Configuring openvpn server and client

johnpoz

please just post up a gui shot of your client config and server config.. Your not editing the .conf manually are you?

What do you have in your outbound nat on the client? On the server? What is the routing table on pfsense of the client look like and on the server side.. On the client you should be putting in what networks are remote..

clientvpnsettings.png_thumb

jerryxLinuX

herewith i have attached all the config screenshots

server.conf1.jpg
server.conf1.jpg_thumb
server.conf2.jpg
server.conf2.jpg_thumb
clent.conf1.jpg
clent.conf1.jpg_thumb
client.conf2.jpg
client.conf2.jpg_thumb
![clentspecific overrides.jpg](/public/imported_attachments/1/clentspecific overrides.jpg)
![clentspecific overrides.jpg_thumb](/public/imported_attachments/1/clentspecific overrides.jpg_thumb)
server.nat.outbound.jpg
server.nat.outbound.jpg_thumb
client.nat.outbound.jpg
client.nat.outbound.jpg_thumb

johnpoz

so your not natting anything through your vpn interfaces.. Fine since your just all local networks.. But you don't have anything in your remote or local networks You don't normally have to push routes.. Unless your doing something specific odd..

Where are you routing tables from pfsense?

jerryxLinuX

Routing table means? how to get that?

jerryxLinuX

I think you are asking about this

routing.jpg_thumb

jerryxLinuX

hey success man , i just made an entry in client specific overrides as " iroute 192.168.140.0 255.255.255.0" my client ip . it was success.
Thanks dude.
i have another question how to add multiple client in the server , do i want to continue my post in same thread or want to raise a new thread

johnpoz

no that is not your routing table… under diagnostics routes, it will list out your routing table.

Why should you have to put it in overrides if you would just setup the server and client correctly in the first place? With the local and remote network fields.

divsys

SSL/TLS still needs an iroute via the CSC section for each client.

Much easier in 2.2.5 than it used to be, but that iroute is often a last Gotcha in S2S links.

jerryxLinuX

ok then its necessary right.

divsys

Definitely necessary, in the current pfSense versions, you simply enter into the server screen a comma delimited list of all the subnet "LANs" on all the client OpenVPN's you want to reach.

Then in the Client Specific Overrides section you make an entry for each client and list the LAN subnets that client will use.

It seems a little convoluted for a single S2S connection, but it lets you setup a single server and easily connect many (I have a link that uses 20+) clients each with more than one subnet.

The only hitch is that the client subnets can't overlap - takes a little planning, but welcome to networking ;)

jerryxLinuX

Thank you all for helping me out . see you in next thread soon. going to configure multiple client ,if any error occurs reach you guys , please provide support…. ;D ;D 8) 8) ??? ??? ??? :P :P :P :P

jerryxLinuX

Dude another issue .
I cant export client .
there is no option in remote server what to do?

Screenshot_4.jpg_thumb

divsys

Client export is only for Remote access type OpenVPN servers ("Roadwarriors").

If you need both S2S and Remote access on the same pfSense box, I normally just create a second server instance listening on a different port and using different CA's and Server Certs.

Personally I prefer to keep them separate anyway, easier to track who's logging in remotely.

jerryxLinuX

my requirement is
one vpn server have multiple clients ==> so that users can have access all regions
if i want to work from home i need vpn key
so users from other network should connect this server using openvpn. so client export is necessary.

so what type of vpn server i have to use S2S or remote access open vpn server .

divsys

When you create an OpenVPN server you have to specify the "Server Mode":

Peer to Peer (SSL/TLS) - Used for pfSense to pfSense connections, two routers that are connected 24/7
or
Remote Access (SSL/TLS) - Used for mobile or sporadic devices, laptops, cell phones, users at home computers. They connect when needed.

As I said before, you create the type (or both) that you need for your situation.

Perhaps it would be worthwhile to draw a simple diagram of your envisioned setup so we can all be clear as to what you're trying to accomplish.

jerryxLinuX

I am not good at networking , but i tried my level best . Please acknowledge

topology.jpg_thumb

divsys

OK, that's a good start.

If we label these starting with your OpenVPN server and going clockwise:

Site1 LAN:192.168.114.0/24 OpenVPN tunnel:10.0.8.0/24

Site2 LAN:192.168.140.0/24

Site3 LAN:192.168.141.0/24 (just my guess I didn't see it posted)

Site4 LAN:192.168.142.0/24 (just my guess I didn't see it posted)

(You could add the labels and LAN subnets to your diagram to further improve the picture)

You have two different types of client connecting to your OpenVPN Server, the 3 Peer-Peer connections (Site2,Site3,Site4) and the Remote access connections (RoadWarriors -laptops, cell phones, etc.)

The easiest way to handle these IMHO is with two different OpenVPN instances on Site1.

The first you've mostly setup already with the main Peer-Peer instance.

You just need to make sure that instance has two lists entered properly:

1) "IPv4 Local Network/s" listed as: "192.168.114.0/24"
2) "IPv4 Remote Network/s" listed as: "192.168.140.0/24,192.168.141.0/24,192.168.142.0/24"

You then make individual "Client Specific Overrides" for each of Site2, Site3, and Site4 and specify in the "IPv4 Remote Network/s" which of the subnets applies to that Site.

If you've set things up properly you should have all 4 sites communicating.

For the Remote access connections (RoadWarriors) you create a second OpenVPN server on Site1.
First create a new Certificate of Authority and a new Server Certificate using that CA.
Then make a new OpenVPN server and choose "Remote Access (SSL/TLS)" for the "Server Mode"
Choose a different "Port" than you used for the Peer-Peer server (1195 will work)
Use the new Peer CA and Server certificate you just created.
Pick a different "IPv4 Tunnel Network" eg:10.0.9.0/24
List ALL the connected subnets in "IPv4 Local Network/s" : "192.168.114.0/24,192.168.140.0/24,192.168.141.0/24,192.168.142.0/24"
Save your new server and make sure you add a rule allow UDP on WAN at the port you chose.

Make certificates for your clients using the new CA and then export the packages you need for the clients.
Install the clients on your devices, connect and test.

jerryxLinuX

Hi ,

Sorry for the late reply . i was offline .

i have tried as per your suggestion , its working but

server :192.168.114.0
can access both clients : (A)192.168.140.0 , (B)192.168.116.0 .

Client A & B can access server 192.168.114.0

but client A cant able to communicate with Client B
Client B cant able to communicate with Client A

is that anything i want to add in advanced section link " route 192.168.140.0 255.255.255.0;" in client B aswell as in client A

suggest an idea.

divsys

If you want Site2 to talk to Site3's LAN through their mutual Site1 connection , you have to add Site3's LAN subnet to the list of "Local IPv4 Network(s)" in Site1's OpenVPN server configuration.

Similarly for Site3 to talk to Site2 you add Site2's Subnet to the list.

Any chance you can upgrade these sites to 2.2.4? 2.1.4 is (getting?) old…...

jerryxLinuX

Yeah good i have upgraded to 2.2.5 8) 8)

stil same problem

Site1:192.168.114.0
site2:192.168.116.0
site3:192.168.140.0

cant access site2 from site3
cant access site3 from site2
remaining all success.

can you please check the screenshots

site1.jpg_thumb

site2.jpg_thumb

site3.jpg_thumb

status-openvpn.jpg_thumb