OpenVPN Access to LAN Question

[pr0ject]

I've followed the various tutorials on setting up an openvpn server/client with pfsense, and I'm almost there.. but I have a few questions.

OpenVPN Clients: 192.168.200/0/24
DMZ: 192.168.1.0/24
LAN: 10.10.10.0/24

The vpn clients can access the DMZ servers fine, but cannot access anything on the LAN (windows shares, rdp, etc). I have the following routes being pushed down from the server:

Destination      Mask                  Gateway            Interface
10.10.10.0      255.255.255.0      192.168.200.5    192.168.200.6
192.168.1.0    255.255.255.0      192.168.200.5    192.168.200.6
192.168.200.1  255.255.255.255    192.168.200.5    192.168.200.6

I have NetBIOS unchecked which should allow for share access, but I get host not found (even though I know the remote 10.10.10.x system is online)

Oddly enough, I can access the pfsense firewall on 10.10.10.1, I just can't seem to access anything beyond that. I don't have any specific rules on either dmz or lan interface (based on what I read, I shouldn't need to as vpn clients are allowed full access automatically)

Am I missing something here?

[dannyb78]

can you ping any 10.10.10.x host via vpn?

[pr0ject]

Nope. Just the gateway.

[dannyb78]

so you have set 192.168.1.0/24 (your DMZ area) as "local network" in openVPN configuration form, and configured the route for your LAN using the advanced configuration field.

I have a similar configuration working.

LAN 192.168.100.x
other subnet in LAN 192.168.1.x, 192.168.2.x, 192.168.3.x …..

Using openVPN I can successfully connect with all this lan.

I just configured the openVPN in pfsense, opened the port on the firewall. no need to create static route or firewall rules. just config 192.168.100.0/24 as "local network" and added push command like this in "advanced configuration" under openVPN config in pfsense.

push "route 192.168.3.0 255.255.255.0";

I'm using pfsense 2.0 RC1, I was not able to make this work with 1.2.3 version.

hope this can help you.

[pr0ject]

Ah. Interesting. I'm using 1.2.3 which might be why. I've also had my 'local network' set to the 10.10.10.0/24 network space and only did a custom route to the DMZ (via push as well as manually on the client via route add). I'm wondering if there's a limitation with 1.2.3 which prevents LAN access.

[dannyb78]

may the 1.2.3 requires a firewall rule?

[pr0ject]

If so, what would that rule look like?

[dannyb78]

you shoul permit connections from your vpn to your dmz.

if your dmz is connected on LAN interface create a rule in LAN interface that permit all traffic from 192.168.200.0/24

[pr0ject]

That's what I thought, too. I added a rule on the LAN interface to allow any any from 192.168.200.0/24 but to no avail. As the DMZ network is reachable as-is (192.168.200.0/24 (vpn) has access to 192.168.1.0/24 (dmz) already), I suspect I only need to focus on LAN connectivity from the vpn subnet. Is there anything special I need to do rule-wise on the WAN interface as that's technically where the VPN is connecting from.

[dannyb78]

I think that you should see only the VPN call in WAN interface, once created the tunnel all comunications are between LAN and VPN interface.