LAN to LAN - Problems ;)



  • Hey,
    i just build my own pfsense-box but im struggeling with my openvpn-setup.
    I simply want to connect my pfsense-box(2.0.3) with the server(ubuntu-server 12.04 lts) on the other network.
    I want to access all devices on the 192.168.1.0/24-network from any device in the 192.168.2.0/24-network

    Heres a diagram of the networks:

    Heres the config of the server:

    
    port 1194
    proto udp
    dev tun
    ca ./easy-rsa2/keys/ca.crt
    cert ./easy-rsa2/keys/server.crt
    key ./easy-rsa2/keys/server.key # This file should be kept secret
    dh ./easy-rsa2/keys/dh1024.pem
    server 10.8.0.0 255.255.255.0
    ifconfig-pool-persist ipp.txt
    push "route 192.168.1.0 255.255.255.0"
    keepalive 10 120
    tls-auth ./easy-rsa2/keys/ta.key 0 # This file is secret
    cipher AES-128-CBC   # AES
    comp-lzo
    user openvpn
    group openvpn
    persist-key
    persist-tun
    log         openvpn.log
    log-append  openvpn.log
    verb 4
    
    

    the pfsense-box:

    
    dev ovpnc1
    dev-type tun
    dev-node /dev/tun1
    writepid /var/run/openvpn_client1.pid
    #user nobody
    #group nobody
    script-security 3
    daemon
    keepalive 10 60
    ping-timer-rem
    persist-tun
    persist-key
    proto udp
    cipher AES-128-CBC
    up /usr/local/sbin/ovpn-linkup
    down /usr/local/sbin/ovpn-linkdown
    local my-local-ip
    tls-client
    client
    lport 0
    management /var/etc/openvpn/client1.sock unix
    remote my.dyndns-domain 1194
    ifconfig 10.8.0.2 10.8.0.1
    ca /var/etc/openvpn/client1.ca
    cert /var/etc/openvpn/client1.cert
    key /var/etc/openvpn/client1.key
    tls-auth /var/etc/openvpn/client1.tls-auth 1
    comp-lzo
    resolv-retry infinite
    remote-cert-tls server
    
    

    Now to the problem:

    when i try to ping from 192.168.2.188 -> 192.168.1.15
    i get the following log-entries on my server:

    
    Sun Aug 25 18:14:01 2013 us=651813 pfsense1/pfsense-box-wan-ip:39703 MULTI: bad source address from client [192.168.2.188], packet dropped
    Sun Aug 25 18:14:06 2013 us=525872 pfsense1/pfsense-box-wan-ip:39703 MULTI: bad source address from client [192.168.2.188], packet dropped
    Sun Aug 25 18:14:11 2013 us=526426 pfsense1/pfsense-box-wan-ip:39703 MULTI: bad source address from client [192.168.2.188], packet dropped
    Sun Aug 25 18:14:16 2013 us=25945 pfsense1/pfsense-box-wan-ip:39703 MULTI: bad source address from client [192.168.2.188], packet dropped
    
    

    Are there any settings i've forgot to configure in pfsense?
    Or did i misconfigured anything?
    Im a software-developer so i dont have any-skills in networking ;)



  • It seems that the DD-WRT server end does not have a route to 192.168.2.0/24
    The DD-WRT server config is pushing a route to the pfSense client that points back to itself - that is good, the pfSense client knows the route to 192.168.1.0/24, but I don't see how the DD-WRT server will know how to route replies.



  • On the server-side (DD-WRT), it looks like you forgot to enter the remote network.  You need to add the following to your server-side config:

    route 192.168.2.0 255.255.255.0



  • First of all, thanks for your help and the patience to unterstand my "english" :)

    I updated the network-diagram, because i may not clearly pointed out was my goal is.

    I added the route to the server, but it still drops the packages… Same message.

    UPDATE:
    I tried to ping my ubuntu-server from my pfsense-box and this worked.
    Seems i only have to make the 192.168.1.0/24-Network available for the other clients in the 192.168.2.0/24-Network.
    But i really dont know how...



  • Now I see the OpenVPN server is behind the DD-WRT. I guess DD-WRT must be port-forwarding 1194 through to the OpenVPN server.
    You are going to have some issues with your clients at the DD-WRT end when they try to reply - they will have DD-WRT as their ordinary gateway. DD-WRT will need to route back to the OpenVPN server for traffic to 192.168.2.0/24…

    But for now, what is the OpenVPN server running on?
    I guess your original error messages mean that it is rejecting the packets coming in across the OpenVPN link from 192.168.2.188. That needs to be fixed somehow.



  • The Port-Forwarding is already done.

    The OpenVPN-Serve is running on a Ubuntu-Server 12.04.

    Any ideas how to set up a specific gateway for the 192.168.0.2/24-Net?


  • LAYER 8 Global Moderator

    Why don't you just move the openvpn connection to dd-wrt or put pfsense where dd-wrt is?

    Your over complicating the setup, putting your vpn endpoint behind a nat and not as the default gateway for the network your tying to access is not an ideal way to go about it.

    Why are trying to use pfsense behind dd-wrt?  I personally would just use pfsense and remove dd-wrt completely.. But if you want to use it - its supports openvpn as well.  http://www.dd-wrt.com/wiki/index.php/OpenVPN



  • Well the DD-WRT router is just a consumer-router with horrible throughput(600-800kb/s openvpn-performance) and i need at least 2mb/s.
    I currently dont got the hardware to build a new pfsense-box.

    UPDATE:
    The speed was when using openvpn on the dd-wrt-router


  • LAYER 8 Global Moderator

    So you need 2mbps, and dd-wrt does 800kbps – how is putting openvpn on a box behind dd-wrt going to fix that?

    So replace the hardware running dd-wrt on now that something can handle the bandwidth you need and then run openvpn on that.  Depending on the hardware - just run pfsense vs dd-wrt.



  • The box behind the DD-WRT router is a ubuntu-server.
    The ubuntu-server got a 4-core-xeon cpu. I think this should handle the 2 mb/s


  • Banned

    Does not exactly matter what's behind the bottleneck. :D



  • The dd-wrt-router is only the bottleneck when im running the openvpn-service on it.
    So whats your point? Or am i missing something?

    I dont want to replace the router, because i dont got the hardware
    and i dont want to spend the money just for running openvpn on it.


  • Banned

    I still do not get why are you running OpenVPN thru an obvious bottleneck. Make an AP from it on your LAN, stop using it as router.



  • I dont get why the dd-wrt router is the bottleneck?


  • Banned

    Sigh… because you said it yourself?  As suggested by myself and other people above, move pfS where the DD-WRT is right now and use the DD-WRT router as an AP. Otherwise, since this obviously does not go anywhere - have a nice day.



  • CaptainWTF could walk him through this…  He figured this out and its fresh in his mind (-:



  • Ok my fault. I was talking about 800kb/s throughput when running openvpn on the dd-wrt router.
    I tought this was clear due to the advice in the previous post.
    Thats why i want to use the ubuntu-server.


Log in to reply