After connecting

poly_s

Hello.

Well I have a pfsense gateway box running a open vpn server and a home network behind it with a samba server running.

I'm able to successfully connect to my open vpn server from the internet and receive a 10 dot IP address.

I'm wondering what is next? How can I access this samba server? I'm also wondering how I can use the pfsense internet connection to surf the web, road warrior style.

I have gone through the guides but I'm still struggling

Some direction would be great.

Thanks in advance for your time.

Nachtfalke

the openvpn server is running on pfsense, right ?

To force all traffic from the roadwarrior to the pfsense then you need to check "Redirect all traffic through VPN" on the OpenVPN server GUI config.

Then go to firewall -> rules and create an "allow any to any" rule on the OpenVPN tab.

In general this should be enough to access hosts behind pfsense and browse the web through VPN -> pfsense -> WAN

marvosa

Lets start with your current settings (server and client). Then tell us exactly what is not working.

poly_s

Thanks for your relply.

Yes the VPN server is on the pfsense.

I did what you said Nachtfalke and clicked "redirect all traffic…." and then created a rule. for pass any any.

Still I was unable to see my samba machine.

When I'm pinging it what address should i use?

@ marvosa

Client settings are set to use config file which looks like this

dev tun
persist-tun
persist-key
proto tcp-client
cipher AES-128-CBC
tls-client
client
resolv-retry infinite
remote **.***.**.** ****
tls-remote steedman
auth-user-pass
pkcs12 gatekeeper-TCP-****.p12
tls-auth gatekeeper-TCP-****-tls.key 1

As for the server settings which ones do you want to know? there seems to be so many that I went through to set it up.

The server logs say that I receives a connection. I would like to browse my networks in explorer and see my samba server after i have connected to the VPN also i would like to surf via the VPN out of the pfsense WAN.

Thanks again.

Nachtfalke

When you setup a firewall "any to any" and you setup "redirect all traffic…" then you should be able to browse the web using the pfsense WAN.

Try to check this on a website which displays your public IP.

marvosa

What server settings? All of them. Either take screen shots, post them manually or get them from your server1.conf (/var/etc/openvpn).

poly_s

@ marvosa
Ok thanks for letting me know where the .conf file was…. here is its content.

dev ovpns1
dev-type tun
dev-node /dev/tun1
writepid /var/run/openvpn_server1.pid
#user nobody
#group nobody
script-security 3
daemon
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
proto tcp-server
cipher AES-128-CBC
up /usr/local/sbin/ovpn-linkup
down /usr/local/sbin/ovpn-linkdown
local **.***.***.**
tls-server
server 10.1.5.0 255.255.255.0
client-config-dir /var/etc/openvpn-csc
username-as-common-name
auth-user-pass-verify /var/etc/openvpn/server1.php via-env
tls-verify /var/etc/openvpn/server1.tls-verify.php
lport ****
management /var/etc/openvpn/server1.sock unix
max-clients 2
push "route 192.168.1.100 255.255.255.0"
push "redirect-gateway def1"
ca /var/etc/openvpn/server1.ca 
cert /var/etc/openvpn/server1.cert 
key /var/etc/openvpn/server1.key

poly_s

UPDATE

Success in part!!! I can now surf the web via the pfsense box.

My error was having the Subnet of the LAN set as a common one (192.168.0.1) such that the remote network had the same and conflicted.

I changed the IP of the LAN to a different Subnet and changed the DHCP address pool range also to coincide. It was also necessary to tell the Access Point about this change.

I am still unable to view my network behind the pfsense box however.

Thanks to Nachfalke for turning me on to the "redirect traffic …" settings and to Marvosa for showing me the .conf file which when I stared at enough seemed to show me the possible problem to look into more.

I'm going to try the AP settings first to see if a problem there is stopping me get through to the Samba server.

Nachtfalke

Try to do something simple to test the connection behind your pfsense:
do a ping
do a tracert
make sure that the destination host (host behind pfsense) allows traffic from hosts on your VPN network. Disable the firewall for testing on these hosts.

How do you connect to your samba server - by IP ? \ip.ip.ip.ip\share ?

Is the accesspoint doing NAT or routing or is it just acting as a wireless bridge ? IIn bridge mode it should be ok/work.
When doing routing on the AP then you need to define additional routes on OpenVPN Server.

poly_s

@ nachtfalke

The AP is in bridge mode so I guess the problem is not there.

I access the samba server Via explorer where it appears under "network".

So from what your saying its most likely a fire wall rule ( or lack there of )that allows traffic from samba server to VPN?

OR

Settings on the samba server itself???

Thanks again.

Nachtfalke

@poly_s:

@ nachtfalke

The AP is in bridge mode so I guess the problem is not there.

I access the samba server Via explorer where it appears under "network".

So from what your saying its most likely a fire wall rule ( or lack there of )that allows traffic from samba server to VPN?

OR

Settings on the samba server itself???

Thanks again.

If you have "any to any" on OpenVPN firewall rule this should be ok.
Firewall on samba server - the firewall must allow traffic from the OpenVPN network - if your samba server has a firewall enabled.
On OpenVPN server GUI try to enable:
"Enable NetBIOS over TCP/IP" and try with "h-node" or some other setting.

Which protocol and port do you use to connect to the samba server ?
enable logging on the OpenVPN firewall rule to get this information.

joako

Assuming you can ping across the VPN, on the server make sure you have the NMB service enabled and then put it's IP address under the WINS field in OpenVPN config.

poly_s

Success

Ok Thanks again.

I can now access my "\server\guest share" over the VPN

Not sure if it was enabaling netbios or adding WINS server or neither.

When I get a second i'm going to back both of these off and see which one it was or if it was just user error and the problem was in fact fixed after I sorted the IP conflict.

I Am one happy Pfsense/OpenVpn user.

marvosa

It's both. NMBD or WINS is the only way to resolve NETBIOS names in a routed VPN solution.

And the "Enable NetBIOS over TCP/IP" check box, it tells you right next to it:

"If this option is not set, all NetBIOS-over-TCP/IP options (including WINS) will be disabled."

So, the answer is both.

extide

You can do it without WINS, actually, but you will need something else (DNS, hosts file, etc) to resolve your names.

poly_s

Doing it without WINS would be nice as I read that WINS is open to abuse and unreliable (wiki) Thanks for the info Extide.

So its as simple as editing my host file to resolve the name of the server to the IP?

extide

Yes, you can do it that way. As long as you have NetBIOS over TCP/IP and can ping the server by name (which should resolve into the IP) you should be good to go.

joako

In that case say your fqdn is server.something.tld place something.tld in "DNS-Domainname," pfsense LAN IP in "DNS-Server" and make sure you can resolve fqdn through pfsense (place it in Services > DNS Resolver) and you should be able to open up \server as well.

Disable nmb service, remove WINS from OpenVPN and don't forget to reconnect.