Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    PfSense OpenVPN Server and Tomato OpenVPN Client

    Scheduled Pinned Locked Moved OpenVPN
    37 Posts 7 Posters 18.3k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • E
      elkosupertech
      last edited by

      2.0.3-RELEASE (amd64)

      DJ

      1 Reply Last reply Reply Quote 0
      • K
        kejianshi
        last edited by

        Thats exactly what I'm using.
        Hmmm - Must be you get different options when setting up a point to point tunnel not using a wizard.

        1 Reply Last reply Reply Quote 0
        • E
          elkosupertech
          last edited by

          I did use the Wizard for this.  My original post shows the options I selected when I set this up.  I am thinking of redoing the setup but they didn't recommend those options.  Would you tell me what options I should select or any other changes that should be made?

          DJ

          1 Reply Last reply Reply Quote 0
          • K
            kejianshi
            last edited by

            I take it back - I don't have that topology option either.  Not sure what I was thinking earlier.
            I have two of those but not the topology one.

            1 Reply Last reply Reply Quote 0
            • K
              kejianshi
              last edited by

              Did you set up rules on the firewall to allow/pass Openvpn to anywhere?

              1 Reply Last reply Reply Quote 0
              • D
                doktornotor Banned
                last edited by

                @kejianshi:

                I take it back - I don't have that topology option either.  Not sure what I was thinking earlier.
                I have two of those but not the topology one.

                Important note: You MUST use device type tun, NOT tap. Otherwise the option is just not there. (Read the OVPN docs for details.)

                1 Reply Last reply Reply Quote 0
                • K
                  kejianshi
                  last edited by

                  Yeah - I definitely thought I saw that option before and now I definitely know I don't in my 2.03 
                  I'm looking at my TUN tunnels that are up and working.  Odd.  I must have been mistaken.

                  1 Reply Last reply Reply Quote 0
                  • E
                    elkosupertech
                    last edited by

                    As far as I can tell, OpenVPN's settings on the Firewall are set to allow all.

                    1 Reply Last reply Reply Quote 0
                    • jimpJ
                      jimp Rebel Alliance Developer Netgate
                      last edited by

                      The last time I had to config Tomato as a client it had a quirk where, for whatever reason, I had to add this to the Tomato client config:

                      
keepalive 10 60
ping-timer-rem

                      And then it started connecting and working as expected.

                      Other than that it was a fairly standard static key config, nothing too special.

                      Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                      Need help fast? Netgate Global Support!

                      Do not Chat/PM for help!

                      1 Reply Last reply Reply Quote 0
                      • E
                        elkosupertech
                        last edited by

                        I have entered this on the Tomato side and still no joy.  Any other suggestions?

                        DJ

                        1 Reply Last reply Reply Quote 0
                        • D
                          doktornotor Banned
                          last edited by

                          Get in touch with Tomato guys… DD-WRT had OpenVPN buggy as hell more often than not, I doubt it's any better with Tomato.

                          1 Reply Last reply Reply Quote 0
                          • K
                            kejianshi
                            last edited by

                            When pfsense is connected to something else and its broken, I get the feeling that people don't come here because they feel its a pfsense issue.  I think they come here because no one will answer their questions in other places.  haha.

                            1 Reply Last reply Reply Quote 0
                            • jimpJ
                              jimp Rebel Alliance Developer Netgate
                              last edited by

                              OpenVPN is pretty standard, despite quirks from the router firmware involved.

                              Given that things have changed from the start to now, it might help to know exactly what settings are in use on both sides as it is right now.

                              Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                              Need help fast? Netgate Global Support!

                              Do not Chat/PM for help!

                              1 Reply Last reply Reply Quote 0
                              • E
                                elkosupertech
                                last edited by

                                Here are the configs I have currently:

                                pfSense:
                                OpenVPN: https://docs.google.com/viewer?a=v&pid=sites&srcid=ZWxrb3N1cGVydGVjaC5jb218d2Vic2l0ZXxneDo3MGM3ZWZmNGIzNGI0YzNi
                                Client Specific Override: https://docs.google.com/viewer?a=v&pid=sites&srcid=ZWxrb3N1cGVydGVjaC5jb218d2Vic2l0ZXxneDozOGVlMjZjZDU0OGFjZWEw

                                Tomato
                                Basic: https://docs.google.com/viewer?a=v&pid=sites&srcid=ZWxrb3N1cGVydGVjaC5jb218d2Vic2l0ZXxneDo0OGQ0N2YxNzY5M2M1NjY3
                                Advanced: https://docs.google.com/viewer?a=v&pid=sites&srcid=ZWxrb3N1cGVydGVjaC5jb218d2Vic2l0ZXxneDo1OWRjM2M3YmVjYjI0MTU1

                                If you need more please let me know.  Thank you for all your help!

                                DJ

                                P.S. This Tomato router used to connect up with an Astaro Security appliance before they changed their licensing on it so I know that side works.  The only change I did with tomato was change the Keys for the new server.

                                1 Reply Last reply Reply Quote 0
                                • jimpJ
                                  jimp Rebel Alliance Developer Netgate
                                  last edited by

                                  The client basic config for tomato links to the pfsense config.

                                  Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                                  Need help fast? Netgate Global Support!

                                  Do not Chat/PM for help!

                                  1 Reply Last reply Reply Quote 0
                                  • E
                                    elkosupertech
                                    last edited by

                                    I edited the links, but just in case https://docs.google.com/viewer?a=v&pid=sites&srcid=ZWxrb3N1cGVydGVjaC5jb218d2Vic2l0ZXxneDo0OGQ0N2YxNzY5M2M1NjY3

                                    Thanks again!

                                    DJ

                                    1 Reply Last reply Reply Quote 0
                                    • jimpJ
                                      jimp Rebel Alliance Developer Netgate
                                      last edited by

                                      Why do you have it on Remote Access SSL/TLS and not Peer to Peer SSL/TLS?

                                      Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                                      Need help fast? Netgate Global Support!

                                      Do not Chat/PM for help!

                                      1 Reply Last reply Reply Quote 0
                                      • jimpJ
                                        jimp Rebel Alliance Developer Netgate
                                        last edited by

                                        I would move it to Peer-to-Peer SSL/TLS, kill the user auth.

                                        Other than the user+pass auth, I don't see anything odd about it from the settings.

                                        We'd need to see the OpenVPN logs from both sides to say much more.

                                        Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                                        Need help fast? Netgate Global Support!

                                        Do not Chat/PM for help!

                                        1 Reply Last reply Reply Quote 0
                                        • E
                                          elkosupertech
                                          last edited by

                                          Well according to the instructions I used (very first post) that was the recommended way.  I am open to changing any of the settings I have.  Also I have stated that I can get it to work (one way) by turning on NAT on the Tomato side so that network then communicates though that way.

                                          DJ

                                          1 Reply Last reply Reply Quote 0
                                          • E
                                            elkosupertech
                                            last edited by

                                            Change made.  And still same issue.  Here are the logs from Tomato:

                                            Aug  2 10:40:34 unknown daemon.notice openvpn[10117]: PUSH: Received control message: 'PUSH_REPLY,route 10.1.0.0 255.255.255.0,route 10.0.0.0 255.255.255.0,route 10.2.0.0 255.255.255.0,route 172.18.0.1,topology net30,ping 10,ping-restart 60,ifconfig 172.18.0.6 172.18.0.5'
                                            Aug  2 10:40:34 unknown daemon.notice openvpn[10117]: OPTIONS IMPORT: timers and/or timeouts modified
                                            Aug  2 10:40:34 unknown daemon.notice openvpn[10117]: OPTIONS IMPORT: –ifconfig/up options modified
                                            Aug  2 10:40:34 unknown daemon.notice openvpn[10117]: OPTIONS IMPORT: route options modified
                                            Aug  2 10:40:34 unknown daemon.notice openvpn[10117]: TUN/TAP device tun11 opened
                                            Aug  2 10:40:34 unknown daemon.notice openvpn[10117]: TUN/TAP TX queue length set to 100
                                            Aug  2 10:40:34 unknown daemon.notice openvpn[10117]: /sbin/ifconfig tun11 172.18.0.6 pointopoint 172.18.0.5 mtu 1500
                                            Aug  2 10:40:34 unknown daemon.notice openvpn[10117]: /sbin/route add -net 10.1.0.0 netmask 255.255.255.0 gw 172.18.0.5
                                            Aug  2 10:40:34 unknown daemon.notice openvpn[10117]: /sbin/route add -net 10.0.0.0 netmask 255.255.255.0 gw 172.18.0.5
                                            Aug  2 10:40:34 unknown daemon.notice openvpn[10117]: /sbin/route add -net 10.2.0.0 netmask 255.255.255.0 gw 172.18.0.5
                                            Aug  2 10:40:34 unknown daemon.notice openvpn[10117]: /sbin/route add -net 172.18.0.1 netmask 255.255.255.255 gw 172.18.0.5
                                            Aug  2 10:40:34 unknown daemon.notice openvpn[10117]: Initialization Sequence Completed
                                            Aug  2 10:40:38 unknown daemon.err openvpn[10117]: event_wait : Interrupted system call (code=4)
                                            Aug  2 10:40:38 unknown daemon.notice openvpn[10117]: OpenVPN STATISTICS
                                            Aug  2 10:40:38 unknown daemon.notice openvpn[10117]: Updated,Fri Aug  2 10:40:38 2013
                                            Aug  2 10:40:38 unknown daemon.notice openvpn[10117]: TUN/TAP read bytes,0
                                            Aug  2 10:40:38 unknown daemon.notice openvpn[10117]: TUN/TAP write bytes,0
                                            Aug  2 10:40:38 unknown daemon.notice openvpn[10117]: TCP/UDP read bytes,6521
                                            Aug  2 10:40:38 unknown daemon.notice openvpn[10117]: TCP/UDP write bytes,4852
                                            Aug  2 10:40:38 unknown daemon.notice openvpn[10117]: Auth read bytes,0
                                            Aug  2 10:40:38 unknown daemon.notice openvpn[10117]: END
                                            Aug  2 10:40:42 unknown daemon.err openvpn[10117]: event_wait : Interrupted system call (code=4)
                                            Aug  2 10:40:42 unknown daemon.notice openvpn[10117]: OpenVPN STATISTICS
                                            Aug  2 10:40:42 unknown daemon.notice openvpn[10117]: Updated,Fri Aug  2 10:40:42 2013
                                            Aug  2 10:40:42 unknown daemon.notice openvpn[10117]: TUN/TAP read bytes,0
                                            Aug  2 10:40:42 unknown daemon.notice openvpn[10117]: TUN/TAP write bytes,0
                                            Aug  2 10:40:42 unknown daemon.notice openvpn[10117]: TCP/UDP read bytes,6521
                                            Aug  2 10:40:42 unknown daemon.notice openvpn[10117]: TCP/UDP write bytes,4852
                                            Aug  2 10:40:42 unknown daemon.notice openvpn[10117]: Auth read bytes,0
                                            Aug  2 10:40:42 unknown daemon.notice openvpn[10117]: END
                                            Aug  2 10:40:59 unknown daemon.err openvpn[10117]: event_wait : Interrupted system call (code=4)
                                            Aug  2 10:40:59 unknown daemon.notice openvpn[10117]: OpenVPN STATISTICS
                                            Aug  2 10:40:59 unknown daemon.notice openvpn[10117]: Updated,Fri Aug  2 10:40:59 2013
                                            Aug  2 10:40:59 unknown daemon.notice openvpn[10117]: TUN/TAP read bytes,3060
                                            Aug  2 10:40:59 unknown daemon.notice openvpn[10117]: TUN/TAP write bytes,0
                                            Aug  2 10:40:59 unknown daemon.notice openvpn[10117]: TCP/UDP read bytes,6659
                                            Aug  2 10:40:59 unknown daemon.notice openvpn[10117]: TCP/UDP write bytes,8205
                                            Aug  2 10:40:59 unknown daemon.notice openvpn[10117]: Auth read bytes,32
                                            Aug  2 10:40:59 unknown daemon.notice openvpn[10117]: END
                                            Aug  2 10:41:01 unknown user.info init[1]: VPN_LOG_NOTE: 73: VPN Client 1 already running…
                                            Aug  2 10:41:50 unknown daemon.err openvpn[10117]: event_wait : Interrupted system call (code=4)
                                            Aug  2 10:41:50 unknown daemon.notice openvpn[10117]: OpenVPN STATISTICS
                                            Aug  2 10:41:50 unknown daemon.notice openvpn[10117]: Updated,Fri Aug  2 10:41:50 2013
                                            Aug  2 10:41:50 unknown daemon.notice openvpn[10117]: TUN/TAP read bytes,6883
                                            Aug  2 10:41:50 unknown daemon.notice openvpn[10117]: TUN/TAP write bytes,0
                                            Aug  2 10:41:50 unknown daemon.notice openvpn[10117]: TCP/UDP read bytes,7004
                                            Aug  2 10:41:50 unknown daemon.notice openvpn[10117]: TCP/UDP write bytes,12925
                                            Aug  2 10:41:50 unknown daemon.notice openvpn[10117]: Auth read bytes,112
                                            Aug  2 10:41:50 unknown daemon.notice openvpn[10117]: END
                                            Aug  2 10:42:01 unknown user.info init[1]: VPN_LOG_NOTE: 73: VPN Client 1 already running…

                                            and from pfSense:
                                            Aug 2 10:38:28 openvpn[567]: event_wait : Interrupted system call (code=4)
                                            Aug 2 10:38:29 openvpn[567]: /usr/local/sbin/ovpn-linkdown ovpns1 1500 1557 172.18.0.1 172.18.0.2 init
                                            Aug 2 10:38:29 openvpn[567]: SIGTERM[hard,] received, process exiting
                                            Aug 2 10:38:29 openvpn[26832]: OpenVPN 2.2.2 amd64-portbld-freebsd8.1 [SSL] [LZO2] [eurephia] built on Apr 2 2013
                                            Aug 2 10:38:29 openvpn[26832]: NOTE: the current –script-security setting may allow this configuration to call user-defined scripts
                                            Aug 2 10:38:29 openvpn[26832]: TUN/TAP device /dev/tun1 opened
                                            Aug 2 10:38:29 openvpn[26832]: /sbin/ifconfig ovpns1 172.18.0.1 172.18.0.2 mtu 1500 netmask 255.255.255.255 up
                                            Aug 2 10:38:29 openvpn[26832]: /usr/local/sbin/ovpn-linkup ovpns1 1500 1557 172.18.0.1 172.18.0.2 init
                                            Aug 2 10:38:29 openvpn[28114]: UDPv4 link local (bound): 204.28.248.153:1195
                                            Aug 2 10:38:29 openvpn[28114]: UDPv4 link remote: [undef]
                                            Aug 2 10:38:29 openvpn[28114]: Initialization Sequence Completed
                                            Aug 2 10:38:29 openvpn[28114]: IPv6 in tun mode is not supported in OpenVPN 2.2
                                            Aug 2 10:39:23 openvpn[28114]: 74.34.62.30:48938 Re-using SSL/TLS context
                                            Aug 2 10:39:26 openvpn[28114]: 74.34.62.30:48938 [VPN_Parents] Peer Connection Initiated with 74.34.62.30:48938
                                            Aug 2 10:40:05 openvpn[28114]: 74.34.62.30:64452 Re-using SSL/TLS context
                                            Aug 2 10:40:07 openvpn[28114]: 74.34.62.30:64452 [VPN_Parents] Peer Connection Initiated with 74.34.62.30:64452
                                            Aug 2 10:40:28 openvpn[28114]: 74.34.62.30:41811 Re-using SSL/TLS context
                                            Aug 2 10:40:31 openvpn[28114]: 74.34.62.30:41811 [VPN_Parents] Peer Connection Initiated with 74.34.62.30:41811

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.