edited by

      Hi, This is the network..

      I hope to integrate OpenVPN to make tunnel for LAN A and LAN B so there can share files, play games together.

      PFSense Box 1 Configuration:
      Protocol: UDP
      Dynamic IP (Thick)
      Local Port:1194
      Address Pool: 10.8.0.0/24
      Remote Network: 192.168.1.1/24
      Client to Client VPN: (Thick)
      Authenication method: PKI
      CA: INserted
      Server CA: INserted
      Server Key: INserted
      DH: Inserted
      DHCP-OPT: DNS Domain Name: (Use domain which i host at dyndns.com)
      DHCP-OPT: DNS Server: 202.188.0.133 (DNS Server ISP)
      custom option:
      ;local 60.xx.xxx.xxx
      ;dev tap
      ;duplicate-cn
      ;comp-Izo
      ;max-clients 150
      ;persist-tun
      ;push "dhcp-option DNS 202.188.0.133"
      ;push "dhcp-option DNS 202.188.1.5"

      –----------
      PFSense Box 2 (Client)
      Configuration
      Protocol: UDP
      Server address: 60.xx.xxx.xxx
      Server port:1194
      Interface IP:192.168.1.1/24
      Proxy port:3128
      Cryptography:BF-CBC(128Bit)
      Authentication method:PKI
      CA certificate: Inserted
      Client certificate: Inserted
      Client key: Inserted
      Custom options:
      ;dev tap;persist-key;persist-tun;ns-cert-type server;comp-lzo;remote 60.xx.xxx.xxx 1194

      Result
      Both PFSense show  Initialization Sequence Completed

      But i cannot ping in PC 1, PC2 nor PC3 to each other

      So, I install Window OpenVPN GUI
      and configure the file:
      –----------

      Client at Window XP Config log files:
      client
      dev tap
      proto udp
      remote 60.xx.xxx.xxx
      resolv-retry infinite
      nobind
      persist-key
      persist-tun
      ca ca.crt
      cert client1.crt
      key client1.key
      ns-cert-type server
      comp-lzo
      verb 3

      Result:
      Client success connected BUT if both side more than 1 PC connect then cannot get link together...

      It is i use wrong method on construct the network or insert wrong code??

      Thanks

      IT Computer System - I love it. Hope that every day is a happy day and the world is peace and green environment always.

      1 Reply Last reply Reply Quote 0
      • GruensFroeschliG
        GruensFroeschli
        last edited by

        I suggest you start reading on http://openvpn.net/howto

        I see that you only want to connect two LAN's together.
        For this dont use a PKI but use a shared key setup.
        –> resetup your openVPN connection.

        The custom options you added are mostly useless since they are generated by pfSense per default or ther eis a checkbox to enable them

        For your test with a windows XP client... you cannot connect multiple clients with the same certificate.

        We do what we must, because we can.

        Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

        1 Reply Last reply Reply Quote 0
        • Y
          yce_kelvin
          last edited by

          Hi Mr.GruensFroeschli
          Really thanks for your suggestion. I am noob on this.. Thanks, I will redo again and once got result i post here d.

          Thanks so much,

          Kelvin

          IT Computer System - I love it. Hope that every day is a happy day and the world is peace and green environment always.

          1 Reply Last reply Reply Quote 0
          • Y
            yce_kelvin
            last edited by

            Hi,
            Mr.GruensFroeschli,
            Now i connect like this:

            Client LAN A (5PC) 192.168.10.2 to 5 <-> Switch <-> PFSense Box A (192.168.10.100) <-> ADSL Modem  –-(ISP STATIC Line A)  ISP --- ISP (ISP Dynamic Line B) <-> ADSL Modem <-> PFSense Box B (192.168.1.1) <-> Switch <-> Client LAN B (10PC) 192.168.1.2 to 11

            PF Sense Box A OpenVPN - Configuration:
            Protocol: UDP
            Dynamic IP: (YES)
            Local Port: 1194
            Address Pool: 10.8.0.0/24
            Local Network: 192.168.10.100/24
            Remote Network: 192.168.1.1/24
            Client-to-Client VPN: (YEs)
            Cryptography: BF-CBC (128Bit)
            Authentication method: PKI
            CA inserted
            Server CA Inserted
            Server Key Inserted
            DH Parameters Inserted
            DHCP-Opt: DNS Server: 202.188.0.133;202.188.1.5
            LZO: (Yes)
            Custom Option: ;dev tap;keepalive 10 120;verb 3;duplicate-cn;client-to-client;max-clients 150;user nobody;group nobody

            ===

            PFsense Box B OpenVPN Configuration"
            Protocol: UDP
            Server address: xxx.dyndns.org
            Server port:1194
            Proxy port:3128
            Cryptography:BF-CBC(128Bit)
            Authentication method:PKI
            CA Inserted
            Client CA Inserted
            CLient Key Inserted
            LZO compression
            Custom options: ;dev tap;resolv-retry infinite;persist-key;persist-tun;ns-cert-type server;

            After setup the log message show: May 7 21:23:30 openvpn[38053]: Initialization Sequence Completed

            Both server and client get same message,

            After connected, the server show the following log:

            May 7 21:23:30 openvpn[1911]: VPN-CLIENT1/124.13.87.49:1195 MULTI: Learn: 00:bd:e0:0d:41:00 -> VPN-CLIENT1/124.13.87.49:1195
            May 7 21:23:30 openvpn[1911]: VPN-CLIENT1/124.13.87.49:1195 SENT CONTROL [VPN-CLIENT1]: 'PUSH_REPLY,route 192.168.10.100 255.255.255.0,dhcp-option DNS 202.188.0.133,dhcp-option DNS 202.188.1.5,route-gateway 10.8.0.1,ping 10,ping-restart 120,ifconfig 10.8.0.2 255.255.255.0' (status=1)
            May 7 21:23:30 openvpn[1911]: VPN-CLIENT1/124.13.87.49:1195 PUSH: Received control message: 'PUSH_REQUEST'

            Problem Now: PFSense box connected but the client machine LAN A to LAN B are not connected.. It is i less some step??

            IT Computer System - I love it. Hope that every day is a happy day and the world is peace and green environment always.

            1 Reply Last reply Reply Quote 0
            • Y
              yce_kelvin
              last edited by

              Client Site: -
              Share Key Config

              IT Computer System - I love it. Hope that every day is a happy day and the world is peace and green environment always.

              1 Reply Last reply Reply Quote 0
              • Y
                yce_kelvin
                last edited by

                This is the server share key conf

                Note: 192.168.10.0/24 is server site
                192.168.1.0/24 is client site
                192.168.100.0/24 is vpn tunnel subnet ….

                IT Computer System - I love it. Hope that every day is a happy day and the world is peace and green environment always.

                1 Reply Last reply Reply Quote 0
                • GruensFroeschliG
                  GruensFroeschli
                  last edited by

                  Follow-up-note:
                  We where able to solve the problem per MSN.
                  yce_kelvin forgot to mention that the server had more than one WAN.

                  http://forum.pfsense.org/index.php/topic,7001.0.html

                  The rule on the LAN had as gateway a loadbalancing-pool.
                  The problem was solved through adding another rule with as destination 192.168.1.0/24 (subnet on the client side) and gateway * above the rule with as gateway Loadbalancer. (see screenshot posted by yce_kelvin below)

                  We do what we must, because we can.

                  Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

                  1 Reply Last reply Reply Quote 0
                  • Y
                    yce_kelvin
                    last edited by

                    The Firewall configuration:

                    IT Computer System - I love it. Hope that every day is a happy day and the world is peace and green environment always.

                    1 Reply Last reply Reply Quote 0
                    • Y
                      yce_kelvin
                      last edited by

                      Arrangement of rules:

                      IT Computer System - I love it. Hope that every day is a happy day and the world is peace and green environment always.

                      1 Reply Last reply Reply Quote 0
                      • Y
                        yce_kelvin
                        last edited by

                        Site to site connection with share key is okay but cannot bridging.
                        Try to do another site-to-site bridging. If some one have experience before kindly share ur exp here. Anyone success before?

                        IT Computer System - I love it. Hope that every day is a happy day and the world is peace and green environment always.

                        1 Reply Last reply Reply Quote 0
                        • Y
                          yce_kelvin
                          last edited by

                          Anyone success with openvpn tunnel and lan game within 2 lan's client pc?

                          IT Computer System - I love it. Hope that every day is a happy day and the world is peace and green environment always.

                          1 Reply Last reply Reply Quote 0
                          • GruensFroeschliG
                            GruensFroeschli
                            last edited by

                            Nobody will ever be able to use UDP broadcast based LAN games in a routed scenario.

                            You NEED a bridge, or else a UDP proxy like this one: http://www.vttoth.com/tunnel.htm

                            In about 3 weeks or so i will have a bit more time. If i'm not too busy with other projects i think i'll try to get this running since i'm interrested in this too.

                            We do what we must, because we can.

                            Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

                            1 Reply Last reply Reply Quote 0
                            • Y
                              yce_kelvin
                              last edited by

                              Bridge mode can successful for 2 LAN sites in a "normal" condition. "Normal" mean a normal office or group network. If those client is "cloned" then will meet the problem with MAC address issue. This is because if the PCs are cloned, that mean the MAC address also will duplicated.

                              Bridge mode i use is form a pfsense as openvpn server and other client pc install openvpn with tap-adaptor. Client can be successful connected but need a different MAC address of TAP-adaptor. I m try to come out a script that can make the TAP-adaptor MAC address can change according to IP address.

                              But, what i hope that is 2 site PF sense can form bridge mode and no need to do any setting or installation to the client PC.. It is possible.

                              I know that PFsense routed VPN is not work with what i want.. Anyway i hope that i can make a successful case under GruensFroeschli help :)

                              or someone interest on it can study together. My network knowledge is level 1 only ^^

                              IT Computer System - I love it. Hope that every day is a happy day and the world is peace and green environment always.

                              1 Reply Last reply Reply Quote 0
                              • First post
                                Last post
                              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.