How to get the remote vpn client to "see" the lan network behind the pfsense router?
-
In the VPN/OpenVPN/Servers edit page, I checked off Redirect IPv4 Gateway to Force all client-generated IPv4 traffic through the tunnel. After I unchecked it, the IPv4 Local network field showed up. But it did have the correct lan specified, i.e. 10.3.0.0/16. I saved it anyway, but still no luck at the client computer.
The lan is still not accessible.
-
I've seen cases where a connection occurs but traffic fails to pass due to wonky encryption settings. I use:
EncryptAlgo: AES-128-CBC
NCP: AES-128-GCM, AES-128-CBC
Auth: SHA256
Compression: Adaptive LZO [Legacy style, comp-lzo adaptive]I've set this up numerous times using the pfSense OpenVPN Remote Server guide and it works every time.
https://docs.netgate.com/pfsense/en/latest/vpn/openvpn/openvpn-remote-access-server.html
-
I used the OpenVPN Wizard. I changed the Compression to your recommendation. Do I need to redo the Client Export? or the Wizard?
Update:
Redid the wizard. No go.Got this msg at the Client Export page:
Servers configured with features that require OpenVPN 2.4 will not work with OpenVPN 2.3.x or older clients. These features include: AEAD encryption such as AES-GCM, TLS Encryption+Authentication, ECDH, LZ4 Compression and other non-legacy compression choices, IPv6 DNS servers, and more.How should I be determining if I can access the lan? Is trying to make a network drive ok?
Update 2:
Followed the instructions at that link. Still no go. (the instructions specify going to System/Package Manager and finding OpenVPN Client Export, but it is not there...this is listed in Installed Packages, should a reinstall be done?) -
What client are you using, Windows or Linux? Windows OpenVPN client must be run as administrator or else it will appear to connect but not pass traffic since non-admins can't update the Windows routing table.
I don't know which version of OpenVPN client the Export dealie dishes up, but you could grab the latest 2.4.7 from https://openvpn.net/community-downloads/
How should I be determining if I can access the lan? Is trying to make a network drive ok?
I would start by pinging something on the LAN that you know respond to pings, just to test basic connectivity. The default OpenVPN rule should allow all access so you don't have to worry about that.
the instructions specify going to System/Package Manager and finding OpenVPN Client Export, but it is not there
When this package is installed, you will have a Client Export tab showing at VPN - OpenVPN - Client Export. If you install the client manually from the OpenVPN website, you just need to export the settings (.ovpn file) and not the entire client package.
-
I'm using the Windows client ver. 2.4.7-lx03 with the Client Export process.
https://i.gyazo.com/2bec3bba5de09676f7fc0571f7467450.pngI am running the OpenVPN gui as an administrator.
The lan behind the pfsense router is 10.3.0.0/16 and the tunnel network is 10.33.0.0/16. The remote Windows client is given ip 10.33.0.2. The pfsense router's ip is 10.3.0.1. From the Windows client, I can't ping 10.3.0.1. I can ping 10.33.0.1. A computer on the lan behind the pfsense router with ip 10.3.2.122 that I can ping from inside the lan, I cannot ping from the remote Windows client. Should I be able to successfully ping 10.3.2.122 from the remote Windows client?
ipconfig /all from the remote Windows client:
https://i.gyazo.com/a19bd23e7adc607701c1a23599b5af3f.pngAt the remote Windows client I am using a home Verizon Fios router. Could some setting in that be blocking the traffic?
-
and the tunnel network is 10.33.0.0/16.
You don't need a tunnel network with that much address space unless you need to have tens of thousands of connected clients. A /24 is usually good enough.
Should I be able to successfully ping 10.3.2.122 from the remote Windows client?
It depends. Windows will not respond to pings outside its local subnet, for instance. For testing, turn OFF any client firewalls and re-enable them once your tests are done and everything is working.
-
All the firewalls were/are off on the remote Windows client when I was doing that pinging from the previous post.
-
If your connected to the vpn server.. Your isp or connection method can not block stuff inside the tunnel.
3 common problems with pinging lan stuff from your vpn client.. Firewall on the dest device you trying to ping.. Dest device you trying to ping isn't using pfsense as gateway.. VPN client your using is on a local network that overlaps the dest network.. So the device has no reason to send traffic down the tunnel to get to your lan..
-
pfsense firewall ip is 10.3.0.1 with 10.3.0.0/16 for lan
An inside lan device ip is 10.3.2.122 with all of its Windows firewalls off and it can be pinged from inside the lan.
Tunnel network is 10.33.0.0/16.
The remote Windows client has tunnel network ip of 10.33.0.2 with private ip of 198.162.1.253 and its Windows firewalls are off.- Firewalls on both ends are all off.
- Device behind the pfsense firewall is using pfsense as its gateway.
Snapshot of ipconfig /all from the device behind the pfsense firewall showing it is using pfsense as its gateway:
https://i.gyazo.com/968693b3b853c1ce1cb7b25fea3b356b.png - The remote Windows VPN client is on network 10.33.0.0/16 with ip of 10.33.0.2 and the dest network is 10.3.0.0/16 with no overlap.
-
Well do a simple sniff on pfsense..
I am on vpn now..
C:\Windows\System32>ping 192.168.9.100 Pinging 192.168.9.100 with 32 bytes of data: Reply from 192.168.9.100: bytes=32 time=115ms TTL=127 Reply from 192.168.9.100: bytes=32 time=116ms TTL=127 Reply from 192.168.9.100: bytes=32 time=117ms TTL=127 Reply from 192.168.9.100: bytes=32 time=117ms TTL=127 Ping statistics for 192.168.9.100: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 115ms, Maximum = 117ms, Average = 116ms C:\Windows\System32>There is really nothing special to do...
C:\Windows\System32>tracert -d 192.168.9.100 Tracing route to 192.168.9.100 over a maximum of 30 hops 1 113 ms 121 ms 131 ms 10.0.8.1 2 133 ms 123 ms 117 ms 192.168.9.100 Trace complete. C:\Windows\System32>You can see that 10.0.8/24 is the tunnel.. I would suggest you sniff on your lan interface in pfsense to validate your traffic is being sent to your client.
What do you have in your openvpn firewall rules - pretty sure that defaults to an any any rule... But yeah that could be stopping you..
if that is good - then your sniff should show you sending your pings to your client..
11:28:37.949522 IP 10.0.8.100 > 192.168.9.100: ICMP echo request, id 1, seq 453, length 40 11:28:37.949828 IP 192.168.9.100 > 10.0.8.100: ICMP echo reply, id 1, seq 453, length 40 11:28:38.944374 IP 10.0.8.100 > 192.168.9.100: ICMP echo request, id 1, seq 454, length 40 11:28:38.944678 IP 192.168.9.100 > 10.0.8.100: ICMP echo reply, id 1, seq 454, length 40 11:28:39.945453 IP 10.0.8.100 > 192.168.9.100: ICMP echo request, id 1, seq 455, length 40 11:28:39.945766 IP 192.168.9.100 > 10.0.8.100: ICMP echo reply, id 1, seq 455, length 40 11:28:40.946545 IP 10.0.8.100 > 192.168.9.100: ICMP echo request, id 1, seq 456, length 40 11:28:40.946828 IP 192.168.9.100 > 10.0.8.100: ICMP echo reply, id 1, seq 456, length 40You can see there my vpn client 10.0.8.100 pinging the client.. If you see that go out, and no answer then you know its something on the client.. If you don't see it go out - then you have problem else where - like the openvpn firewall rule?
-
OpenVPN Firewall rule:
https://i.gyazo.com/86655b3a6f05efd4e8a7c75d5ccc1632.png
My rule is the same as yours, except in the States column I have a 0 and you have a 4, i.e. 0/1.68GiB vs. 4/819.53MiBWhen you ran ping 192.168.9.100, what is the source and what is the dest.?
At the remote Windows client, none of the pings are working:
remote Windows client to device inside lan does not ping.
remote Windows client to pfsense firewall does not ping. -
My vpn clients local IP is
IPv4 Address. . . . . . . . . . . : 10.56.152.96 Subnet Mask . . . . . . . . . . . : 255.255.255.0 Default Gateway . . . . . . . . . : 10.56.152.1His vpn connection is that 10.0.8.100 address.. If your not seeing any states hit your rule - then you have no traffic through the rule.. Ie you have not been able to create a state.
If you can not even ping pfsense lan IP... Then you have something wrong with the client not sending hte traffic down the vpn..
Do a simple tracert from your remote client to your pfsense lan IP... Do you see it hit the other end of your vpn as first hop - like you see in mine above?
your openpvn config you put in your local network right? Or your using forcing all traffic down the vpn? That push route in your first post is not what your still trying to do? That isn't even close to correct.
lets see your route table when your vpn client is connected
route print in windows
IPv4 Route Table =========================================================================== Active Routes: Network Destination Netmask Gateway Interface Metric 0.0.0.0 0.0.0.0 10.56.152.1 10.56.152.96 600 0.0.0.0 128.0.0.0 10.0.8.1 10.0.8.100 276 10.0.8.0 255.255.255.0 On-link 10.0.8.100 276 10.0.8.100 255.255.255.255 On-link 10.0.8.100 276 10.0.8.255 255.255.255.255 On-link 10.0.8.100 276 10.56.152.0 255.255.255.0 On-link 10.56.152.96 556 10.56.152.96 255.255.255.255 On-link 10.56.152.96 556See the other route default route with the 128.0.0.0 mask that is what pushes traffic down my tunnel.. to get to my 192.168.9 network..
edit:
here is another way to do - just changed mine to hand out my local networksIPv4 Route Table =========================================================================== Active Routes: Network Destination Netmask Gateway Interface Metric 0.0.0.0 0.0.0.0 10.56.152.1 10.56.152.96 600 10.0.8.0 255.255.255.0 On-link 10.0.8.100 276 10.0.8.100 255.255.255.255 On-link 10.0.8.100 276 10.0.8.255 255.255.255.255 On-link 10.0.8.100 276 10.56.152.0 255.255.255.0 On-link 10.56.152.96 556 10.56.152.96 255.255.255.255 On-link 10.56.152.96 556 10.56.152.255 255.255.255.255 On-link 10.56.152.96 556 127.0.0.0 255.0.0.0 On-link 127.0.0.1 306 127.0.0.1 255.255.255.255 On-link 127.0.0.1 306 127.255.255.255 255.255.255.255 On-link 127.0.0.1 306 192.168.2.0 255.255.255.0 10.0.8.1 10.0.8.100 276 192.168.3.0 255.255.255.0 10.0.8.1 10.0.8.100 276 192.168.9.0 255.255.255.0 10.0.8.1 10.0.8.100 276Where client gets specific routes down the tunnel for the networks that are behind the vpn server.. See those 192.168.9 and 192.168.2 etc.. routes
-
The remote Windows client's vpn local ip is:
Connection-specific DNS Suffix . : localdomain
Description . . . . . . . . . . . : TAP-Windows Adapter V9
Physical Address. . . . . . . . . : 00-FF-32-6F-2A-24
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IPv4 Address. . . . . . . . . . . : 10.33.0.2(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.0.0
Default Gateway . . . . . . . . . :
DHCP Server . . . . . . . . . . . : 10.33.255.254
DNS Servers . . . . . . . . . . . : 10.3.0.1
NetBIOS over Tcpip. . . . . . . . : EnabledFor some reason there is no Default gateway.
From the remote Windows client:
C:\WINDOWS\system32>tracert -d 10.3.0.1Tracing route to 10.3.0.1 over a maximum of 30 hops
1 1 ms 1 ms 1 ms 192.168.1.1
2 11 ms 11 ms 11 ms 10.3.0.1Trace complete.
IPv4 Route Table
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.1.1 192.168.1.253 50
10.33.0.0 255.255.0.0 On-link 10.33.0.2 291
10.33.0.2 255.255.255.255 On-link 10.33.0.2 291
10.33.255.255 255.255.255.255 On-link 10.33.0.2 291
(my public ip) 255.255.255.255 192.168.1.1 192.168.1.253 50
127.0.0.0 255.0.0.0 On-link 127.0.0.1 331
127.0.0.1 255.255.255.255 On-link 127.0.0.1 331
127.255.255.255 255.255.255.255 On-link 127.0.0.1 331
192.168.1.0 255.255.255.0 On-link 192.168.1.253 306
192.168.1.253 255.255.255.255 On-link 192.168.1.253 306
192.168.1.255 255.255.255.255 On-link 192.168.1.253 306
224.0.0.0 240.0.0.0 On-link 127.0.0.1 331
224.0.0.0 240.0.0.0 On-link 192.168.1.253 306
224.0.0.0 240.0.0.0 On-link 10.33.0.2 291
255.255.255.255 255.255.255.255 On-link 127.0.0.1 331
255.255.255.255 255.255.255.255 On-link 192.168.1.253 306
255.255.255.255 255.255.255.255 On-link 10.33.0.2 291My pfsense firewall's ip is 10.3.0.1
From the remote Windows client:
C:\WINDOWS\system32>ping 10.3.0.1Pinging 10.3.0.1 with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.Ping statistics for 10.3.0.1:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss), -
@axiomcs said in How to get the remote vpn client to "see" the lan network behind the pfsense router?:
Tracing route to 10.3.0.1 over a maximum of 30 hops
1 1 ms 1 ms 1 ms 192.168.1.1
2 11 ms 11 ms 11 ms 10.3.0.1Sure looks like your hitting something on your local network where your vpn client is that using 10.3.0.1 ;)
Since 192.168.1.1 is not your vpn tunnel... And you have nothing setup in your route to send it down your tunnel 10.33
your vpn client wouldn't have a default gateway
Connection-specific DNS Suffix . : local.lan Description . . . . . . . . . . . : TAP-Windows Adapter V9 Physical Address. . . . . . . . . : 00-FF-1F-37-23-EC DHCP Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes IPv4 Address. . . . . . . . . . . : 10.0.8.100(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.255.0 Lease Obtained. . . . . . . . . . : Friday, October 25, 2019 12:26:30 PM Lease Expires . . . . . . . . . . : Saturday, October 24, 2020 12:26:30 PM Default Gateway . . . . . . . . . : DHCP Server . . . . . . . . . . . : 10.0.8.254 DNS Servers . . . . . . . . . . . : 192.168.9.253 192.168.9.253 NetBIOS over Tcpip. . . . . . . . : EnabledSee your trace your hitting 192.168.1.1 trying to get to 10.3.0.1 - not down the tunnel.
You need to on pfsense set vpn to send everything down the tunnel - or you need to tell the server which networks are local so it will hand that to the clients.
-
All of the IPv4 traffic was/is being forced thru the tunnel:
https://i.gyazo.com/2d3e8b70252a79664e1cb094497baa65.png -
No its not.. Not per the route table you listed...
You can see from your freaking tracert that trying to 10.3.0.1 hit your 192.168.1.1 IP.. That might be what you have it set for... But that is not what is happening..
-
I included a screenshot of the setting Redirect IPv4 Gateway being checked and it says next to the checkbox, Force all client-generated IPv4 traffic through the tunnel. Can you see my screenshots? If not, is there a way for me to have my screenshots show up?
-
I see your screenshot - and again... You might have set that, but that is NOT what is happening... Look at your clients route table
0.0.0.0 0.0.0.0 192.168.1.1 192.168.1.253 50
That there says hey no other routes for whatever IP trying to go to - go to 192.168.1.1..
do you have anything in your options box on your server setting... You sure your actually connecting to that instance and not another one... I run multiple instances 443 tcp, and 1194 udp for example.
What is in your local config.. But your own routes and your trace route show you hitting 192.168.1.1 trying to get to 10.3.0.1
If you were going down the tunnel to get to 10.3, then your first hop would be the 10.33 address in your trace.
-
Which options box are you referring to? If its Custom options, then that is empty.
https://i.gyazo.com/36d58311d84723b4b998b90743b1a433.pngHow can I check that I have the right instance? I believe I only have one.
Where is the local config?
Maybe in cases like this it is better to start over with the OpenVPN? Is there a way to wipe all this OpenVPN settings away completely?
Update:
I have attempted to remove all traces (one trace that does remain and I can't seem to remove it is the User certificate from the original OpenVPN setup) of my initial OpenVPN setup and start anew. I have followed the link as suggested in your earlier post to setup OpenVPN. When trying to do the Client Export utility, no client executables appear in the OpenVPN Clients section of the Client Export Utility page. There is this note next to it:
"If a client is missing from the list it is likely due to a CA mismatch between the OpenVPN server instance and the client certificate, the client certificate does not exist on this firewall, or a user certificate is not associated with a user when local database authentication is enabled."Update2:
I managed to remove the original user cert after I removed it from someplace else, the delete/trash can symbol appeared.
The Client Export executables were not showing up b/c I had not created a new user cert.Now I can ping the pingable devices behind the pfsense firewall. I can also create a mapped network drive to those devices. However, I need to use their private IP addr. instead of their Windows name. Is it possible to use the computer names for creating network drives? And is it possible to make network drives to these devices with their firewalls enabled? Also, is it possible to restrict connections to the vpn by MAC addresses that I specify? If so, how?
