• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Configuring openvpn server and client

Scheduled Pinned Locked Moved OpenVPN
43 Posts 4 Posters 9.5k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • D
    divsys
    last edited by Dec 5, 2015, 10:12 PM

    Well those log files look like the client isn't connecting properly with the server.

    I would suggest you simplify your setup down to one server and one client at first.  If you've already setup a number of other clients trying to connect to your server it maybe worthwhile to change the port# that the server listens on and update only the one test client with that new port.  That way the previous setups won't be doing conflicting connection attempts, but can be brought online fairly simply at a later date.

    So for the first connection:

    What's?:

    Server LAN address
    Client LAN Address
    OpenVPN Tunnel address

    Can you post the Server config screen?
    Can you post the Client config screen?

    -jfp

    1 Reply Last reply Reply Quote 0
    • J
      johnpoz LAYER 8 Global Moderator
      last edited by Dec 6, 2015, 2:50 AM

      this is going to cause it to fail every time

      local='auth SHA256', remote='auth SHA1'

      You have to be using the same..  I would post up your server and client configs..

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.8, 24.11

      1 Reply Last reply Reply Quote 0
      • J
        jerryxLinuX
        last edited by Dec 6, 2015, 3:14 PM

        my server conf

        dev ovpns2
        dev-type tun
        tun-ipv6
        dev-node /dev/tun2
        writepid /var/run/openvpn_server2.pid
        #user nobody
        #group nobody
        script-security 3
        daemon
        keepalive 10 60
        ping-timer-rem
        persist-tun
        persist-key
        proto udp
        cipher AES-256-CBC
        up /usr/local/sbin/ovpn-linkup
        down /usr/local/sbin/ovpn-linkdown
        local xxx.xxx.xxx.xxx
        tls-server
        server 10.0.8.0 255.255.255.0
        client-config-dir /var/etc/openvpn-csc
        ifconfig 10.0.8.1 10.0.8.2
        tls-verify /var/etc/openvpn/server2.tls-verify.php
        lport 1194
        management /var/etc/openvpn/server2.sock unix
        ca /var/etc/openvpn/server2.ca
        cert /var/etc/openvpn/server2.cert
        key /var/etc/openvpn/server2.key
        dh /etc/dh-parameters.1024
        tls-auth /var/etc/openvpn/server2.tls-auth 0
        push "route 192.168.116.0 255.255.255.0"
        route 192.168.114.0 255.255.255.0

        one doubt –---------------> in the 3rd line why its showing "tun-ipv6" im using ip4 only .

        client config

        dev ovpnc3
        verb 1
        dev-type tun
        tun-ipv6
        dev-node /dev/tun3
        writepid /var/run/openvpn_client3.pid
        #user nobody
        #group nobody
        script-security 3
        daemon
        keepalive 10 60
        ping-timer-rem
        persist-tun
        persist-key
        proto udp
        cipher AES-256-CBC
        auth SHA256
        up /usr/local/sbin/ovpn-linkup
        down /usr/local/sbin/ovpn-linkdown
        local xxx.xxx.xxx.xxxx
        tls-client
        client
        lport 0
        management /var/etc/openvpn/client3.sock unix
        remote xxx.xxxx.xxx.xxxx 1194
        ifconfig 10.0.8.2 10.0.8.1
        ca /var/etc/openvpn/client3.ca
        cert /var/etc/openvpn/client3.cert
        key /var/etc/openvpn/client3.key
        tls-auth /var/etc/openvpn/client3.tls-auth 1
        resolv-retry infinite

        server LAN address 192.168.116.254/24
        client lan address 192.168.114.254/24
        tunnel 10.0.8.0/24

        anything else????

        1 Reply Last reply Reply Quote 0
        • J
          johnpoz LAYER 8 Global Moderator
          last edited by Dec 6, 2015, 5:48 PM

          So in your client you have

          auth SHA256

          Where is auth statement in your server config??
          At a loss to how that could go missing???  Unless your manually messing with the .conf file?

          howmissing.png
          howmissing.png_thumb

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          1 Reply Last reply Reply Quote 0
          • J
            jerryxLinuX
            last edited by Dec 7, 2015, 7:45 AM

            See in my server GUI
            there is no option ,so  do i want to manually add in server.conf file?
            im using version 2.1.4

            Screenshot_3.jpg
            Screenshot_3.jpg_thumb

            1 Reply Last reply Reply Quote 0
            • D
              doktornotor Banned
              last edited by Dec 7, 2015, 7:50 AM

              @jerryxLinuX:

              there is no option ,so  do i want to manually add in server.conf file?
              im using version 2.1.4

              No. You want to upgrade your pfSense.

              1 Reply Last reply Reply Quote 0
              • J
                jerryxLinuX
                last edited by Dec 7, 2015, 11:16 AM

                ok i try in other network were pfsense is updated. and let you know.

                1 Reply Last reply Reply Quote 0
                • J
                  jerryxLinuX
                  last edited by Dec 7, 2015, 12:36 PM

                  While trying from another two network its working fine , in vpn status i got status " up and bytes sent and received are changing only in bytes:
                  but while trying to ping from one network to other it fails.

                  1 Reply Last reply Reply Quote 0
                  • J
                    jerryxLinuX
                    last edited by Dec 7, 2015, 1:21 PM

                    sorry for the wrong update , client can access the server but server is not responding to client .
                    what might be the issue .
                    while trying ping from client its success ,
                    while trying ping from server to client it fails

                    1 Reply Last reply Reply Quote 0
                    • J
                      johnpoz LAYER 8 Global Moderator
                      last edited by Dec 7, 2015, 5:31 PM

                      firewall on client is quite often blocking…

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      1 Reply Last reply Reply Quote 0
                      • J
                        jerryxLinuX
                        last edited by Dec 8, 2015, 6:57 AM

                        Still same problem , server cant able to access client
                        checked firewall i have made rules same as server on client.
                        any configuration for firewall rules do you have

                        1 Reply Last reply Reply Quote 0
                        • J
                          jerryxLinuX
                          last edited by Dec 8, 2015, 10:19 AM

                          Firewall/Rules
                          Tab OpenVPN
                          Create rule: pass, any, any, any

                          i gave all but still now no luck

                          1 Reply Last reply Reply Quote 0
                          • D
                            doktornotor Banned
                            last edited by Dec 8, 2015, 10:27 AM

                            Which part of "firewall on client" was confusing? Most importantly - there are firewall logs, use them!!!

                            1 Reply Last reply Reply Quote 0
                            • J
                              jerryxLinuX
                              last edited by Dec 8, 2015, 11:24 AM

                              how to check firewall log?
                              status–>systemlogs-->firewall tab. is it so : i have found oly tcp are blocked in my client Ip varies not the server IP is blocked in there.

                              in server config
                              what to mention in advanced option
                              push "route server.o subnet" ; route client.o subnet;
                              is this the correct way ? why we are doing this?
                              in my case
                              eg. push "route"192.168.114.0 255.255.255.0";route 192.168.140.0 255.255.255.0

                              1 Reply Last reply Reply Quote 0
                              • J
                                johnpoz LAYER 8 Global Moderator
                                last edited by Dec 8, 2015, 11:48 AM

                                Dude.. The CLIENT firewall… Why would that be in logs on pfsense?

                                What OS is your client?

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                SG-4860 24.11 | Lab VMs 2.8, 24.11

                                1 Reply Last reply Reply Quote 0
                                • J
                                  jerryxLinuX
                                  last edited by Dec 8, 2015, 12:01 PM

                                  the client firewall is also pfsense . i am trying to communicate b/w two pfsense.
                                  or i mistook your question

                                  1 Reply Last reply Reply Quote 0
                                  • J
                                    johnpoz LAYER 8 Global Moderator
                                    last edited by Dec 8, 2015, 12:49 PM Dec 8, 2015, 12:16 PM

                                    So where did you state that?  What IP are you trying to ping?  An IP on the network in your site to site connection?  Or the pfsense client vpn IP, or its lan or its wan??  What?

                                    Did you create a peer to peer or a remote access on the server pfsense?  What networks do you have at each site??

                                    edit:  Dude while I don't normally mind PMs with questions, etc..  Post your stuff in this thread… And what networks are on each side and what is the tunnel network..  Who exactly are you trying to ping..  These are basic questions that we need to know if you want any sort of help..

                                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                                    If you get confused: Listen to the Music Play
                                    Please don't Chat/PM me for help, unless mod related
                                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                                    1 Reply Last reply Reply Quote 0
                                    • J
                                      jerryxLinuX
                                      last edited by Dec 8, 2015, 1:10 PM

                                      peer to peer ssl/tls
                                      my server.conf

                                      dev ovpns2
                                      verb 1
                                      dev-type tun
                                      tun-ipv6
                                      dev-node /dev/tun2
                                      writepid /var/run/openvpn_server2.pid
                                      #user nobody
                                      #group nobody
                                      script-security 3
                                      daemon
                                      keepalive 10 60
                                      ping-timer-rem
                                      persist-tun
                                      persist-key
                                      proto udp
                                      cipher AES-128-CBC
                                      auth SHA256
                                      up /usr/local/sbin/ovpn-linkup
                                      down /usr/local/sbin/ovpn-linkdown
                                      local xxxx.xxx.xxx.xxx
                                      tls-server
                                      server 10.0.8.0 255.255.255.0
                                      client-config-dir /var/etc/openvpn-csc
                                      ifconfig 10.0.8.1 10.0.8.2
                                      tls-verify "/usr/local/sbin/ovpn_auth_verify tls 'cantonpfs' 1 "
                                      lport 1194
                                      management /var/etc/openvpn/server2.sock unix
                                      push "route 192.168.114.0 255.255.255.0"
                                      ca /var/etc/openvpn/server2.ca
                                      cert /var/etc/openvpn/server2.cert
                                      key /var/etc/openvpn/server2.key
                                      dh /etc/dh-parameters.1024
                                      tls-auth /var/etc/openvpn/server2.tls-auth 0
                                      comp-lzo adaptive
                                      persist-remote-ip
                                      float
                                      push "route 192.168.114.0 255.255.255.0"
                                      route 192.168.140.0 255.255.255.0

                                      client.conf

                                      dev ovpnc1
                                      verb 1
                                      dev-type tun
                                      tun-ipv6
                                      dev-node /dev/tun1
                                      writepid /var/run/openvpn_client1.pid
                                      #user nobody
                                      #group nobody
                                      script-security 3
                                      daemon
                                      keepalive 10 60
                                      ping-timer-rem
                                      persist-tun
                                      persist-key
                                      proto udp
                                      cipher AES-128-CBC
                                      auth SHA256
                                      up /usr/local/sbin/ovpn-linkup
                                      down /usr/local/sbin/ovpn-linkdown
                                      local 10.1.10.11
                                      tls-client
                                      client
                                      lport 0
                                      management /var/etc/openvpn/client1.sock unix
                                      remote xxx.xxxx.xxxx.xxxx 1194
                                      ifconfig 10.0.8.2 10.0.8.1
                                      ca /var/etc/openvpn/client1.ca
                                      cert /var/etc/openvpn/client1.cert
                                      key /var/etc/openvpn/client1.key
                                      tls-auth /var/etc/openvpn/client1.tls-auth 1
                                      comp-lzo adaptive
                                      resolv-retry infinite

                                      so my server ip is : 192.168.114.254
                                      my client ip is : 192.168.140.254

                                      i can ping from client(140.254) to server(114.254) , but not from server(114.254) to client(140.254)

                                      any other info needed , sorry for giving less details

                                      1 Reply Last reply Reply Quote 0
                                      • J
                                        johnpoz LAYER 8 Global Moderator
                                        last edited by Dec 8, 2015, 3:53 PM

                                        please just post up a gui shot of your client config and server config..  Your not editing the .conf manually are you?

                                        What do you have in your outbound nat on the client?  On the server?  What is the routing table on pfsense of the client look like and on the server side..  On the client you should be putting in what networks are remote..

                                        clientvpnsettings.png
                                        clientvpnsettings.png_thumb

                                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                                        If you get confused: Listen to the Music Play
                                        Please don't Chat/PM me for help, unless mod related
                                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                                        1 Reply Last reply Reply Quote 0
                                        • J
                                          jerryxLinuX
                                          last edited by Dec 8, 2015, 4:24 PM

                                          herewith i have attached all the config screenshots

                                          server.conf1.jpg
                                          server.conf1.jpg_thumb
                                          server.conf2.jpg
                                          server.conf2.jpg_thumb
                                          clent.conf1.jpg
                                          clent.conf1.jpg_thumb
                                          client.conf2.jpg
                                          client.conf2.jpg_thumb
                                          ![clentspecific overrides.jpg](/public/imported_attachments/1/clentspecific overrides.jpg)
                                          ![clentspecific overrides.jpg_thumb](/public/imported_attachments/1/clentspecific overrides.jpg_thumb)
                                          server.nat.outbound.jpg
                                          server.nat.outbound.jpg_thumb
                                          client.nat.outbound.jpg
                                          client.nat.outbound.jpg_thumb

                                          1 Reply Last reply Reply Quote 0
                                          25 out of 43
                                          • First post
                                            25/43
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                            This community forum collects and processes your personal information.
                                            consent.not_received