DHCP Relay across IPSEC VPN
-
I'm striking out on this… My setup:
Windows 2008 DHCP Server (192.168.1.6)
2x pfSense (192.168.1.252 & 192.168.1.253, CARP 192.168.1.1)IPSEC VPN
pfSense (192.168.2.1)
ClientI've been banging my head against the wall all morning and I can't for the life of me get the client on the far side of the VPN to pickup a DHCP lease.
Things I've tried:
- Allowing ALL traffic on both sides to pass through the IPSEC tunnel.
- Pinging all involved parties from all other involved parties.
- Relaying directly to 192.168.1.6 from the far side.
- Relaying to 192.168.1.1 (CARP IP) from the far side and then from there to 192.168.1.6.
- Relaying to 192.168.1.252 (local IP) from the far side and then from there to 192.168.1.6.
- Creating static routes as per this
Anyone have any ideas as to what might be going wrong?
-
No one else does this?
-
You want you clients to get a 192.168.1.x address or a 192.168.2.x ???
The second case doesn't make sense … You should use the DHCP server of the pfSense on the clients side to do that. You should ask yourself how Windows 2008 server will know that some particular clients need to have a 192.168.2.x address and the other don't?
You have subnet separation and you should keep it that way, use pfSense DNS forwarder to resolve name on either sides of the VPN. So Windows 2008 will be able to resolve names on the 192.168.2.x side and vice-versa.
I know this doesn't solve your problem, but I think you're trying to implement a solution that won't work with IPSec. I'm not too familiar with OpenVPN so I can't say that it could work with OpenVPN, but I doubt it.
-
I've done this with dedicated lines and 3Com equipment, all you need to do is establish a second dhcp subnet on the windows box and everything works fine. I can't get it to work with pfSense and an IPSEC VPN though.
The DHCP registers that a lease on 192.168.2.x has been given out but that data never makes back to the client and the lease is never confirmed.