Site to Site with DD-WRT (SOLVED)

[viragomann]

You've set up a remote access server on pfSense, not a site-to-site.
??

[killmasta93]

im pretty sure its a site to site as everything shows connected i just cant understand why pfSense cannot contact DDWRT if there both connected

[viragomann]

Yeah, your upper screenshot of pfSense VPN server shows a remote access server, the lower one shows a site-to-site.

Is the DDWRT the default gateway in its LAN?

[killmasta93]

Thanks for the reply, yeah the upper one was a messed up, the second one is correct, when you say is the DDWRT the default gateway do you mean create a rule
or the default gateway of which the it gets from the OpenVPN? which it gets a 192.168.90.6
or the the gateway of the DDWRT which is 192.168.1.251

Thank you

[viragomann]

I asked if the DDWRT is the default gateway in the network behind (192.168.1.0/24).

[killmasta93]

yes the DDWRT is the default gateway for the network 192.168.1.0/24

[viragomann]

It seems that pfSense doesn't find the correct route to the network behind DDWRT.

Are you running multiple VPN instances on pfSense, both server and client?

Please post the IPv4 routing table from pfSense.

[killmasta93]

Thank you for the reply,
as I am also running other OpenVPN servers but there are only remote for clients

See picture for the routing

Thank you

[viragomann]

As mentioned, it doesn't matter which kind of OpenVPN instances, if you run multiple and you haven't assigned separate interfaces to them all are handled as an unique interface group.

So for correct routing you have to assign an interface to the site-to-site server. Interface > assign
At available network ports select the site-to-site server and click Add, open the new interface and enable it, also enter a proper description and save it.

[killmasta93]

Thanks for the reply so something like this? Assuming on DDWRT when it shows connected to remote address it must be the gateway? Would i also delete the Rule on openVPN for

IPv4 * 192.168.90.0/24 * * * * none

Thank you see pictures

[viragomann]

Yes, but don't set an IP address on the interface, just enable it. IP has to be set to "None"!

[killmasta93]

Thanks for the reply So configured to none but still nothing :(

Thank you

[viragomann]

Have you tried to reboot pfSense?

If it still doesn't work after reboot make a packet capture on the SitetoSite interface and select ICMP protocol while you try a ping to the DDWRT. Maybe there is something wrong with the NAT.
Post the capture output, please.

[killmasta93]

Thanks for the reply

here is the packet capture

from the packet capture only showed these lines

20:12:56.238295 IP 192.168.90.1 > 192.168.1.251: ICMP echo request, id 4676, seq 0, length 64
20:12:57.253548 IP 192.168.90.1 > 192.168.1.251: ICMP echo request, id 4676, seq 1, length 64
20:12:58.256451 IP 192.168.90.1 > 192.168.1.251: ICMP echo request, id 4676, seq 2, length 64

packet capture

http://www.filedropper.com/openvpn

Thank you again

[viragomann]

So you get no responses from DDWRT, though the pings come from the VPN server which is connected directly to the DDWRTs interface.
I think DDWRT blocks the access. Check its firewall rules.

[Derelict]

This is not a DDWRT forum.

[killmasta93]

Thanks for the reply,

@derelict, your correct but as i posted on the DDWRT forums i got yelled at saying its a server issue with pfSense

@viragomann
so this means that the routing is correct on the server side? just want to make sure before i start messing with Iptables on DDWRT

Thank you

[viragomann]

The routes look well, 192.168.1.0/24 points to the vpn client. So this subnet is routed over the vpn as the packet capture on vpn server interface shows. You should see the exactly same packets on the clients vpn interface.

[killmasta93]

Thanks for the reply, as i was investigating on DDWRT as they told me it this also i even turn off the firewall of DDWRT so i think it might be something with the routes

you have to add a static route for the OpenVPN client's local IP network to the OpenVPN server config, and use iroute to inform the OpenVPN server that that static route is associated w/ that OpenVPN client. You must address this issue before devices on the OpenVPN server side can initiate connections to devices on the OpenVPN client side.

[piperspace]

I have a working set up which I believe is similar to yours. I am in the process of upgrading from dd-wrt to pfsense with site-to-site OpenVPN.

On the server end I have pfsense running OpenVPN server on subnet 10.0.1.1/24. On the client I have dd-wrt running OpenVPN client on 192.168.122.1/24.

In order to route useful traffic over my VPN it was necessary to add the following directive to pfsense => OpenVPN => Server => Advanced Configuration => Custom options

push "route 10.0.1.0 255.255.255.0"

Also, in pfsense => OpenVPN => Client Specific Overrides => I created an entry with the Common Name (CN) of the client. In that entry Client Settings => Advanced has:

iroute 192.168.122.0 255.255.255.0

The first directive allows stations on the client lan to see assets on the server's lan. The second directive allows stations on the server lan to see assets on the client lan.

Hope this helps.