Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    OpenVPN peer-2-peer routing doesn't work

    Scheduled Pinned Locked Moved OpenVPN
    7 Posts 5 Posters 5.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • K
      kloana
      last edited by

      Hi,

      i have here installed pfsense 2.0-RC1 (i386) built on Thu Apr 14 19:19:42, and i tried to establish a peer-2-peer connetion with a openvpn client. The connection is working find. but i actually have a problem with routing.

      The client has one network interface with 192.168.0.2/24 the second interface is the tunnel network with 10.10.13.6. When i do a ping from 10.10.13.6 to 10.10.0.1 which is the LAN-network on pfsense side, the ping is working fine.

      When i start a ping from a client within 192.168.0.x/24 i can see on ovpn-client with tcpdump, that all packets are running in the tunnel interface. When i enable tcpdump on pfsense ovpn interface i can't see any packets coming in. On client side i also see the packets with ifconfig. When i check the routing tables on both side everything is fine.

      Thanks in advance,
      regards
      Herbert

      1 Reply Last reply Reply Quote 0
      • perikoP
        periko
        last edited by

        Hi kloana.

        I'm having the same issue between 2 hosts running pfsense 2 RC3, did u found a solution ???

        Necesitan Soporte de Pfsense en México?/Need Pfsense Support in Mexico?
        www.bajaopensolutions.com
        https://www.facebook.com/BajaOpenSolutions
        Quieres aprender PfSense, visita mi canal de youtube:
        https://www.youtube.com/c/PedroMorenoBOS

        1 Reply Last reply Reply Quote 0
        • N
          Nachtfalke
          last edited by

          Did your config work with older snapshots or is this a general problem ?

          If it is not snapshot related take a look at this thread:
          http://forum.pfsense.org/index.php/topic,12888.0.html

          You have to focus on the "iroute" command. This is necessary to route to networks behind the client.

          1 Reply Last reply Reply Quote 0
          • P
            probie
            last edited by

            Nachtfalke, from my understanding, iroute command should be use or effective when you have multiple spoke sites to a hubsite.  Kind of learned this Jimp from one of my other post/thread when I was trying to set up multiple spokes to a hubs.

            Periko and Kloana, I have the exact set up as you both and it worked fine in my test enviroment from 2 different internet location.  I went by the exact instruction I gave Periko on his post.  I am running the 20110729-2017 snapshot and few before worked just as well.

            1 Reply Last reply Reply Quote 0
            • jimpJ
              jimp Rebel Alliance Developer Netgate
              last edited by

              The rule of thumb here is:

              1:1 sites, use a /30 tunnel network - then you don't need iroutes
              1:many sites, use a /24 or larger, but you need iroutes.

              Check the doc wiki for more info on iroutes (and a howto for OpenVPN PKI on 2.0)

              Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

              Need help fast? Netgate Global Support!

              Do not Chat/PM for help!

              1 Reply Last reply Reply Quote 0
              • perikoP
                periko
                last edited by

                This link help me:

                http://blog.stefcho.eu/?p=611

                The key was the iroute, u have to create a file in /var/etc/openvpn-ccs(?)/commonnameclient

                iroute client-network, example:

                iroute 192.168.50.0 255.255.255.0

                I have been doing the analysis, this couple of weeks, looks like I had understand the setup in pfsense, is really easy love pfsense.

                I had create  my own manual but is on other language, I got 2 networks to the main network of the factory working very beautiful.

                Othe issue appear in my case, but the problem was the routes, I had to add some routes in my company routers and done, my vpn networks can cross to all the factory networks.

                See u latter  :D

                Necesitan Soporte de Pfsense en México?/Need Pfsense Support in Mexico?
                www.bajaopensolutions.com
                https://www.facebook.com/BajaOpenSolutions
                Quieres aprender PfSense, visita mi canal de youtube:
                https://www.youtube.com/c/PedroMorenoBOS

                1 Reply Last reply Reply Quote 0
                • jimpJ
                  jimp Rebel Alliance Developer Netgate
                  last edited by

                  I mentioned iroutes, and they're covered in the doc I referred to:

                  http://doc.pfsense.org/index.php/OpenVPN_Site-to-Site_PKI_%28SSL%29

                  You add those in the GUI under client-specific overrides, you do not need to add them manually into files on the firewall.

                  Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

                  Need help fast? Netgate Global Support!

                  Do not Chat/PM for help!

                  1 Reply Last reply Reply Quote 0
                  • First post
                    Last post
                  Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.