PKI Site to Site does not work
-
First, I presume that the common names for your two client are different and are not both "xxpf-01" as indicated. If the CN for both clients are indeed the same, it will cause problems with your client-specific options (and therefore, could cause your routing issue).
Have you allowed all traffic on your OpenVPN interface or do you some traffic blocked? If you haven't specified anything on the interface, traffic will be blocked by default.
NetBIOS names will not propagate a routed OpenVPN network (or any routed network for that matter). NetBIOS name resolution require broadcasts to function and broadcasts won't cross networks. Your two options to get NetBIOS name resolution to work are:
1) Setup a WINS server and point all clients towards it.
2) Use a bridged OpenVPN setup instead of a routed setup. -
In the server custom config:
Custom options should be:
route 172.17.1.0 255.255.255.0;route 172.17.2.0 255.255.255.0;push "route 192.168.0.0 255.255.255.0";push "route 172.17.1.0 255.255.255.0";push "route 172.17.2.0 255.255.255.0";
-
Hello,
First, I presume that the common names for your two client are different and are not both "xxpf-01" as indicated. If the CN for both clients are indeed the same, it will cause problems with your client-specific options (and therefore, could cause your routing issue).
Yes, it was a typo. "01" is "01" and "02" is "02".
Have you allowed all traffic on your OpenVPN interface or do you some traffic blocked? If you haven't specified anything on the interface, traffic will be blocked by default.
Okay - Now it is getting interesting. Both remote pfSense's are behind a already existing home router. This could be various brand and models. Internet Connection is made with DHCP on both pfSense’s.
In current example xxpf-01 is behind a Fritz.Box and gets IP 192.168.178.42. I see a few blocked connections on xxpf-01 firewall log…
So what do I need to add here? Any tip or hint?
Better go for IPSec with VPN Passthrough enabled on the employee Home Router (Fritz.Box)?
NetBIOS names will not propagate a routed OpenVPN network (or any routed network for that matter). NetBIOS name resolution require broadcasts to function and broadcasts won't cross networks. Your two options to get NetBIOS name resolution to work are:
1) Setup a WINS server and point all clients towards it.
2) Use a bridged OpenVPN setup instead of a routed setup.On main site there is a WINS server running. I presume adding the option to OpenVPN Server should do the trick.
Regards,
Alexander -
Hello,
In the server custom config:
Custom options should be:
route 172.17.1.0 255.255.255.0;route 172.17.2.0 255.255.255.0;push "route 192.168.0.0 255.255.255.0";push "route 172.17.1.0 255.255.255.0";push "route 172.17.2.0 255.255.255.0";
Thank you. But I think, I am lost with the router / router setup mentioned in my reply above :(
-
Without the options I mentioned, the two remote sites will never be able to talk to each others' subnets. I'd consider that a more urgent thing to fix.
The other should be solved by setting a WINS server on the workstations that points to your existing WINS server. Note that this won't propagate to pfSense via OpenVPN, you'll need to set it in your DHCP server settings, or hardcode it on the workstations.
-
Without the options I mentioned, the two remote sites will never be able to talk to each others' subnets. I'd consider that a more urgent thing to fix.
The other should be solved by setting a WINS server on the workstations that points to your existing WINS server. Note that this won't propagate to pfSense via OpenVPN, you'll need to set it in your DHCP server settings, or hardcode it on the workstations.
Yes - you are right… and I am not wasting my time with WINS nor NetBIOS. I would like to see those clients to able to speak to each other first. The rest I would consider as nice to have...
I already added your route to the server config but it seems that I still struggle somehow. When I try to ping from 172.17.2.0/24 network (actually 172.17.2.248), I do get this:
C:\Windows\System32>ping 172.17.1.1
Ping wird ausgeführt für 172.17.1.1 mit 32 Bytes Daten:
Antwort von 188.109.240.1: Zielnetz nicht erreichbar.
Antwort von 188.109.240.1: Zielnetz nicht erreichbar.
Antwort von 188.109.240.1: Zielnetz nicht erreichbar.
Antwort von 188.109.240.1: Zielnetz nicht erreichbar.Ping-Statistik für 172.17.1.1:
Pakete: Gesendet = 4, Empfangen = 4, Verloren = 0
(0% Verlust),C:\Windows\System32>
So where have I lost something here…. HELP!
-
Before you test from workstations, test from the router console or ssh.
-
Unfortunately the same..
Enter an option: 7
Enter a host name or IP address: 172.17.1.1
PING 172.17.1.1 (172.17.1.1): 56 data bytes
–- 172.17.1.1 ping statistics ---
3 packets transmitted, 0 packets received, 100.0% packet lossPress ENTER to continue.
-
Addition
From Console:
60 bytes from dslb.pools.arcor-ip.net (188.109.240.1): Communication prohibited by filter
Vr HL TOS Len ID Flg off TTL Pro cks Src Dst
4 5 00 5400 dc0f 0 0000 3e 01 ebcb 192.168.71.19 172.17.1.1I realy don't get it….
The connection to the server directly is running well... but remote satellites ???
-
Question:
It seems as if I need to have OpenVPN in bridged mode to get my setup running. I followed this article (http://doc.pfsense.org/index.php/OpenVPN_Bridging) but again -> trapped.In my OpenVPN custom options I added this:
dev tap0; float; server-bridge 192.168.0.1 255.255.255.0 192.168.0.160 192.168.0.199
Unfortunately this does not work, I get this error message:
openvpn[4446]: Options error: –server and --server-bridge cannot be used together
Are there any other ways to get this up and running? I read sth. about the ashahi package. Could this be my solution?
Regards,
Alexander
