OpenVPN peer-2-peer routing doesn't work
i have here installed pfsense 2.0-RC1 (i386) built on Thu Apr 14 19:19:42, and i tried to establish a peer-2-peer connetion with a openvpn client. The connection is working find. but i actually have a problem with routing.
The client has one network interface with 192.168.0.2/24 the second interface is the tunnel network with 10.10.13.6. When i do a ping from 10.10.13.6 to 10.10.0.1 which is the LAN-network on pfsense side, the ping is working fine.
When i start a ping from a client within 192.168.0.x/24 i can see on ovpn-client with tcpdump, that all packets are running in the tunnel interface. When i enable tcpdump on pfsense ovpn interface i can't see any packets coming in. On client side i also see the packets with ifconfig. When i check the routing tables on both side everything is fine.
Thanks in advance,
periko last edited by
I'm having the same issue between 2 hosts running pfsense 2 RC3, did u found a solution ???
Did your config work with older snapshots or is this a general problem ?
If it is not snapshot related take a look at this thread:
You have to focus on the "iroute" command. This is necessary to route to networks behind the client.
Nachtfalke, from my understanding, iroute command should be use or effective when you have multiple spoke sites to a hubsite. Kind of learned this Jimp from one of my other post/thread when I was trying to set up multiple spokes to a hubs.
Periko and Kloana, I have the exact set up as you both and it worked fine in my test enviroment from 2 different internet location. I went by the exact instruction I gave Periko on his post. I am running the 20110729-2017 snapshot and few before worked just as well.
The rule of thumb here is:
1:1 sites, use a /30 tunnel network - then you don't need iroutes
1:many sites, use a /24 or larger, but you need iroutes.
Check the doc wiki for more info on iroutes (and a howto for OpenVPN PKI on 2.0)
periko last edited by
This link help me:
The key was the iroute, u have to create a file in /var/etc/openvpn-ccs(?)/commonnameclient
iroute client-network, example:
iroute 192.168.50.0 255.255.255.0
I have been doing the analysis, this couple of weeks, looks like I had understand the setup in pfsense, is really easy love pfsense.
I had create my own manual but is on other language, I got 2 networks to the main network of the factory working very beautiful.
Othe issue appear in my case, but the problem was the routes, I had to add some routes in my company routers and done, my vpn networks can cross to all the factory networks.
See u latter :D
I mentioned iroutes, and they're covered in the doc I referred to:
You add those in the GUI under client-specific overrides, you do not need to add them manually into files on the firewall.