Inter-Vlan Routing Accross VPN
-
Yeah - The 1.5GHZ processors will do that no problems at all. I manage 5MB links even with a 300MHZ linksys E1000 as client to my servers and those have very weak processors. Hardware won't be an issue for you. Figuring out the VLAN layout should be your only worry. When you get this worked out, can you post the VLAN over Openvpn solution? It would be nice to know.
-
I guess I'm on my own on this one. He [Jimp] told me not to contact him. He want's you to buy commercial support. (which we being a public library could not do)
-
Sorry about that - Thats my mistake.
Referring this or that person by user-name here is probably a Faux pas.
In the event you can't get VLAN tagging to work accross the VPN:
I would probably handle this by having 3 Openvpn server threads running on that main pfsense in main office. One per function.
Then I'd probably have every computer in at every office be a client (24/7) to one of those VPN server threads and control their access to each other that way.
No VLANS required for that to work.
Are these computers windows? If they are, that makes my alternate solution ridiculously easy to implement. -
I think I found a solution, but it will require me to use IPSEC
http://doc.pfsense.org/index.php/IPsec_with_Multiple_Subnets
I can map the routes the additional subnets (vlans)
-
Hey - Thats neat. Not exactly what you were looking for but if that works as advertised, might be fine. Let me know how that turns out and how stable IPsec is for you. I've never needed to do this before, but for this scenario looks like, as far as I can tell, IPsec is better. Thats very cool if it works. I had read that using the TAP interface rather than the TUN in (maybe in bridged mode) might accomplish what you desire but if IPsec works for you, no need experiment.
-
For what its worth I don't think VLANs would work for what you were trying to do. Remember that Vlans are a layer 2 way of breaking up broadcast domains. Once you cross a layer 3 device your layer 2 Vlan tag will be lost. Remember that when the router moves the packet from one interface to another it will change the Ethernet header information which contains the source and destination MACs. Now if there were a way to keep your layer 2 information to persist over the routed connection then what you wanted to do could work.
-
https://forum.openwrt.org/viewtopic.php?id=33678
-
For what its worth I don't think VLANs would work for what you were trying to do. Remember that Vlans are a layer 2 way of breaking up broadcast domains. Once you cross a layer 3 device your layer 2 Vlan tag will be lost. Remember that when the router moves the packet from one interface to another it will change the Ethernet header information which contains the source and destination MACs. Now if there were a way to keep your layer 2 information to persist over the routed connection then what you wanted to do could work.
Yes, I know Lan is at layer 2. I don't plan on having the VLAN tags go across the VPN. The Layer 2 Vlans match up to Layer 3 Subnets (see my OP all of them are serperate subnets/vlan which would require routing, the vlans wouldn't match up for just tagging to work) anyway. All I need is to get all the subnets to be able to route across the VPN and use ACLs at each point to keep the correct subnets where they are suppose to be.
Also with my current config on my Cisco Routers I have A Multipoint VPN (I think it's technically called a Dynamic multi-point VPN) is there any feature like this in Pfsense, meaning that I don't have just one site being the server and the rest being clients (hub a spoke design) but all sites interconnect?
-
You mean full-mesh? TINC. Hmmm. Not in the packages for my 2.03 though.
-
yes
-
I think the open-source full mesh vpn solution is TINC. I know its been talked to go into pfsense but not sure if its in the 2.1
I know it can have NAT issues, but people like you don't have NAT issues. I'm sorta surprised if its not already a package in 2.1 -
Yes, I know Lan is at layer 2. I don't plan on having the VLAN tags go across the VPN. The Layer 2 Vlans match up to Layer 3 Subnets (see my OP all of them are serperate subnets/vlan which would require routing, the vlans wouldn't match up for just tagging to work) anyway. All I need is to get all the subnets to be able to route across the VPN and use ACLs at each point to keep the correct subnets where they are suppose to be.
Also with my current config on my Cisco Routers I have A Multipoint VPN (I think it's technically called a Dynamic multi-point VPN) is there any feature like this in Pfsense, meaning that I don't have just one site being the server and the rest being clients (hub a spoke design) but all sites interconnect?
I'm sorry I misunderstood your post, I thought you were trying to get your vlans to persist across the VPN connection. I did see that you are using different vlans. I was thinking you wanted routing across all sites but just wanted to be sure. I think you would probably need a point to point at each site, it sounds kind of ugly but it would accomplish your task. This has me interested now though, it should be possible with out all the extra configs so I will make a mock setup and report back. If you need it down quickly I would do it the ugly way and then work on the routing through the main site. Might be better to make the mesh setup because that way you don't lose connection to the other sites if the main site goes down and also there is less un-needed processing on the router at your main site.
https://forum.openwrt.org/viewtopic.php?id=33678
Neat trick but I don't think this would work if you wanted to have multiple vlans go across a VPN Connection.
-
I'm sure soon someone will figure a way to build VLAN support smoothly into VPN of some flavour or another, but I'm not seeing it being easy yet.
-
Yes, I know Lan is at layer 2. I don't plan on having the VLAN tags go across the VPN. The Layer 2 Vlans match up to Layer 3 Subnets (see my OP all of them are serperate subnets/vlan which would require routing, the vlans wouldn't match up for just tagging to work) anyway. All I need is to get all the subnets to be able to route across the VPN and use ACLs at each point to keep the correct subnets where they are suppose to be.
Also with my current config on my Cisco Routers I have A Multipoint VPN (I think it's technically called a Dynamic multi-point VPN) is there any feature like this in Pfsense, meaning that I don't have just one site being the server and the rest being clients (hub a spoke design) but all sites interconnect?
I'm sorry I misunderstood your post, I thought you were trying to get your vlans to persist across the VPN connection. I did see that you are using different vlans. I was thinking you wanted routing across all sites but just wanted to be sure. I think you would probably need a point to point at each site, it sounds kind of ugly but it would accomplish your task. This has me interested now though, it should be possible with out all the extra configs so I will make a mock setup and report back. If you need it down quickly I would do it the ugly way and then work on the routing through the main site. Might be better to make the mesh setup because that way you don't lose connection to the other sites if the main site goes down and also there is less un-needed processing on the router at your main site.
https://forum.openwrt.org/viewtopic.php?id=33678
Neat trick but I don't think this would work if you wanted to have multiple vlans go across a VPN Connection.
I upgraded one of my boxes to 2.1RC0 and installed TINC (which I've never heard of before, granted I'm more of Cisco guy than an open source guy). I haven't tried it in practice yet, but It looks like it will pass all the subnets based on this anyway.
and TINC has firewall rules so you can allow subnets only to go to specific subnets.
Let's hope this works.
and then since TINC has firewall rules.
-
I'm sure soon someone will figure a way to build VLAN support smoothly into VPN of some flavour or another, but I'm not seeing it being easy yet.
L2VPN does this exactly, it provides no security itself though. and I don't believe pfsense does IPSEC l2vpn as of yet.
I never looked into it much, but I believe l2vpn would be similar to router-bridging. So it would mess with your broadcast domains and cause more than necessary traffic
-
I think that if you own a nice static public address at every site and don't hit NAT issues (you shouldn't) a full mesh network is good. It even has the added benifit of not laying all the bandwidth burden on one central server. In theory, should make things work alot faster and offer greater resiliency because nodes can go up and down without taking out the entire network. I've yet to install it, so please do let me know how it works for you.
-
Looking at your rule you are making there… Will you only be passing TCP? Because TCP is whats selected there.
I also don't know how automatic any rule creation is on the WAN when you use TINC in pfsense but I do know that there are some ports that have to be opened, either automatically or manually. 655 UDP and TCP for sure. -
Looking at your rule you are making there… Will you only be passing TCP? Because TCP is whats selected there.
Its blocking rule. and It was for example only. no port was configured either for that matter.
-
Yes. I see the block at the top now. Almost chopped, but not quite.
-
I'm not having any lucky with it yet. It installed easy though.
I have both boxes WAN port plugged into our current lan.
One Box set to 10.10.100.52
Second One 10.10.100.60Both Get internet traffic fine. But they can't ping each other which I assume is the problem. I did setup a rule on the WAN interface of both to allow ICMP from ANY to ANY.
This is the TINC log either one only shows itself right now. NAME changed to protect the innocent ;)
Statistics for Generic BSD tun device /dev/tun0:
total bytes in: 620
total bytes out: 900
Nodes:
NAME at MYSELF cipher 0 digest 0 maclength 0 compression 0 options c status 0018 nexthop NAME via NAME pmtu 1518 (min 0 max 1518)
End of nodes.
Edges:
End of edges.
Subnet list:
192.168.1.0/24#10 owner NAME
End of subnet list.