[SOLVED] PFSense 2.2.4 + OpenVPN 2.3.8: Can not create OpenVPN connection
-
you really need a /16 on your lan? So you have how many devices on this lan??
That is going to be really fun to try and vpn into when your at a place and they use anything in 172.16-31 on their end..
-
I will surely not connect 65534 devices into the LAN. :-) I did not see any disadvantages using B Class network. I can have maximum of 150 devices, but it could make my life easier when planning network address spaces, having still enough space for devices to grow.
What I do not like very much, if I have my network address spaces planned and say, I plan for 10 Printers. However, after couple of years, we need 11th one. This 11th printer does not fit anymore in the reserved address space, and I have to place it somewhere else.
Are there any disadvantages when using B class networks, please? It looks they are but I did not quite get the full meaning of your message:
"That is going to be really fun to try and vpn into when your at a place and they use anything in 172.16-31 on their end.."
Could you please explain a bit more? Thanks.
-
Yeah, the disadvantage is that you will not be able to connect from any place using the 172.16/12… Sigh.
-
so rfc1918 space is used EVERYWHERE.. So lets say your at starbucks on their wifi and you want to vpn into your network.. What is their local space 192.168.0/24? what if they are using 172.16.0/24 using such a large segment on your side begs for overlap. Say you have a device on 172.16.0.14 now your vpn client says well I have a locally connected network where that IP would be - why should I go down the tunnel to get to it.
You should use an uncommon rfc1918 on your local network say 192.168.14.0/24 - this is 254 addresses - that is hell of a lot of printers ;) Or use a /23 if you really want…
I am not suggesting you use a /28 if you have 14 devices.. But there has to be a more realistic mask vs the number of devices you have and 65K of them!!
Bad IP planning is why we ipv4 space is gone.. While doesn't matter all that much on a local network using rfc1918 space.. Its just the attitude sure lets use address space for 65K when I have 100 devices.. You would NEVER in a million years ever want to put that many devices on the same broadcast domain ever anyway. I would say a /24 or /23 a /22 would be a lot of devices broadcasting!! When you start to get a lot devices you have multiple segments. Say servers on 1, printer on another, end user devices on another, wifi on another.. You don't put everything on a /16..
-
Hi Johnpoz, Doktornotor,
thank you both for your explanation. It makes sense now. The source place from which I connect to my target network per VPN may not contain the source place IP Addresses. It really makes sense. I can dedo my design easily and i will gladly do it.
What would you say to 130.130.130/23 for my network, please? Does it look acceptable to you? Is the network small enough and unique enough fror a LAN?
Thank you. Kind regards,
-
So you have no clue to what rfc1918 space is then? 10.x.x.x/8 192.168.x.x/16 172.16.x.x/12
https://en.wikipedia.org/wiki/Private_network
That space is owned by
inetnum: 130.130.0.0 - 130.130.255.255
netname: UOWNET
descr: University of Wollongong
country: AUAre you them? Then don't use their space!! That is BAD BAD practice!!!! There is plenty of space to use in the private space - no reason to grab public space and use it on your network.. While technically it can be done - its BAD!!! and ever want to go to actual 130.130.130.x on the public internet your not going to get there.
Use something like 172.30.42.0/24 which is highly unlikely to be duplicated at some other site you might want to vpn from..
Common ones to avoid are 192.168.0/24 or 192.168.1/24 for 10.0.0/24 172.16.0/24 –- people like to grab the first subnets in a range 10.1.1/24 is common as well because its easy to type or 10.10.10/24
My main lan is 192.168.9/24 never seen it in use anywhere.. Then my other segments are .2,.3,.4 and .5 while .2 is common maybe even .3 I have multiple segments with some device I could bounce off of to get where I needed to go in my network in a worse case scenario where I was located was overlap one of my segments.
-
Hi Johnpoz,
I am getting really good information from you. Yes, to be honest, I was completely unaware of RFC1918 and about any regulation of what private address space should I use. I have many times wondered, why internal IP address spaces usually start with 172.16.x.x or 192.168.x.x, and why administrators are not a bit more creative. Now I understand.
So to move next step further, I would then go with: 172.20.20/23
This should be in accordance to what you and others told me. So I hope it will pass even your judgement. :-) However, if there is anything wrong with my slection, please, do not hesitate to tell me. :-) Thank you.
-
That would be fine - I personally think /23 is fairly large.. Do you have that many devices?
Keep in mind while 172.20.20/23 is valid private network 172.20.19/23 would not be since it doesn't fall on the border - that would be host in the 172.20.18/23 network.
It would behoove you to do a bit of reading on networking - if you have any questions on subnets, etc. PM me be happy to help.
/24 or 255.255.255.0 is very good border because it is human friendly to read very quickly what the network is and what the host when you get something like your 172.20.20.0 while that is a network 172.20.21.0 is a host if your mask is /23 and 172.20.20.255 is also a valid address with a /23 mask but would be broadcast address if /24
-
Hi Johnpoz,
thank you for this valuable information. To answer your question if I have so many devices, then no I don't. However, the reason why I have decided for /23 subnet mask bits is that I will have almost all the computers connected to this LAN to use Intel AMT. Intel AMT technology allows me to connect to all of them via KVM on hardware level. This is important because the LAN will be over 300 KM distant from me and I need to have good KVM connection.
Regarding the reserved address space, I plan the following:
-
The computers and other devices will use the range: 172.20.20.1 - 172.20.20.254
-
Intel AMT KVM IP addresses will use the range: 172.20.21.1 - 172.20.21.254
-
Device IP Address and its KVM IP Address will have identical last octets from their IP Addresses
An Example:
A server on this network will have its IP Address 172.20.20.1, while Intel AMT KVM IP Address to this device will be: 172.20.21.1.
This is my solution to having access to the devices transparent and easy to use. At this moment, it is for me hard to say, whether this transparency level overweights my /23 address space, but after evaluating what you've just told me, I think I will not do too much harm keeping this kind of address space. I would be happy to hear, what you think. Thank you.
Kind regards,
-
-
Why would you not put the KVM IP space on its own segment? so you have 172.20.20.0/24 for you devices and 172.20.21.0/24 for your KVM IPs
No it becomes very easy to control access into this KVM segment.
-
To answer the question why, well just for transparency reasons. Yes you are correct, I have 172.20.20.0/24 for my devices and 172.20.21.0/24 for your KVM IPs.
In other words, if I know that a device has IP Address: 172.20.20.10, then its KVM must be 172.20.21.10. I do not need any further table, and know the KVM address out of my head.
-
Well if you have 2 /24 why are you thinking you need to use a /23??
-
Well if you have 2 /24 why are you thinking you need to use a /23??
Well with my limited knowledge I think that I establish VPN network from my remote network to the target network. It means I have to define my destination network into when configuring OpenVPN.
If I enter 172.20.20.0/24 as my destination network (IPv4 Local Network in OpenVPN Tunnel Settings) I will be able to reach the devices but not their KVM IP addresses accessed through 172.20.21.0/24.
If I enter 172.20.21.0/24 as my destination network (IPv4 Local Network in OpenVPN Tunnel Settings) I will be able to reach KVMs but not the devices themselves accessed through 172.20.20.0/24.Maybe that is completely incorrect, but it is how I see it now. Entering 172.20.20.0/23 will allow me to access both, the devices and their KVMs.
-
2 /24 networks is a better solution. What would you do if you wanted to allow someone access to the desktop network but not the kvm network?
You can add additional network routes in the openvpn additional options section. -
Hi Thermo,
thank you very much for your comment. Knowing how to access two networks will definitely be good think to know, and yes, as you said, 2 /24 networks may be a better solution. I will take a look at this. Thank you.
-
so you put in multiple networks as your local, or just route /23 even though you have /24 you could just route 172.16/12 if you wanted too..
-
Hi Johnpoz, Thermo,
I have redone that, as you recommended. As part of my learning process it was great exercise:
-
IPv4 Tunnel NEtwork: 192.168.188.0/24
-
IPv4 Local Networks: 192.168.168.0/24, 192.168.169.0/24
That is correct, that I will have a bit more flexibility now to grant access to only one network if needed. Thank you.
-
