Setting up OpenVPN to access NAS on LAN

Mr Alpha · Feb 23, 2014, 8:45 PM

I've been trying to setup OpenVPN so that I can access files on my NAS from on the road. I followed this tutorial http://www.youtube.com/watch?v=VdAHVSTl1ys that I found.

The tunnel network is 192.168.10.0/24 and the local network is 192.168.1.0/24 The client is installed on a 64bit Win8.1 Pro machine. When starting OpenVPN the connection is established successfully but I can't access anything on the LAN.

Any help is much appreciated.

phil.davis · Feb 25, 2014, 4:20 PM

I haven't watched the video but here are a few common tricks:
a) Is "on the road" actually on a WiFi hotspot that also has subnet 192.168.1.0/24? A conflict like this will not route. Change your home subnet to some obscure private subnet - 172.16.42.0/24 or…
b) Do you have firewall rule/s on OpenVPN tab allowing traffic from source any to destination LANnet (or even to "any" for testing...)?

Give more detail of your rules etc if you are stuck.

Mr Alpha · Feb 25, 2014, 6:13 PM

The setup I'm trying from is this:

NAS 192.168.1.110 –-- pfSense 192.168.1.1 ---- (Internet) VPN Tunnel 192.168.10.0/24 ---- Router 192.168.0.1 --- VPN Client 192.168.0.10

The firewall rules are the ones created by the Wizard:

Under WAN there is a rule allowing all UDP traffic with Destination Port: 1194 and Destination Address: Wan Address

Under OpenVPN there is a rule to allow everything.

phil.davis · Feb 26, 2014, 5:57 AM

I watched the video - it looks good and should work like that on 2.1 also.
Look in Diagnostics->Routes and see what routes the system knows about.
Can the client ping 192.168.10.1 (OpenVPN server end) and 192.168.1.1 (pfSense LAN)?
Does the NAS have a default gateway set to be the pfSense LAN IP? (It will need to know how to route back to you outside of LAN)

Mr Alpha · Feb 27, 2014, 2:21 PM

This is what it in routes. I don't know how to make sense of it though.

| IPv4 | | | | | | | |
| Destination | Gateway | Flags | Refs | Use | Mtu | Netif | Expire |
| default | 82.181.24.1 | UGS | 0 | 1246543 | 1500 | re1 | |
| 62.241.198.245 | a0:98:05:01:b7:a6 | UHS | 0 | 951 | 1500 | re1 | |
| 62.241.198.246 | a0:98:05:01:b7:a6 | UHS | 0 | 944 | 1500 | re1 | |
| 82.181.24.0/21 | link#2 | U | 0 | 14770 | 1500 | re1 | |
| 82.181.27.123 | link#2 | UHS | 0 | 0 | 16384 | lo0 | |
| 127.0.0.1 | link#7 | UH | 0 | 133 | 16384 | lo0 | |
| 192.168.1.0/24 | link#3 | U | 0 | 73922557 | 1500 | re2 | |
| 192.168.1.1 | link#3 | UHS | 0 | 0 | 16384 | lo0 | |
| 192.168.10.1 | link#8 | UHS | 0 | 0 | 16384 | lo0 | => |
| 192.168.10.1/32 | link#8 | U | 0 | 0 | 1500 | ovpns1 | |

Both ping 192.168.10.1 and ping 192.168.1.1 time out.

The Default Gateway for the NAS is 192.168.1.1.

phil.davis · Feb 27, 2014, 4:46 PM

The last line, 192.168.10.1/32, is not what I expect. For example, I am VPN'd in right now to my office and get lines like this:

10.50.32.0/24 	10.50.32.2 	UGS 	0 	12392 	1500 	ovpns5 	 
10.50.32.1 	link#13 	UHS 	0 	0 	16384 	lo0 	 
10.50.32.2 	link#13 	UH 	0 	0 	1500 	ovpns5

The tunnel network is 10.50.32.0/24 and it knows my server end is ".1" (the "lo0" line) and my client is ".2" on ovpns5.
Check your server settings and make sure the tunnel network really is "/24". Post the server settings, just obscure the TLS key stuff. Something is set that is stopping the normal range of addresses existing in the tunnel.

Mr Alpha · Feb 27, 2014, 9:58 PM

Here are the Server settings. There are no advanced settings.

phil.davis · Feb 28, 2014, 9:36 AM

The only difference from my working Road Warrior server is that you have checked "Allow connected clients to retain their connections if their IP address changes." - I can't imagine how that would break things.
I do a Client Export of the 32-bit version of OpenVPN client, and check "Management Interface OpenVPNManager" so I get the OpenVPN Manager toolbox thing for users. It is working for me at home on a Windows8.1 laptop, but it is only 32-bit. Again, I don't see how this would make a real difference to your problem.

Post a "route print" from the Windows8.1 system - it will be interesting to see what it thinks about its routes.

Mr Alpha · Mar 1, 2014, 3:04 PM

This is what route print says:


===========================================================================
Interface List
  8...00 ff 00 3a ea 09 ......TAP-Windows Adapter V9
  7...bc ee 7b 8c 6e d9 ......Realtek PCIe GBE Family Controller #2
  6...00 00 07 fd 52 78 ......Evolve Virtual Ethernet Adapter
  1...........................Software Loopback Interface 1
  9...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
  4...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
  5...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.0.1     192.168.0.10     10
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
      192.168.0.0    255.255.255.0         On-link      192.168.0.10    266
     192.168.0.10  255.255.255.255         On-link      192.168.0.10    266
    192.168.0.255  255.255.255.255         On-link      192.168.0.10    266
     192.168.10.4  255.255.255.252         On-link      192.168.10.6    286
     192.168.10.6  255.255.255.255         On-link      192.168.10.6    286
     192.168.10.7  255.255.255.255         On-link      192.168.10.6    286
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link      192.168.0.10    266
        224.0.0.0        240.0.0.0         On-link      192.168.10.6    286
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link      192.168.0.10    266
  255.255.255.255  255.255.255.255         On-link      192.168.10.6    286
===========================================================================
Persistent Routes:
  Network Address          Netmask  Gateway Address  Metric
  255.255.255.255  255.255.255.255         On-link        1
        224.0.0.0        240.0.0.0         On-link        1
===========================================================================

IPv6 Route Table
===========================================================================
Active Routes:
 If Metric Network Destination      Gateway
  1    306 ::1/128                  On-link
  7    266 fe80::/64                On-link
  8    286 fe80::/64                On-link
  8    286 fe80::1cd4:f06d:beb1:2cfe/128
                                    On-link
  7    266 fe80::c11c:afd1:c3c7:9fee/128
                                    On-link
  1    306 ff00::/8                 On-link
  7    266 ff00::/8                 On-link
  8    286 ff00::/8                 On-link
===========================================================================
Persistent Routes:
  None

phil.davis · Mar 2, 2014, 9:30 AM

There is no route to 192.168.1.0/24. My Win8.1 system IPv4 routes look like this:

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0         On-link    10.240.184.128     31
        10.49.0.0      255.255.0.0       10.50.32.5       10.50.32.6   4256
       10.50.32.1  255.255.255.255       10.50.32.5       10.50.32.6   4256
       10.50.32.4  255.255.255.252         On-link        10.50.32.6   4511
       10.50.32.6  255.255.255.255         On-link        10.50.32.6   4511
       10.50.32.7  255.255.255.255         On-link        10.50.32.6   4511
        10.51.0.0      255.255.0.0       10.50.32.5       10.50.32.6   4256
   10.240.184.128  255.255.255.255         On-link    10.240.184.128    286
        127.0.0.0        255.0.0.0         On-link         127.0.0.1   4531
        127.0.0.1  255.255.255.255         On-link         127.0.0.1   4531
  127.255.255.255  255.255.255.255         On-link         127.0.0.1   4531
        224.0.0.0        240.0.0.0         On-link         127.0.0.1   4531
        224.0.0.0        240.0.0.0         On-link        10.50.32.6   4511
        224.0.0.0        240.0.0.0         On-link    10.240.184.128     31
  255.255.255.255  255.255.255.255         On-link         127.0.0.1   4531
  255.255.255.255  255.255.255.255         On-link        10.50.32.6   4511
  255.255.255.255  255.255.255.255         On-link    10.240.184.128    286
===========================================================================
Persistent Routes:
  None

It has the 10.50.32.n stuff (in the tunnel network), and also has the route to 10.49.0.0/16 across the tunnel (the LAN/s available at the other end.
Make sure to run all the OpenVPN client stuff from an Administrator account on Win8.1 to make sure it works. I suspect that OpenVPN client does not have enough priv to add the route. Once you can get the route to appear and work, then try other less priv ways to do it. I select OpenVPN Manager when exporting the client config.

Mr Alpha · Mar 2, 2014, 5:12 PM

Ok, so starting OpenVPN in admin mode does let it add a route to the table:

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.0.1     192.168.0.10     10
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
      192.168.0.0    255.255.255.0         On-link      192.168.0.10    266
     192.168.0.10  255.255.255.255         On-link      192.168.0.10    266
    192.168.0.255  255.255.255.255         On-link      192.168.0.10    266
      192.168.1.0    255.255.255.0     192.168.10.5     192.168.10.6     30
     192.168.10.1  255.255.255.255     192.168.10.5     192.168.10.6     30
     192.168.10.4  255.255.255.252         On-link      192.168.10.6    286
     192.168.10.6  255.255.255.255         On-link      192.168.10.6    286
     192.168.10.7  255.255.255.255         On-link      192.168.10.6    286
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link      192.168.0.10    266
        224.0.0.0        240.0.0.0         On-link      192.168.10.6    286
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link      192.168.0.10    266
  255.255.255.255  255.255.255.255         On-link      192.168.10.6    286
===========================================================================
Persistent Routes:
  Network Address          Netmask  Gateway Address  Metric
  255.255.255.255  255.255.255.255         On-link        1
        224.0.0.0        240.0.0.0         On-link        1
===========================================================================

Pinging 192.168.10.1 or 192.168.1.1 both still time out.