OpenVPN Site-To-Site Connected but only works one way

Nemo6262

I am currently having some trouble getting a full site-to-site VPN working using OpenVPN. I am running the most recent version of PFsense on both machines (Both are Netgate devices). Site A is the OpenVPN server and has a public IP while Site B is acting as the client. They are using a shared key currently. I have both sides setup with the OpenVPN allowing all traffic through the VPN. I can successfully ping and connect to all devices behind Site A's LAN from both LANs at Site A and Site B. However, I am unable to ping Site B's LAN from any of devices on Site A's LAN. I am able to ping Site B's default gateway address and access the webgui for Site B from Site A. Traceroute does not show either of the the firewalls when attempting to trace to a Site B address but works perfectly when tracing the other direction. Is there a configuration setting I am missing?

TLDR: I can ping all of Site A from both sides of site-to-site VPN but can't seem to ping anything except gateway for Site B from Site A. Using Shared Key for OpenVPN Site-To-Site connection

/------------Configuration---------------------/
Both Firewalls:
OpenVPN Tab
Protocol: IPv4
Source: *
Port: *
Destination: *
Gateway: *

OpenVPN Site A (Server):
Server Mode: Shared Key
Protocol: UDP4 on IPv4 only
Device mode : tun
IPv4 Tunnel: 172.16.0.0/24
Ipv4 Remote Networks: 192.168.105.0/24

OpenVPN Site B (Client):
Server Mode: Shared Key
Protocol: UDP4 on IPv4 only
Device mode : tun
IPv4 Tunnel: 172.16.0.0/24
Ipv4 Remote Networks: 192.168.62.0/24

     WAN Static IP                           WAN with no static IP/Other LAN
          |                                             |
/----------------------/                     /-----------------------/
/      Site A          /-------OpenVPN ----- /        Site B         /
/    OpenVPN Server    /     172.16.0.0/24   /    OpenVPN Client     /
/   192.168.62.0/24    /                     /    192.168.105.0/24    /
/----------------------/                     /-----------------------/
          |                                             |
      Site A LAN                                   Site B LAN

Ping/Traceroute results:
Site A-> Site A - Good
Site B -> Site A - Good
Site B -> Site B - Good
Site A -> Site B - Can ping 192.168.2.1 and access webgui, but not ping any other devices in Site B's LAN

Site B -> Site A

Site A-> Site B

Site A-> Site B gateway

Ping Site A-> Site B Gateway

Any help would be appreciated. Thank you

ThatGuy

@nemo6262,

Do you have any device like a printer you can try to ping via IP from Site A to Site B? If you only have Windows devices on the other end you are trying to ping the Windows Firewall sometimes blocks them because they are coming from a different subnet. I usually see this in Workgroup environments. You could try disabling the Firewall temporarily to test. This is why I suggest a printer. They usually don't block IPs from different subnets coming in.

Also, on site B try putting in the following rule under the WAN interface. You may already have it in there.

Action: Pass
Interface: Wan
Address Family: IPV4
Protocol: UDP
Source: any
Destination: WAN address
Destination Port Range: From: Whatever Port OpenVPN is using TO: Whatever Port OpenVPN is using

Last thing to try is go to Interfaces-->Wan. Take the checkmarks out at the bottom for Block private networks and loopback addresses and Block bogon networks just to see what happens.

Nemo6262

@thatguy Disabling the Windows firewall worked. That has been driving me crazy for a few months, thank you. You mentioned that you have seen Windows devices do this. Is there a setting or anything simple/special I need to do to avoid this problem with the default firewall still enabled?

Edit: I forgot to mention that Windows Defender is already set to allow pings

ThatGuy

@nemo6262,

I was looking for a client setup I have to tell you precisely what to do but I can't find one. This is probably because all of the clients I manage now are on Windows Domains and this is no longer an issue for me. But, I'll tell you where you need to go to setup the Windows Firewall Rule.

Get to your Windows Defender Firewall. It's best to get to this through the Windows Control Panel.
On the left click the link for Advanced Settings. From this screen you can create custom rules to allow for Inbound and Outbound Rules.
If you right click on Inbound Rules or Outbound Rules you can click on New Rule... and a Wizard will come up to create a Rule. When you go through the wizard there will be a portion at the end where you can allow REMOTE subnets.

Unfortunately you'll have to do this for every Windows 10 machine you want access to across the VPN.