Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    After connecting

    Scheduled Pinned Locked Moved OpenVPN
    18 Posts 5 Posters 5.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      marvosa
      last edited by

      Lets start with your current settings (server and client).  Then tell us exactly what is not working.

      1 Reply Last reply Reply Quote 0
      • P
        poly_s
        last edited by

        Thanks for your relply.

        Yes the VPN server is on the pfsense.

        I did what you said Nachtfalke and clicked "redirect all traffic…." and then created a rule. for pass any any.

        Still I was unable to see my samba machine.

        When I'm pinging it what address should i use?

        @ marvosa

        Client settings are set to use config file which looks like this

        dev tun
persist-tun
persist-key
proto tcp-client
cipher AES-128-CBC
tls-client
client
resolv-retry infinite
remote **.***.**.** ****
tls-remote steedman
auth-user-pass
pkcs12 gatekeeper-TCP-****.p12
tls-auth gatekeeper-TCP-****-tls.key 1

        As for the server settings which ones do you want to know? there seems to be so many that I went through to set it up.

        The server logs say that I receives a connection. I would like to browse my networks in explorer and see my samba server after i have connected to the VPN also i would like to surf via the VPN out of the pfsense WAN.

        Thanks again.

        1 Reply Last reply Reply Quote 0
        • N
          Nachtfalke
          last edited by

          When you setup a firewall "any to any" and you setup "redirect all traffic…" then you should be able to browse the web using the pfsense WAN.

          Try to check this on a website which displays your public IP.

          1 Reply Last reply Reply Quote 0
          • M
            marvosa
            last edited by

            What server settings?  All of them.  Either take screen shots, post them manually or get them from your server1.conf (/var/etc/openvpn).

            1 Reply Last reply Reply Quote 0
            • P
              poly_s
              last edited by

              @ marvosa
              Ok thanks for letting me know where the .conf file was…. here is its content.

              dev ovpns1
dev-type tun
dev-node /dev/tun1
writepid /var/run/openvpn_server1.pid
#user nobody
#group nobody
script-security 3
daemon
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
proto tcp-server
cipher AES-128-CBC
up /usr/local/sbin/ovpn-linkup
down /usr/local/sbin/ovpn-linkdown
local **.***.***.**
tls-server
server 10.1.5.0 255.255.255.0
client-config-dir /var/etc/openvpn-csc
username-as-common-name
auth-user-pass-verify /var/etc/openvpn/server1.php via-env
tls-verify /var/etc/openvpn/server1.tls-verify.php
lport ****
management /var/etc/openvpn/server1.sock unix
max-clients 2
push "route 192.168.1.100 255.255.255.0"
push "redirect-gateway def1"
ca /var/etc/openvpn/server1.ca 
cert /var/etc/openvpn/server1.cert 
key /var/etc/openvpn/server1.key
              1 Reply Last reply Reply Quote 0
              • P
                poly_s
                last edited by

                UPDATE

                Success in part!!! I can now surf the web via the pfsense box.

                My error was having the Subnet of the LAN set as a common one (192.168.0.1) such that the remote network had the same and conflicted.

                I changed the IP of the LAN to a different Subnet and changed the DHCP address pool range also to coincide. It was also necessary to tell the Access Point about this change.

                I am still unable to view my network behind the pfsense box however.

                Thanks to Nachfalke for turning me on to the "redirect traffic …" settings and to Marvosa for showing me the .conf file which when I stared at enough seemed to show me the possible problem to look into more.

                I'm going to try the AP settings first to see if a problem there is stopping me get through to the Samba server.

                1 Reply Last reply Reply Quote 0
                • N
                  Nachtfalke
                  last edited by

                  Try to do something simple to test the connection behind your pfsense:
                  do a ping
                  do a tracert
                  make sure that the destination host (host behind pfsense) allows traffic from hosts on your VPN network. Disable the firewall for testing on these hosts.

                  How do you connect to your samba server - by IP ? \ip.ip.ip.ip\share ?

                  Is the accesspoint doing NAT or routing or is it just acting as a wireless bridge ? IIn bridge mode it should be ok/work.
                  When doing routing on the AP then you need to define additional routes on OpenVPN Server.

                  1 Reply Last reply Reply Quote 0
                  • P
                    poly_s
                    last edited by

                    @ nachtfalke

                    The AP is in bridge mode so I guess the problem is not there.

                    I access the samba server Via explorer where it appears under "network".

                    So from what your saying its most likely a fire wall rule ( or lack there of )that allows traffic from samba server to VPN?

                    OR

                    Settings on the samba server itself???

                    Thanks again.

                    1 Reply Last reply Reply Quote 0
                    • N
                      Nachtfalke
                      last edited by

                      @poly_s:

                      @ nachtfalke

                      The AP is in bridge mode so I guess the problem is not there.

                      I access the samba server Via explorer where it appears under "network".

                      So from what your saying its most likely a fire wall rule ( or lack there of )that allows traffic from samba server to VPN?

                      OR

                      Settings on the samba server itself???

                      Thanks again.

                      If you have "any to any" on OpenVPN firewall rule this should be ok.
                      Firewall on samba server - the firewall must allow traffic from the OpenVPN network - if your samba server has a firewall enabled.
                      On OpenVPN server GUI try to enable:
                      "Enable NetBIOS over TCP/IP" and try with "h-node" or some other setting.

                      Which protocol and port do you use to connect to the samba server ?
                      enable logging on the OpenVPN firewall rule to get this information.

                      1 Reply Last reply Reply Quote 0
                      • J
                        joako
                        last edited by

                        Assuming you can ping across the VPN, on the server make sure you have the NMB service enabled and then put it's IP address under the WINS field in OpenVPN config.

                        1 Reply Last reply Reply Quote 0
                        • P
                          poly_s
                          last edited by

                          Success

                          Ok Thanks again.

                          I can now access my "\server\guest share" over the VPN

                          Not sure if it was enabaling netbios or adding WINS server or neither.

                          When I get a second i'm going to back both of these off and see which one it was or if it was just user error and the problem was in fact fixed after I sorted the IP conflict.

                          I Am one happy Pfsense/OpenVpn user.

                          1 Reply Last reply Reply Quote 0
                          • M
                            marvosa
                            last edited by

                            It's both.  NMBD or WINS is the only way to resolve NETBIOS names in a routed VPN solution.

                            And the "Enable NetBIOS over TCP/IP" check box, it tells you right next to it:

                            "If this option is not set, all NetBIOS-over-TCP/IP options (including WINS) will be disabled."

                            So, the answer is both.

                            1 Reply Last reply Reply Quote 0
                            • E
                              extide
                              last edited by

                              You can do it without WINS, actually, but you will need something else (DNS, hosts file, etc) to resolve your names.

                              1 Reply Last reply Reply Quote 0
                              • P
                                poly_s
                                last edited by

                                Doing it without WINS would be nice as I read that WINS is open to abuse and unreliable (wiki) Thanks for the info Extide.

                                So its as simple as editing my host file to resolve the name of the server to the IP?

                                1 Reply Last reply Reply Quote 0
                                • E
                                  extide
                                  last edited by

                                  Yes, you can do it that way. As long as you have NetBIOS over TCP/IP and can ping the server by name (which should resolve into the IP) you should be good to go.

                                  1 Reply Last reply Reply Quote 0
                                  • J
                                    joako
                                    last edited by

                                    In that case say your fqdn is server.something.tld  place something.tld in "DNS-Domainname," pfsense LAN IP in "DNS-Server" and make sure you can resolve fqdn through pfsense (place it in Services > DNS Resolver) and you should be able to open up \server as well.

                                    Disable nmb service, remove WINS from OpenVPN and don't forget to reconnect.

                                    1 Reply Last reply Reply Quote 0
                                    • First post
                                      Last post
                                    Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.