Odd issue with setup
-
Ok I looked at the routing tables when I have VPN on and see something odd:
IPv4 Route Table
Active Routes:
Network Destination Netmask Gateway Interface Metric192.168.1.204 255.255.255.255 192.168.1.1 192.168.1.56 10
204 is the printer, 56 is my laptop.
Why is that going to the Gateway (router) and not directly to the printer. When i look at my routing tables with VPN suspended there is no route for that. Is this a NAT thing that the router doesn't know to send it back onto the LAN? If I do a traceroute it goes out the router and gets lost in the internet.
david
-
Why is that going to the Gateway (router) and not directly to the printer.
Because your VPN connection is most likely configured to send everything through the tunnel. Your local network doesn't exist when your VPN is connected. This can be changed but you have to look at your VPN software and potentially the server end if you've been given a prepackaged client like with pfSense's OpenVPN.
-
No the VPN software is told to route that one IP outside the tunnel. that is why I'm trying to figure out why it isn't working.
I do see that the software creates that route in the routing table, and removes it when VPN is suspended.
david
@KOM:
Why is that going to the Gateway (router) and not directly to the printer.
Because your VPN connection is most likely configured to send everything through the tunnel. Your local network doesn't exist when your VPN is connected. This can be changed but you have to look at your VPN software and potentially the server end if you've been given a prepackaged client like with pfSense's OpenVPN.
-
You wouldn't happen to be using the same subnet for your LAN as well as VPN network?
-
What do I need to look for to determine this?
My laptop IP is: ..1.56
My laptop VPN IP is: ..74.4 (internal corporate IP)Printer is: *.*1.204
so I think the answer is no, they are not on the same subnet.
david
-
how can you tell what subnet those are on - you left off the 2 first couple of octets and the mask… All of those could be on the same network if your mask was say /16 or /17 even that would include x.x.0-127
So your vpn IP is on a tap vs tun connection.. Why would that vpn connection not just be a tunnel network?
If your remote network is say 192.168.1.0/24 and your network behind vpn is also 192.168.1.0/24 your not going to be able to get to stuff because your remote client thinks anything on 192.168.1.0/24 is just local and no reason to go down the vpn tunnel.
-
Ok wondered if those first two numbers mattered :)
Local is 192.168.1.
Remote: 70.12.67.4 seems this number changes during the day, unless I typed the wrong the first time, but he first two numbers stay the same.david
-
If you are on 192.168.1.56 and your printer is on 192.168.1.204 and the netmask is a /24 (255.255.255.0) then pfSense is not involved at all. It is same-subnet traffic and doesn't rely on a router.
-
Exactly what I thought, and yes my net mask is 255:255:255:0
the odd this is that I see the VPN software create a route:
192.168.1.204 255.255.255.255 192.168.1.1 192.168.1.56 10
Not sure why this is necessary, and if it is causing the issue. I wonder if I could remove that route . . .
Additionally both the laptop and the printer are on the same physical switch.
EDIT: I removed the route and it didn't address the issue. What happened instead, is that tracert went into the corporate network and got lost looking for the printer, instead of going out my WAN and getting lost in my ISP network.
david
If you are on 192.168.1.56 and your printer is on 192.168.1.204 and the netmask is a /24 (255.255.255.0) then pfSense is not involved at all. It is same-subnet traffic and doesn't rely on a router.
-
Ok as I suspected IT is saying get a different router :(
They route 192.168.1.204 in the VPN tunnel to the default gateway expecting the router to route it back into the internal network, but what I see is that it gets sent out the WAN interface.
Is there a way I could put an explicit directive in the router to route this IP back into my network and not out the WAN? Why would this be different for pfsense but not all the consumer routers available?
I won't get a new router, if I have to live with it I'll just use suspend/resume, but would really like to get it to work.
thanks,
david -
OK I got it to work!!!!
Now maybe someone can tell me why I had to do this change to my firewall rules?
I added a new rule for destination 192.168.1.204, from any source to the default gateway. You can see it at the top of the rules attached.
One thing to not in the rules, is that the laptop in questions is 192.168.1.56, and there are rules for it. Could this be causing the 192.168.1.204 traffic to be caught up and sent out the WAN?
Why was this necessary?
thanks,
david