Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Routing Setup

    Scheduled Pinned Locked Moved Routing and Multi WAN
    22 Posts 3 Posters 5.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • P
      podilarius
      last edited by

      Did you setup a firewall rule in the OpenVPN tab?

      1 Reply Last reply Reply Quote 0
      • M
        medicshelley
        last edited by

        On the client side or the server side. I have been trying a few different rules have had no luck.

        1 Reply Last reply Reply Quote 0
        • H
          heper
          last edited by

          can you ping the tunnel endpoints from both ends using the pfsense webgui (10.87.2.1/24–----------------10.87.2.2/24)

          be sure to fill in the local and remote address' on each site and then check if the correct routes are formed on each site

          server side would need a route TO 10.87.100.0/24 using 10.87.2.2 as router
          client side would need a route  TO 10.87.3.0/24    using 10.87.2.1 as router

          also common problem is people forget to disable windows firewall on the clients causing pings not to work ..... i'm just saying this incase everything is allready fine but that small detail is overlooked ;)

          1 Reply Last reply Reply Quote 0
          • M
            medicshelley
            last edited by

            I'm not able to ping the opposite openvpn interface fro either side.

            Where would I enter the routing?

            WAN 10.3.1.145–------Wan 10.4.1.125
                                                    /                                     
                                                  /                                       
            10.87.3.0/24-------10.87.2.1/24------------------10.87.2.2/24------------------10.87.100.0/24
            1st Lan                    OpenVpn Server Side            Client Side OpenVPN                2nd Lan

            Looking at the tracer it doesnt look like stuff is traveling across the tunnel

            Firewall is disabled ;)

            1 Reply Last reply Reply Quote 0
            • H
              heper
              last edited by

              if you can't ping the tunnel-endpoint and the tunnelnetwork is the same on both ends …. then the tunnel is probably not UP

              check openvpn logs to find out what goes wrong

              1 Reply Last reply Reply Quote 0
              • M
                medicshelley
                last edited by

                Jul 27 03:14:03 openvpn[10240]: Re-using pre-shared static key
                Jul 27 03:14:03 openvpn[10240]: Preserving previous TUN/TAP instance: ovpns1
                Jul 27 03:14:03 openvpn[10240]: Listening for incoming TCP connection on [AF_INET]10.3.1.145:443
                Jul 27 03:14:25 openvpn[10240]: TCP connection established with [AF_INET]10.4.1.125:22000
                Jul 27 03:14:25 openvpn[10240]: TCPv4_SERVER link local (bound): [AF_INET]10.3.1.145:443
                Jul 27 03:14:25 openvpn[10240]: TCPv4_SERVER link remote: [AF_INET]10.4.1.125:22000
                Jul 27 03:14:25 openvpn[10240]: Peer Connection Initiated with [AF_INET]10.4.1.125:22000
                Jul 27 03:14:27 openvpn[10240]: Initialization Sequence Completed

                Looks like its up.

                1 Reply Last reply Reply Quote 0
                • P
                  podilarius
                  last edited by

                  Can you post what rules you put in the openVPN tab in the firewall?

                  1 Reply Last reply Reply Quote 0
                  • M
                    medicshelley
                    last edited by

                    Here is how I have things setup currently I've been playing around with different settings so I'm sure things are fudged.

                    Server

                    Mode Shared Key
                    Protocol TCP
                    device mode tun
                    interface wan
                    port 443
                    tunnel 10.87.2.0/24
                    local network 10.87.3.0/24
                    remote network 10.87.100.0/24

                    Client

                    Mode Shared Key
                    Protocol TCP
                    device mode tun
                    interface wan
                    Server address 10.3.1.145
                    port 443
                    Tunnel 10.87.2.0/24
                    Remote Network  10.87.3.0/24

                    serverwan.png
                    serverwan.png_thumb
                    serverlan.png
                    serverlan.png_thumb
                    servervpn.png
                    servervpn.png_thumb
                    clientlan.png
                    clientlan.png_thumb
                    clientwan.png
                    clientwan.png_thumb
                    clientvpn.png
                    clientvpn.png_thumb

                    1 Reply Last reply Reply Quote 0
                    • M
                      medicshelley
                      last edited by

                      My default router is not the pfsense box Im guessing this might be part of the issue as well

                      1 Reply Last reply Reply Quote 0
                      • P
                        podilarius
                        last edited by

                        In the VPN rule in firewalling, it will not be the WAN net. It is going to be the remote  private subnet. I would do a source any until you know the vpn config is sound.

                        1 Reply Last reply Reply Quote 0
                        • P
                          podilarius
                          last edited by

                          @medicshelley:

                          My default router is not the pfsense box Im guessing this might be part of the issue as well

                          It could be, so you would need to add the route to the remote subnet in your default router to the pfsense box.

                          1 Reply Last reply Reply Quote 0
                          • M
                            medicshelley
                            last edited by

                            Could I make the default router the pfsense box for those 10.87.3/100 lans?

                            1 Reply Last reply Reply Quote 0
                            • P
                              podilarius
                              last edited by

                              If the traffic doesn't have to go in another direction, yes.

                              1 Reply Last reply Reply Quote 0
                              • M
                                medicshelley
                                last edited by

                                I was just playing around and turned off the firewall completely once I did that I was able to ping the opposite ends of the tunnel from both sides from the webgui. I wasn't able to reach the local subs on either end. So this just has to be a routing/rules issue

                                1 Reply Last reply Reply Quote 0
                                • P
                                  podilarius
                                  last edited by

                                  So far that is what it sounds like … but the rule you have is not correct either .. WAN net is only the subnet that you WAN is on and not the internet.

                                  1 Reply Last reply Reply Quote 0
                                  • H
                                    heper
                                    last edited by

                                    also … maybe ... perhaps ... do not use port 443, possibly the pfsense webgui httpd is allready bound to it.

                                    1 Reply Last reply Reply Quote 0
                                    • M
                                      medicshelley
                                      last edited by

                                      I restarted and am now able to ping across to the other sides vpn tunnel and front end of the other lan from the webgui but am unable to ping from a station on those lan's.

                                      1 Reply Last reply Reply Quote 0
                                      • P
                                        podilarius
                                        last edited by

                                        Did you change the OpenVPN firewall allow rule on both sides? Try a reboot on both sides after that. Also check your routing on the remote site to make sure that is not an issue.

                                        1 Reply Last reply Reply Quote 0
                                        • M
                                          medicshelley
                                          last edited by

                                          I'm rebooting on both ends now here are my current rules on both the server and client

                                          lanrules.png
                                          lanrules.png_thumb
                                          vpnrules.png
                                          vpnrules.png_thumb
                                          wanrules.png
                                          wanrules.png_thumb

                                          1 Reply Last reply Reply Quote 0
                                          • P
                                            podilarius
                                            last edited by

                                            Your LAN rule is incorrect. Again WAN address or WAN subnet is not the internet nor either side of the tunnel. Change the source to be any to any on any port to start with. After you have made sure that the connection is working and the routing is correct, then you can limit your rules if you like. Just make sure that you are wary of what you are blocking and please make use of aliases to help you create rules.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.