Unable to reach LAN IP after connecting to openvpn

[comet424]

and I forgot to say if I use openvpn on my cell on my current network right now I loose internet I was mentioning above.. and that's with the force IP client button checked off you mentioned.. I disconnect from openvpn and internet is back... is that another setting I need or is it just conflicting

hopefully fixs when I test at the coffee shop

[comet424]

ayanbanerjee ah ok.. your 1 up on me.. I unable to ping my pfsense router 192.168.0.1 or 192.168.0.100.1 for the virtual network.. I followed that guys video and I unable to ping anything or get internet and I followed his instructions I watched the video 10 times still no luck and I mentioned it on youtube if you have the same ip address at like the guy said about starbucks what happens.. as its going to happen.. so I going to try his Force the client button and I going to try after the dentist... if doesn't work I going to try changing my ip address from 192.168.0.x to 192.168.254.x and the virtual ip to 192.168.253.x say as odds are no one uses it.. and I not sure if I can use 192.169.x.x over 20 yrs I been taught and used 192.168.0.x back in 90s using Wingate and Sygate trying to share internet over a dialup and network and network cards with dip switchs
problems over years gotten better but still problems I seen just different ones lol. like this vpn stuff I trying to teach myself lol

[ayanbanerjee]

@comet424 As per the video I have changed the VPN ip pool 172.16.12.x but same thing ... still I am unable to ping any of the lan ip which are belongs on 192.168.1.x series.

[johnpoz]

Please post up your openvpn config, your client config and what IP is your client on when you connect..

Not going to watch a 15 min video for something that takes 30 seconds to setup. Clickity Clickity through the wizard, export the client config = done..

[ayanbanerjee]

@johnpoz Hi,

Please find below the VPN config details

dev tun
persist-tun
persist-key
cipher AES-256-CBC
ncp-disable
auth SHA1
tls-client
client
resolv-retry infinite
remote 182.71.195.102 1194 udp
verify-x509-name "IndepayVPNCertificate" name
auth-user-pass
pkcs12 pfSense-UDP4-1194-ayanbanerjee.p12
tls-auth pfSense-UDP4-1194-ayanbanerjee-tls.key 1
remote-cert-tls server

172.16.12.2 is getting when my vpn got connected.

[johnpoz]

why are you putting that in custom options? Remove that.

Is your client getting the option to force all traffic out tunnel. What is the clients IP, not its vpn tunnel IP it gets. As already mentioned if your remove client is on the same network as your remote network its not going to work.

Lets see your clients route after you connect and the status of when your client connects... example

see here is my routes being added to the client per my above post

Fri Jun 15 09:46:45 2018 TEST ROUTES: 3/3 succeeded len=3 ret=1 a=0 u/d=up
Fri Jun 15 09:46:45 2018 MANAGEMENT: >STATE:1529074005,ADD_ROUTES,,,,,,
Fri Jun 15 09:46:45 2018 C:\Windows\system32\route.exe ADD 192.168.9.0 MASK 255.255.255.0 10.0.8.1
Fri Jun 15 09:46:45 2018 Route addition via service succeeded
Fri Jun 15 09:46:45 2018 C:\Windows\system32\route.exe ADD 192.168.2.0 MASK 255.255.255.0 10.0.8.1
Fri Jun 15 09:46:45 2018 Route addition via service succeeded
Fri Jun 15 09:46:45 2018 C:\Windows\system32\route.exe ADD 192.168.3.0 MASK 255.255.255.0 10.0.8.1
Fri Jun 15 09:46:45 2018 Route addition via service succeeded
Fri Jun 15 09:46:45 2018 Initialization Sequence Completed

[comet424]

I just got home from dentist so it didn't work at the denist internet... I can connect using my cell to pfsense.. says I get the 192.168.100.2 address but I loose internet and I cant ping...

how do I post the config files or do I post just the screen captures?

[comet424]

I did config export files only this is what I got
dev tun
persist-tun
persist-key
cipher AES-128-CBC
ncp-ciphers AES-256-GCM:AES-128-GCM
auth SHA1
tls-client
client
resolv-retry infinite
remote 174.94.28.5 1194 udp
verify-x509-name "mikeshouseserver" name
pkcs12 pfSense-UDP4-1194-mikeshouseclient.p12
tls-auth pfSense-UDP4-1194-mikeshouseclient-tls.key 1
remote-cert-tls server

[comet424]

[comet424]

[comet424]

sorry pics seem to have posted out of order... but that's the settings of the server settings.. is there any other screen shots you need?

[johnpoz]

@comet424 said in Unable to reach LAN IP after connecting to openvpn:

but I loose internet and I cant ping…

Can't ping what?? Is what your trying to ping set to allow you to ping from 192.168.100/24 - for example windows out of the box firewall will not answer ping unless your on the same network..

You have to adjust the host firewall. For you to get internet access via this vpn connection, did you set your outbound nat for your tunnel network.. Should of done that for you, but if you had changed to say manual mode on your outbound nat than it wouldn't..

When you connect to your vpn, can you ping your lan IP of pfsense?

[ayanbanerjee]

@johnpoz Hi, I have already removed the custom option.

My client IP is 192.168.5.100

[johnpoz]

so do a traceroute.. What do you get from that?

example here is traceroute to IP on my home lan network

C:\Windows\System32>tracert -d 192.168.9.100

Tracing route to 192.168.9.100 over a maximum of 30 hops

1 101 ms 108 ms 103 ms 10.0.8.1
2 106 ms 101 ms 109 ms 192.168.9.100

Trace complete.

C:\Windows\System32>

Its long because my proxy is all the way in TX, while I am at work in Chicago, so from chicago to hou, back to chicago, etc. So yeah some added latency.

Ping and traceroute to the pfsense lan IP.. For example my pfsense IP on my lan is 192.168.9.253.. You trying to talk to devices on your lan might have host firewalls blocking your remote tunnel IP.

[ayanbanerjee]

@johnpoz Hi, here is the story, I am able to reach the pfsense lan ip which is 192.168.1.2 but to ping any f the ip which are belongs to 192.168.1.x series.

[johnpoz]

Well then your going down the tunnel and as already stated points to host firewall, or the host your trying to ping using a different gateway other than pfsense.

You not being able to get to say public iP 8.8.8.8 down the tunnel would point to outbound nat not configured for your tunnel network on pfsense.

[ayanbanerjee]

@johnpoz Hi, we are using only one GW and that is PfSense local ip 192.168.1.2 and also able to ping 8.8.8.8 or 4.4.2.2 when I am in VPN.
I am really clueless now :(

[ayanbanerjee]

@johnpoz Hi, I got an log below, please help me to understand the same

Fri Jun 15 22:54:01 2018 Block_DNS: Using existing sublayer
Fri Jun 15 22:54:01 2018 Block_DNS: Added permit filters for exe_path
Fri Jun 15 22:54:01 2018 Block_DNS: Added block filters for all interfaces
Fri Jun 15 22:54:02 2018 Block_DNS: Added permit filters for TAP interface
Fri Jun 15 22:54:07 2018 Warning: address 192.168.1.2 is not a network address in relation to netmask 255.255.255.0
Fri Jun 15 22:54:07 2018 ROUTE: route addition failed using CreateIpForwardEntry: The parameter is incorrect. [status=87 if_index=9]
Fri Jun 15 22:54:07 2018 env_block: add PATH=C:\WINDOWS\System32;C:\WINDOWS;C:\WINDOWS\System32\Wbem
Fri Jun 15 22:54:07 2018 Initialization Sequence Completed

[comet424]

here is my outbound nat I set

as for the pinging what I ment was on my cell I have a Ping program when I'm not on my vpn I can ping say 192.168.0.15 which is my Freenas IP as soon as I connect to VPN I get the 192.168.100.2 for my cell and I loose all internet.. I can no longer ping 192.168.0.15(freenas) I cant ping 192.168.0.1 the router or 192.168.100.1 which be the router I in virtual lan setting and this happens when I connect open vpn using my home internet or at the coffee shop

I'm sure its something simple like a check box I missed that's causing all this right? for the traceroute id have to be at the coffee shop with the openvpn to get the results you want correct?

[comet424]

the only ip address I can ping while on vpn is 192.168.100.2 which is the cells ip address for the vpn..

so I confused I thought was so simple like the video showed boom boom boom done now your perfectly connected... I had to missed a step some how probably some check box I missed