OpenVPN TCP - No traffic

[Crlaozwyn]

I've had a rough journey with OpenVPN so far (previous thread here) but for the last month or so, things have been working exactly as expected. All traffic has successfully been routing. Around two days ago, I noticed it wasn't working. I can't exactly pinpoint when things broke, as I was traveling.

I'm still able to connect - both client and server have happy logs that they're talking. However, no traffic is going through. Symptoms are similar to what was happening on the previous thread, except no settings have changed. I did recently upgrade to the latest PFSense version, though I can't conclusively say the issue started at the same time as the upgrade. My UDP connection continues to work without issue. Any idea why a working VPN would suddenly stop? Any troubleshooting tips are welcome.

Thanks in advance.

[Crlaozwyn]

Bump - would still appreciate help with this!

[viragomann]

The outbound NAT rules you posted in the other thread won't work for upstream traffic. You have to change the interface to "WAN" and the sources have to be your VPN tunnel network. Don't know if 192.168.13.0/24 is you tunnel network.

Additionally, have you already removed 'push "redirect-gateway def1"' from custom options?

[Crlaozwyn]

Thanks @viragomann. I did get the NAT rules figured out (later in the thread, I think). They've been on WAN with the VPN subnet (yes, the .13. is the VPN).

There are currently no custom options set. I do have "Force all client-generated IPv4 traffic through the tunnel" checked.

[viragomann]

Are you able to access your local device from the VPN client?

Please post the routing table of the client device.

[Crlaozwyn]

Argh! It started working again without me making a single change from yesterday.

Is the routing table part of the logs? If so, I think the only relevant entry would be this:
2019-37-22 15:37:02 NIP: adding (included) IPv4 route 192.168.13.0/24

[viragomann]

No, the routing table is a list containing all route of an operating system. It depends on the OS how to show it.

In Windows and some Linux "netstat -r" may work.
In other Linux "route" or "ip route".
In MacOS "netstat -nr".

[johnpoz]

route print will also work on windows.

[Crlaozwyn]

Gotcha, thank you both for the clarification. Unfortunately the client is an iPhone and, based on a bit of Googling, there isn't really a way to access the IP routing table. With some help, I did discover a setup issue on my part though:

Both UDP and TCP OpenVPN servers were using the same subnet. I've changed the subnet for UDP to be unique and non-overlapping. It hasn't fixed it yet, but that should hopefully prevent TCP from breaking at least...

[johnpoz]

Dude is that you on reddit ;) heheeh - that is me over on reddit

You should be able to see your route table via Hurricane electric app.

Let me double check that.

Yup the HE tools shows that
login-to-view

You can get it here
https://networktools.he.net/

[Crlaozwyn]

Bahahah, yeah that's me. I didn't get a response here after a few days so I figured I'd put another line in the water. Thanks again for your help.

HE.NET app definitely has a lot of data. Do you need all interfaces? There's around a hundred rows

[johnpoz]

You just need to find your vpn interface, once you connect.

You can use it to do a traceroute as well.. Can you ping your lan side interface of pfsense?

Here pinging my lan IP of pfsense using tcp from ios
login-to-view

[Crlaozwyn]

Total fail screenshot attempt - deleted

[johnpoz]

Well that doesn't look like you have any routes. But I specific route vs default route.. Let me change mine and reconnect

Even when I set to default, I still see routes for the tunnel network..

Are you even connected?

[Crlaozwyn]

So uh... I totally disabled the VPN in order to be able to actually upload anything. Screenshot fail! Should be a little more enlightening here...
login-to-view