Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Custom config VPN failed

    Scheduled Pinned Locked Moved General pfSense Questions
    13 Posts 3 Posters 2.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • T
      tryall
      last edited by

      Hi,

      I've a pfsense fw with this configuration :

      • WAN : 1.1.1.1/32
      • LAN : 192.168.100.0/24

      On the WAN interface, I've a IPsec tunnel with remote subnet 10.1.1.0/24 and IPsec rules :

      • any to any port SSH|RDP pass

      I've configure the same in floating rules with select LAN/IPsec/OVPN interfaces.

      I've a seconde configuration on the WAN interface with OVPN nomade configuration (user auth+tls) with 192.168.100.0/24 as tunnel & remote network.

      On other side, I've a firewall with :

      • WAN : 2.2.2.2
      • LAN : 10.1.1.0/24
      • Rules allow remote network (192.168.100.0/24) to SSH|RDP 10.1.1.0/24.
      • Route : 192.168.100.0/24 via IPsec interface

      I want to :

      Wanted Client use case / Link config:
      [client]-------------------------------------------------------------------------->[10.1.1.0/24|22]
      [client]---->[pfSense_OVPN_get192.168.100.2/24]----->[samePfSense_IPsec]---------->[10.1.1.0/24|22]

      This use case doesn't work with my actual configuration. Someone have an idea to success config this ?

      Thanks

      1 Reply Last reply Reply Quote 0
      • stephenw10S
        stephenw10 Netgate Administrator
        last edited by

        Is the OpenVPN configured as TAP?

        If not you cannot use the same subnet as the LAN on that firewall. The OpenVPN daemon will fail to add it to the routing table when it starts as it conflicts.

        Change the OpenVPN tunnel subnet to, say, 192.168.200.0/24 and add a P2 to the IPSec to carry 192.168.100.0/24 <> 10.1.1.0/24.

        Steve

        1 Reply Last reply Reply Quote 0
        • T
          tryall
          last edited by

          This is my configuration :

          IPsec configuration :

          • Phase 1 :
          • IKE : V2
          • Remote Gateway : 2.2.2.2
          • P1 Protocol : AES (256 bits)
          • P1 Transforms : SHA256
          • P1 DH-Group : 19 (nist ecp256)
          • Authentication Method : Mutual PSK
          • Phase 2 (1) :
          • Mode : tunnel
          • Local Subnet : 192.168.100.0/24
          • Remote Subnet : 10.1.1.0/24
          • P2 Protocol : ESP
          • P2 Transforms : AES (256 bits)
          • P2 Auth Methods : SHA256
          • Phase 2 (2) :
          • Mode : tunnel
          • Local Subnet : 10.7.8.0/24
          • Remote Subnet : 10.1.1.0/24
          • P2 Protocol : ESP
          • P2 Transforms : AES (256 bits)
          • P2 Auth Methods : SHA256

          OVPN configuration :

          • Server mode : SSL/TLS + Auth
          • Auth : Local
          • Interface : WAN (1.1.1.1)
          • Protocol / Port : UDP4/1194
          • Crypto: AES-256-CBC/SHA256
          • D-H Params: 4096 bits
          • Device mode : tun - Layer 3 Tunnel Mode
          • IPv4 Tunnel Network : 10.7.8.0/24
          • IPv4 Local network(s) : Empty

          IPsec rules :

          • pass tcp any any 3389 any (IPv4 TCP)
          • pass tcp any any 22 any (IPv4 TCP)
          • pass icmp any any

          OVPN rules :

          • pass tcp any any 3389 any (IPv4 TCP)
          • pass tcp any any 22 any (IPv4 TCP)
          • pass icmp any any

          Floating rules :

          • pass tcp any any any (on IPsec, OVPN and LAN interfaces)
          1 Reply Last reply Reply Quote 0
          • T
            tryall
            last edited by

            Hi

            I pass a step, now since pfsense :

            [2.4.4-RELEASE][admin@covid19.localdomain]/root: ping -S 10.7.8.1 10.1.1.2
            PING 10.1.1.2 (10.1.1.2) from 10.7.8.1: 56 data bytes
            64 bytes from 10.1.1.2: icmp_seq=0 ttl=127 time=9.822 ms
            64 bytes from 10.1.1.2: icmp_seq=1 ttl=127 time=9.870 ms
            64 bytes from 10.1.1.2: icmp_seq=2 ttl=127 time=9.868 ms
            64 bytes from 10.1.1.2: icmp_seq=3 ttl=127 time=9.744 ms
            ^C
            --- 10.1.1.2 ping statistics ---
            
            [2.4.4-RELEASE][admin@covid19.localdomain]/root: ssh -b10.7.8.1 10.1.1.2
            The authenticity of host '10.1.1.2 (10.1.1.2)' can't be established.
            ECDSA key fingerprint is SHA256:qRfI******************************aN37A.
            No matching host key fingerprint found in DNS.
            Are you sure you want to continue connecting (yes/no)? ^C
            

            But since the client I cannot ping.

            I've this logs client side :

            Tue Mar 17 10:03:44 2020 write to TUN/TAP : Unknown error (code=122)
            Tue Mar 17 10:03:55 2020 write to TUN/TAP : Unknown error (code=122)
            Tue Mar 17 10:04:04 2020 write to TUN/TAP : Unknown error (code=122)
            Tue Mar 17 10:04:14 2020 write to TUN/TAP : Unknown error (code=122)
            Tue Mar 17 10:04:25 2020 write to TUN/TAP : Unknown error (code=122)
            

            Also , I check the routes on a client device, I've only this :

            Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
            10.7.8.0        *               255.255.255.0   U     256    0        0 eth4
            10.7.8.2        *               255.255.255.255 U     256    0        0 eth4
            10.7.8.255      *               255.255.255.255 U     256    0        0 eth4
            

            So I add :

            Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
            10.7.8.0        *               255.255.255.0   U     256    0        0 eth4
            10.7.8.2        *               255.255.255.255 U     256    0        0 eth4
            10.7.8.255      *               255.255.255.255 U     256    0        0 eth4
            10.1.1.0      10.7.8.1        255.255.255.0   U     0      0        0 eth4
            

            But the ping cannot work

            1 Reply Last reply Reply Quote 0
            • stephenw10S
              stephenw10 Netgate Administrator
              last edited by

              @tryall said in Custom config VPN failed:

              IPv4 Local network(s) : Empty

              You are not passing routes to local networks to the client. Do you have redirect gateway set? (send all traffic over the VPN)

              Try adding 10.1.1.0/24 and 192.168.100.0/24 as local networks in the OpenVPN server.

              Steve

              1 Reply Last reply Reply Quote 0
              • T
                tryall
                last edited by tryall

                I've adding the subnet to the local networks and try to redirect gateway, without success :(

                I don't understand that since the pfsense with -S argument (ping) or -b argument (ssh), it's OK, but not since the client.

                Edit : I tried to add "push "route 10.1.1.0 255.255.255.0"" without success

                1 Reply Last reply Reply Quote 0
                • stephenw10S
                  stephenw10 Netgate Administrator
                  last edited by

                  @tryall said in Custom config VPN failed:

                  Tue Mar 17 10:03:44 2020 write to TUN/TAP : Unknown error (code=122)

                  The fact it's logging that seem to show it is trying to send traffic over the VPN but cannot.
                  Can you reach anything other the OpenVPN from the client? Even the VPN server tunnel IP?

                  Do you see any new routes added to the client when you connect?

                  Steve

                  1 Reply Last reply Reply Quote 0
                  • T
                    tryall
                    last edited by

                    If I add push route parameter, after a reconnct, yes I show new route but same issue.

                    With the client, I cannot ping the pfsense openvpn gw (10.7.8.1).

                    1 Reply Last reply Reply Quote 0
                    • stephenw10S
                      stephenw10 Netgate Administrator
                      last edited by

                      Still that same error at the client?

                      Some permissions error? The user you're using not have rights to use the vpn device?

                      Steve

                      1 Reply Last reply Reply Quote 0
                      • T
                        tryall
                        last edited by tryall

                        Hi

                        Yes, I tried with Windows client, and my personal FreeBSD workstation.

                        On my FreeBSD workstation, I show the route pushed but ping/ssh/rdp doesn't pass to 10.1.1.0/24.

                        Edit : In the OVPN log, I see : Bad compression stub (swap) decompression header byte: 69 from user.
                        Edit 2 : for the compression stub, I disable LZO compression and ok AND THE PROBLEM is resolved !

                        1 Reply Last reply Reply Quote 0
                        • S
                          Shepherd Banned
                          last edited by

                          This post is deleted!
                          1 Reply Last reply Reply Quote 0
                          • T
                            tryall
                            last edited by tryall

                            Edit 2 : for the compression stub, I disable LZO compression and ok AND THE PROBLEM is resolved !

                            Thank for your support

                            1 Reply Last reply Reply Quote 0
                            • stephenw10S
                              stephenw10 Netgate Administrator
                              last edited by

                              Nice, good catch! 👍

                              1 Reply Last reply Reply Quote 0
                              • First post
                                Last post
                              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.