Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    Openvpn site to site rules

    OpenVPN
    3
    12
    592
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • C
      choko last edited by

      hello,
      i try to set a site to site openvpn,i applied this tutorial  –> https://serenity-networks.com/step-by-step-guide-on-how-to-create-a-site-to-site-vpn-with-pfsense-using-openvpn-with-a-pre-shared-key/
      but it dont work ,i have this on the server log

      Dec 26 11:29:27 openvpn[9251]: /usr/local/sbin/ovpn-linkdown ovpns1 1500 1560 10.10.10.1 10.10.10.2 init
      Dec 26 11:29:27 openvpn[9251]: SIGTERM[hard,] received, process exiting
      Dec 26 11:29:27 openvpn[68396]: OpenVPN 2.3.8 i386-portbld-freebsd10.1 [SSL (OpenSSL)] [LZO] [MH] [IPv6] built on Aug 21 2015
      Dec 26 11:29:27 openvpn[68396]: library versions: OpenSSL 1.0.1l-freebsd 15 Jan 2015, LZO 2.09
      Dec 26 11:29:27 openvpn[68676]: NOTE: the current –script-security setting may allow this configuration to call user-defined scripts
      Dec 26 11:29:27 openvpn[68676]: TUN/TAP device ovpns1 exists previously, keep at program end
      Dec 26 11:29:27 openvpn[68676]: TUN/TAP device /dev/tun1 opened
      Dec 26 11:29:27 openvpn[68676]: do_ifconfig, tt->ipv6=1, tt->did_ifconfig_ipv6_setup=0
      Dec 26 11:29:27 openvpn[68676]: /sbin/ifconfig ovpns1 10.10.10.1 10.10.10.2 mtu 1500 netmask 255.255.255.255 up
      Dec 26 11:29:27 openvpn[68676]: /usr/local/sbin/ovpn-linkup ovpns1 1500 1560 10.10.10.1 10.10.10.2 init
      Dec 26 11:29:27 openvpn[68676]: UDPv4 link local (bound): [AF_INET]192.168.2.241:8888
      Dec 26 11:29:27 openvpn[68676]: UDPv4 link remote: [undef]

      1 Reply Last reply Reply Quote 0
      • V
        viragomann last edited by

        And what do the client log show?

        1 Reply Last reply Reply Quote 0
        • C
          choko last edited by

          Dec 26 14:13:03 openvpn[9340]: /usr/local/sbin/ovpn-linkdown ovpnc1 1500 1560 10.10.11.2 10.10.11.1 init
          Dec 26 14:13:03 openvpn[9340]: SIGTERM[hard,] received, process exiting
          Dec 26 14:13:03 openvpn[88055]: OpenVPN 2.3.8 i386-portbld-freebsd10.1 [SSL (OpenSSL)] [LZO] [MH] [IPv6] built on Aug 21 2015
          Dec 26 14:13:03 openvpn[88055]: library versions: OpenSSL 1.0.1l-freebsd 15 Jan 2015, LZO 2.09
          Dec 26 14:13:03 openvpn[88207]: NOTE: the current –script-security setting may allow this configuration to call user-defined scripts
          Dec 26 14:13:04 openvpn[88207]: TUN/TAP device ovpnc1 exists previously, keep at program end
          Dec 26 14:13:04 openvpn[88207]: TUN/TAP device /dev/tun1 opened
          Dec 26 14:13:04 openvpn[88207]: do_ifconfig, tt->ipv6=1, tt->did_ifconfig_ipv6_setup=0
          Dec 26 14:13:04 openvpn[88207]: /sbin/ifconfig ovpnc1 10.10.11.2 10.10.11.1 mtu 1500 netmask 255.255.255.255 up
          Dec 26 14:13:04 openvpn[88207]: /usr/local/sbin/ovpn-linkup ovpnc1 1500 1560 10.10.11.2 10.10.11.1 init
          Dec 26 14:13:04 openvpn[88207]: UDPv4 link local (bound): [AF_INET]192.168.1.241
          Dec 26 14:13:04 openvpn[88207]: UDPv4 link remote: [AF_INET]x.x.x.x:8888

          1 Reply Last reply Reply Quote 0
          • V
            viragomann last edited by

            Your client and server settings may not match. The server IP is 10.10.10.1, the clients IP is 10.10.11.2.

            Set the tunnel mask on server to /30. On the client you could leave the tunnel field blank. The address is supplied by the server.

            1 Reply Last reply Reply Quote 0
            • C
              choko last edited by

              i just applied this but nothing is changed

              server log
              Dec 26 14:39:07 openvpn[73428]: /usr/local/sbin/ovpn-linkdown ovpns1 1500 1560 10.10.10.1 10.10.10.2 init
              Dec 26 14:39:07 openvpn[73428]: SIGTERM[hard,] received, process exiting
              Dec 26 14:39:08 openvpn[45035]: OpenVPN 2.3.8 i386-portbld-freebsd10.1 [SSL (OpenSSL)] [LZO] [MH] [IPv6] built on Aug 21 2015
              Dec 26 14:39:08 openvpn[45035]: library versions: OpenSSL 1.0.1l-freebsd 15 Jan 2015, LZO 2.09
              Dec 26 14:39:08 openvpn[45105]: NOTE: the current –script-security setting may allow this configuration to call user-defined scripts
              Dec 26 14:39:08 openvpn[45105]: TUN/TAP device ovpns1 exists previously, keep at program end
              Dec 26 14:39:08 openvpn[45105]: TUN/TAP device /dev/tun1 opened
              Dec 26 14:39:08 openvpn[45105]: do_ifconfig, tt->ipv6=1, tt->did_ifconfig_ipv6_setup=0
              Dec 26 14:39:08 openvpn[45105]: /sbin/ifconfig ovpns1 10.10.10.1 10.10.10.2 mtu 1500 netmask 255.255.255.255 up
              Dec 26 14:39:08 openvpn[45105]: /usr/local/sbin/ovpn-linkup ovpns1 1500 1560 10.10.10.1 10.10.10.2 init
              Dec 26 14:39:08 openvpn[45105]: UDPv4 link local (bound): [AF_INET]192.168.2.241:8888
              Dec 26 14:39:08 openvpn[45105]: UDPv4 link remote: [undef]

              client log
              Dec 26 14:37:14 openvpn[73590]: /usr/local/sbin/ovpn-linkdown ovpnc1 1500 1560 init
              Dec 26 14:37:14 openvpn[73590]: SIGTERM[hard,] received, process exiting
              Dec 26 14:37:15 openvpn[8954]: OpenVPN 2.3.8 i386-portbld-freebsd10.1 [SSL (OpenSSL)] [LZO] [MH] [IPv6] built on Aug 21 2015
              Dec 26 14:37:15 openvpn[8954]: library versions: OpenSSL 1.0.1l-freebsd 15 Jan 2015, LZO 2.09
              Dec 26 14:37:15 openvpn[9140]: NOTE: the current –script-security setting may allow this configuration to call user-defined scripts
              Dec 26 14:37:15 openvpn[9140]: OpenVPN ROUTE: OpenVPN needs a gateway parameter for a –route option and no default was specified by either --route-gateway or --ifconfig options
              Dec 26 14:37:15 openvpn[9140]: OpenVPN ROUTE: failed to parse/resolve route for host/network: 192.168.2.0
              Dec 26 14:37:15 openvpn[9140]: TUN/TAP device ovpnc1 exists previously, keep at program end
              Dec 26 14:37:15 openvpn[9140]: TUN/TAP device /dev/tun1 opened
              Dec 26 14:37:15 openvpn[9140]: /usr/local/sbin/ovpn-linkup ovpnc1 1500 1560 init
              Dec 26 14:37:15 openvpn[9140]: UDPv4 link local (bound): [AF_INET]192.168.1.241
              Dec 26 14:37:15 openvpn[9140]: UDPv4 link remote: [AF_INET]x.x.x.x:8888

              1 Reply Last reply Reply Quote 0
              • Derelict
                Derelict LAYER 8 Netgate last edited by

                You must supply the tunnel networks on both sides with a /30 (point-to-point mode).

                Set them both to 10.10.10.0/30. The server will use .1, the client .2.

                There is nothing in those logs indicating a connection attempt is even occurring. The client isn't properly loading at all.

                OpenVPN 2.3.8 i386-portbld-freebsd10.1 [SSL (OpenSSL)] [LZO] [MH] [IPv6] built on Aug 21 2015

                Why such an ancient version?

                Chattanooga, Tennessee, USA
                The pfSense Book is free of charge!
                DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                1 Reply Last reply Reply Quote 0
                • C
                  choko last edited by

                  i use an old version 2.2.6 because i think its the most stable version,i  plan to use traffic shaper later .an i see in the bug tracker that in the 2.4 traffic shaper dont work at all,many problem with it. so i prefer to use an old stable version. i have a basic use anyway.

                  i set ip like you tell me,but same issue.
                  my 2 pfsense are behind a modem and i forward 8888 udp port on every modem . can this be the cause ??
                  before use this topology i see in the internet that pfsense can work behind modem .
                  i cant set pfsense on pppoe because there is no place to put the vlan id of the ISP  (ipmsan topology) so i am obliged to have pfsense behind modem.
                  but i same tuto i see that is working well ,and that work even with ddns service if not static public ip.

                  1 Reply Last reply Reply Quote 0
                  • C
                    choko last edited by

                    this is haw i want to make my vpn .normally its possible a topologie like this ,it work i hope  :(


                    1 Reply Last reply Reply Quote 0
                    • Derelict
                      Derelict LAYER 8 Netgate last edited by

                      OK well I am not going to spend a bunch of time troubleshooting 2.2.6 with you. Sorry.

                      Chattanooga, Tennessee, USA
                      The pfSense Book is free of charge!
                      DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                      1 Reply Last reply Reply Quote 0
                      • C
                        choko last edited by

                        ok,thanks for help anyway, but can you tell me with what recent stable version can i do that

                        1 Reply Last reply Reply Quote 0
                        • Derelict
                          Derelict LAYER 8 Netgate last edited by

                          2.4.2_1. If your hardware is 32-bit-only then 2.3.5_1.

                          Chattanooga, Tennessee, USA
                          The pfSense Book is free of charge!
                          DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
                          Do Not Chat For Help! NO_WAN_EGRESS(TM)

                          1 Reply Last reply Reply Quote 0
                          • C
                            choko last edited by

                            thank you for the help :)

                            1 Reply Last reply Reply Quote 0
                            • First post
                              Last post