Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    OpenVPN client subnet is not routed to IPSec tunnel

    Scheduled Pinned Locked Moved IPsec
    17 Posts 2 Posters 753 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • JeGrJ
      JeGr LAYER 8 Moderator
      last edited by JeGr

      No, I didn't ignore it, but as I wrote you map your OVPN network to an IP probably in use in another phase or on the LAN? That's why I was mentioning, you should use another network or IP that isn't used on either side if you want to BiNAT or outbound NAT your 192.168.210.x/26 network

      Also you were only NATting the specific IP .178 so if you didn't do some magic in OpenVPN you could get another random IP from your /26 subnet that won't get routed through the tunnel.

      So you should setup your additional phase 2 to something like

      • local net: 192.168.210.126/26
      • BiNAT: <some IP NOT from your LAN or any network on the remote side>
      • remote: 10.100.0.0/16

      Sorry if you think I overlooked some details but you e.g. didn't tell us what the LAN(s) on pfSense or remote side are so I can only guess which IP ranges are in play and why your address of 172.26.1.1 didn't work. Is 172.26.1.0/24 the pfSense LAN side? Or is 172.26.x.y in use there?
      How is the other side configured? Both P2s there? How is the additional P2 setup on the remote side?

      Don't forget to upvote ๐Ÿ‘ those who kindly offered their time and brainpower to help you!

      If you're interested, I'm available to discuss details of German-speaking paid support (for companies) if needed.

      1 Reply Last reply Reply Quote 0
      • J
        jazzl0ver
        last edited by jazzl0ver

        The point is that I want to use just a single P2 entry:

                 left                        right
        172.26.0.0/16 -- ipsec tunnel -- 10.100.0.0/16
        

        and NAT any other possible subnets from the left side to the existing P2 left subnet or address (from 172.26.0.0/16 range).

        Are you saying it's not possible?

        PS Yes, I made that magic and openvpn always gives me a certain IP.
        PPS left LAN is 172.26.0.0 /16
        PPPS The other side has a single P2 entry (why are you saying both P2s?) with the same subnets (just swapped). As I said, ipsec tunnel works well, I can ping the other side from pfSense's IP (172.26.1.1) as well as from other left LAN PCs.

        1 Reply Last reply Reply Quote 0
        • JeGrJ
          JeGr LAYER 8 Moderator
          last edited by

          Are you saying it's not possible?

          Actually I'm not sure. Never even thought of using it that way but it could make problems as the 172.26.1.1 is on your LAN side and NATting ovpns0 to enc0 with that could screw with some routing logic as perhaps the IPsec deamon only picks it up coming from LAN. Could be that the rewriting done by NAT comes too late for that. But just a guess here.

          PS Yes, I made that magic and openvpn always gives me a certain IP.

          Alright, just wanted to check :)

          The other side has a single P2 entry (why are you saying both P2s?)

          Because the way I'd have it set up would have been like NATting the OVPN network to some IP not in use, say 172.27.1.1 and add another P2 entry to both sides with the corresponding network.

          Don't forget to upvote ๐Ÿ‘ those who kindly offered their time and brainpower to help you!

          If you're interested, I'm available to discuss details of German-speaking paid support (for companies) if needed.

          1 Reply Last reply Reply Quote 0
          • JeGrJ
            JeGr LAYER 8 Moderator
            last edited by

            Addendum:

            AH now I understand (after your edit with the "I want to use a single P2 entry"

            Could you post your IPsec P2 again please?
            I think I know why (and that) it won't work?

            Don't forget to upvote ๐Ÿ‘ those who kindly offered their time and brainpower to help you!

            If you're interested, I'm available to discuss details of German-speaking paid support (for companies) if needed.

            1 Reply Last reply Reply Quote 0
            • J
              jazzl0ver
              last edited by jazzl0ver

              Sure.

              # cat /var/etc/ipsec/ipsec.conf
              # This file is automatically generated. Do not edit
              config setup
                      uniqueids = yes
              
              conn con2000
                      fragmentation = yes
                      keyexchange = ikev2
                      reauth = yes
                      forceencaps = no
                      mobike = no
              
                      rekey = yes
                      installpolicy = yes
                      type = tunnel
                      dpdaction = restart
                      dpddelay = 10s
                      dpdtimeout = 60s
                      auto = route
                      left = 95.x.x.x
                      right = 66.x.x.x
                      leftid = fqdn:axxxxxxx
                      ikelifetime = 3600s
                      lifetime = 3600s
                      ike = aes128gcm128-aesxcbc-modp2048!
                      esp = aes128gcm128-modp1024,aes128gcm128-modp2048!
                      leftauth = psk
                      rightauth = psk
                      rightid = 66.x.x.x
                      rightsubnet = 10.100.0.0/16
                      leftsubnet = 172.26.0.0/16,172.26.1.1|192.168.210.178
              

              9f67390c-0ea4-430d-98a6-1a1df240868d-image.png

              3282d82e-5448-4250-b1f2-0917bd22988c-image.png

              a7f446c4-b088-462f-9abb-0571504f0acb-image.png

              (And, yes, I tried to disconnect ipsec tunnel and restart ipsec daemon to make the changes applied for sure)

              1 Reply Last reply Reply Quote 0
              • JeGrJ
                JeGr LAYER 8 Moderator
                last edited by

                So you have two phase 2 entries, not just one. Do you have that on the other side, too? As you wrote:

                The point is that I want to use just a single P2 entry:

                I thought you only had one? If you define 2 P2s on one side, that has to match the other side. There's no way you can run "just one" on the other side. The Phases have to match.

                Greets
                \jens

                Don't forget to upvote ๐Ÿ‘ those who kindly offered their time and brainpower to help you!

                If you're interested, I'm available to discuss details of German-speaking paid support (for companies) if needed.

                1 Reply Last reply Reply Quote 0
                • J
                  jazzl0ver
                  last edited by

                  That makes sense! I indeed missed that point. Thanks for the explanation!

                  Is there a way to NAT a local subnet/address into pfsense's address, so it would travel thru the ipsec tunnel?
                  I just tried to add 192.168.210.178 to outbound nat but that didn't work:
                  06525de4-c5a3-427b-97bb-015d54f1d553-image.png
                  (Also tried to specify "Interface address" in NAT Address field)

                  1 Reply Last reply Reply Quote 0
                  • JeGrJ
                    JeGr LAYER 8 Moderator
                    last edited by

                    Hmm, I don't think that outbound NAT will work on IPsec with a NAT address from LAN but I'm unsure.

                    But as you told us in the OP, that both ends are pfSense? You could change the tunnel to an VTI style tunnel, then you can simply route your networks via the transfer net you define on the VTI phase and as there's a pseudo interface like in OVPN, it should also be possible to NAT traffic to your hearts content ;) as your tunnel has a fixed IP on one and the other side (the tunnel transfer net/gws) that you can NAT on.

                    Don't forget to upvote ๐Ÿ‘ those who kindly offered their time and brainpower to help you!

                    If you're interested, I'm available to discuss details of German-speaking paid support (for companies) if needed.

                    1 Reply Last reply Reply Quote 1
                    • J
                      jazzl0ver
                      last edited by

                      Yeah, I'm aware of VTI, but this is not always possible. Anyway, thank you for your valuable help!

                      1 Reply Last reply Reply Quote 1
                      • JeGrJ
                        JeGr LAYER 8 Moderator
                        last edited by

                        Glad I could be helping you :)

                        Don't forget to upvote ๐Ÿ‘ those who kindly offered their time and brainpower to help you!

                        If you're interested, I'm available to discuss details of German-speaking paid support (for companies) if needed.

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.