Custom config VPN failed
-
Hi,
I've a pfsense fw with this configuration :
- WAN : 1.1.1.1/32
- LAN : 192.168.100.0/24
On the WAN interface, I've a IPsec tunnel with remote subnet 10.1.1.0/24 and IPsec rules :
- any to any port SSH|RDP pass
I've configure the same in floating rules with select LAN/IPsec/OVPN interfaces.
I've a seconde configuration on the WAN interface with OVPN nomade configuration (user auth+tls) with 192.168.100.0/24 as tunnel & remote network.
On other side, I've a firewall with :
- WAN : 2.2.2.2
- LAN : 10.1.1.0/24
- Rules allow remote network (192.168.100.0/24) to SSH|RDP 10.1.1.0/24.
- Route : 192.168.100.0/24 via IPsec interface
I want to :
Wanted Client use case / Link config:
[client]-------------------------------------------------------------------------->[10.1.1.0/24|22]
[client]---->[pfSense_OVPN_get192.168.100.2/24]----->[samePfSense_IPsec]---------->[10.1.1.0/24|22]This use case doesn't work with my actual configuration. Someone have an idea to success config this ?
Thanks
-
Is the OpenVPN configured as TAP?
If not you cannot use the same subnet as the LAN on that firewall. The OpenVPN daemon will fail to add it to the routing table when it starts as it conflicts.
Change the OpenVPN tunnel subnet to, say, 192.168.200.0/24 and add a P2 to the IPSec to carry 192.168.100.0/24 <> 10.1.1.0/24.
Steve
-
This is my configuration :
IPsec configuration :
- Phase 1 :
- IKE : V2
- Remote Gateway : 2.2.2.2
- P1 Protocol : AES (256 bits)
- P1 Transforms : SHA256
- P1 DH-Group : 19 (nist ecp256)
- Authentication Method : Mutual PSK
- Phase 2 (1) :
- Mode : tunnel
- Local Subnet : 192.168.100.0/24
- Remote Subnet : 10.1.1.0/24
- P2 Protocol : ESP
- P2 Transforms : AES (256 bits)
- P2 Auth Methods : SHA256
- Phase 2 (2) :
- Mode : tunnel
- Local Subnet : 10.7.8.0/24
- Remote Subnet : 10.1.1.0/24
- P2 Protocol : ESP
- P2 Transforms : AES (256 bits)
- P2 Auth Methods : SHA256
OVPN configuration :
- Server mode : SSL/TLS + Auth
- Auth : Local
- Interface : WAN (1.1.1.1)
- Protocol / Port : UDP4/1194
- Crypto: AES-256-CBC/SHA256
- D-H Params: 4096 bits
- Device mode : tun - Layer 3 Tunnel Mode
- IPv4 Tunnel Network : 10.7.8.0/24
- IPv4 Local network(s) : Empty
IPsec rules :
- pass tcp any any 3389 any (IPv4 TCP)
- pass tcp any any 22 any (IPv4 TCP)
- pass icmp any any
OVPN rules :
- pass tcp any any 3389 any (IPv4 TCP)
- pass tcp any any 22 any (IPv4 TCP)
- pass icmp any any
Floating rules :
- pass tcp any any any (on IPsec, OVPN and LAN interfaces)
-
Hi
I pass a step, now since pfsense :
[2.4.4-RELEASE][admin@covid19.localdomain]/root: ping -S 10.7.8.1 10.1.1.2 PING 10.1.1.2 (10.1.1.2) from 10.7.8.1: 56 data bytes 64 bytes from 10.1.1.2: icmp_seq=0 ttl=127 time=9.822 ms 64 bytes from 10.1.1.2: icmp_seq=1 ttl=127 time=9.870 ms 64 bytes from 10.1.1.2: icmp_seq=2 ttl=127 time=9.868 ms 64 bytes from 10.1.1.2: icmp_seq=3 ttl=127 time=9.744 ms ^C --- 10.1.1.2 ping statistics ---[2.4.4-RELEASE][admin@covid19.localdomain]/root: ssh -b10.7.8.1 10.1.1.2 The authenticity of host '10.1.1.2 (10.1.1.2)' can't be established. ECDSA key fingerprint is SHA256:qRfI******************************aN37A. No matching host key fingerprint found in DNS. Are you sure you want to continue connecting (yes/no)? ^CBut since the client I cannot ping.
I've this logs client side :
Tue Mar 17 10:03:44 2020 write to TUN/TAP : Unknown error (code=122) Tue Mar 17 10:03:55 2020 write to TUN/TAP : Unknown error (code=122) Tue Mar 17 10:04:04 2020 write to TUN/TAP : Unknown error (code=122) Tue Mar 17 10:04:14 2020 write to TUN/TAP : Unknown error (code=122) Tue Mar 17 10:04:25 2020 write to TUN/TAP : Unknown error (code=122)Also , I check the routes on a client device, I've only this :
Destination Gateway Genmask Flags Metric Ref Use Iface 10.7.8.0 * 255.255.255.0 U 256 0 0 eth4 10.7.8.2 * 255.255.255.255 U 256 0 0 eth4 10.7.8.255 * 255.255.255.255 U 256 0 0 eth4So I add :
Destination Gateway Genmask Flags Metric Ref Use Iface 10.7.8.0 * 255.255.255.0 U 256 0 0 eth4 10.7.8.2 * 255.255.255.255 U 256 0 0 eth4 10.7.8.255 * 255.255.255.255 U 256 0 0 eth4 10.1.1.0 10.7.8.1 255.255.255.0 U 0 0 0 eth4But the ping cannot work
-
@tryall said in Custom config VPN failed:
IPv4 Local network(s) : Empty
You are not passing routes to local networks to the client. Do you have redirect gateway set? (send all traffic over the VPN)
Try adding 10.1.1.0/24 and 192.168.100.0/24 as local networks in the OpenVPN server.
Steve
-
I've adding the subnet to the local networks and try to redirect gateway, without success :(
I don't understand that since the pfsense with -S argument (ping) or -b argument (ssh), it's OK, but not since the client.
Edit : I tried to add "push "route 10.1.1.0 255.255.255.0"" without success
-
@tryall said in Custom config VPN failed:
Tue Mar 17 10:03:44 2020 write to TUN/TAP : Unknown error (code=122)
The fact it's logging that seem to show it is trying to send traffic over the VPN but cannot.
Can you reach anything other the OpenVPN from the client? Even the VPN server tunnel IP?Do you see any new routes added to the client when you connect?
Steve
-
If I add push route parameter, after a reconnct, yes I show new route but same issue.
With the client, I cannot ping the pfsense openvpn gw (10.7.8.1).
-
Still that same error at the client?
Some permissions error? The user you're using not have rights to use the vpn device?
Steve
-
Hi
Yes, I tried with Windows client, and my personal FreeBSD workstation.
On my FreeBSD workstation, I show the route pushed but ping/ssh/rdp doesn't pass to 10.1.1.0/24.
Edit : In the OVPN log, I see : Bad compression stub (swap) decompression header byte: 69 from user.
Edit 2 : for the compression stub, I disable LZO compression and ok AND THE PROBLEM is resolved !
-
This post is deleted!
-
Edit 2 : for the compression stub, I disable LZO compression and ok AND THE PROBLEM is resolved !
Thank for your support
-
Nice, good catch!
