Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Trying to get LAN access, can only ping myself

    Scheduled Pinned Locked Moved
    OpenVPN
    6
    28
    10.2k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • johnpozJ
      johnpoz LAYER 8 Global Moderator
      last edited by

      well in your first post you had no route - so no your not going to be able to get to anything on the other side of the tunnel.

      In your second post you did, so that makes sense why its working now, and was not before.

      Why would you trace to my 192.168.1.100 address??? Did I really have to spell out to use an IP on your pfsense lan vs my example ;)

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.7.2, 24.11

      1 Reply Last reply Reply Quote 0
      • A
        ace_ventura
        last edited by

        haha because i was on call at the time and not really paying attention to what i was doing, lol i'm sorry I feel like an idiot.

        I'm guessing its because the client wasn't run as administrator, which is odd since I explicitly told it to the first time.

        just for giggles ill prove myself now LOL

        C:\Users\Mitch>tracert -d 10.0.0.11

        Tracing route to 10.0.0.11 over a maximum of 30 hops

        1    14 ms    10 ms    10 ms  192.168.2.1
          2    11 ms    10 ms    10 ms  10.0.0.11

        Trace complete.

        1 Reply Last reply Reply Quote 0
        • A
          ace_ventura
          last edited by

          Thanks for your help though, much appreciated.

          1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator
            last edited by

            yeah windows 7 needs to run as admin to add the route, but it seems the new beta version of openvpn client has gotten around that?  You could try the new beta 2.3_beta1

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.7.2, 24.11

            1 Reply Last reply Reply Quote 0
            • M
              myke
              last edited by

              Hi,
              Here my conf :

              Client Config

              dev tun
              persist-tun
              persist-key
              proto udp
              cipher BF-CBC
              tls-client
              client
              resolv-retry infinite
              remote 109.6.229.83 1194
              tls-remote Proxiel Server Cert
              auth-user-pass
              pkcs12 doberman-udp-1194.p12
              tls-auth doberman-udp-1194-tls.key 1
              comp-lzo

              Server Settings :
              dev ovpns1
              dev-type tun
              dev-node /dev/tun1
              writepid /var/run/openvpn_server1.pid
              #user nobody
              #group nobody
              script-security 3
              daemon
              keepalive 10 60
              ping-timer-rem
              persist-tun
              persist-key
              proto udp
              cipher BF-CBC
              up /usr/local/sbin/ovpn-linkup
              down /usr/local/sbin/ovpn-linkdown
              local 192.168.1.1
              tls-server
              server 10.0.8.0 255.255.255.0
              client-config-dir /var/etc/openvpn-csc
              username-as-common-name
              auth-user-pass-verify /var/etc/openvpn/server1.php via-env
              tls-verify /var/etc/openvpn/server1.tls-verify.php
              lport 1194
              management /var/etc/openvpn/server1.sock unix
              max-clients 10
              push "route 172.16.0.0 255.255.248.0"
              ca /var/etc/openvpn/server1.ca
              cert /var/etc/openvpn/server1.cert
              key /var/etc/openvpn/server1.key
              dh /etc/dh-parameters.1024
              tls-auth /var/etc/openvpn/server1.tls-auth 0
              comp-lzo
              persist-remote-ip
              float
              route 172.16.0.0 255.255.248.0

              firewall rules openvpn tab:
              Proto:* Source:* Port:* Destination:* Port:* GW:* Queue: none
              action:pass
              interface: openvpn

              IPv4 Table de routage

              Itinéraires actifs :
              Destination réseau    Masque réseau  Adr. passerelle  Adr. interface Métrique
                        0.0.0.0          0.0.0.0    192.168.0.254    192.168.0.75    20
                        0.0.0.0        128.0.0.0        10.0.8.1        10.0.8.2    30
                      10.0.8.0  255.255.255.252        On-link          10.0.8.2    286
                      10.0.8.2  255.255.255.255        On-link          10.0.8.2    286
                      10.0.8.3  255.255.255.255        On-link          10.0.8.2    286
                      127.0.0.0        255.0.0.0        On-link        127.0.0.1    306
                      127.0.0.1  255.255.255.255        On-link        127.0.0.1    306
                127.255.255.255  255.255.255.255        On-link        127.0.0.1    306
                      128.0.0.0        128.0.0.0        10.0.8.1        10.0.8.2    30
                    172.16.0.0    255.255.248.0        10.0.8.1        10.0.8.2    30
                    192.168.0.0    255.255.255.0        On-link      192.168.0.75    276
                  192.168.0.75  255.255.255.255        On-link      192.168.0.75    276
                  192.168.0.255  255.255.255.255        On-link      192.168.0.75    276
                  192.168.56.0    255.255.255.0        On-link      192.168.56.1    276
                  192.168.56.1  255.255.255.255        On-link      192.168.56.1    276
                192.168.56.255  255.255.255.255        On-link      192.168.56.1    276
                      224.0.0.0        240.0.0.0        On-link        127.0.0.1    306
                      224.0.0.0        240.0.0.0        On-link      192.168.56.1    276
                      224.0.0.0        240.0.0.0        On-link          10.0.8.2    286
                      224.0.0.0        240.0.0.0        On-link      192.168.0.75    276
                255.255.255.255  255.255.255.255        On-link        127.0.0.1    306
                255.255.255.255  255.255.255.255        On-link      192.168.56.1    276
                255.255.255.255  255.255.255.255        On-link          10.0.8.2    286
                255.255.255.255  255.255.255.255        On-link      192.168.0.75    276

              My Lan Office network is 192.168.0.0 , My pfsense Lan is 172.16.0.0/21 and The tunnel network 10.0.8.0/24

              So what can i do now ?
              Thanks.

              1 Reply Last reply Reply Quote 0
              • P
                phil.davis
                last edited by

                push "route 172.16.0.0 255.255.248.0"
                route 172.16.0.0 255.255.248.0

                Your server config has both route and push route with the same address. As I understand it, the server is on the pfSense that has LAN 172.16.0.0/21 - so the server should have only:

                push "route 172.16.0.0 255.255.248.0"

                Then it will tell ("push a route to") clients that connect saying that it is the way to reach 172.16.0.0/21

                The extra:

                route 172.16.0.0 255.255.248.0

                will confuse the routing - this tells pfSense that 172.16.0.0/21 can be reached by sending packets out this OpenVPN server - which is not correct.

                As the Greek philosopher Isosceles used to say, "There are 3 sides to every triangle."
                If I helped you, then help someone else - buy someone a gift from the INF catalog http://secure.inf.org/gifts/usd/

                1 Reply Last reply Reply Quote 0
                • M
                  myke
                  last edited by

                  I remove the extra route and i'm still serching my issue.

                  1 Reply Last reply Reply Quote 0
                  • M
                    myke
                    last edited by

                    hello,
                    i try with server mode Peer to Peer in a other pfsense box.

                    With the same parameter i have internet but i can't ping the computer and AP on the Lan pfsense.

                    there's a problem when we use OpenVpn with multi wan,failover , and Captive Portal ?

                    i don't know where is blocking cause no rules blocked the traffic….

                    1 Reply Last reply Reply Quote 0
                    • M
                      myke
                      last edited by

                      I'm back.
                      I try with Ipsec but i've got the same issue…  :'(

                      1 Reply Last reply Reply Quote 0
                      • P
                        phil.davis
                        last edited by 

                        local 192.168.1.1

                        This looks wrong in your server config. It should be the WAN IP that the server is on. I am guessing that the server is not on a private address like 192.168.1.1
                        I just noticed this issue on Redmine http://redmine.pfsense.org/issues/2582 and confirmed the problem. If you change your static IP on WAN, then pfSense does not update the OpenVPN conf files. If you go to each OpenVPN server and client and edit+save again, the conf files are generated again and have the new WAN IP in the "local n.n.n.n" line.

                        As the Greek philosopher Isosceles used to say, "There are 3 sides to every triangle."
                        If I helped you, then help someone else - buy someone a gift from the INF catalog http://secure.inf.org/gifts/usd/

                        1 Reply Last reply Reply Quote 0
                        • M
                          myke
                          last edited by

                          Hi,

                          Thanks Davis but i have the same result, i can reach my pfsense Lan.

                          I try with an SDSL router with the Wan IP but exactly the same issues…..

                          Here my server1.conf :

                          dev ovpns1
                          dev-type tun
                          dev-node /dev/tun1
                          writepid /var/run/openvpn_server1.pid
                          #user nobody
                          #group nobody
                          script-security 3
                          daemon
                          keepalive 10 60
                          ping-timer-rem
                          persist-tun
                          persist-key
                          proto tcp-server
                          cipher BF-CBC
                          up /usr/local/sbin/ovpn-linkup
                          down /usr/local/sbin/ovpn-linkdown
                          local 81.252.136.49
                          tls-server
                          server 10.0.8.0 255.255.255.0
                          client-config-dir /var/etc/openvpn-csc
                          ifconfig 10.0.8.1 10.0.8.2
                          tls-verify /var/etc/openvpn/server1.tls-verify.php
                          lport 1194
                          management /var/etc/openvpn/server1.sock unix
                          max-clients 8
                          push "route 172.16.0.0 255.255.248.0"
                          ca /var/etc/openvpn/server1.ca
                          cert /var/etc/openvpn/server1.cert
                          key /var/etc/openvpn/server1.key
                          dh /etc/dh-parameters.1024
                          crl-verify /var/etc/openvpn/server1.crl-verify
                          comp-lzo

                          Thanks Phil Davis but

                          1 Reply Last reply Reply Quote 0
                          • M
                            myke
                            last edited by

                            Hi,
                            I just reboot my pfsense and my VPN works now….

                            Thanks for the help.

                            1 Reply Last reply Reply Quote 0
                            • First post
                              Last post