OpenVPN clients can't ping LAN
-
It's possible I'm reading this wrong, but the way I see it... in order to make this work, you will need to deploy the "Network with Internet Gateway" model. PFsense is your gateway droplet and all VPC's on the LAN will need PFsense set as the default gateway.
The examples they've shown are for configuring Ubuntu/Debian/Centos droplets as an internet gateway by enabling routing, NAT and configuring the firewall (iptables).
Even if you configured OpenVPN on a properly configured Ubuntu droplet, the other devices on the network would still need their gateway set to the Ubuntu LAN IP in order to be reachable over the tunnel.
It appears that the "Configure Backend Droplets" section should be reviewed in order to add a default route to your VPC's. I'm assuming "droplets" refers to VPC's... or am I misreading what they're describing as a "droplet"?
Fingers crossed for @viragomann's suggestion though.
-
@viragomann Also, take a look at the OpenVPN server config, I still have redirect traffic over IPv4 so I can't enter the local network... should I remove the check and enter the LAN address 10.116.0.0/20 ??
-
@marvosa said in OpenVPN clients can't ping LAN:
It's possible I'm reading this wrong, but the way I see it... in order to make this work, you will need to deploy the "Network with Internet Gateway" model. PFsense is your gateway droplet and all VPC's on the LAN will need PFsense set as the default gateway.
The examples they've shown are for configuring Ubuntu/Debian/Centos droplets as an internet gateway by enabling routing, NAT and configuring the firewall (iptables).
Even if you configured OpenVPN on a properly configured Ubuntu droplet, the other devices on the network would still need their gateway set to the Ubuntu LAN IP in order to be reachable over the tunnel.
It appears that the "Configure Backend Droplets" should be reviewed in order to add a default route. I'm assuming "droplets" refers to VPC's... or am I misreading what they're describing as a "droplet"?
"Droplet" is the term Digital Ocean uses for a virtual machine. A "droplet" has a public IP address and a VPC (or virtual private network) address. In my case, my VPC network is 10.116.0.0/20. The OpenVPN server on pfSense has the WAN address and I configured the LAN address as the VPC address, 10.116.0.3. The server I'm trying to reach on the VPC LAN is 10.116.0.2, but I can't get to it for anything. I'm re-exporting the client config and trying all of your suggestions again... Here goes!
-
@jacobisreal said in OpenVPN clients can't ping LAN:
Also, take a look at the OpenVPN server config, I still have redirect traffic over IPv4 so I can't enter the local network... should I remove the check and enter the LAN address 10.116.0.0/20 ??
This directs the whole upstream traffic from the VPN client over the VPN. This aims to access internet resources with the public IP of the VPC.
If you don't need this uncheck redirect gateway and enter the VPC LAN network into the "Local networks" box. -
@marvosa @viragomann YOU FUKN GENIOUSES! Take a look...
I dunno if it was the NAT masquerade, the change in the OpenVPN tunnel, or what but it's working now!PING 10.116.0.2 (10.116.0.2) from 172.28.32.1: 56 data bytes 64 bytes from 10.116.0.2: icmp_seq=0 ttl=64 time=1.918 ms 64 bytes from 10.116.0.2: icmp_seq=1 ttl=64 time=0.785 ms 64 bytes from 10.116.0.2: icmp_seq=2 ttl=64 time=0.691 ms --- 10.116.0.2 ping statistics --- 3 packets transmitted, 3 packets received, 0.0% packet loss round-trip min/avg/max/stddev = 0.691/1.131/1.918/0.558 msAND I can ping from local machine (OpenVPN client) to the other VPC box now:
ping 10.116.0.3 PING 10.116.0.3 (10.116.0.3) 56(84) bytes of data. 64 bytes from 10.116.0.3: icmp_seq=1 ttl=64 time=45.5 ms 64 bytes from 10.116.0.3: icmp_seq=2 ttl=64 time=46.3 ms 64 bytes from 10.116.0.3: icmp_seq=3 ttl=64 time=50.4 ms ^C --- 10.116.0.3 ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 2004ms rtt min/avg/max/mdev = 45.501/47.382/50.382/2.143 msWhat do you think the root cause was and why did all these suggestions work? Could it be the NAT rule?
-
@viragomann said in OpenVPN clients can't ping LAN:
@jacobisreal said in OpenVPN clients can't ping LAN:
Also, take a look at the OpenVPN server config, I still have redirect traffic over IPv4 so I can't enter the local network... should I remove the check and enter the LAN address 10.116.0.0/20 ??
This directs the whole upstream traffic from the VPN client over the VPN. This aims to access internet resources with the public IP of the VPC.
If you don't need this uncheck redirect gateway and enter the VPC LAN network into the "Local networks" box.Yeah, I don't want these users using the internet really. We're a non-profit and my next issue will be locking down internet access to only approved internet URLs. So, I should keep it like that right?? And, next question, how do I filter the web addresses the OpenVPN client can view? I want a nice "YOUR BLOCKED" page too! lol
Y'all are awesome, you've got this Texas dude freaking out. Wow. This forum is awesome and YOU GUYS are GR8!!!! THANK U
-
I'm taking a snapshot of this box right away! You guys are literal lifesavers, I nnnneeeeedddd sleep!
-
@viragomann This freaking worked.... Thanks!! Now, does this setup cause any security vulnerabilities or are we good?
-
@jacobisreal said in OpenVPN clients can't ping LAN:
What do you think the root cause was and why did all these suggestions work? Could it be the NAT rule?
It's the NAT.
If you have no gateway on the remote device it cannot response to requests from outside of its own subnets (no route to host failure). The masqerading tranlates the source address in packets into the pfSense LAN interface IP, so its in the LAN subnet and its well done.
But as I stated, it's a dirty solution. But seems to bo the only one in your case.
-
@jacobisreal said in OpenVPN clients can't ping LAN:
Now, does this setup cause any security vulnerabilities or are we good?
The drawback of this is that you're not able to determine the origin source on the destination device. However, since the only way into the network is over the VPN you have full control over it.
-
@viragomann Yeah, everything I read about this cloud provider said I MUST use NAT for this. Now that your genius minds have resolved that, can you maybe help with:
-
How can I automate the OpenVPN client config download for the user? In other words, if I create the user, is there a way to make it so pfSense will allow them to download their .ovpn file if they, like maybe login to the pfSense WAN ip? Something to make config of the clients easier. Kind of like OpenVPN Access server but without paying a license fee?
-
How can I lock down the pfSense admin GUI so that only MY public IP can access it, ie from my home ISP (Comcast)?
I really, really appreciate you guys, you've saved my non-profit money and me countless hours. Thank you so much!
-
-
@viragomann Those douchebags at Digital Ocean and OpenVPN wanted us to pay for an OpenVPN Access server and pay $75/mo for just ten users! This way, we can really grow and not pay. I had to really freak the config, they don't have an image for pfSense so I had to create a FreeBSD box, then dd a raw image of pfSense over it and in pfSense setup re-create the partitions, etc etc - this has not been easy but now that it works, we're set man. Thank you both so much, I really can't say it enough. Bless you!!
-
@jacobisreal said in OpenVPN clients can't ping LAN:
How can I automate the OpenVPN client config download for the user? In other words, if I create the user, is there a way to make it so pfSense will allow them to download their .ovpn file if they, like maybe login to the pfSense WAN ip? Something to make config of the clients easier.
That was already asked here multiple times. So there are some thread regarding to this topic. I didn't occupy.
pfSense itself has no function for that at all. Maybe there are solutions with additional scripts.@jacobisreal said in OpenVPN clients can't ping LAN:
How can I lock down the pfSense admin GUI so that only MY public IP can access it, ie from my home ISP (Comcast)?
The GUI should only be accessible from your VPN. To set rule you need a static VPN IP. You can achieve this by Client Specific Override.
If you also want SSH access, generate a key for and assing it to your user. -
@viragomann Could I at least log invalid logins to the OpenVPN server and track the IPs going into the WAN IP on pfSense since it's the entrypoint for the VPN and the LAN? If so, how?
-
@jacobisreal
The logins are also written into the OpenVPN log.
You can send to log to a syslog server for saving them. -
@viragomann I saw a syslog package in the Package Manager - will that do or do I need to send the logs to a separate server?
-
@jacobisreal
No, that's a syslog server on pfSense. I'd recommend to run the server on a separate VM.
In Status > System Logs > Settings you can then Enable Remote Logging.Another simply option is to dayly download the log files. But consider that they are round robin and the size is limited. You can adjust it in the logging settings.
-
@viragomann Gotcha, I see the setting. Before I freak anything up I'm taking another snapshot backup lol. Thanks so much. Any suggestions about how to filter internet sites / URLs for users connected via the OpenVPN? Also, the automatic .ovpn client config file download? Sorry, I must be overloading you... Progress!!
-
@jacobisreal said in OpenVPN clients can't ping LAN:
Any suggestions about how to filter internet sites / URLs for users connected via the OpenVPN?
If you haven't "Redirect gateway" checked in the OpenVPN server setting internet traffic is not routed to pfSense normally. You have to consider that the users can add routes by themselves, however.
So you should add rules to the VPN interface to restrict access for your needs.
If you also want to pass internet traffic from the clients over the VPN rules are more complicated. But this depends on your needs.@jacobisreal said in OpenVPN clients can't ping LAN:
Also, the automatic .ovpn client config file download?
Already talked about that above. There is nothing intended on pfSense. But search the forum, maybe someone has posted a script to aid distributing VPNs.