Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    OpenVPN client can ping but not access server on LAN

    Scheduled Pinned Locked Moved OpenVPN
    36 Posts 3 Posters 3.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • johnpozJ
      johnpoz LAYER 8 Global Moderator
      last edited by johnpoz

      No its not..

      Btu you show a response.. How would you see a response if the security system has no gateway? 192.168.10 is not on its network 192.168.2/24

      Did you set a specific route on the security system for 192.168.10/24?

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.8, 24.11

      1 Reply Last reply Reply Quote 0
      • A
        Andy142
        last edited by

        That's what has been throwing me.

        There are no static routes or bridges setup. Only thing I have linking them is the "Local Network" of 192.168.2.0/24 in the OpenVPN config.

        Here is the interface setup for OPT1.

        OPT1.PNG

        1 Reply Last reply Reply Quote 0
        • AKEGECA
          AKEGEC
          last edited by

          @Andy142 , Can I see a screenshot of your Mappings?
          Go to Firewall > NAT > Outbound

          1 Reply Last reply Reply Quote 0
          • A
            Andy142
            last edited by

            Sure thing, here you go.

            mappings.PNG

            1 Reply Last reply Reply Quote 0
            • AKEGECA
              AKEGEC
              last edited by

              @Andy142 , Do you how to make Aliases?

              A 1 Reply Last reply Reply Quote 0
              • A
                Andy142 @AKEGEC
                last edited by

                @AKEGEC Not really... Sorry

                1 Reply Last reply Reply Quote 0
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator
                  last edited by johnpoz

                  Your dest is wrong in that outbound nat.. your vpn client is coming from 192.168.10 right, and he is talking to your security device on 192.168.2.x right?

                  So your outbound nat dest would be the 192.168.2 network.. not 192.168.10

                  The point of the outbound nat to talk to a device on a 192.168.2 network that has no gateway on the device, is to make the traffic look like its coming from its own network 192.168.2..

                  The destination is the opt1 network.. 192.168.2

                  client 192.168.10.2 --- vpn ---192.168.10.1 (pfsense) 192.168.2.1 --- 192.168.2.x

                  So you want to nat this 192.168.10 traffic to look like it came from 192.168.2.1, so 2.x knows how to talk back to it without a gateway..

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                  1 Reply Last reply Reply Quote 0
                  • AKEGECA
                    AKEGEC
                    last edited by

                    Go to Firewall > Aliases > +Add

                    Name: Private OPT1 or bla bla bla
                    Type: Network(s)
                    Network or FQDN: 192.168.10.2-192.168.10.254
                    If your OPT1 IP interface is 192.168.10.1, you must excluded your OPT1 interface ip address.
                    Press Add Network button

                    A 1 Reply Last reply Reply Quote 0
                    • A
                      Andy142
                      last edited by Andy142

                      I regijied the outbound, here are the results

                      On the OpenVPN Interface

                      12:40:36.930315 IP 192.168.10.2 > 192.168.2.10: ICMP echo request, id 1, seq 69, length 40
                      12:40:36.931039 IP 192.168.2.10 > 192.168.10.2: ICMP echo reply, id 1, seq 69, length 40

                      The OPT1 interface

                      12:42:01.418506 IP 192.168.2.1 > 192.168.2.10: ICMP echo request, id 50048, seq 73, length 40
                      12:42:01.419125 IP 192.168.2.10 > 192.168.2.1: ICMP echo reply, id 50048, seq 73, length 40

                      Looks like it's replying to the default gateway now at least.

                      1 Reply Last reply Reply Quote 0
                      • johnpozJ
                        johnpoz LAYER 8 Global Moderator
                        last edited by johnpoz

                        Yup that looks good..

                        You should be able to talk to that device now on anything not just icmp

                        To that device any traffic coming from your vpn will just look like its coming from pfsense 2.1, which is on its own network and it can talk to.

                        This should also circumvent any device firewalls that would prevent talking to some service from a different network.

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                        A 1 Reply Last reply Reply Quote 0
                        • A
                          Andy142 @AKEGEC
                          last edited by

                          @AKEGEC What do I put in the second box that comes up after pressing "Add network"? Or did you mean "save"?

                          1 Reply Last reply Reply Quote 0
                          • johnpozJ
                            johnpoz LAYER 8 Global Moderator
                            last edited by

                            Have no idea why he wants you to create an alias, there is no need for one in such a setup.

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                            1 Reply Last reply Reply Quote 0
                            • A
                              Andy142 @johnpoz
                              last edited by

                              @johnpoz Still not getting a response from the security system....

                              1 Reply Last reply Reply Quote 0
                              • johnpozJ
                                johnpoz LAYER 8 Global Moderator
                                last edited by johnpoz

                                Well do you sniff test again.. Do you see traffic going to your security system looking like its coming from 2.1, do you see a response - does the response go back to yoru vpn client?

                                If you see traffic going back over the vpn to your vpn client - its not a pfsense issue.

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                SG-4860 24.11 | Lab VMs 2.8, 24.11

                                A 1 Reply Last reply Reply Quote 0
                                • A
                                  Andy142 @johnpoz
                                  last edited by Andy142

                                  @johnpoz This is when trying to access the webpage:

                                  On the OpenVPN interface

                                  12:54:58.643002 IP 192.168.10.2.63027 > 192.168.2.10.85: tcp 0
                                  12:55:00.483117 IP 192.168.10.2.63202 > 192.168.2.10.85: tcp 0
                                  12:55:00.483881 IP 192.168.2.10.85 > 192.168.10.2.63202: tcp 0
                                  12:55:00.868709 IP 192.168.10.2.63202 > 192.168.2.10.85: tcp 0
                                  12:55:00.868786 IP 192.168.10.2.63202 > 192.168.2.10.85: tcp 283
                                  12:55:00.869464 IP 192.168.2.10.85 > 192.168.10.2.63202: tcp 0
                                  12:55:00.870122 IP 192.168.2.10.85 > 192.168.10.2.63202: tcp 108
                                  12:55:01.651781 IP 192.168.2.10.85 > 192.168.10.2.63202: tcp 870

                                  The OPT1 interface

                                  12:53:08.909190 IP 192.168.2.1.63368 > 192.168.2.10.85: tcp 0
                                  12:53:08.909830 IP 192.168.2.10.85 > 192.168.2.1.63368: tcp 1440
                                  12:53:09.143689 IP 192.168.2.10.85 > 192.168.2.1.37840: tcp 0
                                  12:53:09.170709 IP 192.168.2.10.85 > 192.168.2.1.51729: tcp 0

                                  Looks like everything should be working....

                                  1 Reply Last reply Reply Quote 0
                                  • johnpozJ
                                    johnpoz LAYER 8 Global Moderator
                                    last edited by johnpoz

                                    Not doesn't look right to be honest.. Looks like you sent 2 syns maybe, you have 2 different source ports there.

                                    Well clearly your seeing answers back to your vpn client.. I would open them in say wireshark, make sure its not the security system sending back F off with a RST..

                                    But if you see return traffic going back to the client over the vpn - pfsense is doing exactly what it suppose to..

                                    This is traffic 2 3 different source ports

                                    12:53:08.909830 IP 192.168.2.10.85 > 192.168.2.1.63368: tcp 1440
                                    12:53:09.143689 IP 192.168.2.10.85 > 192.168.2.1.37840: tcp 0
                                    12:53:09.170709 IP 192.168.2.10.85 > 192.168.2.1.51729: tcp 0
                                    

                                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                                    If you get confused: Listen to the Music Play
                                    Please don't Chat/PM me for help, unless mod related
                                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                                    A 2 Replies Last reply Reply Quote 0
                                    • A
                                      Andy142 @johnpoz
                                      last edited by

                                      @johnpoz I'll install wireshark and have a look, it looks like it's trying to connect to the webpage in the browser, but never gets there.

                                      1 Reply Last reply Reply Quote 0
                                      • A
                                        Andy142 @johnpoz
                                        last edited by

                                        @johnpoz Could DNS be causing issues here? I don't think I have it setup correctly.

                                        1 Reply Last reply Reply Quote 0
                                        • johnpozJ
                                          johnpoz LAYER 8 Global Moderator
                                          last edited by

                                          @johnpoz said in OpenVPN client can ping but not access server on LAN:

                                          12:53:08.909830 IP 192.168.2.10.85 > 192.168.2.1.63368: tcp 1440
                                          12:53:09.143689 IP 192.168.2.10.85 > 192.168.2.1.37840: tcp 0
                                          12:53:09.170709 IP 192.168.2.10.85 > 192.168.2.1.51729: tcp 0

                                          2.10 is serving up the webpage right? And 10.2 is the client trying to view the webpage.

                                          You clearly are getting there, and your seeing answers.. But what are the answers... Pfsense has no control over the answers.. It just forwards the packets back and forth between the client and the server.. It has no interest or influence over what those answers might be.

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                                          A 1 Reply Last reply Reply Quote 0
                                          • A
                                            Andy142 @johnpoz
                                            last edited by

                                            @johnpoz That's correct. I can get it fine by going through the net with standard port forwarding, just this VPN stuff is causing problems.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.