How to make OpenVPN work with Virtual IPs

gabecz

hi
my setup (the first two segments of the ips are made up of course. the real ips i use are valid public ips):
pf1 (master):
WAN: 19.83.10.27/29
WANGW (def): 19.83.10.25
LAN: 19.83.10.35/29
LANGW: 19.83.10.33
SYNC: 10.200.200.2/29
SYNCGW: 10.200.200.1

pf2 (backup):
WAN: 19.83.10.28/29
WANGW (def): 19.83.10.25
LAN: 19.83.10.36/29
LANGW: 19.83.10.33
SYNC: 10.200.200.3/29
SYNCGW: 10.200.200.1

Virtual IPs:
WAN: 19.83.10.26 (port udp 1194 on cisco firewall open)
LAN: 19.83.10.34

VLAN24: 19.83.10.24/29
VLAN33: 19.83.10.33/29
VLAN200: 10.200.200.0/29

OpenVPN with Radius, network: 10.10.10.0/24. Interface set to 19.83.10.26 (so the vip) i split tunnel it to let's say 38.91.0.0/16
I even check System / Advanced / Firewall & NAT "Disable all packet filtering." (Does this turn off the firewall completely?)

When i try to connect. I get the Duo popup. I get the connection going. I even can ping the client/host ip from pf1. But i don't get to ping anything on my local network. Which is 38.91.0.0/16 But i see 'traffic' on the OpenVPN client when i try to ping anything on 38.91.0.0/16 so the request/ping goes out to the ovpn server but won't reach its destination. Any ideas would be much appreciated.

When i set up a single appliance pfSense (using wan 19.83.10.26 lan 19.83.10.34, no sync same ovpn settings) it works well without setting up any firewall rules or anything fancy.

viragomann

@gabecz said in How to make OpenVPN work with Virtual IPs:

LANGW: 19.83.10.33

Any reason for setting a gateway on the LAN? Normally this is not needed at all.

Virtual IPs:
WAN: 19.83.10.26 (port udp 1194 on cisco firewall open)
LAN: 19.83.10.34

VLAN24: 19.83.10.24/29
VLAN33: 19.83.10.33/29

These subnets are overlapping. Maybe a typo?

But i don't get to ping anything on my local network. Which is 38.91.0.0/16

You want to access the LAN devices on the client side from the server side?

gabecz

@viragomann

thanks
i tried to set langw to none, but i get the same result.

vlan33 is 19.83.10.32/29 so indeed a typo.

my actual subnet i need to access (98.91.0.0/16, and 5 more of the /16 subnets so covering a quite wide area) and set in OpenVPN Server's "IPv4 Local network(s)" section is not the pfSense LAN (19.83.10.32/29). pfSense LAN i could call MGMT because it's got no real use but to manage the OpenVPN.

Btw the reason for the tiny vlan subnet is that to have carp and HA set up properly, i needed to allow promiscuous mode, mac address changes and forging transmits which i will not do on my other vlans for security reasons.

once again, setting up a single server with the same setup without virtual ips it's all wrapped and packed working.
there's something about the firewall/nat/rules i can't figure out.

i can access (ping) 98.91.0.0/16 devices from WAN, LAN, Carp LAN, Carp WAN, too but not from OpenVPN 'nic'. I can ping my client from LAN and WAN, Carp LAN and Carp WAN, also OpenVPN 'nic'.

I feel like there's a route/nat/firewall rule missing for requests coming from the OpenVPN nic, to my desired subnets (38.91.0.0/16 etc)