Can't connect to my own OpenVPN server now

[Derelict]

Set the Destination address on the firewall rule to WAN address there. Probably will not matter but dest any is improper.

What is in the OpenVPN server logs when you try to connect.

If you have changed the server to listen on WAN address UDP 1194 and have a firewall rule on WAN passing traffic from any to dest WAN address UDP 1194 then either the packets aren't arriving or the OpenVPN server should be logging something.

Be sure you run another client export and reconfigure the client after you have all that set.

[sos]

Thanks again.

Followed those steps & re-exported the client config (now port 1194).

I checked the open VPN logs (log level 3) - no sign of any client connection attempts, so it looks as though the packets aren't getting through for some reason. Client is a linux laptop, using network manager and importing the ovpn config file. Also tried from the terminal as per the error message in my first post.

FWIW I can readily access my webserver on the same web address (ratiro.dynu.com) served from a machine connected to the router through Port 80, so I know my pfSense router is connected and able to serve at least port 80.

[Derelict]

You can prove the packets are or are not arriving with a packet capture on WAN on UDP 1194 with an address of the client's public egress IP address.

[maverick_slo]

Had the same thing.
Left all untouched, rebooted and all was working again…

[sos]

@maverick_slo:

Had the same thing.
Left all untouched, rebooted and all was working again…

Heh - if only!

I've set up a static IP address, which I've been meaning to do for a while, but was prompted to do so now just in case it was some funny business with my dyn DNS provider. Still not working with the static IP address.

Interestingly I can connect to the VPN from within the LAN, which I never used to be able to do, but still cannot do so from the WAN, which rather defeats the purpose. I jsut cannot work out what rule(s) or network setup has changed to ellicit this behaviour.

[johnpoz]

"Interestingly I can connect to the VPN from within the LAN, which I never used to be able to do, but still cannot do so from the WAN"

Not sure how that is interesting.. If the packets are not getting there, then there is no way to connect..  Your saying openvpn is not logging any connection attempt.. What is your client saying?  As derelict suggested sniff on your want for the traffic.. Do you see any when you try to connect?

Are you using IP or some dynamic dns name?  Is it resolving to your current public IP?

[sos]

Thanks, johnpoz.

It's perhaps not so much interesting, as at least confirming that my VPN server and client can connect with each other, just not from the WAN.

My server is on a static IP now, and my webserver is accessible and resolving through the same public IP as the VPN server.

The client is failing silently, as per the terminal message in my first post - but I will dig deeper into some logs and sniff some packets as suggested when I get a chance.

[sos]

Ahem. Have now learnt all about the 'Packet Capture' feature under 'diagnostics'. It's always good to learn more about pfSense and take another step on the path to enlightenment :)

Here is the result when I try to connect from my Android phone over 3G. It indicates that the packets are at least getting to pfSense:

08:20:05.123926 AF IPv4 (2), length 86: (tos 0x0, ttl 54, id 23168, offset 0, flags [DF], proto UDP (17), length 82)
    xxx.xxx.xxx.xx.xxxx > 219.88.232.203.1194: [udp sum ok] UDP, length 54

[johnpoz]

So that is a good thing.  But if your server is not showing a connection attempt then either your firewall rules are not allowing it to get to the openvpn server, or openvpn server is not running on the wan, or 1194 udp, etc.

[Derelict]

Again, why are you listening on LAN address and forwarding to LAN address?

You do not need a port forward to run OpenVPN. All you need to to is tell the server to listen on WAN address and pass UDP 1194 from any to WAN address. Delete the port forward.

[sos]

@Derelict:

Again, why are you listening on LAN address and forwarding to LAN address?

You do not need a port forward to run OpenVPN. All you need to to is tell the server to listen on WAN address and pass UDP 1194 from any to WAN address. Delete the port forward.

Thanks again, guys.

1. I'm listening on the WAN, UDP protocol, port 1194 - that was how I'd set up the packet capture, while trying to connect to the VPN using my android phone i.e from the WAN. I don't think I'm listening on the LAN and forwarding to a LAN address  ???

2. As indicated in the 3rd post in this thread, I did follow your helpful advice and delete that port forward rule.

3. Other than that, my firewall rules seem to be in order, and those udp packets are confirmed as arriving on port 1194 of the pfSense/openVPN host @ WAN IP 219.88.232.203. But they seem to be dying there, with nothing in the openVPN logs. I am trying to work out what the firewall is doing to them now.

4. Temporarily disabling firewall/NAT allowed the client to connect.

5. But I still cannot figure out which of my firewall rules is causing the issue  :'(

[Jerod]

Any luck?

I am having the same problem as you are. My tracer shows me hitting my pfsense, but doesn't allow me to connect. It hasn't worked for a about a month.

Jerod

[sos]

No,sadly. I've put fixing it on the back burner until after Christmas, as I am probably going to have to try a fresh install.

[AndyC]

Are you guys using Android devices to connect? I had the same issue and checked everything in pfsense. It turned out to be a problem with the power-saving feature in an Android update. Turning that off or adding OpenVPN Connect as an exception in power-saving made everything work again. Just a thought.

[johnpoz]

4. Temporarily disabling firewall/NAT allowed the client to connect.

Well post up rules, both on your wan, your floating and your nats..  And your openvpn config..  You sure actually listening on your wan??  Just removing a nat that sent to your lan IP doesn't change vpn to listen on your wan address.

Do a sockstat and lets where pfsense is listening for 1194

example

[2.3.2-RELEASE][root@pfsense.local.lan]/root: sockstat -L | grep :1194
root     openvpn    25696 5  udp4   24.13.snipped:1194     *:*
[2.3.2-RELEASE][root@pfsense.local.lan]/root:

[sos]

I thought I had it cracked when I uninstalled pfBlockerNG and my android phone connected. As I had also relaxed my firewall rules (allow any from any), when I reinstituted the correct firewall rule (allow UDP:34982 on WAN address), it stopped working again. Resetting the any-from-any rule, it no longer connected again.

[2.3.2-RELEASE][admin@ratiro-net.ratiro]/root: sockstat -L | grep :34982
root     openvpn    11123 6  udp4   *:34982               *:*

I have attached my firewall rules, NAT and openVPN config pages. There are no floating rules defined.


[TechnologicalLiving]

I think that you're trying this via celluar, correct?  If so, your carrier wouldn't be T-Mobile would it?

[sos]

@TechnologicalLiving:

I think that you're trying this via celluar, correct?  If so, your carrier wouldn't be T-Mobile would it?

Yes to cellular (3G), but no to T-Mobile… it's 2-degrees/vodafone (NZ)

[hp408]

I have exactly the same problem. Tried it with android and surface 4. T-Mobile and Vodafone (both LTE) cellular network: I can't connect to the openvpn-server.

Server listens to port 1194:

[2.3.2-RELEASE][root@pfs.local.net]/root: sockstat -L | grep :1194
root     openvpn    16667 6  udp4   95.88.x.x:1194    *:*
[2.3.2-RELEASE][root@pfs.local.net]/root:

WAN-Rule:
(red0 = WAN)

OpenVPN-Rule:

I deactivated my WAN-failover and all outgoing vpn-connections (all on other ports) for testing but it didn't work.  :-\

[Derelict]

Packet capture on RED0 for UDP 1194 and try to connect and verify connection attempts are actually arriving on RED0 Address.