• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

[SOLVED] OpenVPN Site to Site still Ping / RDP not working

Scheduled Pinned Locked Moved OpenVPN
19 Posts 2 Posters 2.8k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • V
    viragomann
    last edited by Nov 10, 2017, 12:22 PM

    The firewall log only shows requests on the interface where the packets come in, no responses.
    These can only be seen in a packet capture or any other network sniffer.

    1 Reply Last reply Reply Quote 0
    • R
      rafael.seeck
      last edited by Nov 10, 2017, 12:50 PM

      Now it works i can´t understand why i have test something and now it will works. More details and the final solution shortly! Thanks!

      1 Reply Last reply Reply Quote 0
      • R
        rafael.seeck
        last edited by Nov 10, 2017, 1:20 PM

        What i do:

        1. I have add two firewall rules from lan to s2s and to 192.168.15.0/24
        2. I add on both site routes for the opposite networks
        3. I add outbound rules from interface lan with source 10.10.15.0/30 to destination networks

        What the decisive step was i can´t say actually. I will still testing some settings and give feedback later.

        Thanks and bye

        1 Reply Last reply Reply Quote 0
        • V
          viragomann
          last edited by Nov 10, 2017, 2:00 PM

          @rafael.seeck:

          3. I add outbound rules from interface lan with source 10.10.15.0/30 to destination networks

          That NAT rule translates source addresses of packets coming over vpn and destined to a LAN device to the pfSense LAN address. So for the LAN device it seems the packets come from inside the subnet. I already mentioned above.
          If that solve the issue, either the device firewall blocks access from addresses outside its own subnet or the vpn client / server is not the default gateway.

          1 Reply Last reply Reply Quote 0
          • R
            rafael.seeck
            last edited by Nov 10, 2017, 2:19 PM

            Hi,

            is it possible that i use two solutions for one problem?

            outbound nat and static routes?

            Is it possible that i get problems later?

            I add some pictures under the attachments.

            Thanks

            Ps:Do you know as it possible to join the official pfsense docs team to add this informations under openvpn site to site?

            ![2017-11-10 15_14_06-pfsense_server - Firewall_ NAT_ Outbound.png](/public/imported_attachments/1/2017-11-10 15_14_06-pfsense_server - Firewall_ NAT_ Outbound.png)
            ![2017-11-10 15_14_06-pfsense_server - Firewall_ NAT_ Outbound.png_thumb](/public/imported_attachments/1/2017-11-10 15_14_06-pfsense_server - Firewall_ NAT_ Outbound.png_thumb)
            ![2017-11-10 15_11_48-pfsense_server - Firewall_ Rules.png](/public/imported_attachments/1/2017-11-10 15_11_48-pfsense_server - Firewall_ Rules.png)
            ![2017-11-10 15_11_48-pfsense_server - Firewall_ Rules.png_thumb](/public/imported_attachments/1/2017-11-10 15_11_48-pfsense_server - Firewall_ Rules.png_thumb)
            ![2017-11-10 15_16_47-pfsense_server - System_ Routing_ Gateways.png](/public/imported_attachments/1/2017-11-10 15_16_47-pfsense_server - System_ Routing_ Gateways.png)
            ![2017-11-10 15_16_47-pfsense_server - System_ Routing_ Gateways.png_thumb](/public/imported_attachments/1/2017-11-10 15_16_47-pfsense_server - System_ Routing_ Gateways.png_thumb)
            ![2017-11-10 15_17_56-pfsense_server - System_ Routing_ Static Routes.png](/public/imported_attachments/1/2017-11-10 15_17_56-pfsense_server - System_ Routing_ Static Routes.png)
            ![2017-11-10 15_17_56-pfsense_server - System_ Routing_ Static Routes.png_thumb](/public/imported_attachments/1/2017-11-10 15_17_56-pfsense_server - System_ Routing_ Static Routes.png_thumb)

            1 Reply Last reply Reply Quote 0
            • V
              viragomann
              last edited by Nov 10, 2017, 2:40 PM

              @rafael.seeck:

              outbound nat and static routes?

              You have set a static route?? You should never set static routes on vpn gateways!
              https://doc.pfsense.org/index.php/Static_Routes

              @rafael.seeck:

              is it possible that i use two solutions for one problem?

              Not with that outbound NAT rule. Since the source network is only the vpn tunnel subnet, it only affects packets coming from the client address respectively the server, not from the network behind.
              That's the same useless outbound NAT rule you had set before. The client or server won't access devices in the remote LAN aside from your testing.

              @rafael.seeck:

              Is it possible that i get problems later?

              Possibly with the static route.

              1 Reply Last reply Reply Quote 0
              • R
                rafael.seeck
                last edited by Nov 10, 2017, 2:46 PM

                Hi

                @Viragomann

                Thank you very much.

                Bye

                1 Reply Last reply Reply Quote 0
                • R
                  rafael.seeck
                  last edited by Nov 10, 2017, 3:02 PM

                  Hi,

                  @Viragomann

                  when i disable the static route then the connection will break.

                  What is wrong?

                  thanks

                  1 Reply Last reply Reply Quote 0
                  • V
                    viragomann
                    last edited by Nov 10, 2017, 3:35 PM

                    The route have to be set by OpenVPN, depending on the entries in "Local Network(s)" and "Remote Network(s)" on both sites. If these entries are set, the routes should work.

                    You can check the routing table in Diagnostic > Routes.

                    Is that a SSL/TLS OpenVPN or a Preshared key?

                    1 Reply Last reply Reply Quote 0
                    • R
                      rafael.seeck
                      last edited by Nov 10, 2017, 4:05 PM Nov 10, 2017, 4:00 PM

                      Hi,

                      i found this howto and following up.

                      Now i have Peer to Peer SSL/TLS before it was a pre shared key setup.
                      The connection is established but now i can´t access any ressources from the other site.

                      What is wrong?

                      Thanks

                      ![2017-11-10 16_57_31pfsense_server - VPN_ OpenVPN_ Servers_ Edit.png](/public/imported_attachments/1/2017-11-10 16_57_31pfsense_server - VPN_ OpenVPN_ Servers_ Edit.png)
                      ![2017-11-10 16_57_31pfsense_server - VPN_ OpenVPN_ Servers_ Edit.png_thumb](/public/imported_attachments/1/2017-11-10 16_57_31pfsense_server - VPN_ OpenVPN_ Servers_ Edit.png_thumb)
                      ![2017-11-10 16_58_10-pfsense_server - VPN_ OpenVPN_ Servers_ Edit.png](/public/imported_attachments/1/2017-11-10 16_58_10-pfsense_server - VPN_ OpenVPN_ Servers_ Edit.png)
                      ![2017-11-10 16_58_10-pfsense_server - VPN_ OpenVPN_ Servers_ Edit.png_thumb](/public/imported_attachments/1/2017-11-10 16_58_10-pfsense_server - VPN_ OpenVPN_ Servers_ Edit.png_thumb)
                      ![2017-11-10 16_58_42-pfsense_server - VPN_ OpenVPN_ Servers_ Edit.png](/public/imported_attachments/1/2017-11-10 16_58_42-pfsense_server - VPN_ OpenVPN_ Servers_ Edit.png)
                      ![2017-11-10 16_58_42-pfsense_server - VPN_ OpenVPN_ Servers_ Edit.png_thumb](/public/imported_attachments/1/2017-11-10 16_58_42-pfsense_server - VPN_ OpenVPN_ Servers_ Edit.png_thumb)
                      ![2017-11-10 16_59_17-pfsense_server - VPN_ OpenVPN_ Servers_ Edit.png](/public/imported_attachments/1/2017-11-10 16_59_17-pfsense_server - VPN_ OpenVPN_ Servers_ Edit.png)
                      ![2017-11-10 16_59_17-pfsense_server - VPN_ OpenVPN_ Servers_ Edit.png_thumb](/public/imported_attachments/1/2017-11-10 16_59_17-pfsense_server - VPN_ OpenVPN_ Servers_ Edit.png_thumb)
                      ![2017-11-10 16_59_43-pfsense_server - VPN_ OpenVPN_ Servers_ Edit.png](/public/imported_attachments/1/2017-11-10 16_59_43-pfsense_server - VPN_ OpenVPN_ Servers_ Edit.png)
                      ![2017-11-10 16_59_43-pfsense_server - VPN_ OpenVPN_ Servers_ Edit.png_thumb](/public/imported_attachments/1/2017-11-10 16_59_43-pfsense_server - VPN_ OpenVPN_ Servers_ Edit.png_thumb)
                      ![2017-11-10 17_03_57-pfsense_server - VPN_ OpenVPN_ Client Specific Overrides_ Edit.png](/public/imported_attachments/1/2017-11-10 17_03_57-pfsense_server - VPN_ OpenVPN_ Client Specific Overrides_ Edit.png)
                      ![2017-11-10 17_03_57-pfsense_server - VPN_ OpenVPN_ Client Specific Overrides_ Edit.png_thumb](/public/imported_attachments/1/2017-11-10 17_03_57-pfsense_server - VPN_ OpenVPN_ Client Specific Overrides_ Edit.png_thumb)
                      ![2017-11-10 17_04_22pfsense_server - VPN_ OpenVPN_ Client Specific Overrides_ Edit.png](/public/imported_attachments/1/2017-11-10 17_04_22pfsense_server - VPN_ OpenVPN_ Client Specific Overrides_ Edit.png)
                      ![2017-11-10 17_04_22pfsense_server - VPN_ OpenVPN_ Client Specific Overrides_ Edit.png_thumb](/public/imported_attachments/1/2017-11-10 17_04_22pfsense_server - VPN_ OpenVPN_ Client Specific Overrides_ Edit.png_thumb)

                      1 Reply Last reply Reply Quote 0
                      • V
                        viragomann
                        last edited by Nov 10, 2017, 4:26 PM

                        Why you set up a client specific override for a site-to-site? Do you plan to connect with multiple clients?
                        Besides there is nothing to override, since the settings are the same as on server tab.

                        Aside this it looks well. But what's about the client settings? And the routing table from both sites?

                        1 Reply Last reply Reply Quote 0
                        • R
                          rafael.seeck
                          last edited by Nov 10, 2017, 8:18 PM

                          Hi,

                          @Viragomann

                          Why you set up a client specific override for a site-to-site? Do you plan to connect with multiple clients?

                          No actually i plan no multiple clients -> I have remove client specific override.

                          PFsense Server:
                          In the routing table is not an entry for 192.168.15.0/24 (PFsense Client) only a tunnel network entry:

                          Destination Gateway         Flags Use Mtu         Netif     Expire
                          10.10.15.0/24 10.10.15.2 UGS 0 1500 ovpns4

                          it does not look right ?!!? or??!!

                          Complete table you can see in the attachments.

                          PFSense Client:
                          Complete in the attachments (Entry for 192.168.10.0/24 exists)

                          The client configuration is also under the attachments.

                          Thanks

                          ![2017-11-10 20_58_01-pfsense_server - Diagnostics_ Routes.png](/public/imported_attachments/1/2017-11-10 20_58_01-pfsense_server - Diagnostics_ Routes.png)
                          ![2017-11-10 20_58_01-pfsense_server - Diagnostics_ Routes.png_thumb](/public/imported_attachments/1/2017-11-10 20_58_01-pfsense_server - Diagnostics_ Routes.png_thumb)
                          ![2017-11-10 21_11_00-pfSense_client - Diagnostics_ Routes.png](/public/imported_attachments/1/2017-11-10 21_11_00-pfSense_client - Diagnostics_ Routes.png)
                          ![2017-11-10 21_11_00-pfSense_client - Diagnostics_ Routes.png_thumb](/public/imported_attachments/1/2017-11-10 21_11_00-pfSense_client - Diagnostics_ Routes.png_thumb)
                          ![2017-11-10 21_12_28-pfSense_client - VPN_ OpenVPN_ Clients_ Edit_1.png](/public/imported_attachments/1/2017-11-10 21_12_28-pfSense_client - VPN_ OpenVPN_ Clients_ Edit_1.png)
                          ![2017-11-10 21_12_28-pfSense_client - VPN_ OpenVPN_ Clients_ Edit_1.png_thumb](/public/imported_attachments/1/2017-11-10 21_12_28-pfSense_client - VPN_ OpenVPN_ Clients_ Edit_1.png_thumb)
                          ![2017-11-10 21_13_14-pfSense_client - VPN_ OpenVPN_ Clients_ Edit_2.png](/public/imported_attachments/1/2017-11-10 21_13_14-pfSense_client - VPN_ OpenVPN_ Clients_ Edit_2.png)
                          ![2017-11-10 21_13_14-pfSense_client - VPN_ OpenVPN_ Clients_ Edit_2.png_thumb](/public/imported_attachments/1/2017-11-10 21_13_14-pfSense_client - VPN_ OpenVPN_ Clients_ Edit_2.png_thumb)
                          ![2017-11-10 21_14_44-pfSense_client - VPN_ OpenVPN_ Clients_ Edit_3.png](/public/imported_attachments/1/2017-11-10 21_14_44-pfSense_client - VPN_ OpenVPN_ Clients_ Edit_3.png)
                          ![2017-11-10 21_14_44-pfSense_client - VPN_ OpenVPN_ Clients_ Edit_3.png_thumb](/public/imported_attachments/1/2017-11-10 21_14_44-pfSense_client - VPN_ OpenVPN_ Clients_ Edit_3.png_thumb)
                          ![2017-11-10 21_15_15-pfSense_client - VPN_ OpenVPN_ Clients_ Edit_4.png](/public/imported_attachments/1/2017-11-10 21_15_15-pfSense_client - VPN_ OpenVPN_ Clients_ Edit_4.png)
                          ![2017-11-10 21_15_15-pfSense_client - VPN_ OpenVPN_ Clients_ Edit_4.png_thumb](/public/imported_attachments/1/2017-11-10 21_15_15-pfSense_client - VPN_ OpenVPN_ Clients_ Edit_4.png_thumb)
                          ![2017-11-10 21_16_50-pfSense_client - VPN_ OpenVPN_ Clients_ Edit_5.png](/public/imported_attachments/1/2017-11-10 21_16_50-pfSense_client - VPN_ OpenVPN_ Clients_ Edit_5.png)
                          ![2017-11-10 21_16_50-pfSense_client - VPN_ OpenVPN_ Clients_ Edit_5.png_thumb](/public/imported_attachments/1/2017-11-10 21_16_50-pfSense_client - VPN_ OpenVPN_ Clients_ Edit_5.png_thumb)

                          1 Reply Last reply Reply Quote 0
                          • R
                            rafael.seeck
                            last edited by Nov 10, 2017, 8:38 PM

                            Hi,

                            @Viragomann
                            I have disable and enable vpn server and now i found an entry in the pfsense server routing table.

                            See attachments

                            Ping and Access is not possible!

                            Thanks

                            ![2017-11-10 21_35_01-pfsense_server - Diagnostics_ Routes_incl_192_168_15_0_24.png](/public/imported_attachments/1/2017-11-10 21_35_01-pfsense_server - Diagnostics_ Routes_incl_192_168_15_0_24.png)
                            ![2017-11-10 21_35_01-pfsense_server - Diagnostics_ Routes_incl_192_168_15_0_24.png_thumb](/public/imported_attachments/1/2017-11-10 21_35_01-pfsense_server - Diagnostics_ Routes_incl_192_168_15_0_24.png_thumb)

                            1 Reply Last reply Reply Quote 0
                            • R
                              rafael.seeck
                              last edited by Nov 11, 2017, 10:21 PM

                              Hi,

                              my Site to Site is now running and i have setup according recommendation, it means that i have no static routes.

                              The final solution was to reset the states and take a /30 tunnel network.

                              Thx and Bye

                              1 Reply Last reply Reply Quote 0
                              19 out of 19
                              • First post
                                19/19
                                Last post
                              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                This community forum collects and processes your personal information.
                                consent.not_received