Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Client Override fails on Win10 OpenVPN GUI

    Scheduled Pinned Locked Moved OpenVPN
    8 Posts 3 Posters 8.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • P
      pwood999
      last edited by

      My pfsense is running 2.3.3-RELEASE-p1, with OpenVPN configured for multiple remote users.  In general everything is working fine for remote Linux, Mac & Windows clients.

      I have created a Client Overrides for one user in order to restrict access to a specific LAN IP.  The config seems to work fine for OSX Tunnelblick, but Windows fails to connect for this new user.

      I have searched the forums & googled but cannot seem to find the correct answer.

      Tue May 23 12:33:58 2017 WARNING: Since you are using –dev tun with a point-to-point topology, the second argument to --ifconfig must be an IP address.  You are using something (255.255.255.252) that looks more like a netmask. (silence this warning with --ifconfig-nowarn)
      Tue May 23 12:33:58 2017 There is a problem in your selection of --ifconfig endpoints [local=10.9.8.201, remote=255.255.255.252].  The local and remote VPN endpoints must exist within the same 255.255.255.252 subnet.  This is a limitation of –dev tun when used with the TAP-WIN32 driver.  Try 'openvpn --show-valid-subnets' option for more info.
      Tue May 23 12:33:58 2017 Exiting due to fatal error

      Server Tunnel = 10.9.8.0/24
      Common Subnet for all clients

      In Client Override, I added the following:
      Common Name = Client Name
      Tunnel Network = 10.9.8.201/30
      IPV4 Local Network = 10.1.0.5/32  (the IP I want to limit this client access to)

      Advanced = empty

      I have tried various ifconfig & route options to no avail.

      Capture.JPG
      Capture.JPG_thumb

      1 Reply Last reply Reply Quote 1
      • jimpJ
        jimp Rebel Alliance Developer Netgate
        last edited by

        Is your server set for net30 or subnet topology?

        If you are using net30, try clearing out the tunnel network and setting it in advanced settings of the override:

        ifconfig-push 10.9.8.202 10.9.8.201
        

        It's also possible your windows client is very, very out-of-date. Uninstall it and the tap driver and install the latest version again.

        Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

        Need help fast? Netgate Global Support!

        Do not Chat/PM for help!

        1 Reply Last reply Reply Quote 0
        • P
          pwood999
          last edited by

          Server is set for Subnet topology.

          I haven't tried Net30.  Will this require other changes such as FW Rules, etc ?

          The Windows client is the 2.4.0 installer provided within the Client Export package, so hopefully not out-of-date.

          1 Reply Last reply Reply Quote 0
          • jimpJ
            jimp Rebel Alliance Developer Netgate
            last edited by

            If you are on subnet topology, then the error message from windows is wrong. So either something isn't correct in the windows client, or somehow the wrong settings are being used by the client.

            I would definitely uninstall and then reinstall the client on windows. And if that doesn't change anything, post the full client log here along with the client config (redact any private info, but keep the directives visible). The server config would be helpful to see as well.

            Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

            Need help fast? Netgate Global Support!

            Do not Chat/PM for help!

            1 Reply Last reply Reply Quote 0
            • P
              pwood999
              last edited by

              Ok I uninstalled & re-installed the 2.4.0 OpenVPN GUI Client using the download from PfSense export package.  Still same issue.

              Attached are:

              • pfsense OpenVPN server config including Client Specifics
              • VPN Client Config
              • VPN Client Log

              In all cases the Public IP has been replaced with 999.999.999.999 plus Key & Cert specifics removed

              openvpn-config+client-specifics-20170524132216.xml.txt
              pf-lab-TCP-11194-Client_Remote-config.ovpn.txt
              pf-lab-TCP-11194-Client-Specific.log.txt

              1 Reply Last reply Reply Quote 0
              • jimpJ
                jimp Rebel Alliance Developer Netgate
                last edited by

                If you are on subnet topology, your client-specific override entry tunnel network MUST have a matching mask for the server tunnel network. Change that to 10.9.8.201/24. See if that helps.

                Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                Need help fast? Netgate Global Support!

                Do not Chat/PM for help!

                1 Reply Last reply Reply Quote 0
                • P
                  pwood999
                  last edited by

                  @jimp:

                  ifconfig-push 10.9.8.202 10.9.8.201
                  

                  Thanks to all.  Even though I'm using Subnet mode, I tried clearing the Tunnel Network box, and added this to Advanced instead,  and then restarted OpenVPN Server.  Now my Windoze client connects and restricts the user to the specific IP in the CSC.

                  All that remains now is to add FW rule to restrict him to HTTPS only for the GUI he needs access to !!

                  Pete

                  1 Reply Last reply Reply Quote 0
                  • DerelictD
                    Derelict LAYER 8 Netgate
                    last edited by

                    Pass rule on the OpenVPN tab for his source address port any server's dest address port 443
                    Reject rule for his source address dest any

                    You will also need to pass DNS, etc if that needs to work over the tunnel.

                    Chattanooga, Tennessee, USA
                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                    1 Reply Last reply Reply Quote 0
                    • First post
                      Last post
                    Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.