[SOLVED] Port forward
-
Yes there is a openvpn client - just install the export package, makes it easy.
As to rules, you need to check the box that says redirect gateway.. Thats really all there is. What firewall rules you setup to limit or allow access from the vpn clients into your network is up to your requirements.
-
i have checkt the box for "Force all client generated traffic through the tunnel." and i tried to connect to my vpn … it connected but i didn't have any internet access so it means something gone wrong :(
-
And did you run the client as admin, you can not set routes on windows 7 without admin rights?
And your connecting to this from OUTSIDE pfsense?
-
i started the VPN program as "Run as administrator" , but i didn't try it from outside only from inside that can be the problem? i'm going to send the program for a friend and i hope it works,i will be back with the results :)
-
if you want someone to test it that is actually literate in how this stuff works ;) You could send me the configuration archive. I don't need the software. And just let me know any other resources you would like me to verify and or if just my internet goes through this connection, etc.
And I can show you the routing that makes it work, etc.
-
ok where should i send you the file?
-
I will PM you my personal email.
BTW - they clearly did not run as admin, since you see the access denied on adding the routes.
Also your just running on UDP 1194, this is default – I can almost promise you this is NOT going to be open outbound from someone behind the China Firewall.. I would have your openvpn listen on tcp on a common port that is open, 443 or 80, etc.
Even then I would think that China is doing deep packet, and might be able to tell that its a openvpn connection.. Even though openvpn is ssl based vpn. You can tell its not a typical handshake, etc. You might need to hide the vpn traffic inside another ssl tunnel, etc.
But lets take baby steps and make sure your server actual works ;)
-
I got your email, but you only sent the ovpn file - and not the inline version that has the certs imbedded. Please send the archive, ie ZIP file.. First download option in export client package tab. This will include the certs needed to make the connection.
-
Ok I got in, but your not handing out any dns.. And seems your behind a double nat?
Here I connected just fine and get a route out
IPv4 Route Table
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 128.0.0.0 192.168.2.9 192.168.2.10 30But you have a 128.0.0.0 mask?? huh? Going to turn on logging and connect again ..
But I can trace out using you
C:>tracert -d 4.2.2.2
Tracing route to 4.2.2.2 over a maximum of 30 hops
1 154 ms 152 ms 152 ms 192.168.2.1
2 155 ms 155 ms 154 ms 10.0.0.1
3 154 ms 212 ms 155 ms 10.52.17.254
4 154 ms 155 ms 156 ms 213.154.139.193That 2.1 is you – but why do I hit 10.x.x.x addresses ?
And since I am on 192.168.1.0/24 as well - going to be a bit of a problem.. I would suggest you change your lan to oddball network, maybe 172.18.14.0/24 or something -- this is highly unlikely to match up with any outside networks connecting into yours.
edit.. Ok here is log attached, you can see I make connection just fine.. Have an issue with our overlapping networks so I would never be able to get to your local network. If I had dns given out, 192.168.2.1 is pfsense and should work, but I can not get into your pfsense because of security check you have enabled. see other attachment
-
so i should change my dhcp to 172.18.14.0/24 ? and i have nooo idea what is 10.0.0.1
-
it shows me that 10.0.0.1 is the Gateway ….
How to disable the security check?
-
What do you have in front of pfsense? something is 10.0.0.1 – that is NOT a routable public address is a nat to rfc1918 from a public address.
I would change your local network, pfsense address and yes dhcp to be a different network other than common 192.168.1.0/24 -- I could change mine - but you most likely will run into this problem with other users, or other locations you come from.
If you check this, I should be able to get into your openvpn config and fix up some stuff. about dns, etc. And look at your wan IP and see if your behind nat, etc.
-
done!
and i don't have anything in front of pfsense.. :-\
-
Ok I got in.. But I found your running proxy!! Well explains my issue with being able to query dns once handed to me, but not able to access any sites..
I will have to look deeper.. But why do you need that proxy running? And why do you have specific routes to your dns that are .1?
Yeah your ISP is clearly natting your connection, etc. But since I can hit you on 1194, it must be a 1:1 nat – they allow traffic into you. Can you change your network - so I can point to your proxy. I am also on 192.168.1.0/24 and quite likely your friend in china could be on that very common network as well.
-
ok, i try to find find where should i modified.
And i activated the proxy for chasing but normally it's not working very well for me :P -
Can we turn it off - then I should be able to use internet through your connection
if your friend is not on 192.168.1.0 or 192.168.2. which you used for your tunnel network you should be fine. Other than fact I don't believe china will allow outbound connection on udp 1194 which is the default openvpn port..
-
i had to get it back to factory reset :-\ bat the good this is that it's brand new :)
i disabled the enforcement check but i have to setup the vpn 5 min -
Not for changing an IP you wouldn't All you needed to do was change the lan IP to new network.
-
what should i put in " Tunnel Network: " ? 192.168.1.0 ?
-
No that is a COMMON network.. something NOT common.. I use 10.0.8.0/24 for one of mine, and 10.0.200.0/24 for the other one.. I run openvpn both on tcp 443, and udp 1194
Pick something out of the rfc1918 space that you feel is not common! but using the first networks in the space is very common. Every soho router I have seen defaults to 192.168.0.0/24 or 192.168.1.0/24 etc.. ;) Not good networks to use if you might have other users connecting to you via vpn.
Then the next few are used because it makes sense.. So I have 3 segments on my network lan, wlan and dmz - I use 192.168.1.0/24 192.168.2.0/24 and 192.168.3.0/24
So if you want to make sure your not going to step on such a setup on the remote side.. You would want to use something odd ball like the 172.18.14.0/24 network I just pulled out of thin air ;)
Which I am off next week, might be about time I changed my address space around to be outside norm when helping people like you.
