OpenVPN: connecting to LAN subnet
-
Hey Folks,
I have built an ESXi box and am running Pfsense as a virtual machine (among others). I followed many guides on setting up OpenVPN and I can connect remotely. However, I cannot reach any LAN resources other than the pfsense router itself. The LAN is on the 10.0.0.0/24 subnet and the OpenVPN connections are on the 10.0.10.0/24 subnet. From a remotely connected client I can ping 10.0.0.1 (pfsense) with an IP of 10.0.10.6 but I can't ping any of my other servers on the 10.0.0.0 subnet.
Is there anything I should check?
Thanks. -
The OpenVPN server needs to push the rout of the LAn subnet to the client.
push "Route 10.0.0.0 255.255.255.0";The Firewall rule on OpenVPN tab must be setup correct.
-
I have the push "route 10.0.0.0 255.255.255.0" created on the server, although I think this is already created through the wizard. There is also a pass firewall rule under the openvpn tab, which was also created with the wizard.
Actually, when I connect the remote client without the "push route…." there are no errors on the OpenVPN client dialog, but when I add it, it says "route addition failed... : the object already exists" and connects successfully. This is why I assumed that PFsense created that route automatically.
-
Didn't use the wizard for that so I had to manually add these routes in my environment.
If the route exists and the firewall rule allows the traffic then there is another problem.Check the firewall on the destination host on LAN subnet - better disable the firewall for testing.
Do you run the OpenVPN client on a Windows 7 machine ? If yes - run it "As administrator". But you probably did that because it added the route.
-
Here is a copy of my route table. I'm not sure if this is right or not.
IPv4
Destination Gateway Netif
default 142.177.. em0
10.0.0.0/24 link#2 em1
10.0.0.1 link#2 lo0
10.0.10.0/24 10.0.10.2 ovpns1
10.0.10.1 link#8 lo0
10.0.10.2 link#8 ovpns1
127.0.0.1 link#4 lo0
142.177../22 link#1 em0
142.177.. link#1 lo0 -
While playing around I found something interesting. As I mentioned pfsense is running as a VM inside an ESXi host. From the VPN connected computer (10.0.10.6) I can ping 10.0.0.1 which is pfsense, but I can also ping 10.0.0.2, which is the esxi host, but none of the machines past that. I just thought this was odd.
-
Some more interesting things:
On a hunch I decided to add a route from one of the devices on the 10.0.0.0 subnet to the 10.0.10.0 subnet to see if that would help. Previously a ping from 10.0.10.6 to 10.0.0.5 (for example) resulted in a request timeout and a ping from 10.0.0.9 to 10.0.10.6 resulted in a destination unreachable reply.So, on my 10.0.0.9 machine I opened a command prompt with the following command: route ADD 10.0.10.0 MASK 255.255.255.0 10.0.0.1 METRIC 266
To my surprise this allowed pings to pass both ways. I'll keep you updated, but I'm not really sure why this would make a difference given the routes already present on the machines. -
Post server config and post client routing table once connected.
A screen shot of the firewall rule from openvpn tab would also be helpful.
-
@KM:
As marvosa said, please post the client routing tabel. On Windows you can find this with "netstat -rn" -
or with```
route print -
This is after a reboot of the machine. The route is gone because I didn't add it as persistent. The default gateway is set as 10.0.0.1 on this machine in the adapter config settings.
route print
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 10.0.0.1 10.0.0.9 266
10.0.0.0 255.0.0.0 On-link 10.0.0.9 266
10.0.0.9 255.255.255.255 On-link 10.0.0.9 266
10.255.255.255 255.255.255.255 On-link 10.0.0.9 266
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 10.0.0.9 266
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 10.0.0.9 266
===========================================================================
Persistent Routes:
Network Address Netmask Gateway Address Metric
0.0.0.0 0.0.0.0 10.0.0.1 Default
=========================================================================== -
This is after OpenVPN client is connected:
IPv4 Route Table
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 10.0.0.1 10.0.0.9 266
10.0.0.0 255.0.0.0 On-link 10.0.0.9 266
10.0.0.0 255.255.255.0 10.0.10.5 10.0.10.6 30
10.0.0.9 255.255.255.255 On-link 10.0.0.9 266
10.0.10.1 255.255.255.255 10.0.10.5 10.0.10.6 30
10.0.10.4 255.255.255.252 On-link 10.0.10.6 286
10.0.10.6 255.255.255.255 On-link 10.0.10.6 286
10.0.10.7 255.255.255.255 On-link 10.0.10.6 286
10.255.255.255 255.255.255.255 On-link 10.0.0.9 266
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 10.0.10.6 286
224.0.0.0 240.0.0.0 On-link 10.0.0.9 266
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 10.0.10.6 286
255.255.255.255 255.255.255.255 On-link 10.0.0.9 266Persistent Routes:
Network Address Netmask Gateway Address Metric
0.0.0.0 0.0.0.0 10.0.0.1 Default -
Please post your tunnel settings. Are you routed or bridged?
-
This line looks like a problem:
10.0.0.0 255.0.0.0 On-link 10.0.0.9 266Your 10.0.0.9 interface (on your server, if I understood the descriptions correctly) is thinking that it is sitting on a 10.0.0.0/8 network. So when it replies to any 10.n.n.n addresses, it will think it can reach them directly on its local LAN. It should be in the 10.0.0.0/24 network. Then it will send packets for 10.0.10.0/24 network addresses to the router.