Route traffic from Client VPN Network to Network on other side of Site-to-Site IPSec VPN?
-
@viragomann Yyes, 172.16.42.0/29 is the OpenVPN tunnel network. Firewall interfaces are all set to wide open ATM for testing. I'll do some packet capturing to see what's going on.
-
I'm thinking that I need a static route but since I can't set the IPSec tunnel as an interface and thus gain a gateway I can't do that yet. It looks like that feature is coming in 2.4.4.
-
That shouldn't be necessary since you have only one IPSec connection.
What you're trying to achieve have other guys already accomplished here. So it should also be possible in your setup. -
@viragomann Ok than that is frustrating. Hmmmmm.
-
So try some troubleshooting.
A traceroute from a vpn client.
Packet capture.That should be an easy challenge.
-
@viragomann said in Route traffic from Client VPN Network to Network on other side of Site-to-Site IPSec VPN?:
So try some troubleshooting.
A traceroute from a vpn client.
Packet capture.That should be an easy challenge.
Traceroute is not helpful, everything times out beyond the local router (192.168.1.1) my VPN client is connected to.
As for packet capture, I see nothing at all related to the 192.168.2.x network that I'm trying to access. I have a constant ping going have tried a package capture with every interface.
-
If you ping an IP out of 192.168.2.0/24 from a vpn client you should at least see the ping on the OpenVPN interface on your home router, don't you?
-
@viragomann said in Route traffic from Client VPN Network to Network on other side of Site-to-Site IPSec VPN?:
If you ping an IP out of 192.168.2.0/24 from a vpn client you should at least see the ping on the OpenVPN interface on your home router, don't you?
Nope, not seeing it. I'm ping 192.168.2.55 from 172.16.42.5 and it's not showing up in the packet capture on my home pfSense box. Not making sense.
-
Probably the client is missing the route to 192.168.2.55?
What shows the client routing table?
-
@viragomann said in Route traffic from Client VPN Network to Network on other side of Site-to-Site IPSec VPN?:
Probably the client is missing the route to 192.168.2.55?
What shows the client routing table?
It seems there is no route to 192.168.2.0 in my pfsense routing table but that doesn't make sense because I can clearly get there from 10.0.10.0.
*Blacked out = WAN
-
I was talking about the OpenVPN Client.
-
@viragomann Yea I know. Don't have my laptop ATM to check. Not sure how to view routing tables on Android.
-
Ok, confirmed my Windows client connected to the VPN has no defined router to 192.168.2.0. However, even when I'm connected to my home LAN (10.0.10.0) with the same Windows client, it doesn't have a router to 192.168.2.0 either. Yet it can still get there.
So it almost seems like the second Phase 2 entry isn't active or working. Is there an easy way to confirm the status of the P2 entries?
-
Grrrrrrrrrrrrr.
Found the problem and it was of course my fault. I had a client specific override for my user account (which I knew about but never checked). In there, the 192.168.2.0/24 network was set as a "Remote Network" instead of a "Local Network." Deleted it form remote networks, added it to local networks and now all is working. I didn't realize there was an option for "Remote Networks" as that's not an option for the actual OpenVPN server itself.