LAN to LAN - Problems ;)

da_blubb

Hey,
i just build my own pfsense-box but im struggeling with my openvpn-setup.
I simply want to connect my pfsense-box(2.0.3) with the server(ubuntu-server 12.04 lts) on the other network.
I want to access all devices on the 192.168.1.0/24-network from any device in the 192.168.2.0/24-network

Heres a diagram of the networks:

Heres the config of the server:


port 1194
proto udp
dev tun
ca ./easy-rsa2/keys/ca.crt
cert ./easy-rsa2/keys/server.crt
key ./easy-rsa2/keys/server.key # This file should be kept secret
dh ./easy-rsa2/keys/dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "route 192.168.1.0 255.255.255.0"
keepalive 10 120
tls-auth ./easy-rsa2/keys/ta.key 0 # This file is secret
cipher AES-128-CBC   # AES
comp-lzo
user openvpn
group openvpn
persist-key
persist-tun
log         openvpn.log
log-append  openvpn.log
verb 4

the pfsense-box:


dev ovpnc1
dev-type tun
dev-node /dev/tun1
writepid /var/run/openvpn_client1.pid
#user nobody
#group nobody
script-security 3
daemon
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
proto udp
cipher AES-128-CBC
up /usr/local/sbin/ovpn-linkup
down /usr/local/sbin/ovpn-linkdown
local my-local-ip
tls-client
client
lport 0
management /var/etc/openvpn/client1.sock unix
remote my.dyndns-domain 1194
ifconfig 10.8.0.2 10.8.0.1
ca /var/etc/openvpn/client1.ca
cert /var/etc/openvpn/client1.cert
key /var/etc/openvpn/client1.key
tls-auth /var/etc/openvpn/client1.tls-auth 1
comp-lzo
resolv-retry infinite
remote-cert-tls server

Now to the problem:

when i try to ping from 192.168.2.188 -> 192.168.1.15
i get the following log-entries on my server:


Sun Aug 25 18:14:01 2013 us=651813 pfsense1/pfsense-box-wan-ip:39703 MULTI: bad source address from client [192.168.2.188], packet dropped
Sun Aug 25 18:14:06 2013 us=525872 pfsense1/pfsense-box-wan-ip:39703 MULTI: bad source address from client [192.168.2.188], packet dropped
Sun Aug 25 18:14:11 2013 us=526426 pfsense1/pfsense-box-wan-ip:39703 MULTI: bad source address from client [192.168.2.188], packet dropped
Sun Aug 25 18:14:16 2013 us=25945 pfsense1/pfsense-box-wan-ip:39703 MULTI: bad source address from client [192.168.2.188], packet dropped

Are there any settings i've forgot to configure in pfsense?
Or did i misconfigured anything?
Im a software-developer so i dont have any-skills in networking ;)

phil.davis

It seems that the DD-WRT server end does not have a route to 192.168.2.0/24
The DD-WRT server config is pushing a route to the pfSense client that points back to itself - that is good, the pfSense client knows the route to 192.168.1.0/24, but I don't see how the DD-WRT server will know how to route replies.

marvosa

On the server-side (DD-WRT), it looks like you forgot to enter the remote network. You need to add the following to your server-side config:

route 192.168.2.0 255.255.255.0

da_blubb

First of all, thanks for your help and the patience to unterstand my "english" :)

I updated the network-diagram, because i may not clearly pointed out was my goal is.

I added the route to the server, but it still drops the packages… Same message.

UPDATE:
I tried to ping my ubuntu-server from my pfsense-box and this worked.
Seems i only have to make the 192.168.1.0/24-Network available for the other clients in the 192.168.2.0/24-Network.
But i really dont know how...

phil.davis

Now I see the OpenVPN server is behind the DD-WRT. I guess DD-WRT must be port-forwarding 1194 through to the OpenVPN server.
You are going to have some issues with your clients at the DD-WRT end when they try to reply - they will have DD-WRT as their ordinary gateway. DD-WRT will need to route back to the OpenVPN server for traffic to 192.168.2.0/24…

But for now, what is the OpenVPN server running on?
I guess your original error messages mean that it is rejecting the packets coming in across the OpenVPN link from 192.168.2.188. That needs to be fixed somehow.

da_blubb

The Port-Forwarding is already done.

The OpenVPN-Serve is running on a Ubuntu-Server 12.04.

Any ideas how to set up a specific gateway for the 192.168.0.2/24-Net?

johnpoz

Why don't you just move the openvpn connection to dd-wrt or put pfsense where dd-wrt is?

Your over complicating the setup, putting your vpn endpoint behind a nat and not as the default gateway for the network your tying to access is not an ideal way to go about it.

Why are trying to use pfsense behind dd-wrt? I personally would just use pfsense and remove dd-wrt completely.. But if you want to use it - its supports openvpn as well. http://www.dd-wrt.com/wiki/index.php/OpenVPN

da_blubb

Well the DD-WRT router is just a consumer-router with horrible throughput(600-800kb/s openvpn-performance) and i need at least 2mb/s.
I currently dont got the hardware to build a new pfsense-box.

UPDATE:
The speed was when using openvpn on the dd-wrt-router

johnpoz

So you need 2mbps, and dd-wrt does 800kbps – how is putting openvpn on a box behind dd-wrt going to fix that?

So replace the hardware running dd-wrt on now that something can handle the bandwidth you need and then run openvpn on that. Depending on the hardware - just run pfsense vs dd-wrt.

da_blubb

The box behind the DD-WRT router is a ubuntu-server.
The ubuntu-server got a 4-core-xeon cpu. I think this should handle the 2 mb/s

doktornotor

Does not exactly matter what's behind the bottleneck. :D

da_blubb

The dd-wrt-router is only the bottleneck when im running the openvpn-service on it.
So whats your point? Or am i missing something?

I dont want to replace the router, because i dont got the hardware
and i dont want to spend the money just for running openvpn on it.

doktornotor

I still do not get why are you running OpenVPN thru an obvious bottleneck. Make an AP from it on your LAN, stop using it as router.

da_blubb

I dont get why the dd-wrt router is the bottleneck?

doktornotor

Sigh… because you said it yourself? As suggested by myself and other people above, move pfS where the DD-WRT is right now and use the DD-WRT router as an AP. Otherwise, since this obviously does not go anywhere - have a nice day.

kejianshi

CaptainWTF could walk him through this… He figured this out and its fresh in his mind (-:

da_blubb

Ok my fault. I was talking about 800kb/s throughput when running openvpn on the dd-wrt router.
I tought this was clear due to the advice in the previous post.
Thats why i want to use the ubuntu-server.