Site-to-site loop - How to stop the loop?

johnpoz

So you setup site to site vpn between A and B and C and B? Or A an C are just road warriors into B?

So you created a route that Tells A hey to get to C go to B? Or your just default routing it out?

Fmslick

A an C are just road warriors into B?

A an C are just road warriors into B

Just default routing it out?

Yep, I added the ip's of Home (A):192.168.3.x & Other (C):192.168.1.x into filed "IPv4 Remote network(s)" under the OpenVPN server tab on Colo (B) … Then did the same on A & C under the client tab but I left out the LAN or local network of that site and only added the remote networks. Should have I created a route??

just to add some more info.

2.3.4-RELEASE-p1 (i386)
Colo (B) the firewall and server for openvpn on a Watchguard X550e

Thanks for your reply johnpoz :)

Untitled.png_thumb

johnpoz

"Yep, I added the ip's of Home (A):192.168.3.x & Other (C):192.168.1.x into filed "IPv4 Remote network(s)" "

Huh? If your server is road warrior server, why would you setup any remote networks?? If your going to setup your server as s2s then the clients should be s2s as well, not remote access..

You have pfsense at site A and B right?

https://doc.pfsense.org/index.php/OpenVPN_Site_To_Site

Fmslick

@johnpoz:

"Yep, I added the ip's of Home (A):192.168.3.x & Other (C):192.168.1.x into filed "IPv4 Remote network(s)" "

Huh? If your server is road warrior server, why would you setup any remote networks?? If your going to setup your server as s2s then the clients should be s2s as well, not remote access..

Sorry. I must have miss understood "road warrior" (Did have my coffee yep :o an just so I know im on the same page. road warrior=mobile? ), no the server and clients are not "road warrior"…
So you setup site to site vpn between A and B and C and B?yes!? if I am reading this right this time… (look at pic in post up there^)

You have pfsense at site A and B right?

Yes

https://doc.pfsense.org/index.php/OpenVPN_Site_To_Site

I did follow this tutorial to get everything up and running, as it said to add remote networks..

Server settings: "IPv4 Remote networks : Enter the remote (Client Side) LAN here. To access more than one network, add them all here separated by a comma (e.g. 10.10.10.0/24, 192.168.10.0/24)."

Client Settings: "IPv4 Remote networks : Enter the remote (Server Side) LAN here. To access more than one network, add them all here separated by a comma (e.g. 10.10.9.0/24, 192.168.9.0/24)."

–
Screenshots of server settings and client settings.

Screenshot_25 is the server side B
Screenshot_26 is client side C

Screenshot_25.png_thumb

Screenshot_26.png_thumb

johnpoz

"I did follow this tutorial to get everything up and running, a"

And did you see where the other site is also s2s and not road warrior..

according to your drawing your C site is 192.168.1.. But you have on its client setting that 192.168.1 is remote! That is not the case the networks that are remote from it or B and A, not itself.

Fmslick

@johnpoz:

And did you see where the other site is also s2s and not road warrior..

Quote what you are talking about from the tut.. By road warrior do you mean client?

according to your drawing your C site is 192.168.1.. But you have on its client setting that 192.168.1 is remote! That is not the case the networks that are remote from it or B and A, not itself.

That is a typo (C is 192.168.2.x) see Attachment.

Untitled.png_thumb

johnpoz

"Quote what you are talking about from the tut.. By road warrior do you mean client?"

Yes the CLIENT!! You stated it was road warrior or remote access.. That is not how you do it..

@Fmslick:

[A an C are just road warriors into B
[/quote]

"That is a typo (C is 192.168.2.x) see Attachment."

Your new attachment shows 192.168.1 - dude can not help you without correct info…

Fmslick

Sorry, lets start over!

I have listed all of my setting on all the box's , if I have some wrong settings or just effed up just say so lol.

A: 192.168.3.x - Home network
B: 192.168.2.x - Openvpn servers
C: 192.168.1.x - Other network

A: 192.168.3.x - Home network
General Information
Client A
Server mode: p2p (Shared Key)
Device mode: tun
Interface: WAN
Local port: blank

Tunnel Settings
IPv4 Tunnel Network: 10.1.200.0/24
IPv6 Tunnel Network: blank
IPv4 Remote network(s): 192.168.1.0/24,192.168.2.0/24
Disable IPv6: yes
–--------------------------------------------------------------------------------------
B: 192.168.2.x - Openvpn servers
Server settings to (A)
Server mode: p2p (Shared Key)
Device mode: tun
Interface: WAN
Local port: blank

Tunnel Settings
IPv4 Tunnel Network: 10.1.200.0/24
IPv6 Tunnel Network: blank
IPv4 Remote network(s): 192.168.3.0/24,192.168.1.0/24
Disable IPv6: yes

General Information
Server to other (C)
Server mode: p2p (Shared Key)
Device mode: tun
Interface: WAN
Local port: blank

Tunnel Settings
IPv4 Tunnel Network: 10.0.100.0/24
IPv6 Tunnel Network: blank
IPv4 Remote network(s): 192.168.1.0/24,192.168.3.0/24
Disable IPv6: yes

[[b]Why did I use two OPENVPN servers you may ask? Well I tried to use one but could not get it to work so I googled and found this video https://youtu.be/8f13lfnEKY8 and it worked. is using two OPENVPN servers wrong? ]
–---------------------------------------------------------------------------------------
C: 192.168.1.x - Other network
General Information
Client C
Server mode: p2p (Shared Key)
Device mode: tun
Interface: WAN
Local port: blank

Tunnel Settings
IPv4 Tunnel Network: 10.0.100.0/24
IPv6 Tunnel Network: blank
IPv4 Remote network(s): 192.168.2.0/24,192.168.3.0/24
Disable IPv6: yes

Is there more info you need johnpoz?

Untitled-1.jpg_thumb

Derelict

Do this:

B: 192.168.2.x - Openvpn servers
Server settings to (A)
Server mode: p2p (Shared Key)
Device mode: tun
Interface: WAN
Local port: blank

Tunnel Settings
IPv4 Tunnel Network: 10.1.200.0/24
IPv6 Tunnel Network: blank
IPv4 Remote network(s): 192.168.3.0/24~~,192.168.1.0/24~~
Disable IPv6: yes

Server setting to(C)
General Information
Server to other (C)
Server mode: p2p (Shared Key)
Device mode: tun
Interface: WAN
Local port: blank

Tunnel Settings
IPv4 Tunnel Network: 10.0.100.0/24
IPv6 Tunnel Network: blank
IPv4 Remote network(s): 192.168.1.0/24~~,192.168.3.0/24~~
Disable IPv6: yes

You are attempting to create an OpenVPN route for both remote sites on both openvpn tunnels. You only need to define the remote networks that are actually remote on that connection.

You are probably seeing all kinds of strangeness because the OpenVPN process that starts first gets both routes and the other one fails to add the routes because they already exist.

Fmslick

@Derelict:

Do this:

B: 192.168.2.x - Openvpn servers
Server settings to (A)
Server mode: p2p (Shared Key)
Device mode: tun
Interface: WAN
Local port: blank

Tunnel Settings
IPv4 Tunnel Network: 10.1.200.0/24
IPv6 Tunnel Network: blank
IPv4 Remote network(s): 192.168.3.0/24~~,192.168.1.0/24~~
Disable IPv6: yes

Server setting to(C)
General Information
Server to other (C)
Server mode: p2p (Shared Key)
Device mode: tun
Interface: WAN
Local port: blank

Tunnel Settings
IPv4 Tunnel Network: 10.0.100.0/24
IPv6 Tunnel Network: blank
IPv4 Remote network(s): 192.168.1.0/24~~,192.168.3.0/24~~
Disable IPv6: yes

You are attempting to create an OpenVPN route for both remote sites on both openvpn tunnels. You only need to define the remote networks that are actually remote on that connection.

You are probably seeing all kinds of strangeness because the OpenVPN process that starts first gets both routes and the other one fails to add the routes because they already exist.

Hey thinks that worked, after removing ~~,192.168.3.0/24~~ & ~~,192.168.1.0/24~~ from C on the two servers ping and tracert is now working and not looping. So I see what I was doing wrong after you pointed it out, think you for this Derelict.