LAN to LAN - Problems ;)
-
Hey,
i just build my own pfsense-box but im struggeling with my openvpn-setup.
I simply want to connect my pfsense-box(2.0.3) with the server(ubuntu-server 12.04 lts) on the other network.
I want to access all devices on the 192.168.1.0/24-network from any device in the 192.168.2.0/24-networkHeres a diagram of the networks:
Heres the config of the server:
port 1194 proto udp dev tun ca ./easy-rsa2/keys/ca.crt cert ./easy-rsa2/keys/server.crt key ./easy-rsa2/keys/server.key # This file should be kept secret dh ./easy-rsa2/keys/dh1024.pem server 10.8.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt push "route 192.168.1.0 255.255.255.0" keepalive 10 120 tls-auth ./easy-rsa2/keys/ta.key 0 # This file is secret cipher AES-128-CBC # AES comp-lzo user openvpn group openvpn persist-key persist-tun log openvpn.log log-append openvpn.log verb 4
the pfsense-box:
dev ovpnc1 dev-type tun dev-node /dev/tun1 writepid /var/run/openvpn_client1.pid #user nobody #group nobody script-security 3 daemon keepalive 10 60 ping-timer-rem persist-tun persist-key proto udp cipher AES-128-CBC up /usr/local/sbin/ovpn-linkup down /usr/local/sbin/ovpn-linkdown local my-local-ip tls-client client lport 0 management /var/etc/openvpn/client1.sock unix remote my.dyndns-domain 1194 ifconfig 10.8.0.2 10.8.0.1 ca /var/etc/openvpn/client1.ca cert /var/etc/openvpn/client1.cert key /var/etc/openvpn/client1.key tls-auth /var/etc/openvpn/client1.tls-auth 1 comp-lzo resolv-retry infinite remote-cert-tls server
Now to the problem:
when i try to ping from 192.168.2.188 -> 192.168.1.15
i get the following log-entries on my server:Sun Aug 25 18:14:01 2013 us=651813 pfsense1/pfsense-box-wan-ip:39703 MULTI: bad source address from client [192.168.2.188], packet dropped Sun Aug 25 18:14:06 2013 us=525872 pfsense1/pfsense-box-wan-ip:39703 MULTI: bad source address from client [192.168.2.188], packet dropped Sun Aug 25 18:14:11 2013 us=526426 pfsense1/pfsense-box-wan-ip:39703 MULTI: bad source address from client [192.168.2.188], packet dropped Sun Aug 25 18:14:16 2013 us=25945 pfsense1/pfsense-box-wan-ip:39703 MULTI: bad source address from client [192.168.2.188], packet dropped
Are there any settings i've forgot to configure in pfsense?
Or did i misconfigured anything?
Im a software-developer so i dont have any-skills in networking ;) -
It seems that the DD-WRT server end does not have a route to 192.168.2.0/24
The DD-WRT server config is pushing a route to the pfSense client that points back to itself - that is good, the pfSense client knows the route to 192.168.1.0/24, but I don't see how the DD-WRT server will know how to route replies. -
On the server-side (DD-WRT), it looks like you forgot to enter the remote network. You need to add the following to your server-side config:
route 192.168.2.0 255.255.255.0
-
First of all, thanks for your help and the patience to unterstand my "english" :)
I updated the network-diagram, because i may not clearly pointed out was my goal is.
I added the route to the server, but it still drops the packages… Same message.
UPDATE:
I tried to ping my ubuntu-server from my pfsense-box and this worked.
Seems i only have to make the 192.168.1.0/24-Network available for the other clients in the 192.168.2.0/24-Network.
But i really dont know how... -
Now I see the OpenVPN server is behind the DD-WRT. I guess DD-WRT must be port-forwarding 1194 through to the OpenVPN server.
You are going to have some issues with your clients at the DD-WRT end when they try to reply - they will have DD-WRT as their ordinary gateway. DD-WRT will need to route back to the OpenVPN server for traffic to 192.168.2.0/24…But for now, what is the OpenVPN server running on?
I guess your original error messages mean that it is rejecting the packets coming in across the OpenVPN link from 192.168.2.188. That needs to be fixed somehow. -
The Port-Forwarding is already done.
The OpenVPN-Serve is running on a Ubuntu-Server 12.04.
Any ideas how to set up a specific gateway for the 192.168.0.2/24-Net?
-
Why don't you just move the openvpn connection to dd-wrt or put pfsense where dd-wrt is?
Your over complicating the setup, putting your vpn endpoint behind a nat and not as the default gateway for the network your tying to access is not an ideal way to go about it.
Why are trying to use pfsense behind dd-wrt? I personally would just use pfsense and remove dd-wrt completely.. But if you want to use it - its supports openvpn as well. http://www.dd-wrt.com/wiki/index.php/OpenVPN
-
Well the DD-WRT router is just a consumer-router with horrible throughput(600-800kb/s openvpn-performance) and i need at least 2mb/s.
I currently dont got the hardware to build a new pfsense-box.UPDATE:
The speed was when using openvpn on the dd-wrt-router -
So you need 2mbps, and dd-wrt does 800kbps – how is putting openvpn on a box behind dd-wrt going to fix that?
So replace the hardware running dd-wrt on now that something can handle the bandwidth you need and then run openvpn on that. Depending on the hardware - just run pfsense vs dd-wrt.
-
The box behind the DD-WRT router is a ubuntu-server.
The ubuntu-server got a 4-core-xeon cpu. I think this should handle the 2 mb/s -
Does not exactly matter what's behind the bottleneck. :D
-
The dd-wrt-router is only the bottleneck when im running the openvpn-service on it.
So whats your point? Or am i missing something?I dont want to replace the router, because i dont got the hardware
and i dont want to spend the money just for running openvpn on it. -
I still do not get why are you running OpenVPN thru an obvious bottleneck. Make an AP from it on your LAN, stop using it as router.
-
I dont get why the dd-wrt router is the bottleneck?
-
Sigh… because you said it yourself? As suggested by myself and other people above, move pfS where the DD-WRT is right now and use the DD-WRT router as an AP. Otherwise, since this obviously does not go anywhere - have a nice day.
-
CaptainWTF could walk him through this… He figured this out and its fresh in his mind (-:
-
Ok my fault. I was talking about 800kb/s throughput when running openvpn on the dd-wrt router.
I tought this was clear due to the advice in the previous post.
Thats why i want to use the ubuntu-server.