HELP NEEDED - OPENVPN NO LAN ACCESS!!***

CalTommo · Nov 14, 2017, 7:15 PM

Hi Guys,

Forgive me as i'm a bit of a newbie to this but i have just followed a guide on YouTube (link below) in order to setup OpenVPN on my pfSense Router. The only difference i made from the video is that i use LDAP authentication to my Domain Controller rather than creating users on the local pfSense database to authenticate. However, this all works fine! I can connect and authenticate and i am able to access my pfSense router (10.1.10.1) and also my Server (10.1.10.2) which hosts the server in a virtual machine.

These are the ONLY 2 resources i'm able to access and when trying to access any other machines such as my RDP server (10.1.10.13) i cannot ping or communicate with it. This is the same with all other active IPs on the network. I can ping these resources from my home network but not through the VPN Tunnel.

When connecting it connects me to a subnet of 10.120.0.0/24 although my LAN network is on 10.1.10.0/24 but I've been advised this shouldn't matter. I do want the connected clients to be on the 10.120.0.0/24 subnet if possible?

Any assistance is appreciated! Happy to provide screenshots where necessary.

viragomann · Nov 14, 2017, 8:58 PM

Ensure that the firewalls on your LAN devices don't block the access. The Windows firewall for instance blocks access from other subnet ranges by default.
Since your able to access the server, the routing should work.

CalTommo · Nov 14, 2017, 9:13 PM

Hi viragomann,

Thanks for your reply! Unfortunately that doesn't seem to help, i completely disabled the firewall on one of the PCs and still couldn't ping it. I even tried pinging devices which won't have a firewall such as a SmartTV & Android Phone.

Are you able to offer any more solutions?

Thanks in advance!

viragomann · Nov 14, 2017, 9:53 PM

I'd go to troubleshooting in this case to narrow the issue.
Use the packet capture tool from the pfSense Diagnostic menu.
Start a capture on the LAN interface, protocol filtered to "ICMP" while you try a ping to a LAN device. Stop the capture and check if you see the packets, requests and responses.

john_galt · Nov 14, 2017, 10:23 PM

Try the "IPv4 Local network(s)" setting for your VPN server.

IPv4 networks that will be accessible from the remote endpoint. Expressed as a comma-separated list of one or more CIDR ranges. This may be left blank if not adding a route to the local network through this tunnel on the remote machine. This is generally set to the LAN network.

CalTommo · Nov 15, 2017, 5:05 PM

Hi Viragomann,

I started the packet capture and could see the replies from my 10.1.10.2 device (server which PfSense is hosted on). However when trying to ping my RDP server (10.1.10.13) there was no response i just get 'Request timed out' on my command prompt. The packet capture can see the echo request but no response. I have posted the results from the packet capture below:

17:02:57.103150 IP 10.120.0.2 > 10.1.10.2: ICMP echo request, id 1, seq 145, length 40
17:02:57.103394 IP 10.1.10.2 > 10.120.0.2: ICMP echo reply, id 1, seq 145, length 40
17:02:58.005566 IP 10.1.10.22 > 10.1.10.1: ICMP echo request, id 7943, seq 0, length 64
17:02:58.005617 IP 10.1.10.1 > 10.1.10.22: ICMP echo reply, id 7943, seq 0, length 64
17:02:58.072320 IP 10.120.0.2 > 10.1.10.2: ICMP echo request, id 1, seq 146, length 40
17:02:58.072534 IP 10.1.10.2 > 10.120.0.2: ICMP echo reply, id 1, seq 146, length 40
17:02:59.005446 IP 10.1.10.22 > 10.1.10.1: ICMP echo request, id 7943, seq 1, length 64
17:02:59.005478 IP 10.1.10.1 > 10.1.10.22: ICMP echo reply, id 7943, seq 1, length 64
17:02:59.091281 IP 10.120.0.2 > 10.1.10.2: ICMP echo request, id 1, seq 147, length 40
17:02:59.091496 IP 10.1.10.2 > 10.120.0.2: ICMP echo reply, id 1, seq 147, length 40
17:03:00.140932 IP 10.120.0.2 > 10.1.10.2: ICMP echo request, id 1, seq 148, length 40
17:03:00.141139 IP 10.1.10.2 > 10.120.0.2: ICMP echo reply, id 1, seq 148, length 40
17:03:05.089289 IP 10.120.0.2 > 10.1.10.13: ICMP echo request, id 1, seq 149, length 40
17:03:09.766012 IP 10.120.0.2 > 10.1.10.13: ICMP echo request, id 1, seq 150, length 40
17:03:14.733753 IP 10.120.0.2 > 10.1.10.13: ICMP echo request, id 1, seq 151, length 40
17:03:19.717440 IP 10.120.0.2 > 10.1.10.13: ICMP echo request, id 1, seq 152, length 40

CalTommo · Nov 15, 2017, 5:14 PM

Hi John_Gault,

Thanks for your response to this thread! I looked at the IPv4 Local Network(s) setting and in the box was just my LAN subnet (10.1.10.0/24) which should allow me to ping the 10.1.10.13 address if i'm not mistaken? The IPv4 Tunnel Network is 10.120.0.0/24 i'm not sure if this makes any impact? I've attached screenshots of the whole OpenVPN Config page so you can see the settings and hopefully shine some light on this problem.

Thanks in advance!

viragomann · Nov 15, 2017, 5:49 PM

@CalTommo:

I started the packet capture and could see the replies from my 10.1.10.2 device (server which PfSense is hosted on). However when trying to ping my RDP server (10.1.10.13) there was no response i just get 'Request timed out' on my command prompt. The packet capture can see the echo request but no response. I have posted the results from the packet capture below:

So either 10.1.10.13 sends the responses to another gateway (improbably; I presume that pfSense is set as default gateway on the device) or it doesn't respond (block) to the requests (presumably, cause the request packets have a source IP which belongs to a different subnet).

You can easily demonstrate this with the ping tool from the pfSense Diagnostic menu. Try do ping the device with automatically selected source address (that's the LAN address if you're pinging a LAN device) and then select another interface address and try to ping again. Both come from the same interface (LAN), but with different source addresses.
Presumably you get no response from 10.1.10.13 if you select a different source address.

CalTommo · Nov 15, 2017, 7:00 PM

Hi Viragomann,

I used the 'ping' diagnostic tool from within pfSense and when using Automatically selected source address or LAN as the source address i can successfully ping the 10.1.10.13 address. I'm unsure why but i had a seperate interface called OPENVPN, when pinging from this as the source address i couldn't contact the 10.1.10.13 address. However, there was another one in the list called OpenVPN Server: when pinging from this i DO receive replies from the 10.1.10.13 address! Not sure why this interface was created so i just deleted it. However if i change the source address to the WAN interface i get no responses from the ping. This is as you suspected but i'm unsure what this tells us? Does this give us anything further to go on?

Thanks

chpalmer · Nov 15, 2017, 7:27 PM

Can you show-

/status_openvpn.php

/firewall_rules.php?if=openvpn

/vpn_openvpn_server.php

/vpn_openvpn_client.php

~~You can make your tunnel network a /30. There is no need to have more than that. ~~
Nevermind that statement.. I was thinking site to site. You only need enough here for the number of devices you have. A /28 would be better.

chpalmer · Nov 15, 2017, 7:28 PM

What is the client side device?

On the pfSense box you do not have OpenVPN assigned as an interface do you?

CalTommo · Nov 15, 2017, 7:32 PM

Hi,

I've attached the outputs that you requested in picture form below this post. I am connecting using OpenVPN client on my windows 10 Laptop. I connect to my phone's hotspot in order to not be on the LAN.

I am not sure whether i need to have OpenVPN as an interface? Currently i don't have it set up as one. Are you able to tell me whether this needs to be done? When i go to 'assignments' under the interfaces tab, it allows me to add OPT1 as it says 'Available network ports - ovpns1 (). Should i add this?

Thanks

viragomann · Nov 15, 2017, 9:12 PM

@CalTommo:

However, there was another one in the list called OpenVPN Server: when pinging from this i DO receive replies from the 10.1.10.13 address! Not sure why this interface was created so i just deleted it. However if i change the source address to the WAN interface i get no responses from the ping. This is as you suspected but i'm unsure what this tells us? Does this give us anything further to go on?

That's truly strange.
The "OpenVPN Server" has 10.120.0.1. So 10.1.10.13 responses if the source address is 10.120.0.1, but it doesn't if the source is 10.120.0.2. ???

Maybe something messed up with the network settings on the LAN computer?

The "OPENVPN" in the source dropdown of the ping tool was the interface you've assigned to the server. Have you also assigned an IP to it?
Assigning an interface to the OpenVPN server isn't needed in your setup.

If you don't find a working solution you can get access by natting the VPN traffic as a workaround.

chpalmer · Nov 15, 2017, 10:49 PM

@viragomann:

The "OpenVPN Server" has 10.120.0.1. So 10.1.10.13 responses if the source address is 10.120.0.1, but it doesn't if the source is 10.120.0.2. ???

10.120.0.1 is just part of his tunnel address.. has nothing to do with his actual networks. Just required address for the VPN tunnel.

I am not sure whether i need to have OpenVPN as an interface?

No- don't.

When your connected- is your laptop in the same subnet as your pfSense LAN?
What does your Windows 10 configuration file look like?

On your open VPN firewall rule- make "Destination" LAN Net. Ive seen issues before with "allow all"

CalTommo · Nov 17, 2017, 1:17 AM

Hi Guys,

Sorry for my late reply, i've been trying to scour the internet all day but haven't been able to get nowhere with it. I haven't assigned an IP to the interface as i have now deleted the interface as you mentioned it wasn't required in my setup. How would we go about NATTing the traffic as you mentioned? Would that affect anything else & is it complicated to do?

When connected my laptop is in the 10.120.0.0/24 subnet (as per the Tunnel Address Subnet) whilst my LAN is 10.1.10.0/24 but i didn't think this would make a difference? I have changed the VPN firewall rule to make Destination as the LAN subnet as you mentioned but doesn't seem to have resolved the issue. My windows 10 configuration file is below with my IP Removed:

dev tun
persist-tun
persist-key
cipher AES-256-CBC
ncp-ciphers AES-256-GCM:AES-128-GCM
auth SHA1
tls-client
client
resolv-retry infinite
remote (MY IP IS HERE SO BEEN REMOVED) 1194 udp
auth-user-pass
ca pfSense-udp-1194-ca.crt
tls-auth pfSense-udp-1194-tls.key 1
remote-cert-tls server

UPDATE: I Don't seem to be able to ping ANY LAN devices now when connected to the VPN. I can see my connection in the clients list on the pfsense router however i'm unable to communicate with anything when connected. So i know the connecting is authenticating with the LDAP server and also being seen by pfSense as a connected client, but no communication is happening between my LAN devices over my VPN connection? Back to the drawing board i guess guys!

Hope somebody can help me resolve this, as it's turning into a real headache :-\

viragomann · Apr 7, 2019, 2:28 AM

If you do NAT, the source address in packets coming from a VPN client and destined to a LAN device is translated to the routers LAN address. So the device sees the packets coming from its own network segment and will trust the access.

It's not difficult to enable it: Go to Firewall > NAT > Outbound, if you've never changed the NAT mode it will still be in automatic rule gen mode, so change it to hybrid mode and save this.
Then add a new NAT rule:
Interface: LAN
Source: Network - 10.120.0.0/24 (your VPN tunnel subnet)
Leave all other options at their defaults, just enter a description and save it.

CalTommo · Nov 17, 2017, 1:27 PM

Hi Viragomann,

I did what you said with the NAT Rule however that didn't seem to work for my either. :'(

However, i just went into my OpenVPN Settings again and ticked the boxes 'Block Outside DNS' & 'Force DNS cache update'.

It now seems to be working great! Thanks again for your help with this.

viragomann · Nov 17, 2017, 2:27 PM

So the problem was on hostnames?
You didn't mentioned that you use hostnames for trying to access.

cadam · Apr 7, 2019, 2:28 AM

@viragomann

Then add a new NAT rule:
Interface: LAN
Source: Network - 10.120.0.0/24 (your VPN tunnel subnet)
Leave all other options at their defaults, just enter a description and save it.

@viragomann
thanks, that solution worked for me :)

adelphi_sky · Nov 1, 2019, 11:14 PM

I registered just to say thanks! What took me hours upon hours to figure out, this one thread did it for me. NATs! All the other sites failed to suggest that! They got into the weeds about tun vs. tap yadda yadda. But NATting is the fix. Thanks again!