Cant get OpenVPN to work
-
Hi guys,
Im new to pFsense and using it for the past 3 weeks.
My setup is as follow
Pfsense is installed over a PC with 3 eth interfaces.LAN is under 10.0.0.0/24
pfense: 10.0.0.138WAN1 - ADSL connection ( ppoe )
WAN2 - CABLE connection ( DHCP ) - cable router makes the connection and pfsense box is on DMZ with mac address reservation
Lan - connected to HP switch for other computers to login.everything is working with the internet and network i have several nat rules to allow port 80 and 22 to a server i have here.
problem all started when i decided i want to establish VPN connection.
first ive thought about pptp but saw the big warnning about its not being secured and moved to OpenVPN.
i went through several how-to guides found on pfsense docs, users based guides and did the following:
1. created certificates
2. created user
3. installed openvpn export
4. configured openvpn server with the wizard :
server mode: remote access (ssl/tld + user auth)
backend: local database
protocol: udp
device mode: tun
interface: wan2
port: 1194
TLS authentication enabled and the certificate is inside
peer certificate: VPNACA (created earlier )
server certificate: pfsense openvpn(ca:vpnca)*in use
DH parameters length: 2048
Encryption algorithm: AES-256-CBC-HMAC-SHA1(256-bit)
Hardware Crypto: no hardware acceleration
IPv4 tunnel network: 10.0.10.0/24
force all client generated traffic through the tunnel is checked
concurrent users: 10
compress is enabled and so do inter-client communications
client settings:
dynamic ip: checked
address pool: checked
dns: 10.0.0.138 , 8.8.8.8i used export to get the ovpn folder to my mac.
tried to connect using tunnelblick and got TLS timeout not being able to handshake.firewall rules on WAN2 is allowing openvpn (1194) from any on ipv4 udp
firewall rules on openvpn is any to anywhen i activate outbound nat i lose internet connectivity for all computers inside the network(internet not lan)
im not sure what im doing wrong but after 8 hours reading topics i decided to open my own topic and use your kind help.
Thanks !
-
Ensure that the WAN2 is reachable from your clients.
Check the OVPN Log at pfSense to see if the client can reach the server. Status > System Logs > OpenVPN.For troubleshooting, it could be useful to add a test user without privileges and certificate and switch the OVPN server mode to "user auth" to prevent certificate failures. Depending on the client, the failure massage "TLS timeout" can be the same for both cases, when server is unreachable and bad / wrong certificate is used.
-
Yeah where exactly are your clients? So your on a double nat, you mention pfsense being in dmz? What is the network pfsense is getting on the wan? And how is the client suppose to talk to pfsense via IP or is it resolving some name.. Does that name resolve on the client to the correct ip?
-
First of all, thanks alot for taking the time and trying to help me, im sorry guys for this missing info, first post here and as i mentioned new to pFsense.
im working with password authentication.
i managed several times to login with the openvpn but when i am logged in i can go to http://10.0.0.138 and enter pfsense.
besides that , i have no internet , i was able to go to http://10.0.0.9 which is the web interface of the NAS.
i read about this issue and everywhere it says that i need to add outbound nat, when i do so, my entire network lose internet connection ( LAN ONLY )
pfsense on WAN2 is on the DMZ so all ports will be forwarded to it , and then i can control everything from the pfsense.
i tried the same just for a check with pptp , i am able to login to the pptp vpn but no internet connection.now im not really sure what i did, but i am unable to connect to OpenVPN ( i get timeout after waiting for server to respond )
about resolve issues, ive used ips all along so it wont be an issue.
-
Not sure if its relevant but:
when i tried using openvpn with encryption algorithm: AES-256-CBC-HMAC-SHA1(256bit)
i got an error in my openvpn client (tunnelblick) on my macbook saying: "cipgher algorithn 'aes-256-cbc-hmac-sha1' not found (OpenSSL)
and when i look in pfsense openvpn log i see that it contacted the openvpn untill i got "SIGTERM[hard]received process exiting"
which im assuming is when the client tried to use the aes-256-cbc-hmac-sha1 and got an error"i googled and couldnt find anything usefull so i changed the encrpytion on the openvpn server to AES-256-CBC(256-BIT)
now my vpn client says: "established communications with openvpn"
and several lines below it says:
udpv5 link remote 192.168.3.3:1194 ( which is the WAN2 DHCP address from the ADSL router)
below it says: "TLS key negotitaion failed to occur within 60 seconds)
no log presented in the pfsense openvpn log.do i need to open any other rule to allow TLS negotiation ?
any idea what im doing wrong ? -
"192.168.3.3:1194"
How could you possible ever expect to connect to a rfc1918 address from the public internet?
PM me your config please.. Why would you not just run the wizard to setup openvpn - click click done!! It creates the firewall rules for you - and you sure and the hell do not need to create any outbound nats by hand. Did you turn off automatic nat?
pfsense out of the box is click click and you have a openpvn server. So unless you have gone in and like turned off automatic nat, did not let it create your firewalls you should have had no issues other than your behind a double nat?? Or you put in the wrong tunnel network or remote networks, etc.
-
Hi Johnpoz, Thanks for your reply.
I did created the openvpn with the wizard, my WAN interface is 192.168.3.3 which is the DMZ of the ADSL router.
i did had to change on the client to use the external ip of the DSL connection.i found that if the openvpn server encryption algorithm to "none (no encryption) i am able to connect.
at the moment im going one by one to see which algorithm will work. -
They should all work… So you setup the certs when you ran through the wizard..
So seems you have a client issues - your mac, did you install the viscosity client? https://www.sparklabs.com/viscosity/
-
nope, i am using TunnelBlick which is free, well, it was weird but i called my DSL provider to ask him if i use DMZ if there is any chance that their router is still taking some ports or blocking stuff.
he told me to disable "SIP ALG" and everything works :)
weirdest thing i have ever came across. -
But your not using the sip port are you.. Application gateways can rewrite packets, etc.. But shouldn't mess with the openvpn traffic.. Curious test would be to turn that back on and use tcp vs udp for your vpn connection.
I normally run openvpn on tcp 443 as well as the default udp 1194 since many places block that.. But its normal safe bet that 443 is open if there is internet access at all.
-
i thoguht about that at the beginning but since im using nat for both 80 and 443 for my development box i cant test the OpenVPN on it.
i turned the SIP ALG back on , but for some reason it is still working.honestly , im clueless, as long as it works, im an happy man.
