[SOLVED] VPN routing

viragomann

I presume it is an OpenVPN access server.

If the devices you want to access from a vpn client are in the pfSense WAN network, the only way to solve is to add a static route for the vpn tunnel network to each unique device pointing to pfSense.

Better solution would be to connect the pfSense WAN interface to a separate network interface of the Cisco with a separate network segment.
So you would only have to add a static route for the vpn tunnel network on the Cisco firewall pointing to pfSense and on pfSense you have to add static route(s) for your internal network(s) pointing to the Cisco.

maryjohnston

Is there anyone vpn provider for online gaming ? Because i want to play some high games on my android mobile phone ?

maverick_slo

Yeah OpenVPN classic access (roadwarrior setup) server.
WAN is plugged into Cisco firewall network.
On core switches and Cisco firewall there are routes to my VPN subnet pointing to pfsense WAN IP (which is IP from network attached to Cisco).
On pfsense I have not configured any static routes, I juts added subnets to OpenVPN server config.
Funny thing is if I disable outbound NAT ping and tracert work but http not, and with outbound NAT everything works but server on vlan on core switch sees traffic from pfsense WAN instead of actual client.

viragomann

@maverick_slo said in VPN routing:

Funny thing is if I disable outbound NAT ping and tracert work but http not

As I mentioned above, that's the problem when the vpn endpoint is in the same network segment as the destination device, but the vpn endpoint is not the default gateway.

TCP which http is based on is a stateful protocol, ICMP (ping) is stateless.
When you try to access a device from vpn client, the request packets go from pfSense directly to the device, while response packets are sent to the default gateway (Cisco FW, presumably) where they should be directed to pfSense. However, your default gateway has no state for it since it didn't get the request packet and will drop it.
For a stateless protocol that doesn't matter.

When using outbound NAT, request packets have the source IP of pfSense, so responses are directed back to pfSense directly.

So as already suggested, put the pfSense in a separate network segment and set up a correct routing. This can also be done by VLAN.

maverick_slo

hmm.
pfsense IS on separate network on ASA.
routing works actually everything works but little thing I mentioned.

on server on different VLAN all requests are coming from pfsense WAN.
So how do I make them come from openvpn client instead.

viragomann

Turn off the outbound NAT on pfSense.

Consider that for routing vpn responses back you need a static route for the vpn tunnel network on your ASA?

maverick_slo

Well if I turn off outbound NAT things stop to work.

I have route on asa to route my tunnel network to pfsense WAN IP.

viragomann

If that's the case, the route won't work.

Try a traceroute from the device you tried to access.

maverick_slo

Tracert is OK.
Tried both ways both ways OK.

viragomann

If the routes are OK there is no need for the outbound NAT.

Sorry, no more ideas as long as I don't get more infos like tunnel network, network map, detailed routes, packets capture of an access attempt from a vpn client.

maverick_slo

Thanks, will check tomorrow with our fw guys as I don't see errors in my config...

maverick_slo

Closure:
I had it configured correctly.
So correct FW rules and outbound nat (SNAT) disabled.
Problem was on cisco router where network guys forgot to allow my traffic (even when they say they did, well doublecheck) :)

netdomon2

i have same problem thank