Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    [SOLVED] Site-to-Site routing bug?

    Scheduled Pinned Locked Moved OpenVPN
    13 Posts 4 Posters 8.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • N
      Nachtfalke
      last edited by

      Hi,

      didn't read the entire post but if you "push" a route to the client than you do not need to add the same route on the client config.

      1 Reply Last reply Reply Quote 0
      • M
        Mattofsweden
        last edited by

        @Nachtfalke:

        Hi,

        didn't read the entire post but if you "push" a route to the client than you do not need to add the same route on the client config.

        Push has been tested as stated in OP. If I remember correctly, push route does not work on PeerToPeer. Think I read it in the forums.

        Also, routes added in remote network/local network fields should be pushed automatically and not have to be entered in Advanced config, me thinks.

        Regards,
        Mattias

        IT Teacher & Networking Consultant

        1 Reply Last reply Reply Quote 0
        • C
          chrismsnz
          last edited by

          Hi,

          I'm running into this exact same problem.

          I had a working OpenVPN connection with pfSense 2 BETA 4. I upgraded to pfSense2 final release and it completely broke this site-to-site VPN.

          The client was TomatoVPN, but having a pfSense router on the client end does not make a difference so there is definitely something up with pfSense 2.0's site-to-site OpenVPN configuration. Not only that but it's a bug that's been introduced in the later part of the release cycle.

          If we don't hear anything from them I'll file a bug, but this is affecting production systems so the immediate fix for me is going to be replacing the broken OpenVPN connection with an IPSec so I'm not sure how much testing I'd be able to do, but by the sounds of things it seems pretty easily reproducible.

          Matt, did you find a work around to make this work in the short term? Open to any hacks to get it working! :D

          Cheers,
          Chris.

          EDIT: I'll just quickly describe the symptoms. The VPN client can access any system in the remote network, but the local network can not access systems on the remote network. Systems on the remote network are unable to contact systems on the local network. This implies to me that the routing issue is on the VPN server and is not correctly routing communication from the remote network to the local network.

          EDIT 2: Looks like there was a openvpn routing issue reported against pfSense 2 RC1 but the ticket was rejected on the grounds of User Error. http://redmine.pfsense.com/issues/1483 There isn't really enough info in the ticket to decide if it's the same issue but looks pretty similar to me.

          1 Reply Last reply Reply Quote 0
          • C
            chrismsnz
            last edited by

            I've replaced my OpenVPN connection with a site-to-site IPSec VPN.

            I recommend that you do the same if you're having issues with OpenVPN, especially if it's pfSense to pfSense on both sides.

            1 Reply Last reply Reply Quote 0
            • jimpJ
              jimp Rebel Alliance Developer Netgate
              last edited by

              There are no problems with a properly configured OpenVPN tunnel. There are people running in production with all kinds of setups between pfSense and other pfSense, as well as Tomato/WRT/Linux/BSD/etc. If there is a problem it is almost certainly a configuration issue.

              Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

              Need help fast? Netgate Global Support!

              Do not Chat/PM for help!

              1 Reply Last reply Reply Quote 0
              • M
                Mattofsweden
                last edited by

                @jimp:

                There are no problems with a properly configured OpenVPN tunnel. There are people running in production with all kinds of setups between pfSense and other pfSense, as well as Tomato/WRT/Linux/BSD/etc. If there is a problem it is almost certainly a configuration issue.

                My configuration is posted above, in plain text below. I for sure can not find any reason why this ain't working. The routing table doesn't get updated with anything other than the tunnel itself. What about the errors in OpenVPN log? They look weird. I have tried with both live systems and virtual systems and experience the exact same problem, so it's quickly reproducible.

                SERVER CONFIG

                dev ovpns1
dev-type tun
dev-node /dev/tun1
writepid /var/run/openvpn_server1.pid
#user nobody
#group nobody
script-security 3
daemon
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
proto udp
cipher AES-128-CBC
up /usr/local/sbin/ovpn-linkup
down /usr/local/sbin/ovpn-linkdown
local 192.168.31.10
ifconfig 192.168.200.1 192.168.200.2
lport 1194
management /var/etc/openvpn/server1.sock unix
push "route 192.168.201.0 255.255.255.0"
route 192.168.202.0 255.255.255.0
secret /var/etc/openvpn/server1.secret 
comp-lzo
route 192.168.202.0 255.255.255.0
 push "route 192.168.201.0 255.255.255.0"

                CLIENT CONFIG

                dev ovpnc1
dev-type tun
dev-node /dev/tun1
writepid /var/run/openvpn_client1.pid
#user nobody
#group nobody
script-security 3
daemon
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
proto udp
cipher AES-128-CBC
up /usr/local/sbin/ovpn-linkup
down /usr/local/sbin/ovpn-linkdown
local 192.168.31.11
lport 0
management /var/etc/openvpn/client1.sock unix
remote 192.168.31.10 1194
ifconfig 192.168.200.2 192.168.200.1
route 192.168.201.0 255.255.255.0
secret /var/etc/openvpn/client1.secret 
comp-lzo

                Regards,
                Mattias

                IT Teacher & Networking Consultant

                1 Reply Last reply Reply Quote 0
                • jimpJ
                  jimp Rebel Alliance Developer Netgate
                  last edited by

                  Routing errors suggest the routes already exist. There may be something else on your system (like an IPsec tunnel that isn't disabled) grabbing the traffic or making things complicated. If the racoon service is started, stop it and make sure any tunnels that overlap the subnets are disabled.

                  Showing the complete contents of your routing table on both sides with OpenVPN stopped and started might shed some light on the situation.

                  The route made by the 'remote network' box is all you need in shared key mode since you can't push routes in that setup.

                  Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                  Need help fast? Netgate Global Support!

                  Do not Chat/PM for help!

                  1 Reply Last reply Reply Quote 0
                  • M
                    Mattofsweden
                    last edited by

                    @jimp:

                    Routing errors suggest the routes already exist. There may be something else on your system (like an IPsec tunnel that isn't disabled) grabbing the traffic or making things complicated. If the racoon service is started, stop it and make sure any tunnels that overlap the subnets are disabled.

                    Showing the complete contents of your routing table on both sides with OpenVPN stopped and started might shed some light on the situation.

                    The route made by the 'remote network' box is all you need in shared key mode since you can't push routes in that setup.

                    These are freshly installed virtual machines for the sole purpose of trying to reproduce the problem I've encountered on my live system.

                    What's done.
                    Installed two virtual machines on VMWare Workstation.

                    PFSenseServer renamed to PFSense server, WAN and LAN IP addresses setup, Firewall Rule to accept incoming connections on WLAN on Port 1194, certificates created (which ain't needed in Shared Keys, but did it anyways) and OpenVPN Server setup according to configuration below.

                    PFSense Client renamed to PFSense1, WAN and LAN IP addresses setup, OpenVPN client settings configured. Nothing else.

                    Removed the advanced configuration options (that replicated a push route already done in the basic setup from what I gather by the configs) and this is what I have.

                    =======NET INFO==========

                    PFSense Server
                    Name: pfsenseserver.testing
                    WAN: 192.168.31.10/24
                    LAN: 192.168.201.101/24

                    PFSense Client1
                    Name: pfsense1.testing
                    WAN: 192.168.31.11/24
                    LAN: 192.168.202.101/24
                    =========END OF NET INFO =========

                    ========== OpenVPN CONFIGURATIONS ===========

                    PFSense Server OpenVPN Config

                    dev ovpns1
dev-type tun
dev-node /dev/tun1
writepid /var/run/openvpn_server1.pid
#user nobody
#group nobody
script-security 3
daemon
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
proto udp
cipher AES-128-CBC
up /usr/local/sbin/ovpn-linkup
down /usr/local/sbin/ovpn-linkdown
local 192.168.31.10
ifconfig 192.168.200.1 192.168.200.2
lport 1194
management /var/etc/openvpn/server1.sock unix
push "route 192.168.201.0 255.255.255.0"
route 192.168.202.0 255.255.255.0
secret /var/etc/openvpn/server1.secret 
comp-lzo

                    PFSense Client Config

                    dev ovpnc1
dev-type tun
dev-node /dev/tun1
writepid /var/run/openvpn_client1.pid
#user nobody
#group nobody
script-security 3
daemon
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
proto udp
cipher AES-128-CBC
up /usr/local/sbin/ovpn-linkup
down /usr/local/sbin/ovpn-linkdown
local 192.168.31.11
lport 0
management /var/etc/openvpn/client1.sock unix
remote 192.168.31.10 1194
ifconfig 192.168.200.2 192.168.200.1
route 192.168.201.0 255.255.255.0
secret /var/etc/openvpn/client1.secret 
comp-lzo

                    ==========END OF OpenVPN CONFIGURATION==========

                    ========== OpenVPN LOGS============

                    PFSense Server Log

                    Nov 16 08:59:47	openvpn[31991]: OpenVPN 2.2.0 amd64-portbld-freebsd8.1 [SSL] [LZO2] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Aug 11 2011
Nov 16 08:59:47	openvpn[31991]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Nov 16 08:59:47	openvpn[31991]: LZO compression initialized
Nov 16 08:59:47	openvpn[31991]: TUN/TAP device /dev/tun1 opened
Nov 16 08:59:47	openvpn[31991]: do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Nov 16 08:59:47	openvpn[31991]: /sbin/ifconfig ovpns1 192.168.200.1 192.168.200.2 mtu 1500 netmask 255.255.255.255 up
Nov 16 08:59:47	openvpn[31991]: /usr/local/sbin/ovpn-linkup ovpns1 1500 1561 192.168.200.1 192.168.200.2 init
Nov 16 08:59:48	openvpn[31991]: ERROR: FreeBSD route add command failed: external program exited with error status: 1
Nov 16 08:59:48	openvpn[34443]: UDPv4 link local (bound): [AF_INET]192.168.31.10:1194
Nov 16 08:59:48	openvpn[34443]: UDPv4 link remote: [undef]
Nov 16 09:00:01	openvpn[34443]: Peer Connection Initiated with [AF_INET]192.168.31.11:53650
Nov 16 09:00:02	openvpn[34443]: Initialization Sequence Completed

                    PFSense Client Log

                    Nov 16 09:00:01	openvpn[51494]: OpenVPN 2.2.0 amd64-portbld-freebsd8.1 [SSL] [LZO2] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Aug 11 2011
Nov 16 09:00:01	openvpn[51494]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Nov 16 09:00:01	openvpn[51494]: LZO compression initialized
Nov 16 09:00:01	openvpn[51494]: TUN/TAP device /dev/tun1 opened
Nov 16 09:00:01	openvpn[51494]: do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Nov 16 09:00:01	openvpn[51494]: /sbin/ifconfig ovpnc1 192.168.200.2 192.168.200.1 mtu 1500 netmask 255.255.255.255 up
Nov 16 09:00:01	openvpn[51494]: /usr/local/sbin/ovpn-linkup ovpnc1 1500 1561 192.168.200.2 192.168.200.1 init
Nov 16 09:00:01	openvpn[51494]: ERROR: FreeBSD route add command failed: external program exited with error status: 1
Nov 16 09:00:01	openvpn[52188]: UDPv4 link local (bound): [AF_INET]192.168.31.11
Nov 16 09:00:01	openvpn[52188]: UDPv4 link remote: [AF_INET]192.168.31.10:1194
Nov 16 09:00:08	openvpn[52188]: Peer Connection Initiated with [AF_INET]192.168.31.10:1194
Nov 16 09:00:08	openvpn[52188]: Initialization Sequence Completed

                    **=========== END OF OpenVPN LOGS =============

                    ================ INTERFACES ================

                    PFSense Server Interfaces Setup**

                    $ ifconfig
em0: flags=8843 <up,broadcast,running,simplex,multicast>metric 0 mtu 1500
	options=9b <rxcsum,txcsum,vlan_mtu,vlan_hwtagging,vlan_hwcsum>ether 00:0c:29:77:46:47
	inet6 fe80::20c:29ff:fe77:4647%em0 prefixlen 64 scopeid 0x1 
	inet 192.168.31.10 netmask 0xffffff00 broadcast 192.168.31.255
	nd6 options=3 <performnud,accept_rtadv>media: Ethernet autoselect (1000baseT <full-duplex>)
	status: active
em1: flags=8843 <up,broadcast,running,simplex,multicast>metric 0 mtu 1500
	options=9b <rxcsum,txcsum,vlan_mtu,vlan_hwtagging,vlan_hwcsum>ether 00:0c:29:77:46:51
	inet6 fe80::20c:29ff:fe77:4651%em1 prefixlen 64 scopeid 0x2 
	inet 192.168.201.101 netmask 0xffffff00 broadcast 192.168.201.255
	inet 192.168.32.1 netmask 0xffffff00 broadcast 192.168.32.255
	inet 192.168.33.1 netmask 0xffffff00 broadcast 192.168.33.255
	nd6 options=3 <performnud,accept_rtadv>media: Ethernet autoselect (1000baseT <full-duplex>)
	status: active
plip0: flags=8810 <pointopoint,simplex,multicast>metric 0 mtu 1500
pflog0: flags=100 <promisc>metric 0 mtu 33664
pfsync0: flags=0<> metric 0 mtu 1460
	syncpeer: 224.0.0.240 maxupd: 128 syncok: 1
enc0: flags=0<> metric 0 mtu 1536
lo0: flags=8049 <up,loopback,running,multicast>metric 0 mtu 16384
	options=3 <rxcsum,txcsum>inet 127.0.0.1 netmask 0xff000000 
	inet6 ::1 prefixlen 128 
	inet6 fe80::1%lo0 prefixlen 64 scopeid 0x7 
	nd6 options=3 <performnud,accept_rtadv>ovpns1: flags=8843 <up,broadcast,running,simplex,multicast>metric 0 mtu 1500
	options=80000 <linkstate>ether 00:bd:3f:fe:06:01
	inet6 fe80::2bd:3fff:fefe:601%ovpns1 prefixlen 64 scopeid 0x8 
	inet 192.168.200.1 netmask 0xffffffff broadcast 192.168.200.2
	nd6 options=3 <performnud,accept_rtadv>tun1: flags=8010 <pointopoint,multicast>metric 0 mtu 1500
	options=80000 <linkstate>Opened by PID 31991</linkstate></pointopoint,multicast></performnud,accept_rtadv></linkstate></up,broadcast,running,simplex,multicast></performnud,accept_rtadv></rxcsum,txcsum></up,loopback,running,multicast></promisc></pointopoint,simplex,multicast></full-duplex></performnud,accept_rtadv></rxcsum,txcsum,vlan_mtu,vlan_hwtagging,vlan_hwcsum></up,broadcast,running,simplex,multicast></full-duplex></performnud,accept_rtadv></rxcsum,txcsum,vlan_mtu,vlan_hwtagging,vlan_hwcsum></up,broadcast,running,simplex,multicast>

                    PFSense Client Interfaces Config

                    $ ifconfig
em0: flags=8843 <up,broadcast,running,simplex,multicast>metric 0 mtu 1500
	options=9b <rxcsum,txcsum,vlan_mtu,vlan_hwtagging,vlan_hwcsum>ether 00:0c:29:1e:85:6e
	inet6 fe80::20c:29ff:fe1e:856e%em0 prefixlen 64 scopeid 0x1 
	inet 192.168.31.11 netmask 0xffffff00 broadcast 192.168.31.255
	inet 192.168.202.1 netmask 0xffffff00 broadcast 192.168.202.255
	nd6 options=3 <performnud,accept_rtadv>media: Ethernet autoselect (1000baseT <full-duplex>)
	status: active
em1: flags=8843 <up,broadcast,running,simplex,multicast>metric 0 mtu 1500
	options=9b <rxcsum,txcsum,vlan_mtu,vlan_hwtagging,vlan_hwcsum>ether 00:0c:29:1e:85:78
	inet6 fe80::20c:29ff:fe1e:8578%em1 prefixlen 64 scopeid 0x2 
	inet 192.168.202.101 netmask 0xffffff00 broadcast 192.168.202.255
	nd6 options=3 <performnud,accept_rtadv>media: Ethernet autoselect (1000baseT <full-duplex>)
	status: active
plip0: flags=8810 <pointopoint,simplex,multicast>metric 0 mtu 1500
lo0: flags=8049 <up,loopback,running,multicast>metric 0 mtu 16384
	options=3 <rxcsum,txcsum>inet 127.0.0.1 netmask 0xff000000 
	inet6 ::1 prefixlen 128 
	inet6 fe80::1%lo0 prefixlen 64 scopeid 0x4 
	nd6 options=3 <performnud,accept_rtadv>pflog0: flags=100 <promisc>metric 0 mtu 33664
pfsync0: flags=0<> metric 0 mtu 1460
	syncpeer: 224.0.0.240 maxupd: 128 syncok: 1
enc0: flags=0<> metric 0 mtu 1536
ovpnc1: flags=8843 <up,broadcast,running,simplex,multicast>metric 0 mtu 1500
	options=80000 <linkstate>ether 00:bd:f9:03:00:01
	inet6 fe80::2bd:f9ff:fe03:1%ovpnc1 prefixlen 64 scopeid 0x8 
	inet 192.168.200.2 netmask 0xffffffff broadcast 192.168.200.1
	nd6 options=3 <performnud,accept_rtadv>tun1: flags=8010 <pointopoint,multicast>metric 0 mtu 1500
	options=80000 <linkstate>Opened by PID 51494</linkstate></pointopoint,multicast></performnud,accept_rtadv></linkstate></up,broadcast,running,simplex,multicast></promisc></performnud,accept_rtadv></rxcsum,txcsum></up,loopback,running,multicast></pointopoint,simplex,multicast></full-duplex></performnud,accept_rtadv></rxcsum,txcsum,vlan_mtu,vlan_hwtagging,vlan_hwcsum></up,broadcast,running,simplex,multicast></full-duplex></performnud,accept_rtadv></rxcsum,txcsum,vlan_mtu,vlan_hwtagging,vlan_hwcsum></up,broadcast,running,simplex,multicast>

                    **============= END OF INTERFACES CONFIG ===========

                    ============== ROUTING TABLES ================

                    PSSense Server Routing Table**

                    $ netstat -r
Routing tables

Internet:
Destination        Gateway            Flags    Refs      Use  Netif Expire
default            192.168.31.2       UGS         0      221    em0
localhost          link#7             UH          0      294    lo0
192.168.31.0       link#1             U           0    15006    em0
192.168.31.10      link#1             UHS         0        0    lo0
192.168.32.0       link#2             U           0        0    em1
192.168.32.1       link#2             UHS         0        0    lo0
192.168.33.0       link#2             U           0        0    em1
192.168.33.1       link#2             UHS         0        0    lo0
192.168.200.1      link#8             UHS         0        0    lo0 =>
192.168.200.1/32   link#8             U           0        0 ovpns1
192.168.201.0      link#2             U           0        0    em1
pfsenseserver      link#2             UHS         0        0    lo0

Internet6:
Destination        Gateway            Flags      Netif Expire
::1                ::1                UH          lo0
fe80::%em0         link#1             U           em0
fe80::20c:29ff:fe7 link#1             UHS         lo0
fe80::%em1         link#2             U           em1
fe80::20c:29ff:fe7 link#2             UHS         lo0
fe80::%lo0         link#7             U           lo0
fe80::1%lo0        link#7             UHS         lo0
fe80::2bd:3fff:fef link#8             UHS         lo0
ff01:1::           fe80::20c:29ff:fe7 U           em0
ff01:2::           fe80::20c:29ff:fe7 U           em1
ff01:7::           ::1                U           lo0
ff01:8::           fe80::2bd:3fff:fef U        ovpns1
ff02::%em0         fe80::20c:29ff:fe7 U           em0
ff02::%em1         fe80::20c:29ff:fe7 U           em1
ff02::%lo0         ::1                U           lo0
ff02::%ovpns1      fe80::2bd:3fff:fef U        ovpns1

                    PFSense Client Routing Table

                    $ netstat -r
Routing tables

Internet:
Destination        Gateway            Flags    Refs      Use  Netif Expire
localhost              link#4             UH          0       49     lo0
192.168.31.0        link#1             U            0    13467  em0
192.168.31.11      link#1             UHS        0        0     lo0
192.168.200.2      link#8             UHS        0        0     lo0 =>
192.168.200.2/32 link#8             U           0        0      ovpnc1
192.168.202.0      link#1             U           0        0      em0
192.168.202.1      link#1             UHS         0        0    lo0
pfsense1              link#2             UHS         0        0    lo0

Internet6:
Destination        Gateway            Flags      Netif Expire
::1                          ::1              UH           lo0
fe80::%em0         link#1             U           em0
fe80::20c:29ff:fe1 link#1             UHS         lo0
fe80::%em1         link#2             U           em1
fe80::20c:29ff:fe1 link#2             UHS         lo0
fe80::%lo0            link#4             U           lo0
fe80::1%lo0          link#4             UHS         lo0
fe80::2bd:f9ff:fe0   link#8             UHS         lo0
ff01:1::           fe80::20c:29ff:fe1  U           em0
ff01:2::           fe80::20c:29ff:fe1  U           em1
ff01:4::           ::1                         U           lo0
ff01:8::           fe80::2bd:f9ff:fe0    U         ovpnc1
ff02::%em0     fe80::20c:29ff:fe1   U           em0
ff02::%em1     fe80::20c:29ff:fe1   U           em1
ff02::%lo0                ::1                U                lo0
ff02::%ovpnc1      fe80::2bd:f9ff:fe0 U        ovpnc1 

                    Regards,
                    Mattias

                    IT Teacher & Networking Consultant

                    1 Reply Last reply Reply Quote 0
                    • jimpJ
                      jimp Rebel Alliance Developer Netgate
                      last edited by

                      On both of those VMs you have IPs from the same subnets on two NICs. That is not a valid config.

                      Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                      Need help fast? Netgate Global Support!

                      Do not Chat/PM for help!

                      1 Reply Last reply Reply Quote 0
                      • M
                        Mattofsweden
                        last edited by

                        @jimp:

                        On both of those VMs you have IPs from the same subnets on two NICs. That is not a valid config.

                        Bugger. Very sorry for wasting some time. Forgot I added virtual IP's to test out some VPN complexity when I installed them. All day I've been at my students saying small mistakes cause huge problems and I myself did the same :) Helps having a pair of eyes.

                        All right. So, I've removed those darn VIP's and am back to basics. Unfortunately I'm still encountering the same problem :/ Routes does not appear and error in OpenVPN Log.

                        I've done yet another full run down, instead of referring to previous post, so we're not mixing up old info with new info and vice versa.

                        =======NET INFO==========

                        PFSense Server
                        Name: pfsenseserver.testing
                        WAN: 192.168.31.10/24
                        LAN: 192.168.201.101/24

                        PFSense Client1
                        Name: pfsense1.testing
                        WAN: 192.168.31.11/24
                        LAN: 192.168.202.101/24
                        =========END OF NET INFO =========

                        ========== OpenVPN CONFIGURATIONS ===========

                        PFSense Server OpenVPN Config

                        dev ovpns1
dev-type tun
dev-node /dev/tun1
writepid /var/run/openvpn_server1.pid
#user nobody
#group nobody
script-security 3
daemon
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
proto udp
cipher AES-128-CBC
up /usr/local/sbin/ovpn-linkup
down /usr/local/sbin/ovpn-linkdown
local 192.168.31.10
ifconfig 192.168.200.1 192.168.200.2
lport 1194
management /var/etc/openvpn/server1.sock unix
push "route 192.168.201.0 255.255.255.0"
route 192.168.202.0 255.255.255.0
secret /var/etc/openvpn/server1.secret 
comp-lzo

                        PFSense Client Config

                        dev ovpnc1
dev-type tun
dev-node /dev/tun1
writepid /var/run/openvpn_client1.pid
#user nobody
#group nobody
script-security 3
daemon
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
proto udp
cipher AES-128-CBC
up /usr/local/sbin/ovpn-linkup
down /usr/local/sbin/ovpn-linkdown
local 192.168.31.11
lport 0
management /var/etc/openvpn/client1.sock unix
remote 192.168.31.10 1194
ifconfig 192.168.200.2 192.168.200.1
route 192.168.201.0 255.255.255.0
secret /var/etc/openvpn/client1.secret 
comp-lzo

                        ==========END OF OpenVPN CONFIGURATION==========

                        ========== OpenVPN LOGS============

                        PFSense Server Log

                        Nov 16 19:54:15	openvpn[14901]: OpenVPN 2.2.0 amd64-portbld-freebsd8.1 [SSL] [LZO2] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Aug 11 2011
Nov 16 19:54:15	openvpn[14901]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Nov 16 19:54:15	openvpn[14901]: LZO compression initialized
Nov 16 19:54:15	openvpn[14901]: TUN/TAP device /dev/tun1 opened
Nov 16 19:54:15	openvpn[14901]: do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Nov 16 19:54:15	openvpn[14901]: /sbin/ifconfig ovpns1 192.168.200.1 192.168.200.2 mtu 1500 netmask 255.255.255.255 up
Nov 16 19:54:15	openvpn[14901]: /usr/local/sbin/ovpn-linkup ovpns1 1500 1561 192.168.200.1 192.168.200.2 init
Nov 16 19:54:15	openvpn[14901]: ERROR: FreeBSD route add command failed: external program exited with error status: 1
Nov 16 19:54:15	openvpn[17070]: UDPv4 link local (bound): [AF_INET]192.168.31.10:1194
Nov 16 19:54:15	openvpn[17070]: UDPv4 link remote: [undef]
Nov 16 19:54:38	openvpn[17070]: Peer Connection Initiated with [AF_INET]192.168.31.11:31082
Nov 16 19:54:39	openvpn[17070]: Initialization Sequence Completed

                        PFSense Client Log

                        Nov 16 19:54:38	openvpn[6663]: OpenVPN 2.2.0 amd64-portbld-freebsd8.1 [SSL] [LZO2] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Aug 11 2011
Nov 16 19:54:38	openvpn[6663]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Nov 16 19:54:38	openvpn[6663]: LZO compression initialized
Nov 16 19:54:38	openvpn[6663]: TUN/TAP device /dev/tun1 opened
Nov 16 19:54:38	openvpn[6663]: do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Nov 16 19:54:38	openvpn[6663]: /sbin/ifconfig ovpnc1 192.168.200.2 192.168.200.1 mtu 1500 netmask 255.255.255.255 up
Nov 16 19:54:38	openvpn[6663]: /usr/local/sbin/ovpn-linkup ovpnc1 1500 1561 192.168.200.2 192.168.200.1 init
Nov 16 19:54:38	openvpn[6663]: ERROR: FreeBSD route add command failed: external program exited with error status: 1
Nov 16 19:54:38	openvpn[7945]: UDPv4 link local (bound): [AF_INET]192.168.31.11
Nov 16 19:54:38	openvpn[7945]: UDPv4 link remote: [AF_INET]192.168.31.10:1194
Nov 16 19:54:46	openvpn[7945]: Peer Connection Initiated with [AF_INET]192.168.31.10:1194
Nov 16 19:54:46	openvpn[7945]: Initialization Sequence Completed

                        **=========== END OF OpenVPN LOGS =============

                        ================ INTERFACES ================

                        PFSense Server Interfaces Setup**

                        $ ifconfig
em0: flags=8843 <up,broadcast,running,simplex,multicast>metric 0 mtu 1500
	options=9b <rxcsum,txcsum,vlan_mtu,vlan_hwtagging,vlan_hwcsum>ether 00:0c:29:77:46:47
	inet6 fe80::20c:29ff:fe77:4647%em0 prefixlen 64 scopeid 0x1 
	inet 192.168.31.10 netmask 0xffffff00 broadcast 192.168.31.255
	nd6 options=3 <performnud,accept_rtadv>media: Ethernet autoselect (1000baseT <full-duplex>)
	status: active
em1: flags=8843 <up,broadcast,running,simplex,multicast>metric 0 mtu 1500
	options=9b <rxcsum,txcsum,vlan_mtu,vlan_hwtagging,vlan_hwcsum>ether 00:0c:29:77:46:51
	inet6 fe80::20c:29ff:fe77:4651%em1 prefixlen 64 scopeid 0x2 
	inet 192.168.201.101 netmask 0xffffff00 broadcast 192.168.201.255
	nd6 options=3 <performnud,accept_rtadv>media: Ethernet autoselect (1000baseT <full-duplex>)
	status: active
plip0: flags=8810 <pointopoint,simplex,multicast>metric 0 mtu 1500
pflog0: flags=100 <promisc>metric 0 mtu 33664
pfsync0: flags=0<> metric 0 mtu 1460
	syncpeer: 224.0.0.240 maxupd: 128 syncok: 1
enc0: flags=0<> metric 0 mtu 1536
lo0: flags=8049 <up,loopback,running,multicast>metric 0 mtu 16384
	options=3 <rxcsum,txcsum>inet 127.0.0.1 netmask 0xff000000 
	inet6 ::1 prefixlen 128 
	inet6 fe80::1%lo0 prefixlen 64 scopeid 0x7 
	nd6 options=3 <performnud,accept_rtadv>ovpns1: flags=8843 <up,broadcast,running,simplex,multicast>metric 0 mtu 1500
	options=80000 <linkstate>ether 00:bd:3f:fe:06:01
	inet6 fe80::2bd:3fff:fefe:601%ovpns1 prefixlen 64 scopeid 0x8 
	inet 192.168.200.1 netmask 0xffffffff broadcast 192.168.200.2
	nd6 options=3 <performnud,accept_rtadv>tun1: flags=8010 <pointopoint,multicast>metric 0 mtu 1500
	options=80000 <linkstate>Opened by PID 14901</linkstate></pointopoint,multicast></performnud,accept_rtadv></linkstate></up,broadcast,running,simplex,multicast></performnud,accept_rtadv></rxcsum,txcsum></up,loopback,running,multicast></promisc></pointopoint,simplex,multicast></full-duplex></performnud,accept_rtadv></rxcsum,txcsum,vlan_mtu,vlan_hwtagging,vlan_hwcsum></up,broadcast,running,simplex,multicast></full-duplex></performnud,accept_rtadv></rxcsum,txcsum,vlan_mtu,vlan_hwtagging,vlan_hwcsum></up,broadcast,running,simplex,multicast>

                        PFSense Client Interfaces Config

                        $ ifconfig
em0: flags=8843 <up,broadcast,running,simplex,multicast>metric 0 mtu 1500
	options=9b <rxcsum,txcsum,vlan_mtu,vlan_hwtagging,vlan_hwcsum>ether 00:0c:29:1e:85:6e
	inet6 fe80::20c:29ff:fe1e:856e%em0 prefixlen 64 scopeid 0x1 
	inet 192.168.31.11 netmask 0xffffff00 broadcast 192.168.31.255
	nd6 options=3 <performnud,accept_rtadv>media: Ethernet autoselect (1000baseT <full-duplex>)
	status: active
em1: flags=8843 <up,broadcast,running,simplex,multicast>metric 0 mtu 1500
	options=9b <rxcsum,txcsum,vlan_mtu,vlan_hwtagging,vlan_hwcsum>ether 00:0c:29:1e:85:78
	inet6 fe80::20c:29ff:fe1e:8578%em1 prefixlen 64 scopeid 0x2 
	inet 192.168.202.101 netmask 0xffffff00 broadcast 192.168.202.255
	nd6 options=3 <performnud,accept_rtadv>media: Ethernet autoselect (1000baseT <full-duplex>)
	status: active
plip0: flags=8810 <pointopoint,simplex,multicast>metric 0 mtu 1500
lo0: flags=8049 <up,loopback,running,multicast>metric 0 mtu 16384
	options=3 <rxcsum,txcsum>inet 127.0.0.1 netmask 0xff000000 
	inet6 ::1 prefixlen 128 
	inet6 fe80::1%lo0 prefixlen 64 scopeid 0x4 
	nd6 options=3 <performnud,accept_rtadv>pflog0: flags=100 <promisc>metric 0 mtu 33664
pfsync0: flags=0<> metric 0 mtu 1460
	syncpeer: 224.0.0.240 maxupd: 128 syncok: 1
enc0: flags=0<> metric 0 mtu 1536
ovpnc1: flags=8843 <up,broadcast,running,simplex,multicast>metric 0 mtu 1500
	options=80000 <linkstate>ether 00:bd:f9:03:00:01
	inet6 fe80::2bd:f9ff:fe03:1%ovpnc1 prefixlen 64 scopeid 0x8 
	inet 192.168.200.2 netmask 0xffffffff broadcast 192.168.200.1
	nd6 options=3 <performnud,accept_rtadv>tun1: flags=8010 <pointopoint,multicast>metric 0 mtu 1500
	options=80000 <linkstate>Opened by PID 6663</linkstate></pointopoint,multicast></performnud,accept_rtadv></linkstate></up,broadcast,running,simplex,multicast></promisc></performnud,accept_rtadv></rxcsum,txcsum></up,loopback,running,multicast></pointopoint,simplex,multicast></full-duplex></performnud,accept_rtadv></rxcsum,txcsum,vlan_mtu,vlan_hwtagging,vlan_hwcsum></up,broadcast,running,simplex,multicast></full-duplex></performnud,accept_rtadv></rxcsum,txcsum,vlan_mtu,vlan_hwtagging,vlan_hwcsum></up,broadcast,running,simplex,multicast>

                        **============= END OF INTERFACES CONFIG ===========

                        ============== ROUTING TABLES ================

                        PSSense Server Routing Table**

                        $ netstat -r
Routing tables

Internet:
Destination        Gateway            Flags    Refs      Use  Netif Expire
default            192.168.31.2       UGS         0      349    em0
localhost          link#7             UH          0      320    lo0
192.168.31.0       link#1             U           0    18466    em0
192.168.31.10      link#1             UHS         0        0    lo0
192.168.200.1      link#8             UHS         0        0    lo0 =>
192.168.200.1/32   link#8             U           0        0 ovpns1
192.168.201.0      link#2             U           0        0    em1
pfsenseserver      link#2             UHS         0        0    lo0

Internet6:
Destination        Gateway            Flags      Netif Expire
::1                ::1                UH          lo0
fe80::%em0         link#1             U           em0
fe80::20c:29ff:fe7 link#1             UHS         lo0
fe80::%em1         link#2             U           em1
fe80::20c:29ff:fe7 link#2             UHS         lo0
fe80::%lo0         link#7             U           lo0
fe80::1%lo0        link#7             UHS         lo0
fe80::2bd:3fff:fef link#8             UHS         lo0
ff01:1::           fe80::20c:29ff:fe7 U           em0
ff01:2::           fe80::20c:29ff:fe7 U           em1
ff01:7::           ::1                U           lo0
ff01:8::           fe80::2bd:3fff:fef U        ovpns1
ff02::%em0         fe80::20c:29ff:fe7 U           em0
ff02::%em1         fe80::20c:29ff:fe7 U           em1
ff02::%lo0         ::1                U           lo0
ff02::%ovpns1      fe80::2bd:3fff:fef U        ovpns1

                        PFSense Client Routing Table

                        $ netstat -r
Routing tables

Internet:
Destination        Gateway            Flags    Refs      Use  Netif Expire
localhost          link#4             UH          0       71    lo0
192.168.31.0       link#1             U           0    19445    em0
192.168.31.11      link#1             UHS         0        0    lo0
192.168.200.2      link#8             UHS         0        0    lo0 =>
192.168.200.2/32   link#8             U           0        0 ovpnc1
pfsense1           link#2             UHS         0        0    lo0

Internet6:
Destination        Gateway            Flags      Netif Expire
::1                ::1                UH          lo0
fe80::%em0         link#1             U           em0
fe80::20c:29ff:fe1 link#1             UHS         lo0
fe80::%em1         link#2             U           em1
fe80::20c:29ff:fe1 link#2             UHS         lo0
fe80::%lo0         link#4             U           lo0
fe80::1%lo0        link#4             UHS         lo0
fe80::2bd:f9ff:fe0 link#8             UHS         lo0
ff01:1::           fe80::20c:29ff:fe1 U           em0
ff01:2::           fe80::20c:29ff:fe1 U           em1
ff01:4::           ::1                U           lo0
ff01:8::           fe80::2bd:f9ff:fe0 U        ovpnc1
ff02::%em0         fe80::20c:29ff:fe1 U           em0
ff02::%em1         fe80::20c:29ff:fe1 U           em1
ff02::%lo0         ::1                U           lo0
ff02::%ovpnc1      fe80::2bd:f9ff:fe0 U        ovpnc1

                        Regards,
                        Mattias

                        IT Teacher & Networking Consultant

                        1 Reply Last reply Reply Quote 0
                        • jimpJ
                          jimp Rebel Alliance Developer Netgate
                          last edited by

                          Also if you switched between tun and tap and back (as it appears you have) you must reboot in between.

                          The openvpn interfaces in tun mode would not have an 'ether' line and the IP config wouldn't look like that.

                          Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                          Need help fast? Netgate Global Support!

                          Do not Chat/PM for help!

                          1 Reply Last reply Reply Quote 0
                          • M
                            Mattofsweden
                            last edited by

                            @jimp:

                            Also if you switched between tun and tap and back (as it appears you have) you must reboot in between.

                            The openvpn interfaces in tun mode would not have an 'ether' line and the IP config wouldn't look like that.

                            THANK YOU!!

                            You're absolutely correct. I have switched between tun and tap mode. I was messing about because I initially didn't have the knowledge of which one did what. On the currently deployed Ubuntu Server interfaces config says TAP, but after investigating it's operating in TUN mode. Weird :/

                            Anyways, a reboot solved the issue. I'm so used to not rebooting that I never even considered it on a freshly installed VM.

                            Thanks again.

                            Regards,
                            Mattias

                            IT Teacher & Networking Consultant

                            1 Reply Last reply Reply Quote 0
                            • First post
                              Last post
                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.