OpenVPN for 2 LAN sites fail to connect each other

GruensFroeschli

I suggest you start reading on http://openvpn.net/howto

I see that you only want to connect two LAN's together.
For this dont use a PKI but use a shared key setup.
–> resetup your openVPN connection.

The custom options you added are mostly useless since they are generated by pfSense per default or ther eis a checkbox to enable them

For your test with a windows XP client... you cannot connect multiple clients with the same certificate.

yce_kelvin

Hi Mr.GruensFroeschli
Really thanks for your suggestion. I am noob on this.. Thanks, I will redo again and once got result i post here d.

Thanks so much,

Kelvin

yce_kelvin

Hi,
Mr.GruensFroeschli,
Now i connect like this:

Client LAN A (5PC) 192.168.10.2 to 5 <-> Switch <-> PFSense Box A (192.168.10.100) <-> ADSL Modem –-(ISP STATIC Line A) ISP --- ISP (ISP Dynamic Line B) <-> ADSL Modem <-> PFSense Box B (192.168.1.1) <-> Switch <-> Client LAN B (10PC) 192.168.1.2 to 11

PF Sense Box A OpenVPN - Configuration:
Protocol: UDP
Dynamic IP: (YES)
Local Port: 1194
Address Pool: 10.8.0.0/24
Local Network: 192.168.10.100/24
Remote Network: 192.168.1.1/24
Client-to-Client VPN: (YEs)
Cryptography: BF-CBC (128Bit)
Authentication method: PKI
CA inserted
Server CA Inserted
Server Key Inserted
DH Parameters Inserted
DHCP-Opt: DNS Server: 202.188.0.133;202.188.1.5
LZO: (Yes)
Custom Option: ;dev tap;keepalive 10 120;verb 3;duplicate-cn;client-to-client;max-clients 150;user nobody;group nobody

===

PFsense Box B OpenVPN Configuration"
Protocol: UDP
Server address: xxx.dyndns.org
Server port:1194
Proxy port:3128
Cryptography:BF-CBC(128Bit)
Authentication method:PKI
CA Inserted
Client CA Inserted
CLient Key Inserted
LZO compression
Custom options: ;dev tap;resolv-retry infinite;persist-key;persist-tun;ns-cert-type server;

After setup the log message show: May 7 21:23:30 openvpn[38053]: Initialization Sequence Completed

Both server and client get same message,

After connected, the server show the following log:

May 7 21:23:30 openvpn[1911]: VPN-CLIENT1/124.13.87.49:1195 MULTI: Learn: 00:bd:e0:0d:41:00 -> VPN-CLIENT1/124.13.87.49:1195
May 7 21:23:30 openvpn[1911]: VPN-CLIENT1/124.13.87.49:1195 SENT CONTROL [VPN-CLIENT1]: 'PUSH_REPLY,route 192.168.10.100 255.255.255.0,dhcp-option DNS 202.188.0.133,dhcp-option DNS 202.188.1.5,route-gateway 10.8.0.1,ping 10,ping-restart 120,ifconfig 10.8.0.2 255.255.255.0' (status=1)
May 7 21:23:30 openvpn[1911]: VPN-CLIENT1/124.13.87.49:1195 PUSH: Received control message: 'PUSH_REQUEST'

Problem Now: PFSense box connected but the client machine LAN A to LAN B are not connected.. It is i less some step??

yce_kelvin

Client Site: -
Share Key Config

yce_kelvin

This is the server share key conf

Note: 192.168.10.0/24 is server site
192.168.1.0/24 is client site
192.168.100.0/24 is vpn tunnel subnet ….

GruensFroeschli

Follow-up-note:
We where able to solve the problem per MSN.
yce_kelvin forgot to mention that the server had more than one WAN.

http://forum.pfsense.org/index.php/topic,7001.0.html

The rule on the LAN had as gateway a loadbalancing-pool.
The problem was solved through adding another rule with as destination 192.168.1.0/24 (subnet on the client side) and gateway * above the rule with as gateway Loadbalancer. (see screenshot posted by yce_kelvin below)

yce_kelvin

The Firewall configuration:

yce_kelvin

Arrangement of rules:

yce_kelvin

Site to site connection with share key is okay but cannot bridging.
Try to do another site-to-site bridging. If some one have experience before kindly share ur exp here. Anyone success before?

yce_kelvin

Anyone success with openvpn tunnel and lan game within 2 lan's client pc?

GruensFroeschli

Nobody will ever be able to use UDP broadcast based LAN games in a routed scenario.

You NEED a bridge, or else a UDP proxy like this one: http://www.vttoth.com/tunnel.htm

In about 3 weeks or so i will have a bit more time. If i'm not too busy with other projects i think i'll try to get this running since i'm interrested in this too.

yce_kelvin

Bridge mode can successful for 2 LAN sites in a "normal" condition. "Normal" mean a normal office or group network. If those client is "cloned" then will meet the problem with MAC address issue. This is because if the PCs are cloned, that mean the MAC address also will duplicated.

Bridge mode i use is form a pfsense as openvpn server and other client pc install openvpn with tap-adaptor. Client can be successful connected but need a different MAC address of TAP-adaptor. I m try to come out a script that can make the TAP-adaptor MAC address can change according to IP address.

But, what i hope that is 2 site PF sense can form bridge mode and no need to do any setting or installation to the client PC.. It is possible.

I know that PFsense routed VPN is not work with what i want.. Anyway i hope that i can make a successful case under GruensFroeschli help :)

or someone interest on it can study together. My network knowledge is level 1 only ^^