Site-to-Site OpenVPN : server-side can only reach client-side router, no other LAN devices

hts

I have set up a site-to-site OpenVPN connection using the recipe at https://docs.netgate.com/pfsense/en/latest/recipes/openvpn-s2s-tls.html
with pfSense 2.7.2 and a lot of it works.

From the client side, I can access anything on the server side LAN (as expected for any client).

From the server side I can ping and open a browser to the client side's pfSense web interface using it's LAN address. However I cannot ping any other devices on the client-side LAN. Client-side LAN devices can ping each other.

Some detail/setting/rule must be missing or mis-configured.

Help troubleshooting will be appreciated.

viragomann

@hts
Is the client VPN endpoint the default gateway in its local network?

Do you have rules on the VPN interface to pass incoming traffic?

Also consider, that the local computers block access from remote itself by default by their own firewalls.

hts

Yes, client VPN endpoint is default gateway.
Yes, rules to pass incoming traffic.
Local computer firewall allows ICMPv4 Echo (ping) for public, private and domain.

viragomann

@hts
Are there on the servers LAN also rules in place to allow access to the remote site?

I assume, you have configured the CSO and it is working. Otherwise access to the clients LAN IP wouldn't be possible.

hts

Yes to both.

I don't believe I could get to the client's router/endpoint LAN address without those being in place. But I'm looking for any methods to see where the traffic is being blocked.

viragomann

@hts
Diagnostic > Packet Capture is the tool for investigate this issue.

Sniff the traffic on the clients VPN and LAN to see, how far you get.

hts

I wanted to follow up to give the "resolution" to my problem. I reset the pfSense box to defaults, re-imported CA and certificate, re-added client, and everything worked.

One "interesting" observation before the above was that Diagnostic > Packet Capture showed duplicates of packets for the filtered destination as if some deleted firewall rules were still active.

hts

For clarity, I reset the client pfsense box to factory defaults.