OPenVPN Routing to ENTIRE network.



  • Ok, First I apologize if this has been already discussed. But I am having a hard time wrapping my head around this issue. I have 4 sites. 3 are currently on-line and one will be coming on-line in a few weeks. Each site has a Site to Site VPN, those work perfectly, and they all route between each other with NO issues. One of the sites has the site to site PLUS is also our OpenVPN Road Warrior site for Employees to VPN, right now this RoadWarrior VPN only sees the site it is on, I've added the needed routes to all other sites, however this still is not working. I want to have our Employees have access to the ENTIRE network. I've been banging my head for over 2 weeks on this. I need to get this working without breaking the routing between the site to sites.

    VPN Routing:
    Site 0: 192.168.0.0/24
    Site to Site VPN # 0 with routes to Site 1, Site 2 and Site 3 <– Routes added to other sites but site 0 not on-line yet.

    Site 1: 192.168.100.0/24
    Road Warrior for Remote Staff <- Only works on Site 1, can't route to Site 2 or Site 3, even though routes are added to the Server Configuration under Advanced configuration for the RoadWarrior VPN Server:

    push "route 192.168.0.0 255.255.255.0"; push "route 192.168.10.0 255.255.255.0";push "route 192.168.40.0 255.255.255.0"

    Site to Site VPN # 1 with routes to Sites 0, Site 2 and Site 3. <-- Works

    Site 2: 192.168.10.0/24
    Site to Site VPN # 2 with routes to Site 0, Site 1 and Site 3. <-- Works

    Site 3: 192.168.40.0/24
    Site to Site VPN  #3 with routes to Site 0, Site 1 and Site 2.  <-- Works

    How do I get the Road Warrior Clients to see all Sites, not just Site 1.

    Do I need to add the RoadWarrior Tunnel to Local Networks on all the Site to Site VPNs?

    Any pointers would help.



  • its best to start by drawing up a schematic of your network. with included devices/ip/ssubnets/routes/..

    that way it makes a lot more sense and will be easier to provide you with a solution



  • Let me work out a diagram.



  • Just guessing but your working site to site routing is by lan address. Did you add routing for vpn server address?

    For example site 2 will need a route back to RoadWarrior VPN gateway.



  • Sorry found an error in my diagram….




  • Yes, I have the following in my Road Warrior Server Advanced Configuration:

    push "route 192.168.0.0 255.255.255.0"; push "route 192.168.10.0 255.255.255.0";push "route 192.168.40.0 255.255.255.0"

    Each site to site VPN has a route back to each other, this works perfectly.

    Based on other posts this is all that should be needed for the Road Warrior VPN, but still not working.



  • Maybe site 2 192.168.10.0 needs a route to roadwarrior vpn 172.16.1.0



  • Just just add 172.16.1.0/24 to the Local Networks on the Site to Site Server configuration for all sites?!?! (Slightly more confused now.)



  • the devices on sites 0,2,3 don't have a route towards your road-warrior subnet (=connected to site1).

    so like @beb consulting said:

    • @site1 site-to-site configs ==> add 172.16.1.1/24 to the local networks  (do this for site 0,2,3)


  • Thanks Heper, I will try  adding the RW subnet to all site. I'll update here if it works.



  • Ok, Added the RW Subnet (172.16.1.0/24) to all Sites to Sites under the Local Networks. However still not able to route to Sites 2 or 3 via the RW VPN.

    RW still only sees Site 1. I've even restarted all the VPN Connections. Still no routes to sites 2 or 3.



  • are you sure the routes aren't there ? filling in the local/remote networks should create the routes.

    provides some traceroutes / packet captures / screenshots of config.

    when you start the RW client, you right click it and 'run as administrator' ?



  • It runs as a services

    I've attached one example of the server side config from site 2 screen shot, and one of the road warrior side config from Site 1 screen shot.

    Also the traceroute attempt from a Road Warrior Client to Site 2, which fails at first IP.

    Also a traceroute from the same Road Warrior Client to Site 1, that works just fine.

    default 104.153.44.121 UGS 12042069 1500 em1
    google-public-dns- 104.153.44.121 UGHS 2582783 1500 em1
    10.1.1.0 link#3 U 3612750 1500 em2
    10.1.1.1 link#3 UHS 0 16384 lo0
    104.153.44.120/29 link#2 U 918385 1500 em1
    104.153.44.123 link#2 UHS 0 16384 lo0
    104.153.44.125 link#2 UHS 248410 16384 lo0
    localhost link#8 UH 257424 16384 lo0
    172.16.1.0 172.16.1.2 UGS 43319 1500 ovpns1
    172.16.1.1 link#10 UHS 0 16384 lo0
    172.16.1.2 link#10 UH 57 1500 ovpns1
    172.16.2.1 link#11 UH 12 1500 ovpnc2
    172.16.2.2 link#11 UHS 0 16384 lo0
    172.16.3.1 link#12 UH 8 1500 ovpnc3
    172.16.3.2 link#12 UHS 0 16384 lo0
    192.168.0.0 172.16.2.1 UGS 2047600 1500 ovpnc2
    192.168.10.0 172.16.2.1 UGS 353061 1500 ovpnc2
    192.168.40.0 172.16.3.1 UGS 214494 1500 ovpnc3
    192.168.50.0 link#5 U 996 1500 em4
    192.168.50.1 link#5 UHS 0 16384 lo0
    192.168.50.50 link#5 UHS 0 16384 lo0
    192.168.100.0 link#1 U 4253299 1500 em0
    pfSense01 link#1 UHS 6 16384 lo0
    192.168.100.50 link#1 UHS 0 16384 lo0
    192.168.200.0 link#4 U 992 1500 em3
    192.168.200.1 link#4 UHS 0 16384 lo0
    192.168.200.50 link#4 UHS 0 16384 lo0

    ![Server Side Config Site 2.png](/public/imported_attachments/1/Server Side Config Site 2.png)
    ![Server Side Config Site 2.png_thumb](/public/imported_attachments/1/Server Side Config Site 2.png_thumb)
    ![Road Warrior Side Config Site 1.png](/public/imported_attachments/1/Road Warrior Side Config Site 1.png)
    ![Road Warrior Side Config Site 1.png_thumb](/public/imported_attachments/1/Road Warrior Side Config Site 1.png_thumb)
    ![Road Warrior Side Config Site 1-PG2.png](/public/imported_attachments/1/Road Warrior Side Config Site 1-PG2.png)
    ![Road Warrior Side Config Site 1-PG2.png_thumb](/public/imported_attachments/1/Road Warrior Side Config Site 1-PG2.png_thumb)
    ![OpenVPN Status Page.png](/public/imported_attachments/1/OpenVPN Status Page.png)
    ![OpenVPN Status Page.png_thumb](/public/imported_attachments/1/OpenVPN Status Page.png_thumb)
    Roadwarrior-client-TraceRT.txt
    Roadwarrior-client-TraceRT2site1.txt
    [packetcapture to site 1.pcap](/public/imported_attachments/1/packetcapture to site 1.pcap)
    [packetcapture to site 2.pcap](/public/imported_attachments/1/packetcapture to site 2.pcap)



  • Any suggestions? Made changes in the other recommendations here. Nothing has worked thus far.



  • It sounds like you were given the right info, but the wrong implementation.  First things first, your issue is that your remote sites do not have a return route to your road warrior subnet (172.16.1.0/24).

    According to your diagram, site 1 is the server… so, you need to add 172.16.1.0/24 to all the client sites (0,2,3) in the "IPv4 Remote Network/s" section (not the local network section on the server… you can remove those entries).

    Once you have everything working, the next order of business would be to get off that 192.168.0.0/24 subnet on site 0... it's too common... you're just asking for issues down the road.



  • Thanks I will give this a try.

    We have to use 192.168.0.0/24 for our internal network. We currently use all the follow superblocks for our network.

    192.168.0.0/16  - DataCenters/Branch Offices Server/workstations/Wired Laptops

    10.0.0.0/16 - VPN Internal/Building WIFI

    172.16.0.0/16 -  Employee VPN/Customer VPN/Site to Sites/ISCSI SAN/Cloud Services.

    So we are limited on what we can use. But thanks for the suggestion.



  • Thanks, that slight change corrected the problem. We now have working Road Warrior VPN routing through all sites to site VPNs, and all application/databases are reachable via road-warrior.

    Thanks so much!



  • Excellent!  Glad it's working.

    Regarding the issue with the 192.168.0.0/24 subnet, obviously everything being ideal you'll be fine, but every time a VPN user behind a home router on that same subnet tries to access site 0 it will generate a phone call because the routing will be broken.

    Also, with some clever subnetting, you could get away with a quarter of the ranges you're using… but typically you have to play the hand you're dealt... and it's a whole bunch of work to re-ip an org.



  • Well the site 0 (192.168.0.0/24) has not been brought up fully yet, so I might be able to get that changed. I'll speak to our NE. Any ways now I have a new issue on the same topic.

    We just upgraded all the sites (1,2,3) (again 0 is not up fully yet) to Pfsense 2.2.3. Prior to the upgrade routing though the RoadWarrior worked through to all the sites, however after the upgrade now routing to just one site via the RoadWarrior VPN fails with:

    TTL expired in Transit.

    We have rebooted all the VPNs, (all site to sites, and the Roadwarrior) and still nothing works.

    Routing to 192.168.100.0/24 and 192.168.40.0/24 work fine. However 192.168.10.0/24 fails with the TTL errors.

    Doing a trace route from a Roadwarrior laptop to 192.168.10.1 gives me:
    C:\Users\Administrator>tracert 192.168.10.1

    Tracing route to 192.168.10.1 over a maximum of 30 hops

    1    56 ms    56 ms    56 ms  172.16.1.1
      2  102 ms  102 ms  227 ms  172.16.3.1
      3  350 ms  162 ms  103 ms  172.16.3.2
      4  151 ms  149 ms  149 ms  172.16.3.1
      5  150 ms  148 ms  148 ms  172.16.3.2
      6  196 ms  195 ms  194 ms  ^C
    C:\Users\Administrator>

    It looks like a routing loop on the Site to Site from Site 1 to site Site 2. But the configs worked just fine before.

    Not sure why the upgrade would have broken the working routing, but it appears it has.

    Any thoughts? Suggestions.

    BTW, I am going to pull ALL the routing referencing 192.168.0.0/24 for now, as the site is not up and eliminate the possibility that that route is trying to be used by something somewhere. Once our NE changes the addressing for site 0 (if he is willing at this point) I can put it back.



  • Update:

    Now the issue seem to have move to the 192.168.40.0/24 network. It appear the routing loops is alternating between the 192.168.10.0/24 site and the 192.168.40.0/24 sites.



  • Fixed my own issues, had to pull out the routing under Advanced, at each of the server side site to sites, leave the 172.168.1.0/24 in the remote network sections, and put push routes in the Roadwarrior server side.



  • That's what I figured, but couldn't post 'til now.  Since 2.x, you can enter multiple subnets into the GUI and the routing directives will be generated automatically.


Log in to reply