Windows 7 OpenVPN client can't reach the LAN

[georgeman]

All you posted looks fine for me.

Check also your Outbound NAT settings (I have just read a topic where that was the problem). There shouldn't be any rules for the OpenVPN interface

[Rob Pomeroy]

@georgeman:

All you posted looks fine for me.

Check also your Outbound NAT settings (I have just read a topic where that was the problem). There shouldn't be any rules for the OpenVPN interface

Automatic outbound NAT is switched on. No other mappings.

[Rob Pomeroy]

Is it possibly an issue that my VPN tunnel network (10.12.43.0/24) is within my LAN (10.12.0.0/16)?

And is this firewall rule on the OpenVPN interface sufficient?

Proto  Source  Port  Destination  Port  Gateway  Queue  Schedule	Description	
IPv4   *       *     *            *     *        *      none      OpenVPN My company VPN wizard

[Rob Pomeroy]

@Rob:

Is it possibly an issue that my VPN tunnel network (10.12.43.0/24) is within my LAN (10.12.0.0/16)?

Switched the VPN tunnel net to 192.168.20.0/24.  Still nothing travels into the LAN.  :-\  I've temporarily disabled the firewall on the client.  Doesn't help though.

[Rob Pomeroy]

Does this entry in the log shed any light on the problem?

Nov 20 10:30:08	openvpn[36283]: rob.pomeroy/e.f.g.h:49386 Authenticate/Decrypt packet error: bad packet ID (may be a replay): [ #95045 ] -- see the man page entry for --no-replay and --replay-window for more info or silence this warning with --mute-replay-warnings

[marvosa]

Post your server1.conf.

[Rob Pomeroy]

Okay:

dev ovpns1
dev-type tun
tun-ipv6
dev-node /dev/tun1
writepid /var/run/openvpn_server1.pid
#user nobody
#group nobody
script-security 3
daemon
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
proto udp
cipher AES-128-CBC
up /usr/local/sbin/ovpn-linkup
down /usr/local/sbin/ovpn-linkdown
client-connect /usr/local/sbin/openvpn.attributes.sh
client-disconnect /usr/local/sbin/openvpn.attributes.sh
local a.b.c.d
tls-server
server 192.168.20.0 255.255.255.0
client-config-dir /var/etc/openvpn-csc
client-cert-not-required
username-as-common-name
auth-user-pass-verify /var/etc/openvpn/server1.php via-env
tls-verify /var/etc/openvpn/server1.tls-verify.php
lport 1194
management /var/etc/openvpn/server1.sock unix
max-clients 50
push "route 10.12.0.0 255.255.0.0"
push "route 192.168.3.0 255.255.255.0"
push "dhcp-option DOMAIN mycompany.local"
push "dhcp-option DNS 10.12.20.6"
push "dhcp-option DNS 10.12.20.7"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
push "dhcp-option NTP 10.12.20.6"
push "dhcp-option NTP 10.12.20.7"
ca /var/etc/openvpn/server1.ca 
cert /var/etc/openvpn/server1.cert 
key /var/etc/openvpn/server1.key 
dh /etc/dh-parameters.1024
tls-auth /var/etc/openvpn/server1.tls-auth 0
comp-lzo
persist-remote-ip
float
topology subnet

[Nachtfalke]

Do the clients on the LAN allow pings from the OpenVPN network? Try to turn off firewall on the clients temporarily.

[marvosa]

Export a new config and install it on the client-side.

Post new exported client config.

Post Pfsense routing table.

Post client routing table once connected with new config.

[Rob Pomeroy]

Thanks for your input.

The quantity of issues I'm having with pfSense is rising,  Now I'm getting failures on attempting to log in:

Warning: session_start(): open(/var/tmp//sess_1e36ef0d17d9b13cdeb3d59c25e8e0ab, O_RDWR) failed: No space left on device (28) in /etc/inc/auth.inc on line 1357

There's plenty of space, so I'm going to guess there's some filesystem-level corruption of some kind, in which case all bets are off.  sigh  Time to reinstall.

[Rob Pomeroy]

Completely reinstalled pfSense and what do you know?  It's working.

Hypotheses:

• Corruption of original installation and/or

• Using older version of OpenVPN Client Export pacakge and/or

• Some other installed package caused a problem (have installed this fairly lean on this occasion).

Thanks to all for your help.  I'm going to snapshot this virtual machine while it's working!!!