Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    VPN Network is not routing via tunnel

    OpenVPN
    4
    23
    468
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • C
      Chris-The-Tuner last edited by

      Hi together,
      i set up a OpenVPN Tunnel to a Server from our radio station (internal stuff).
      My pfs at home is the client and connects without problems to the server.
      A traceroute from the pfs to a server inside the vpn works flawless.
      But if i try to connect from my office pc the connection gets to my home pfs and then nothing...

      I have another tunnel running in basicly exactly the same way to a pfs box in my datacenter colo, on that one it works without problems...

      I don't understand why the network of 1 tunnel gets put via the tunnel it should and the other one does not.

      Networks:
      Home: 10.0.11.0/24
      VPN personal Datacenter: 192.168.3.0/24 (I can go via OpenVPN directly to there from my home network)
      VPN radio: 192.168.42.0/24 (from pfs hui i can ping servers etc, but my LAN from home is not able to connect)

      I hope someone has an idea why this is...
      Thanks in advance

      Greetings Chris

      Greetings Chris-The-Tuner
      Yes i'm german, get used to it :)
      Visit my Webpage @ Chris-The-Tuner.de

      1 Reply Last reply Reply Quote 0
      • Derelict
        Derelict LAYER 8 Netgate last edited by

        I'd check the firewall in the workstation itself.

        Chattanooga, Tennessee, USA
        The pfSense Book is free of charge!
        DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
        Do Not Chat For Help! NO_WAN_EGRESS(TM)

        1 Reply Last reply Reply Quote 0
        • C
          Chris-The-Tuner last edited by

          There is no firewall on any workstation i run here...
          The fun part is that i can freely use another tunnel and it works fine, but the second one just does not work...

          I don't understand why this is, but i got that problem.
          The config of both clients is the same (except for Server/Port).

          Greetings Chris-The-Tuner
          Yes i'm german, get used to it :)
          Visit my Webpage @ Chris-The-Tuner.de

          1 Reply Last reply Reply Quote 0
          • Derelict
            Derelict LAYER 8 Netgate last edited by

            Well, it has to be something.

            Guess you need to post screenshots, etc, so we can have a chance at seeing what was done wrong.

            Chattanooga, Tennessee, USA
            The pfSense Book is free of charge!
            DO NOT set a source port in a port forward or firewall rule unless you KNOW you need it!
            Do Not Chat For Help! NO_WAN_EGRESS(TM)

            1 Reply Last reply Reply Quote 0
            • C
              Chris-The-Tuner last edited by

              Beginning with the working Tunnel:
              This one works without any issues, every network is accessable from my side (LAN @ 10.0.11.0/24)
              0_1544540466571_Bildschirmfoto zu 2018-12-11 15-54-52.png

              Next is the same config for the radio network, this one is NOT (but should) accessable from my side (LAN @ 10.0.11.0/24):
              1_1544540466571_Bildschirmfoto zu 2018-12-11 15-55-12.png

              As you can se here, the Connection is up, the tunnels work: (Upper one is my Datacenter Link, the lower one to our radio station)
              2_1544540466572_Bildschirmfoto zu 2018-12-11 15-55-30.png

              Even a traceroute from the pfs here works to the server inside the LAN in want to access:
              0_1544540848008_Bildschirmfoto zu 2018-12-11 16-06-59.png
              But if i try that from my workstation (LAN @ 10.0.11.90):
              0_1544540943164_Bildschirmfoto zu 2018-12-11 16-08-23.png
              It just runs until it fails at the end...

              Last but not least my Routes, as far as i can see this is correct in every way.
              I did everything the same in both tunnels, the first one works, the second one does not...
              3_1544540466572_Bildschirmfoto zu 2018-12-11 15-55-47.png

              I hope i included everything you need, if not just tell me what i should include :)

              Greetings Chris

              Greetings Chris-The-Tuner
              Yes i'm german, get used to it :)
              Visit my Webpage @ Chris-The-Tuner.de

              1 Reply Last reply Reply Quote 0
              • Rico
                Rico LAYER 8 Rebel Alliance last edited by

                Can you please show your Firewall Rules? OpenVPN Tab and Interfaces (if assigned).

                -Rico

                2x Netgate XG-7100 | 11x Netgate SG-5100 | 6x Netgate SG-3100 | 2x Netgate SG-1100

                1 Reply Last reply Reply Quote 0
                • C
                  Chris-The-Tuner last edited by

                  Interfaces are not assigned to VPN tunnels for now.
                  Within the OpenVPN Interface i only have 1 Rule (everything allowed) * * * * * :D

                  Greetings Chris-The-Tuner
                  Yes i'm german, get used to it :)
                  Visit my Webpage @ Chris-The-Tuner.de

                  1 Reply Last reply Reply Quote 0
                  • Rico
                    Rico LAYER 8 Rebel Alliance last edited by Rico

                    How about Routing on the non working far side?
                    Anything in the table for 10.0.11.0/24 ?

                    -Rico

                    2x Netgate XG-7100 | 11x Netgate SG-5100 | 6x Netgate SG-3100 | 2x Netgate SG-1100

                    1 Reply Last reply Reply Quote 0
                    • C
                      Chris-The-Tuner last edited by

                      I'm not able to check the Server Side on the second tunnel since i'm not running it.
                      What should be there ?
                      I have a small suspicion that the Server maybe blocks connections from a LAN network...
                      Could that be the case ?

                      Greetings Chris-The-Tuner
                      Yes i'm german, get used to it :)
                      Visit my Webpage @ Chris-The-Tuner.de

                      1 Reply Last reply Reply Quote 0
                      • Rico
                        Rico LAYER 8 Rebel Alliance last edited by

                        The Server Side need to know your local network and a route set (normally this happens in the OpenVPN Server Config).
                        And of course the Server need to accept your Packets by it's Firewall Rules.
                        ATM the only thing we know the Server side knows the Route and accept Packets for the tunnel network.

                        -Rico

                        2x Netgate XG-7100 | 11x Netgate SG-5100 | 6x Netgate SG-3100 | 2x Netgate SG-1100

                        chpalmer 1 Reply Last reply Reply Quote 0
                        • chpalmer
                          chpalmer @Rico last edited by chpalmer

                          In your second picture.. You need to add your LAN to the Remote Networks of that site. 10.0.11.0/24

                          Ive got this same scenario between a radio station I do work for and my office.

                          Triggering snowflakes one by one..

                          1 Reply Last reply Reply Quote 0
                          • Rico
                            Rico LAYER 8 Rebel Alliance last edited by

                            ...this is what I just said right? ;-)

                            -Rico

                            2x Netgate XG-7100 | 11x Netgate SG-5100 | 6x Netgate SG-3100 | 2x Netgate SG-1100

                            chpalmer 1 Reply Last reply Reply Quote 0
                            • chpalmer
                              chpalmer @Rico last edited by

                              @rico

                              Missed that. Yep. I hate this laptop.

                              Triggering snowflakes one by one..

                              chpalmer 1 Reply Last reply Reply Quote 0
                              • chpalmer
                                chpalmer @chpalmer last edited by

                                @chpalmer

                                Looking again your radio station router should not have its own LAN in the "remote networks" entry..

                                Triggering snowflakes one by one..

                                1 Reply Last reply Reply Quote 0
                                • C
                                  Chris-The-Tuner last edited by

                                  Yep that eas the problem.
                                  I just mapped the traffic from my LAN to the IP i get from the VPN Server so that i show up as a Single VPN Client and not as a LAN workstation.

                                  Works fine now :)

                                  Thank you very mutch !

                                  Greetings Chris-The-Tuner
                                  Yes i'm german, get used to it :)
                                  Visit my Webpage @ Chris-The-Tuner.de

                                  1 Reply Last reply Reply Quote 0
                                  • Rico
                                    Rico LAYER 8 Rebel Alliance last edited by

                                    So you do NAT now?
                                    That is not ideal but can work in some cases. :-)

                                    -Rico

                                    2x Netgate XG-7100 | 11x Netgate SG-5100 | 6x Netgate SG-3100 | 2x Netgate SG-1100

                                    1 Reply Last reply Reply Quote 0
                                    • C
                                      Chris-The-Tuner last edited by

                                      The Admin does not want to let traffic from my LAN pass, so thats the only way i have.

                                      Sure its not ideal but hey, its getting the job done.

                                      Greetings Chris-The-Tuner
                                      Yes i'm german, get used to it :)
                                      Visit my Webpage @ Chris-The-Tuner.de

                                      chpalmer 1 Reply Last reply Reply Quote 0
                                      • chpalmer
                                        chpalmer @Chris-The-Tuner last edited by

                                        @chris-the-tuner said in VPN Network is not routing via tunnel:

                                        The Admin does not want to let traffic from my LAN pass, so thats the only way i have.

                                        Actually a correctly built firewall rule at the radio station only allowing you workstation IP would do the job just as well. In fact if your not accessing you LAN from any of the other sites Id delete the firewall rule on your local router on the OpenVPN tab.

                                        Triggering snowflakes one by one..

                                        1 Reply Last reply Reply Quote 0
                                        • C
                                          Chris-The-Tuner last edited by

                                          I do access my home LAN via a Server running on my pfs ;)

                                          Greetings Chris-The-Tuner
                                          Yes i'm german, get used to it :)
                                          Visit my Webpage @ Chris-The-Tuner.de

                                          chpalmer 1 Reply Last reply Reply Quote 0
                                          • chpalmer
                                            chpalmer last edited by

                                            I believe you could also place your local workstation at an address such as .129 and then use x.x.x.128/30 on the radio station side "remote network" to limit the size of your network their router sees. I have not tried this but there seems no reason it would not work.

                                            Triggering snowflakes one by one..

                                            1 Reply Last reply Reply Quote 0
                                            • chpalmer
                                              chpalmer @Chris-The-Tuner last edited by

                                              @chris-the-tuner said in VPN Network is not routing via tunnel:

                                              I do access my home LAN via a Server running on my pfs ;)

                                              Then adjust your local OpenVPN rule to the data center server network to your local LAN.

                                              Firewall rules are your friend!

                                              Triggering snowflakes one by one..

                                              1 Reply Last reply Reply Quote 0
                                              • chpalmer
                                                chpalmer last edited by

                                                Remember that connections that are initiated by the allowed end are by proxy allowed to return. You do not need special WAN rules to allow return traffic from the web.. right? Same with any interface.

                                                Triggering snowflakes one by one..

                                                1 Reply Last reply Reply Quote 0
                                                • C
                                                  Chris-The-Tuner last edited by

                                                  I got a Rule that sorts out traffic trying to connect to my LAN from the radio network.
                                                  For the rest its fine since i run the other network anyway 😁

                                                  Greetings Chris-The-Tuner
                                                  Yes i'm german, get used to it :)
                                                  Visit my Webpage @ Chris-The-Tuner.de

                                                  1 Reply Last reply Reply Quote 0
                                                  • First post
                                                    Last post