Issue Connecting pfsense as a client to OpenVPN Access Server
-
@Rico Thanks a lot!! I was able to to connect after switching TLS Encryption and Authentication to TLS Authentication and than after that Added SHA1(160 bit)
Now I am able to ping the AWS network from pfsense end but not able to ping the remote network (pfsense) side from the AWS end.
I am not able to ping bidirectionally, Is this a normal behaviour in case of OpenVPN our some pfsense configuration needs to be done ?
-
You need to setup your Rules in the Firewall -> Rules -> OpenVPN tab (pfSense WebGUI).
For testing just do any-any and check if everything works.-Rico
-
@shahid3507 said in Issue Connecting pfsense as a client to OpenVPN Access Server:
tls-crypt /var/etc/openvpn/client1.tls-crypt
I am like 99% sure that openvpn-as does not support tls-crypt.. Atleast not current 2.6.1 version..
The AS stores its config in a db, so its a bit harder to show - but there is zero place to turn on crypt for tls in the gui. And do believe reading something about it - they did a while back enable crypt for the connect client (ios and android) but I do not believe the AS server supports it as of yet.
When you setup the client in pfsense - did you download the client config from the AS to validate what you need to set?
example - just download my client config from my AS
Automatically generated OpenVPN client config file # Generated on Mon Feb 4 07:15:51 2019 by ns1 # Note: this config file contains inline private keys # and therefore should be kept confidential! # Note: this configuration is user-locked to the username belowCerts will all be inline
And its just doing auth
key-direction 1 <tls-auth> # # 2048 bit OpenVPN static key (Server Agent) # -----BEGIN OpenVPN Static key V1----- 12303adb7486e4ef9d4dae4742741a22 10f785d43598499de66a7da89ee45221 <snipped> 235863ac6188180030d13ab6481e966c a8bd1f1b1c08bd009430af58ab3e0b88 -----END OpenVPN Static key V1----- </tls-auth> -
@johnpoz I have just downloaded the config from AS and followed this document.
https://www.netgate.com/docs/pfsense/vpn/openvpn/connecting-pfsense-to-an-openvpn-access-server.html -
Seems you didn't follow the part where it says
" pfSense may be configured to use the info in the .ovpn file"
And not encryption and auth. Double check all your other settings.
example here is my client config form pfsense for my openvpn-as server
dev ovpnc3 verb 1 dev-type tun dev-node /dev/tun3 writepid /var/run/openvpn_client3.pid #user nobody #group nobody script-security 3 daemon keepalive 10 60 ping-timer-rem persist-tun persist-key proto udp4 cipher AES-256-CBC auth SHA256 up /usr/local/sbin/ovpn-linkup down /usr/local/sbin/ovpn-linkdown local 64.53.<snipped> engine rdrand tls-client client lport 0 management /var/etc/openvpn/client3.sock unix remote <snipped> 1195 ca /var/etc/openvpn/client3.ca cert /var/etc/openvpn/client3.cert key /var/etc/openvpn/client3.key tls-auth /var/etc/openvpn/client3.tls-auth 1 ncp-ciphers AES-128-GCM:AES-192-GCM:AES-256-GCM:AES-128-CBC:AES-192-CBC:AES-256-CBC comp-lzo no resolv-retry infinite route-nopull fast-io sndbuf 524288 rcvbuf 524288 [2.4.4-RELEASE][root@sg4860.local.lan]/var/etc/openvpn:notice
tls-auth /var/etc/openvpn/client3.tls-auth 1 -
-
What are you trying to ping?
-
The tunnel is connecting and I am able to ping the AWS side (Access server subnet) but when I am trying to ping the client side form the access server or the subnet than it's not reachable.
-
Any Idea regarding this connectivity stuff @Rico ??
-
Not atm, I don't have any experience with OpenVPN AS or AWS, sorry.
But my guess is @johnpoz will come back with some ideas.
-Rico
-
Ping what exactly? Can you ping the lan IP of pfsense from your aws side?
-
No I can't @johnpoz
-
What is your routing on your aws side show you how to get to your lan network?
-
