Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Issue sending traffic over openvpn

    Scheduled Pinned Locked Moved OpenVPN
    46 Posts 2 Posters 7.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • K
      kr0490
      last edited by

      I got a site to site vpn setup and it establishes fine, but neither side can access devices or ping the other side, any ideas for things to check or do?

      V 1 Reply Last reply Reply Quote 0
      • V
        viragomann @kr0490
        last edited by

        @kr0490 said in Issue sending traffic over openvpn:

        any ideas for things to check or do?

        Firewall rules on pfSense

        Routes

        Firewall on the devices you want to access

        logs

        1 Reply Last reply Reply Quote 0
        • K
          kr0490
          last edited by

          Here are the logs i get back

          Dec 21 15:25:36 rc.gateway_alarm 56816 >>> Gateway alarm: VPNgateway (Addr:172.1.2.1 Alarm:1 RTT:0.000ms RTTsd:0.000ms Loss:100%)
          Dec 21 15:25:36 check_reload_status 379 updating dyndns VPNgateway
          Dec 21 15:25:36 check_reload_status 379 Restarting ipsec tunnels
          Dec 21 15:25:36 check_reload_status 379 Restarting OpenVPN tunnels/interfaces
          Dec 21 15:25:36 check_reload_status 379 Reloading filter
          Dec 21 15:25:36 php-fpm 24044 /rc.filter_configure_sync: An error occurred while trying to find the interface got 172.1.2.1 . The rule has not been added.
          Dec 21 15:25:37 php-fpm 349 /rc.openvpn: Gateway, none 'available' for inet6, use the first one configured. 'WAN_DHCP6'
          Dec 21 15:25:37 php-fpm 349 /rc.openvpn: OpenVPN: One or more OpenVPN tunnel endpoints may have changed its IP. Reloading endpoints that may use VPNgateway.
          Dec 21 15:25:37 php-fpm 24044 /rc.filter_configure_sync: An error occurred while trying to find the interface got 172.1.2.1 . The rule has not been added.
          Dec 21 15:26:38 check_reload_status 379 Syncing firewall
          Dec 21 15:26:40 php-fpm 24044 /system_gateway_groups.php: Gateway, none 'available' for inet6, use the first one configured. 'WAN_DHCP6'
          Dec 21 15:26:40 check_reload_status 379 Updating all dyndns
          Dec 21 15:26:40 check_reload_status 379 Restarting ipsec tunnels
          Dec 21 15:26:40 check_reload_status 379 Reloading filter
          Dec 21 15:26:42 rc.gateway_alarm 13327 >>> Gateway alarm: VPNgateway (Addr:172.1.2.1 Alarm:1 RTT:0.000ms RTTsd:0.000ms Loss:100%)
          Dec 21 15:26:42 check_reload_status 379 updating dyndns VPNgateway
          Dec 21 15:26:42 check_reload_status 379 Restarting ipsec tunnels
          Dec 21 15:26:42 check_reload_status 379 Restarting OpenVPN tunnels/interfaces
          Dec 21 15:26:42 check_reload_status 379 Reloading filter
          Dec 21 15:26:43 php-fpm 24044 /rc.openvpn: Gateway, none 'available' for inet6, use the first one configured. 'WAN_DHCP6'
          Dec 21 15:26:43 php-fpm 24044 /rc.openvpn: OpenVPN: One or more OpenVPN tunnel endpoints may have changed its IP. Reloading endpoints that may use VPNgateway.

          K 1 Reply Last reply Reply Quote 0
          • K
            kr0490 @kr0490
            last edited by

            @kr0490 I’m just not sure where the issue lies, do I need to add some firewall rules or something, not sure why the logs are saying there is an issue with the gateway group

            V 1 Reply Last reply Reply Quote 0
            • V
              viragomann @kr0490
              last edited by

              @kr0490
              I‘m wondering, why there is even an OpenVPN gateway group at all.
              But without getting more details about your setup it‘s hard to say what’s wrong.

              K 1 Reply Last reply Reply Quote 1
              • K
                kr0490 @viragomann
                last edited by

                @viragomann probably cause I’m goofy, likely doesn’t need to be, I’ll try removing the group

                K 1 Reply Last reply Reply Quote 0
                • K
                  kr0490 @kr0490
                  last edited by

                  @kr0490 so when I setup a gateway, should the gateway ip be the ip of the pfsense box, or of the remote pfsense box network I’m trying to send it to, cause it’s not accepting them now, saying they aren’t in the range

                  K V 2 Replies Last reply Reply Quote 0
                  • K
                    kr0490 @kr0490
                    last edited by

                    @kr0490 or should it be the ipv4 tunnel network in openvpn

                    1 Reply Last reply Reply Quote 0
                    • V
                      viragomann @kr0490
                      last edited by

                      @kr0490
                      You should generally not add any gateway for a VPN at all.

                      If you ever add a gateway, the gateway IP has to be one of a different device on the connection.

                      K 1 Reply Last reply Reply Quote 1
                      • K
                        kr0490 @viragomann
                        last edited by

                        @viragomann I guess I’m confused as to how to send all traffic on the network over the vpn tunnel

                        V 1 Reply Last reply Reply Quote 0
                        • V
                          viragomann @kr0490
                          last edited by

                          @kr0490 said in Issue sending traffic over openvpn:

                          I guess I’m confused as to how to send all traffic on the network over the vpn tunnel

                          Enter the respective remote network into the "Remote network/s" box on each node.

                          This causes pfSense to route the concerned traffic to OpenVPN and the server or client forwards it to the proper remote endpoint.

                          K 1 Reply Last reply Reply Quote 0
                          • K
                            kr0490 @viragomann
                            last edited by

                            @viragomann I checked and that is set properly but still no luck

                            V 1 Reply Last reply Reply Quote 0
                            • V
                              viragomann @kr0490
                              last edited by

                              @kr0490
                              So provide your settings at long last, so that someone else can see what's wrong with it.

                              K 1 Reply Last reply Reply Quote 0
                              • K
                                kr0490 @viragomann
                                last edited by

                                @viragomann screenshots? Or is there a better way?

                                V 1 Reply Last reply Reply Quote 0
                                • V
                                  viragomann @kr0490
                                  last edited by

                                  @kr0490
                                  Yeah, your OpenVPN settings on both sites. And what's about the interface gateway settings? Obviously you might have messed up something with it.
                                  Did you assign interfaces to the OpenVPN instances?
                                  What about firewall rules?
                                  Routing table.

                                  K 1 Reply Last reply Reply Quote 0
                                  • K
                                    kr0490 @viragomann
                                    last edited by

                                    @viragomann https://drive.google.com/drive/folders/1gHPWyy_fs7YgmNY-SmaGsgp3eWs1FsMI?usp=sharing

                                    Googledrive link to all the screenshots

                                    V 1 Reply Last reply Reply Quote 0
                                    • V
                                      viragomann @kr0490
                                      last edited by

                                      @kr0490
                                      I was assuming, you have already removed that gateway.

                                      Never set a static IP for a VPN gateway! It is set by OpenVPN.

                                      Don't set static routes to VPN endpoints. The routing is done by the settings I mentioned above.

                                      It's not a good idea to use a public IP range for the tunnel.
                                      Also you should better use /30 tunnel for a site to site vpn.
                                      And the tunnel network have to be a network address!. 172.1.2.1/24 isn't one.

                                      Any reason for specifying "local port" in the client settings? If not you leave it blank.

                                      You can assign interfaces the OpenVPN instances, but not necessarily needed. You only need it special routing purposes like policy routing.

                                      K 1 Reply Last reply Reply Quote 0
                                      • K
                                        kr0490 @viragomann
                                        last edited by

                                        @viragomann ok I removed the gateway, deleted the opt interface in both sides, changed the tunnel network to a 10.x.x.x/30. I am confused where you say that the tunnel network must be an address?

                                        V 1 Reply Last reply Reply Quote 0
                                        • V
                                          viragomann @kr0490
                                          last edited by

                                          @kr0490 said in Issue sending traffic over openvpn:

                                          changed the tunnel network to a 10.x.x.x/30. I am confused where you say that the tunnel network must be an address?

                                          You have to enter a network address in the tunnel field. E.g. 10.8.0.0/30. Otherwise the tunnel doesn't work.
                                          The client and server IP are set automatically by OpenVPN.

                                          K 1 Reply Last reply Reply Quote 0
                                          • K
                                            kr0490 @viragomann
                                            last edited by

                                            @viragomann ok got all that done, tunnel is stuck on pending, not connecting. It’s saying my remote network is unreachable in the logs.

                                            K 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.