OpenVPN Routing Issue

Derelict

Then post up because if it is all as you say it would be working.

nirav.solanki

Thank you for your reply.

Do I need to add routes for VPN networks on the remote side or any extra configuration on OpenVPN server ?

Derelict

As already discussed, there needs to be an IPsec phase 2 on the remote side for the OpenVPN tunnel network (so traffic from LAN to the OpenVPN tunnel network is "interesting" to IPsec) and there needs to be an OpenVPN "Local Network" for the remote side in the OpenVPN server (That adds a route to the client so it knows to route traffic for the remote side through OpenVPN.)

And the firewall rules need to pass the traffic.

nirav.solanki

Have added Phase 2 entries for VPN network ( 10.0.8.0/24 ) and remote network ( 192.168.55.0/24 ) on both local and remote side.
Needed to add manual route for network 192.168.55.0/24 on windows system which is OpenVPN client.
Now I was able to communicate to the remote LAN systems.

PfSense doesn't push routes on client's machine. Is there any issue with the PfSense openvpn configuration ?

Derelict

pfSense OpenVPN pushes routes just fine. Has to use SSL/TLS mode though, not PSK, but that is how OpenVPN works.

nirav.solanki

Had used SSL/TLS mode but then also have to give manual routes in windows client machine to be able to get connected.

Derelict

Must've done something wrong.

nirav.solanki

I have sent attachments of my configuration, openvpn rules, phase 2 entries in ipsec tunnel on local and remote site.

1.png_thumb

3.png_thumb

4.png_thumb
![Local Site Phase 2.png](/public/imported_attachments/1/Local Site Phase 2.png)
![Local Site Phase 2.png_thumb](/public/imported_attachments/1/Local Site Phase 2.png_thumb)
![Remote Site Phase 2.png](/public/imported_attachments/1/Remote Site Phase 2.png)
![Remote Site Phase 2.png_thumb](/public/imported_attachments/1/Remote Site Phase 2.png_thumb)

awair

You don't seem to be consistent with your local/remote IPs:

Are you using 192.168.5.0/24 or 192.168.0.0/24? (See Phase 2 images)

Derelict

Those examples don't show the Phase 2 in question (OpenVPN Tunnel <==> Far side LAN).

There are usually options to not pull routes on OpenVPN clients. It is Don't pull routes in pfSense.

nirav.solanki

I have two PfSense firewalls running on the same versions 2.3.2
I have entered IPSec 2nd Phase entries of VPN Network ( 192.168.5.0/24 ) and Remote Firewall ( 192.168.55.0/24 ) on both sides.
When I connect to VPN, I can connect to all the systems behind the LAN.

But the same process I am doing on the PfSense running version 2.2, I am not able to connect.
Is PfSense versioning really a big concern ?

Derelict

Yes. Upgrade.