Why can I not reach my clients from the LAN?
-
I'm exporting it with the client export utility. The client config looks like this:
dev tun persist-tun persist-key cipher AES-256-CBC tls-client client resolv-retry infinite remote 66.77.67.200 443 tcp tls-remote pfSense-cert auth-user-pass pkcs12 pfSense-TCP-443-jg3.p12 tls-auth pfSense-TCP-443-jg3-tls.key 1I'll note that this firewall was installed fresh on 2.0.3, no upgrade to get here.
-
Firewalls on the client?
-
see reply #2 ?
-
I don't know - Using a windows machine with similar system ping and SSH both work.
-
Do you have any firewall rules with policy-routing on LAN? Those might be forcing new flows initiated from LAN down a real WAN. But to get to the OpenVPN clients pfSense needs to just give the packet/flow to the ordinary routing for delivery.
Or a firewall rule on LAN that ends up blocking traffic to the OpenVPN tunnel network? -
Do you have latest version of Viscosity installed?
-
Are you doing something weird with your nats? Are you setup for automatic or manual?
That route looks correct to me. If your clients are 10.16.2.0/24
What does traceroute from lan box to vpn client do? your lan boxes are pointing to this pfsense box as their default gateway? And what is the mask on the lan clients? You don't have a overlapping network do you where the lan clients think 10.16.2 is local to their connection?
-
Do you have any firewall rules with policy-routing on LAN? Those might be forcing new flows initiated from LAN down a real WAN. But to get to the OpenVPN clients pfSense needs to just give the packet/flow to the ordinary routing for delivery.
Or a firewall rule on LAN that ends up blocking traffic to the OpenVPN tunnel network?Thanks for the help. I understand what you're saying, but it seems like "pfSense … just giv[ing] the packet/flow to the ordinary routing for delivery" is not happening for some reason.
I don't have any policy-routing at all.
My firewall rules are all very simple:
-
Allow anything from the LAN outbound (Default LAN to any rule)
-
Allow anything from anywhere on the OpenVPN rule tab (Default OpenVPN wizard rule)
WAN rules don't apply in this case, but they are:
- allow traffic for one port in to a 1:1 NAT'ed host
- allow traffic in to the firewall IP on TCP:443 for OpenVPN
-
-
-
Are you doing something weird with your nats? Are you setup for automatic or manual?
That route looks correct to me. If your clients are 10.16.2.0/24
What does traceroute from lan box to vpn client do? your lan boxes are pointing to this pfsense box as their default gateway? And what is the mask on the lan clients? You don't have a overlapping network do you where the lan clients think 10.16.2 is local to their connection?
I have automatic NAT. LAN hosts use the pfSense firewall as their default gateway. LAN hosts have /24 mask, the LAN and VPN client networks do not overlap (10.16.23.0/24 v. 10.16.2.0/24).
Traceroute from the LAN host to the VPN client address hits the firewall and hangs:
jge@bigsister:~$ traceroute -n 10.16.2.10 traceroute to 10.16.2.10 (10.16.2.10), 30 hops max, 60 byte packets 1 10.16.23.1 0.241 ms 0.210 ms 0.197 ms 2 * * * 3 * * * 4 * * * 5 * * *The LAN host here, is 1:1 NAT'ed behind a public IP (not the firewall's). That's the only thing I can imagine is problematic, but I'm not sure how to pinpoint / fix it.
-
@jg3:
The LAN host here, is 1:1 NAT'ed behind a public IP (not the firewall's). That's the only thing I can imagine is problematic, but I'm not sure how to pinpoint / fix it.
Fixed! Thanks for the help johnpoz, your questions set me in the right direction (finally).
I disabled a 1:1 NAT rule I had created that applied to the LAN host on the OpenVPN interface and now the LAN machine can reach the VPN clients. Great.
I had implemented this rule to cover a corner case of no-split VPN clients needing NAT reflection, discussed here:
http://forum.pfsense.org/index.php/topic,65793.msg359377.html
