• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Clients cannot communicate with each other.

Scheduled Pinned Locked Moved OpenVPN
42 Posts 8 Posters 7.0k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • S
    scilek @yumcheese
    last edited by scilek Nov 19, 2019, 7:11 AM Nov 19, 2019, 7:07 AM

    @yumcheese

    I don't have that under the "Peer to Peer (Shared Key)" option. But I don't believe that is the issue anyway since I can ping any client at HQ from any other branch and vice versa. The problem is that I cannot ping clients that reside on another branch.

    HQ -> ping 172.16.1.2 -> OK
    HQ -> ping 172.16.2.2 -> OK
    BRANCH_A -> ping 172.16.0.2 -> OK
    BRANCH_B -> ping 172.16.0.2 -> OK
    BRANCH_A -> ping 172.16.2.2 -> FAIL!
    BRANCH_B -> ping 172.16.1.2 -> FAIL!

    1 Reply Last reply Reply Quote 0
    • T
      tman904
      last edited by Nov 19, 2019, 7:19 AM

      If the vpns connect back and talk through hq assuming it's a hub/spoke, make sure the hq will route that traffic between the spokes.

      S Y 2 Replies Last reply Nov 19, 2019, 7:23 AM Reply Quote 0
      • S
        scilek @tman904
        last edited by Nov 19, 2019, 7:23 AM

        @tman904

        That was my guess, but I think OpenVPN takes cares of that. What if I am wrong? How do I make the HQ router route traffic between the spokes? (Forgive my ignorance, oh high gurus of networking!)

        1 Reply Last reply Reply Quote 0
        • Y
          yumcheese @tman904
          last edited by yumcheese Nov 19, 2019, 7:24 AM Nov 19, 2019, 7:24 AM

          @tman904
          Yes, that sounds like the problem. Also, is VPNS_B needed? I believe you should be able to just have the branch offices connect to VPNS_A. That might make the path of travel easier. Do you see a route to the other Branch office IP/Tunnel when you look at Diagnostics | Routes on the branch offices?

          Maybe you need to use the "Client Specific Overrides" feature to pass the routing info.

          S 1 Reply Last reply Nov 19, 2019, 7:33 AM Reply Quote 0
          • S
            scilek @yumcheese
            last edited by Nov 19, 2019, 7:33 AM

            @yumcheese

            At first, I tried running one server but was not able to get it working. I found a tutorial on Youtube (https://www.youtube.com/watch?v=8f13lfnEKY8) which suggests running two servers. I did exactly as he does but my setup fails. I am stuck.

            1 Reply Last reply Reply Quote 0
            • Y
              yumcheese
              last edited by Nov 19, 2019, 9:05 AM

              @marvosa said in Clients cannot communicate with each other.:

              VPNS_A:
              Type -> Peer to Peer (Shared Key)
              Port -> 1194
              Tunnel Network -> 10.0.0.0/24
              Remote Networks -> 172.16.1.0/24

              Maybe try adding to your remote networks: 172.16.2.0/24

              VPNS_B:
              Type -> Peer to Peer (Shared Key)
              Port -> 1195
              Tunnel Network -> 10.0.1.0/24
              Remote Networks -> 172.16.2.0/24

              Maybe try adding to your remote networks: 172.16.1.0/24

              When Branch A (172.16.1.0/24) tries to reach Branch B (172.16.2.0/24), it will send traffic through VPNS_A, but I don't think it knows how to route that request through VPNS_B. Hopefully, those changes will help. I'm relatively new to openvpn, so this might not work. Just trying to help.

              You might also try the Packet Capture tool under Diagnostics. You can capture the traffic on each tunnel to see where your Pings fail (ICMP). Then you can figure out where to focus your efforts.

              S 1 Reply Last reply Nov 19, 2019, 9:17 AM Reply Quote 0
              • S
                scilek @yumcheese
                last edited by Nov 19, 2019, 9:17 AM

                @yumcheese

                It seems to me the solution is to run server on each of the routers and a clients to all other routers.

                1 Reply Last reply Reply Quote 0
                • Y
                  yumcheese
                  last edited by Nov 19, 2019, 9:17 AM

                  Actually, I think what I just wrote isn't going to work. If traffic originates in HQ it will not know the proper tunnel to go through if sending traffic to a branch office.

                  S 1 Reply Last reply Nov 19, 2019, 9:33 AM Reply Quote 0
                  • S
                    scilek @yumcheese
                    last edited by Nov 19, 2019, 9:33 AM

                    @yumcheese

                    So what is the solution?

                    1 Reply Last reply Reply Quote 0
                    • Y
                      yumcheese
                      last edited by Nov 19, 2019, 9:37 AM

                      You might need to switch to SSL/TLS instead of pre-shared key and use Client Specific Overrides:
                      https://forum.netgate.com/topic/126091/openvpn-site-to-site-multisite

                      S J 2 Replies Last reply Nov 19, 2019, 9:41 AM Reply Quote 0
                      • S
                        scilek @yumcheese
                        last edited by Nov 19, 2019, 9:41 AM

                        @yumcheese

                        I understand. Thank you.

                        1 Reply Last reply Reply Quote 0
                        • J
                          JeGr LAYER 8 Moderator @yumcheese
                          last edited by Nov 19, 2019, 11:32 AM

                          @yumcheese said in Clients cannot communicate with each other.:

                          You might need to switch to SSL/TLS instead of pre-shared key and use Client Specific Overrides:
                          https://forum.netgate.com/topic/126091/openvpn-site-to-site-multisite

                          Nope you don't. We have many clients that we do support for, that are using shared-key tunnels from OpenVPN just fine. There's something other missing here. The tunnel itself shouldn't be a problem. For the problem of Site A not being able to Ping Site B and vice versa I'd check the following steps:

                          • are there rules on the OVPN interface tabs active on any site?
                          • check routes on HQ and Sites A/B and check if all Sites actually have all required routes set and if the gateways are right.
                          • check your NAT settings so your VPN tunnel won't get accidentally NATted when it shouldn't

                          Greets

                          Don't forget to upvote 👍 those who kindly offered their time and brainpower to help you!

                          If you're interested, I'm available to discuss details of German-speaking paid support (for companies) if needed.

                          S 1 Reply Last reply Nov 19, 2019, 11:47 AM Reply Quote 1
                          • S
                            scilek @JeGr
                            last edited by Nov 19, 2019, 11:47 AM

                            @JeGr

                            "all required routes"? Are you referring to static routes?

                            1 Reply Last reply Reply Quote 0
                            • J
                              JeGr LAYER 8 Moderator
                              last edited by Nov 19, 2019, 11:55 AM

                              @scilek said in Clients cannot communicate with each other.:

                              "all required routes"? Are you referring to static routes?

                              Yes, your OVPN configuration as you described in the OP should take care of them and both remote networks (in every location) should show in your system routing table (diagonstics / routes) with the OVPNx interface as Gateway

                              Don't forget to upvote 👍 those who kindly offered their time and brainpower to help you!

                              If you're interested, I'm available to discuss details of German-speaking paid support (for companies) if needed.

                              S 1 Reply Last reply Nov 19, 2019, 12:28 PM Reply Quote 0
                              • S
                                scilek @JeGr
                                last edited by Nov 19, 2019, 12:28 PM

                                @JeGr

                                I tried that too, but it did not work. Maybe I was not able to get the hang of it. Could you kindly give an example of a static route entry for the HQ router?

                                1 Reply Last reply Reply Quote 0
                                • J
                                  JeGr LAYER 8 Moderator
                                  last edited by JeGr Nov 19, 2019, 12:34 PM Nov 19, 2019, 12:31 PM

                                  @scilek said in Clients cannot communicate with each other.:

                                  I tried that too, but it did not work. Maybe I was not able to get the hang of it. Could you kindly give an example of a static route entry for the HQ router?

                                  You tried what? Just have a look into Diagnostics/Routes. If your VPN config is right, there should be routes. Can you show that?

                                  Otherwise as you didn't post any configuration, I can only guess, but as you have to shared key tunnels, you should probably have two OVPN servers defined in your HQ config, so there should be something like ovpns1 and ovpns2 in your routing table. Something along the lines of

                                  172.16.1.1/24	10.0.0.1	UGS	4273856	1500	ovpns1
                                  172.16.2.1/24	10.0.1.1	UGS	4273856	1500	ovpns2
                                  

                                  Don't forget to upvote 👍 those who kindly offered their time and brainpower to help you!

                                  If you're interested, I'm available to discuss details of German-speaking paid support (for companies) if needed.

                                  S 1 Reply Last reply Nov 19, 2019, 12:41 PM Reply Quote 0
                                  • S
                                    scilek @JeGr
                                    last edited by Nov 19, 2019, 12:41 PM

                                    @JeGr

                                    I see... I have already taken care of the issue by creating a mesh network among the routers. Each router is a server to all others. But I will have another go at it when I get the chance.

                                    1 Reply Last reply Reply Quote 0
                                    • T
                                      tman904
                                      last edited by Nov 19, 2019, 1:06 PM

                                      on HQ ssh in select option 8 and run "netstat -rn -f inet |grep -i tap" It may be tun in place of tap I don't remember off the top of my head. Anyway that should show you if the vpn networks have routing table entries that use the tun interface. If that doesn't show anything you need to go back and make sure your openvpn config is correct.

                                      Remember the vpn networks routing entries need to use the tunnel interface. Or have a next hop ip address of the far end of the vpn tunnel. They won't be routed correctly if the exit interface isn't the tunnel.

                                      1 Reply Last reply Reply Quote 0
                                      • J
                                        JeGr LAYER 8 Moderator
                                        last edited by Nov 19, 2019, 2:09 PM

                                        @scilek said in Clients cannot communicate with each other.:

                                        I have already taken care of the issue by creating a mesh network among the routers.

                                        With OpenVPN? What did you set up?

                                        Each router is a server to all others. But I will have another go at it when I get the chance.

                                        That sounds nothing like a typical OVPN setup?

                                        Don't forget to upvote 👍 those who kindly offered their time and brainpower to help you!

                                        If you're interested, I'm available to discuss details of German-speaking paid support (for companies) if needed.

                                        S 1 Reply Last reply Nov 19, 2019, 2:27 PM Reply Quote 0
                                        • S
                                          scilek @JeGr
                                          last edited by Nov 19, 2019, 2:27 PM

                                          @JeGr

                                          First I set up an OpenVPN [Remote Access (SSL/TSL)] server on each of the routers. Then I created two clients to the other routers. Now I can ping any client from any other. It took me about an hour to get it working. Do you happen to know a good tutorial that explains and exemplifies all this?

                                          J 1 Reply Last reply Nov 21, 2019, 10:31 AM Reply Quote 0
                                          14 out of 42
                                          • First post
                                            14/42
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                            This community forum collects and processes your personal information.
                                            consent.not_received