Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    [SOLVED]Tunnel up but no connections between client LAN to server LAN

    Scheduled Pinned Locked Moved OpenVPN
    17 Posts 3 Posters 12.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • johnpozJ Online
      johnpoz LAYER 8 Global Moderator
      last edited by

      And are these devices in your different networks running firewalls?  Tell you out of the box the windows firewall is not going to answer a ping from an IP that is not from its local network..

      A test to see if the tunnel is up is ping the IP addresses of the other sides lan interface in pfsense.

      Pinging or talking device to device that are on the lans of your different sites, you have to take into account any firewall software running on these devices and their rules as well.

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 25.07 | Lab VMs 2.8, 25.07

      1 Reply Last reply Reply Quote 0
      • R Offline
        rjabella
        last edited by

        Hi, thank you for the reply. Ive disabled all firewall software of client hosts, i can ping 10.10.10.2 tunnel ip from pfsense openvpn server which is the client pfsenses ip but i cant ping 10.10.10.1 from client box . 10.10.10.1 is the vpn servers tunnel ip

        1 Reply Last reply Reply Quote 0
        • R Offline
          rjabella
          last edited by

          no one can help me with this?  :'(

          1 Reply Last reply Reply Quote 0
          • DerelictD Offline
            Derelict LAYER 8 Netgate
            last edited by

            https://doc.pfsense.org/index.php/Why_can%27t_I_ping_some_OpenVPN_adapter_addresses

            Ping something on the LAN, not the tunnel address.

            Chattanooga, Tennessee, USA
            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
            Do Not Chat For Help! NO_WAN_EGRESS(TM)

            1 Reply Last reply Reply Quote 0
            • R Offline
              rjabella
              last edited by

              I cant ping any adress on LAN on both sides. When i looked at the servers firewall logs, i see this :

              
              action       Time                 interface         source               dest                             proto
              X	Dec 10 18:40:40 	   ovpns1 	      10.0.1.2		192.168.1.3		       ICMP 
              
              1 Reply Last reply Reply Quote 0
              • DerelictD Offline
                Derelict LAYER 8 Netgate
                last edited by

                Check your OpenVPN Firewall rules. Most people set to pass any any any to start then tighten when they know the VPN is working.

                Chattanooga, Tennessee, USA
                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                1 Reply Last reply Reply Quote 0
                • R Offline
                  rjabella
                  last edited by

                  I already added a rule in openvpn tab after creating the server to accept traffic from any to any on both sides

                  1 Reply Last reply Reply Quote 0
                  • DerelictD Offline
                    Derelict LAYER 8 Netgate
                    last edited by

                    Maybe you did it wrong because if it was right the traffic would be passing there.

                    How about you post what you have done instead of just saying what you think you have done.

                    There is nothing in your OP talking about 10.0.1.2 or 10.0.1.0/24. Where is that source IP address coming from?

                    Chattanooga, Tennessee, USA
                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                    1 Reply Last reply Reply Quote 0
                    • R Offline
                      rjabella
                      last edited by

                      Sorry for misleading you. From my OP, I indicated there tat my tunnel network is 10.10.10.0/24, it is now 10.0.1.0/24 please see my screensots

                      OVPNC-OVPN.png
                      OVPNC-OVPN.png_thumb
                      OVPNC-OVPNs1.png
                      OVPNC-OVPNs1.png_thumb
                      OVPNC-OVPNs2.png
                      OVPNC-OVPNs2.png_thumb
                      OVPNC-OVPNstatus.png
                      OVPNC-OVPNstatus.png_thumb
                      OVPNC-WAN.png
                      OVPNC-WAN.png_thumb
                      OVPNFW.png
                      OVPNFW.png_thumb
                      PLDTFW.png
                      PLDTFW.png_thumb
                      SERVERCONF1.png
                      SERVERCONF1.png_thumb
                      SERVERCONF2.png
                      SERVERCONF2.png_thumb
                      SERVERSTATUS.png
                      SERVERSTATUS.png_thumb

                      1 Reply Last reply Reply Quote 0
                      • DerelictD Offline
                        Derelict LAYER 8 Netgate
                        last edited by

                        You can't have 192.168.1.0/24 as remote networks on both sides.

                        Chattanooga, Tennessee, USA
                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                        1 Reply Last reply Reply Quote 0
                        • R Offline
                          rjabella
                          last edited by

                          so im going to remove 192.168.1.0/24 from client remote network field? i sorry for this idiotic question, i dont know what to do.  :'( i followed all the steps in the tutorial but i cant get it to work.

                          1 Reply Last reply Reply Quote 0
                          • DerelictD Offline
                            Derelict LAYER 8 Netgate
                            last edited by

                            No you are trying to VPN two networks, both 192.168.1.0/24. That can't work. Well, at least without herculean NAT efforts.

                            Chattanooga, Tennessee, USA
                            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                            Do Not Chat For Help! NO_WAN_EGRESS(TM)

                            1 Reply Last reply Reply Quote 0
                            • R Offline
                              rjabella
                              last edited by

                              Can you suggest something that i should do or change? I dont understand when you said "you are trying to VPN two networks, both 192.168.1.0/24" the server network is the only 192.168.1.0/24 network on the client pfsense is 172.16.0.0/24 thats behind a 192.168.10.0/24 ISP router.

                              1 Reply Last reply Reply Quote 0
                              • DerelictD Offline
                                Derelict LAYER 8 Netgate
                                last edited by

                                Only going by what you posted.

                                The remote networks on both client and server are shown as 192.168.1.0/24.

                                The remote networks on the server should be 172.16.0.0/24

                                On the client 192.168.1.0/24

                                Chattanooga, Tennessee, USA
                                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                1 Reply Last reply Reply Quote 0
                                • R Offline
                                  rjabella
                                  last edited by

                                  Thank you good Sir. I'll give it a try tomorrow.

                                  1 Reply Last reply Reply Quote 0
                                  • R Offline
                                    rjabella
                                    last edited by

                                    Thank you very much Mr. Derelict. My VPN is working now :)

                                    1 Reply Last reply Reply Quote 0
                                    • First post
                                      Last post
                                    Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.