Make openvpn client
-
Good morning,
I 'm with problem for to make openvpn client. I used version 2.3.1. The conection can't be established.
Log:
Wed Jul 06 08:33:27 2016 OpenVPN 2.3.11 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on May 10 2016
Wed Jul 06 08:33:27 2016 Windows version 6.2 (Windows 8 or greater) 64bit
Wed Jul 06 08:33:27 2016 library versions: OpenSSL 1.0.1t 3 May 2016, LZO 2.09
Wed Jul 06 08:33:35 2016 ******* WARNING *******: null MAC specified, no authentication will be used
Wed Jul 06 08:33:35 2016 UDPv4 link local (bound): [undef]
Wed Jul 06 08:33:35 2016 UDPv4 link remote: [AF_INET]192.168.25.2:1198
Wed Jul 06 08:34:35 2016 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)
Wed Jul 06 08:34:35 2016 TLS Error: TLS handshake failed
Wed Jul 06 08:34:35 2016 SIGUSR1[soft,tls-error] received, process restarting
Wed Jul 06 08:34:40 2016 UDPv4 link local (bound): [undef]
Wed Jul 06 08:34:40 2016 UDPv4 link remote: [AF_INET]192.168.25.2:1198 -
you are trying to vpn to a rfc1918 address - doubt that is valid
Wed Jul 06 08:34:40 2016 UDPv4 link remote: [AF_INET]192.168.25.2:1198
-
I don't understand … This is my WAN on Pfsense. What are you trying to stay with this address "rfc918"?
-
By definition, anything in the 192.168.x.x range is an internal only address and not available on the Internet (that's what RFC1918, an internet standards document, says).
That address will not and cannot appear on the Internet.You've probably put your pfSense box behind another router, giving you a double NAT setup.
It's preferable if you can bridge the other router so pfSense gets an Outside address and your WAN will have a proper Internet address.
If that's not possible you'll have to forward the OpenVPN port (usually 1194) on the outside router so that OpenVPN traffic appears to pfSense. -
rfc1918 space as divsys correctly states is not routable on the internet. This space includes 192.168/16, 10/8 and 172.16/12 so if pfsense is behind a nat router and has rfc1918 on its wan. Then you would have to forward the port you want to use for vpn since your not using the standard port it seems either your using 1198
You then need to make sure your client configuration says to go to your public IP, so your nat router can forward that to pfsense or use a fqdn that resolve to your actual public IP.
-
The problem only happen in version 2.3.1. In the Others are it works no problems.
Can be problem this new version?
-
No there is no problem with 2.3.1, I use vpn on it every single day, multiple times a day from multiple devices. I can not recall there ever being any issue with openvpn on any build..
I have never had any issues even with upgrades multiple times all the 2.x and 2.x.x builds and now 2.3 no issues. Openvpn works clickity clickity.. run the wizard, grab the config and connect it really is clickity clickity if it takes you more than 2 minutes to setup a openvpn connection into pfsense your doing something at a basic level wrong. Like not going to the right IP. Not using the wizard and trying to use a user cert vs a server cert. Using a port that is not open inbound to pfsense either from where your at or by your isp or pfsense is behind a nat at your location and you didn't forward the right port, etc.
The wizard even creates the firewall rule for you. But if you had created some rules on your wan that would block before it gets to your open that could cause problems. Using something like snort might cause you grief if not configured correctly, or pfblock if letting it create rules and those are blocking, or even using its aliases and you misuse them in the rules, etc.
Or maybe you didn't answer the questions correctly on the wizard for what your wanting to do, maybe your local networks or remote networks are wrong or maybe your at a location where you have the same IP as the network behind pfsense, etc. There are for sure lots and lots of things that could be misconfigured or cause problems but out of the block its really click click openvpn server up and running.
Without details its impossible for anyone to help you spot the problem. But I can tell you for sure trying to connect to a rfc1918 from outside pfsense on the internet somewhere is going to FAIL 100% for sure..
Not sure what your doing different if your saying its working on 2.2.x but not 2.3 But accessing a 192.168 address from the internet is never ever ever going to work.
