Problems routing all traffic through tunnel

chillster · Oct 23, 2006, 11:45 AM

Im trying to route all my traffic through the Ovpn tunnel, i can reach the remote network where my pfsensebox is located and ping that whole subnet but i cant reach the internet when i push the "redirect-gateway def1" option to my client. Im guessing its a firewall issue of some kind but i cant figure it out. Would really apreciate som guidance or if someone could point towards a guide or something…thanks!

SFM · Oct 24, 2006, 6:52 PM

Do you have a rule to allow everything out from the LAN?

* LAN net * * * * Default LAN -> any

Open everything up and then make sure it works.
Once you have it working you can lock things down.

SFM

chillster · Oct 25, 2006, 9:06 AM

Thanks for the reply :)

Yea i have that rule, however i think that rule only applies to nodes on the same subnet as the green card on the firewall. I tried to add a similar rule with my vpn subnet but no luck.

I also tried adding a rule allow anything from anywhere to anyplace on both LAN and WAN and still couldnt ping out, so maybe it isnt a firewall related. Any ideas ?

Anyone else got this working?

SFM · Oct 25, 2006, 12:16 PM

http://www.uplinksecurity.de/data/pfsense-ovpn.pdf

Is everything setup like it is described in this document?

If you don't use the (push "redirect-gateway def1") command can you get everything to work except of course the redirection of your gateway?

chillster · Oct 26, 2006, 4:38 PM

Yes its more or less set up like the pdf describes.
Everything works excellent when i dont redirect the gateway, i can reach the internet (not through tunnel) and the remote subnet without any problems. Even when i do redirect gateway i can reach the remote subnet but not the internet at all.

SFM · Oct 26, 2006, 4:51 PM

Hum….

If you do an ipconfig /all does it show that the gateway has been added to your client computer when you are connnected?

Are you pushing more then just the gateway?
If so are you adding the ; between items?

push "dhcp-option DNS 10.0.0.10";push "dhcp-option WINS 10.0.0.10"

Do the other pushed items show in ipconfig /all (wins or DNS if you are pushing them)

Are you pushing the dns?
You may need this to get to the outside world

Just a few ideas
SFM

chillster · Oct 28, 2006, 9:18 PM

The gateway gets pushed to the client correctly so that works ok.
I don push any other options except the gateway, but im thinking that shouldnt matter cause im not trying to ping a dnsadress just a regular ip.
Running out of ideas here :/

GruensFroeschli · Oct 28, 2006, 10:00 PM

what you are trying to do is working for me right now.
i use TCP since i have to use a proxy.

here's my config.
maybe you want to compare it with your own.

$ less /var/etc/openvpn_server0.conf
writepid /var/run/openvpn_server0.pid
#user nobody
#group nobody
daemon
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
dev tun
proto tcp-server
cipher BF-CBC
client-to-client
server 172.17.103.0 255.255.255.0
client-config-dir /var/etc/openvpn_csc
lport 443
ca /var/etc/openvpn_server0.ca
cert /var/etc/openvpn_server0.cert
key /var/etc/openvpn_server0.key
dh /var/etc/openvpn_server0.dh
comp-lzo
persist-remote-ip
float
push "redirect-gateway def1"
push "dhcp-option DNS 172.17.103.1"

chillster · Oct 29, 2006, 10:25 AM

Thanks, very helpful!
OK i compared our configs now and its almost identical except subnets, port, cipher and compression. And those shouldnt matter much i guess.
Did you add any rules to your firewall to get it to work ?

GruensFroeschli · Oct 29, 2006, 10:54 AM

i only added a rule to allow traffic to any

SFM · Oct 30, 2006, 1:40 PM

If you are connecting with windows xp service pack 2 make sure the firewall is off on the OVPN adapter.
You can have the firewall on all connections but the Open VPN.

There is a known issue with xp2 and openvpn.
www.openvpn.org

chillster · Oct 30, 2006, 4:35 PM

No my client is on an Ubuntubox, but thanks anyway : )

tpunder · Dec 11, 2006, 5:13 AM

I realize this topic is a month old, but a friend and I have been banging our heads again the wall for about 3 hours now trying to figure this out. We finally did. What you need to do is go into Firewall/NAT/Outbound then enable Advanced outbound NAT and add a line for your VPN's network much like your internal LAN. Once that was added it started working.

dairaen · Dec 16, 2006, 2:35 PM

cheers,

tpunder, could you please send me or upload a screenshot of
your working outbound NAT rules so i can add them to the
tutorial?

thanks.

kind regards
dairaen

tpunder · Dec 17, 2006, 5:21 AM

@dairaen:

cheers,

tpunder, could you please send me or upload a screenshot of
your working outbound NAT rules so i can add them to the
tutorial?

thanks.

kind regards
dairaen

No problem, I just sent a PM with a screenshot.