Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    From roadwarrios to vpn site to site

    OpenVPN
    5
    19
    5786
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      mariofiorentino last edited by

      Hi guys,

      must implement that rule in the firewall to reach the VPN SITE TO SITE Roadwarriors connecting from?

      Thanks

      M.F.

      1 Reply Last reply Reply Quote 0
      • Cry Havok
        Cry Havok last edited by

        Can you try re-wording your question to make it clearer what you're asking please. It would help to know what version of pfSense you're talking about.

        1 Reply Last reply Reply Quote 0
        • M
          mariofiorentino last edited by

          ok :) I use the pfsense 1.2.3
          i have to connect to roadwarrios on the vpn site to site is it possible ?

          1 Reply Last reply Reply Quote 0
          • Cry Havok
            Cry Havok last edited by

            I don't believe so, but it is simple to create another VPN just for those roadwarriors.

            1 Reply Last reply Reply Quote 0
            • X
              XIII last edited by

              I agree with Cry Havok.
              I have not figured out how to do so with PSK, I am working on moving to PKI and if I figure out a way I will let you know.

              -Chris Stutzman
              Sys0:2.0.1: AMD Sempron 140 @2.7 1024M RAM 100GHD
              Sys1:2.0.1: Intel P4 @2.66 1024M RAM 40GHD
              freedns.afraid.org - Free DNS dynamic DNS subdomain and domain hosting.
              Check out the pfSense Wiki

              1 Reply Last reply Reply Quote 0
              • M
                mariofiorentino last edited by

                Hi all,

                i have two Openvpn Server

                one is Site to Site Vpn
                two Roadwarriors  Vpn Connection

                I would like to connect to site to site vpn from roadwarriors vpn

                Could you help me ?

                1 Reply Last reply Reply Quote 0
                • Cry Havok
                  Cry Havok last edited by

                  That's just a routing issue - you have to ensure that all devices (or at least their default gateways, the routers) know how to reach all the IP ranges you're using.

                  That's easier if your OpenVPN servers are also the default gateways for their networks. If they aren't then ensure that all the default gateways, on both the local and remote networks, know how to route to your Roadwarrior IP range. You'll also want to ensure that the Roadwarriors have the OpenVPN server pushed as their default gateway or have appropriate static routes pushed.

                  For anything more precise you'll need to provide a diagram of your networks, how they are connected and what IP ranges you're using.

                  1 Reply Last reply Reply Quote 0
                  • M
                    mariofiorentino last edited by

                    i have attached the screenshot.

                    the my vpn roadwarriors not ping vpn site to site






                    1 Reply Last reply Reply Quote 0
                    • Cry Havok
                      Cry Havok last edited by

                      @Cry:

                      For anything more precise you'll need to provide a diagram of your networks, how they are connected and what IP ranges you're using.

                      1 Reply Last reply Reply Quote 0
                      • X
                        XIII last edited by

                        you will also want to remove your actual public IPs/FQDNs from your examples above.

                        -Chris Stutzman
                        Sys0:2.0.1: AMD Sempron 140 @2.7 1024M RAM 100GHD
                        Sys1:2.0.1: Intel P4 @2.66 1024M RAM 40GHD
                        freedns.afraid.org - Free DNS dynamic DNS subdomain and domain hosting.
                        Check out the pfSense Wiki

                        1 Reply Last reply Reply Quote 0
                        • M
                          mariofiorentino last edited by

                          On one pfSense box I have the following OpenVPN configurations:

                          As a server for Road Warriors
                          Dynamic IP: yes
                          Address pool: 10.99.254.0/24
                          Local network: 192.168.100.0/24
                          Client-to-client VPN: yes
                          Cryptography: BF-CBC (128-bit)
                          Authentication method: PKI
                          CA cert
                          Server cert
                          Server key
                          DH parameters
                          TLS
                          LZO compression: yes

                          As server for Site-To-Site OpenVPN
                          Address pool: 10.11.12.0/24
                          Remote network: 192.168.200.0/24
                          Cryptography: BF-CBC (128-bit)
                          Authentication method: Shared key
                          Shared key cert
                          LZO compression: yes

                          My routing issue is:
                          From Site 1 I can reach hosts on Site 2 and vice versa.
                          From Road Warrior I can reach hosts on Site 1.
                          I want to be able to reach hosts in Site 2 from Road Warrior.

                          Could you help me ?

                          1 Reply Last reply Reply Quote 0
                          • Cry Havok
                            Cry Havok last edited by

                            It would be much, much, easier to help you if you'd provide the information we ask for.

                            I'm guessing that Site 2 doesn't know how to route to the Road Warrior LAN.

                            1 Reply Last reply Reply Quote 0
                            • M
                              mariofiorentino last edited by

                              Yes :) Roadwarriors don't ping site 2

                              1 Reply Last reply Reply Quote 0
                              • Cry Havok
                                Cry Havok last edited by

                                I'll say it slightly differently - have you configured the routers at Site 2 so that they know how to route to the Road Warrior subnet? They'll need a static route for 10.99.254.0/24 with a route through the Site 2 OpenVPN server's LAN IP.

                                1 Reply Last reply Reply Quote 0
                                • J
                                  joako last edited by

                                  I was told this arrangement isn't possible to have OpenVPN clients to one LAN have their traffic pass through another OpenVPN to another LAN… so I just setup more OpenVPN clients and servers.... it would be nice if each site could only need 1 OpenVPN...but I never got that working!

                                  1 Reply Last reply Reply Quote 0
                                  • GruensFroeschli
                                    GruensFroeschli last edited by

                                    That's not actually true.
                                    I have this exact setup working.

                                    It's really a matter of setting up static routes on every router involved, so every devices know where to send traffic to.

                                    We do what we must, because we can.

                                    Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

                                    1 Reply Last reply Reply Quote 0
                                    • Cry Havok
                                      Cry Havok last edited by

                                      It is perfectly possible - I've done it and I know some folks who have an intra-site VPN that they use daily without problems.

                                      As GruensFroeschli said, it's just a matter of getting the routes right.

                                      1 Reply Last reply Reply Quote 0
                                      • J
                                        joako last edited by

                                        I don't follow. The site to site openvpn comes up and the routes are setup. I have a client-to-site VPN on the same pfsense and I ass the correct push route statement to the openvpn configuration.

                                        Client VPN traffic goes from openvpn to pfsense first hop, but then no further.

                                        How could I add a route for this?

                                        1 Reply Last reply Reply Quote 0
                                        • GruensFroeschli
                                          GruensFroeschli last edited by

                                          The other side of the site-to-site knows nothing about the roadwarrior subnet.
                                          –>you need a static route to make the roadwarriors known.

                                          We do what we must, because we can.

                                          Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

                                          1 Reply Last reply Reply Quote 0
                                          • First post
                                            Last post