Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    OpenVPN Site 2 Site problems.

    Scheduled Pinned Locked Moved OpenVPN
    19 Posts 3 Posters 15.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • S
      Seth
      last edited by

      Negative on the Muli WAN.

      Yes I was pinging the opposite sides pfsense LAN IP.

      Ping results

      main.pfsense
      from main.pfsense to 192.168.101.1 fail
      from main.pfsense to 192.168.101.2 fail

      remote.pfsense
      from remote.pfsense to 192.168.101.1 success
      from remote.pfsense to 192.168.101.2 fail

      1 Reply Last reply Reply Quote 0
      • GruensFroeschliG
        GruensFroeschli
        last edited by

        Ok this is impossible.
        At the very least you should be able to ping your own IP on each side.

        At this point i would resetup the whole OpenVPN-thing.
        Maybe with a different IP-range. (10.10.10.0/24 ?)
        Is it possible that the 192.168.101.0/24 subnet is used for something else?

        We do what we must, because we can.

        Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

        1 Reply Last reply Reply Quote 0
        • S
          Seth
          last edited by

          192.168.101.0/24 is my second range/attempt.  I'll try someother range…  192.168.101.0/24 isn't being used anywhere else.  The DSL modems on both sides are in bridged mode.  pfsense handles the PPOE.  There management interface is 192.168.1.0/24.  The LAN on main.pfsense is 192.168.1.0/24.  Never been an issue before.

          How about firewall rules?  main.pfsense has a rule to allow OpenVPN
          Proto  Source  Port  Destination  Port                Gateway  Schedule
          UDP    *        *    *                1194(OpenVPN)  *

          No rule on remote.pfsense for OpenVPN

          Both boxes are blocking RFC 1918 networks and Reserved/not assigned by IANA on WAN.  FYI I have turned these off and and tested as well with no success.

          Additional ping tests

          main.pfsense WAN
          Host 192.168.101.1
          Interface WAN
          Result Fail

          Host 192.168.101.1
          Interface LAN
          Result Fail

          Host 192.168.101.2
          Interface WAN
          Result Fail

          Host 192.168.101.2
          Interface LAN
          Result Success

          remote.pfsense WAN
          Host 192.168.101.1
          Interface WAN
          Result Success

          Host 192.168.101.1
          Interface LAN
          Result Success

          Host 192.168.101.2
          Interface WAN
          Result Fail

          Host 192.168.101.2
          Interface LAN
          Result Fail

          Thanks
          --Seth

          1 Reply Last reply Reply Quote 0
          • S
            Seth
            last edited by

            Deleted and added new OpenVPN tunel on main.pfsense.  Here are the ping results:

            Ping results

            main.pfsense WAN
            Host 10.10.10.1
            Interface WAN
            Result Fail

            Host 10.10.10.1
            Interface LAN
            Result Fail

            Host 10.10.10.2
            Interface WAN
            Result Fail

            Host 10.10.10.2
            Interface LAN
            Result Success

            remote.pfsense WAN
            Host 10.10.10.1
            Interface WAN
            Result Success

            Host 10.10.10.1
            Interface LAN
            Result Success

            Host 10.10.10.2
            Interface WAN
            Result Fail

            Host 10.10.10.2
            Interface LAN
            Result Fail

            Looks like a routing or firewall issue to me, but I'm stumped.

            –Seth

            1 Reply Last reply Reply Quote 0
            • S
              Seth
              last edited by

              I've build a new set of pfsense servers in VM without issue.  What I have noticed is that in the pair of VMs I can see the tunnel in both states tables, I only see the tunnel open in the states table on remote.pfsense not main.pfsense on the physical boxes.

              –Seth

              1 Reply Last reply Reply Quote 0
              • S
                Seth
                last edited by

                Looks like a missing route on main.pfsense

                missing
                192.168.3  192.168.101.2 tun0

                How do I add/force this route.  tun0 interface not present in static routes.

                Thanks
                –Gary

                1 Reply Last reply Reply Quote 0
                • GruensFroeschliG
                  GruensFroeschli
                  last edited by

                  You add a route command to the custom options on the OpenVPN config page.
                  in the form of:

                  route 10.0.0.0 255.255.248.0 10.0.3.1

                  (10.0.0.0/21 through 10.0.3.1)

                  We do what we must, because we can.

                  Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

                  1 Reply Last reply Reply Quote 0
                  • S
                    Seth
                    last edited by

                    Yes, but tun0 is absent from System | Static Routes –> Interface drop down.  This is my dilemma....

                    1 Reply Last reply Reply Quote 0
                    • GruensFroeschliG
                      GruensFroeschli
                      last edited by

                      That's what i mean with:
                      You add a route command to the custom options on the OpenVPN config page.

                      You dont add the static route via the static-route-config-page.
                      You add the static route in the openVPN config file.
                      When the tunnel comes up, openVPN dynamically add the static routes, and removes them when the tunnel goes down.

                      We do what we must, because we can.

                      Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

                      1 Reply Last reply Reply Quote 0
                      • S
                        Seth
                        last edited by

                        Sorry.  Read your post quickly and missed it.  My bad.

                        Being uncertain of the syntax I entered the route I thought I needed and got the following message:
                        Aug 20 21:53:32 openvpn[9320]: ERROR: FreeBSD route add command failed: shell command exited with error status: 1

                        Removed the route and OpenVPN started working as designed.  Tunnel is is now operation between sites without custom options.

                        I would however like to understand the syntax of your route command

                        route 10.0.0.0 255.255.248.0 10.0.3.1
                        route = Add a route
                        10.0.0.0 = network to route to
                        255.255.248.0 = subnet mas of the 10.0.0.0 network
                        10.0.3.1 = Gateway

                        Thanks

                        1 Reply Last reply Reply Quote 0
                        • GruensFroeschliG
                          GruensFroeschli
                          last edited by

                          @http://openvpn.net/index.php/documentation/manuals/openvpn-20x-manpage.html:

                          –route network/IP [netmask] [gateway] [metric]
                              Add route to routing table after connection is established. Multiple routes can be specified. Routes will be automatically torn down in reverse order prior to TUN/TAP device close.

                          This option is intended as a convenience proxy for the route(8) shell command, while at the same time providing portable semantics across OpenVPN's platform space.

                          netmask default – 255.255.255.255

                          gateway default -- taken from --route-gateway or the second parameter to --ifconfig when --dev tun is specified.

                          The default can be specified by leaving an option blank or setting it to "default".

                          The network and gateway parameters can also be specified as a DNS or /etc/hosts file resolvable name, or as one of three special keywords:

                          vpn_gateway -- The remote VPN endpoint address (derived either from --route-gateway or the second parameter to --ifconfig when --dev tun is specified).

                          net_gateway -- The pre-existing IP default gateway, read from the routing table (not supported on all OSes).

                          remote_host -- The --remote address if OpenVPN is being run in client mode, and is undefined in server mode.

                          Make sure that you dont overlap the route with the current subnet you're on..
                          I think the above example wont work because the 10.0.0.0/21 subnet contains the 10.0.3.0/24 subnet on which the example-client is.

                          We do what we must, because we can.

                          Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

                          1 Reply Last reply Reply Quote 0
                          • S
                            Seth
                            last edited by

                            Solved.

                            I was adding routes to server side not the client.  Once route added to client side pfsense OpenVPN client it started to work as expected.

                            Thanks GruensFroeschli for your help

                            –Seth

                            1 Reply Last reply Reply Quote 0
                            • First post
                              Last post
                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.