Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    From roadwarrios to vpn site to site

    Scheduled Pinned Locked Moved OpenVPN
    19 Posts 5 Posters 6.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • X
      XIII
      last edited by

      you will also want to remove your actual public IPs/FQDNs from your examples above.

      -Chris Stutzman
      Sys0:2.0.1: AMD Sempron 140 @2.7 1024M RAM 100GHD
      Sys1:2.0.1: Intel P4 @2.66 1024M RAM 40GHD
      freedns.afraid.org - Free DNS dynamic DNS subdomain and domain hosting.
      Check out the pfSense Wiki

      1 Reply Last reply Reply Quote 0
      • M
        mariofiorentino
        last edited by

        On one pfSense box I have the following OpenVPN configurations:

        As a server for Road Warriors
        Dynamic IP: yes
        Address pool: 10.99.254.0/24
        Local network: 192.168.100.0/24
        Client-to-client VPN: yes
        Cryptography: BF-CBC (128-bit)
        Authentication method: PKI
        CA cert
        Server cert
        Server key
        DH parameters
        TLS
        LZO compression: yes

        As server for Site-To-Site OpenVPN
        Address pool: 10.11.12.0/24
        Remote network: 192.168.200.0/24
        Cryptography: BF-CBC (128-bit)
        Authentication method: Shared key
        Shared key cert
        LZO compression: yes

        My routing issue is:
        From Site 1 I can reach hosts on Site 2 and vice versa.
        From Road Warrior I can reach hosts on Site 1.
        I want to be able to reach hosts in Site 2 from Road Warrior.

        Could you help me ?

        1 Reply Last reply Reply Quote 0
        • Cry HavokC
          Cry Havok
          last edited by

          It would be much, much, easier to help you if you'd provide the information we ask for.

          I'm guessing that Site 2 doesn't know how to route to the Road Warrior LAN.

          1 Reply Last reply Reply Quote 0
          • M
            mariofiorentino
            last edited by

            Yes :) Roadwarriors don't ping site 2

            1 Reply Last reply Reply Quote 0
            • Cry HavokC
              Cry Havok
              last edited by

              I'll say it slightly differently - have you configured the routers at Site 2 so that they know how to route to the Road Warrior subnet? They'll need a static route for 10.99.254.0/24 with a route through the Site 2 OpenVPN server's LAN IP.

              1 Reply Last reply Reply Quote 0
              • J
                joako
                last edited by

                I was told this arrangement isn't possible to have OpenVPN clients to one LAN have their traffic pass through another OpenVPN to another LAN… so I just setup more OpenVPN clients and servers.... it would be nice if each site could only need 1 OpenVPN...but I never got that working!

                1 Reply Last reply Reply Quote 0
                • GruensFroeschliG
                  GruensFroeschli
                  last edited by

                  That's not actually true.
                  I have this exact setup working.

                  It's really a matter of setting up static routes on every router involved, so every devices know where to send traffic to.

                  We do what we must, because we can.

                  Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

                  1 Reply Last reply Reply Quote 0
                  • Cry HavokC
                    Cry Havok
                    last edited by

                    It is perfectly possible - I've done it and I know some folks who have an intra-site VPN that they use daily without problems.

                    As GruensFroeschli said, it's just a matter of getting the routes right.

                    1 Reply Last reply Reply Quote 0
                    • J
                      joako
                      last edited by

                      I don't follow. The site to site openvpn comes up and the routes are setup. I have a client-to-site VPN on the same pfsense and I ass the correct push route statement to the openvpn configuration.

                      Client VPN traffic goes from openvpn to pfsense first hop, but then no further.

                      How could I add a route for this?

                      1 Reply Last reply Reply Quote 0
                      • GruensFroeschliG
                        GruensFroeschli
                        last edited by

                        The other side of the site-to-site knows nothing about the roadwarrior subnet.
                        –>you need a static route to make the roadwarriors known.

                        We do what we must, because we can.

                        Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.