Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    OpenVPN doesn't return subnet mask correctly

    Scheduled Pinned Locked Moved OpenVPN
    27 Posts 5 Posters 17.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      marvosa
      last edited by

      Jeffwji, Sort of :)  Actually in a routed VPN solution, the tunnel network can NOT be within the LAN range… which is why you need to name the local network... so your clients know that packets destined for the 10.10.8.0/28 network need to be routed over the VPN.

      1 Reply Last reply Reply Quote 0
      • J
        jeffwji
        last edited by

        Sorry, I'm back again. :-[

        I'm now able to visit the management UI from VPN network, that means I'm able to access 10.10.8.1. Then I did the two tests:

        1. Created a machine on LAN net, which the IP is 10.10.8.5
        2. Created a VLAN which the net is 10.10.8.32/28(Gateway 33), and setup a machine on 10.10.8.35.

        Created two rules for both of the them, allow all the IPs from those two net to go any. Then tried to talk with this two machines from VPN, the first one passed, but the second failed. Why?

        1 Reply Last reply Reply Quote 0
        • M
          marvosa
          last edited by

          Because 10.10.8.5/28 is in your "Local Network" where as 10.10.8.35/28 is not.

          By default, the system only provides routing to what's configured in the "Local Network".  Access to other subnets need to be configured in the "Advanced configuration" section.  Add the following statement to the "Advanced configuration" field:

          push "route 10.10.8.32 255.255.255.240"

          1 Reply Last reply Reply Quote 0
          • J
            jeffwji
            last edited by

            So that means I have to create individual item for each subnet? How about if I have many VLANs, for example, 10.10.8.0/28, 10.10.8.16/28, 10.10.8.32/28… then I create one local network as 10.10.8.0/24, which covers all the VLANs under 8 section, does it work?

            Jeff

            1 Reply Last reply Reply Quote 0
            • P
              phil.davis
              last edited by

              @jeffwji:

              So that means I have to create individual item for each subnet? How about if I have many VLANs, for example, 10.10.8.0/28, 10.10.8.16/28, 10.10.8.32/28… then I create one local network as 10.10.8.0/24, which covers all the VLANs under 8 section, does it work?

              Jeff

              Yes, if networks you want to be reachable can all aggregate like this into a single network, then you can specify a single aggregated network as "Local Network". All it does is make a route to whatever you put.
              Note: In 2.1-RC you can put a list of networks in "Local Network" and "Remote Network", so you can specify multiple disjoint networks without using the advanced box.

              As the Greek philosopher Isosceles used to say, "There are 3 sides to every triangle."
              If I helped you, then help someone else - buy someone a gift from the INF catalog http://secure.inf.org/gifts/usd/

              1 Reply Last reply Reply Quote 0
              • J
                jeffwji
                last edited by

                Sounds great! thanks for every one!

                1 Reply Last reply Reply Quote 0
                • J
                  jeffwji
                  last edited by

                  Hi Guys

                  I'm back!

                  I upgraded my little virtual network so that it looks be more secure. Now the draft is:

                  |–------------------NEW ADDED---------------------------|
                  |--Test outter network --||---------- External firewall----------||--------DMZ--------||--------Internal firewall--------||---Internal network
                         [192.168.x.x] –--->[ WAN:192.168.137.36||LAN:10.10.1.1 ] <–-10.10.0.0/21---> [ DMZ:10.10.1.2||LAN:10.10.8.1 ]<–---10.10.8.0/21
                                                    <----------------------- NAT------------------------------->|-OpenVPN(10.10.9.1/24)

                  Yes, I added an external firewall in front of the old one. Mapped the OpenVPN to the world, and keep every thing on the old firewall as before(except change the name to internal firewall). As what we did, the VPN user is still able to access the now called "internal network"(10.10.8.0/21) via NAT, and I also set a static route on the new external firewall to make the DMZ(10.10.0.0/21) is able to access to 10.10.8.0/21. Now every thing works fine, but the VPN user can't access DMZ. How can I make it works? The current local network for VPN is 10.10.8.0/21, do I have to change it to 10.10.0.0/21? if so, will it lost the accessibility to 8.0/21?

                  Jeff

                  1 Reply Last reply Reply Quote 0
                  • M
                    marvosa
                    last edited by

                    You will need to add a route to it via the advanced config field… has this been done?

                    Also, which DMZ are you trying to access?  Because you have your DMZ's in the same subnet on both firewalls.

                    1 Reply Last reply Reply Quote 0
                    • J
                      jeffwji
                      last edited by

                      Right, when I added push "route 10.10.0.0 255.255.248.0" to the advanced, I'm able to access DMZ now. There's only one DMZ, why you think I have two?

                      And I also have to add  push "route 10.10.8.0 255.255.255.0" to advanced, even though the local network has the same value, otherwise I'll be blocked by 10.10.8.0 section. (Advanced config overrides the local network instead of add-on?)

                      And also If I put in "10.10.8.0 255.255.248.0", I purposed to be able to access 8.0 to 16.255, but failed. Is it because it covers the VPN subnet?

                      1 Reply Last reply Reply Quote 0
                      • P
                        phil.davis
                        last edited by

                        The advanced config adds to the other settings - you can put 1 network in the Local Network field, and others in the advanced box with push route statements.

                        And also If I put in "10.10.8.0 255.255.248.0", I purposed to be able to access 8.0 to 16.255, but failed. Is it because it covers the VPN subnet?

                        "10.10.8.0 255.255.248.0" is 10.10.8.0 to 10.10.15.255 - but you do not need that in the advanced section if you already have 10.10.8.0/21 in Local Network.
                        Actually you can put whatever aggregated network you like in the Local Network or Remote Network boxes - 10.10.0.0/20 will cover 10.10.0.0 to 10.10.15.255 in one go.

                        As the Greek philosopher Isosceles used to say, "There are 3 sides to every triangle."
                        If I helped you, then help someone else - buy someone a gift from the INF catalog http://secure.inf.org/gifts/usd/

                        1 Reply Last reply Reply Quote 0
                        • M
                          marvosa
                          last edited by

                          Sorry, from your diagram it looks like you have DMZ's on both firewalls.

                          Yes, adding push "route 10.10.8.0 255.255.255.0" to your advanced config when it's already in your Local Network field is redundant and can be removed.  If you look at your config, you'll see the duplicate entry.

                          1 Reply Last reply Reply Quote 0
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.