Configuring openvpn server and client

[jerryxLinuX]

Firewall/Rules
Tab OpenVPN
Create rule: pass, any, any, any

i gave all but still now no luck

[doktornotor]

Which part of "firewall on client" was confusing? Most importantly - there are firewall logs, use them!!!

[jerryxLinuX]

how to check firewall log?
status–>systemlogs-->firewall tab. is it so : i have found oly tcp are blocked in my client Ip varies not the server IP is blocked in there.

in server config
what to mention in advanced option
push "route server.o subnet" ; route client.o subnet;
is this the correct way ? why we are doing this?
in my case
eg. push "route"192.168.114.0 255.255.255.0";route 192.168.140.0 255.255.255.0

[johnpoz]

Dude.. The CLIENT firewall… Why would that be in logs on pfsense?

What OS is your client?

[jerryxLinuX]

the client firewall is also pfsense . i am trying to communicate b/w two pfsense.
or i mistook your question

[johnpoz]

So where did you state that?  What IP are you trying to ping?  An IP on the network in your site to site connection?  Or the pfsense client vpn IP, or its lan or its wan??  What?

Did you create a peer to peer or a remote access on the server pfsense?  What networks do you have at each site??

edit:  Dude while I don't normally mind PMs with questions, etc..  Post your stuff in this thread… And what networks are on each side and what is the tunnel network..  Who exactly are you trying to ping..  These are basic questions that we need to know if you want any sort of help..

[jerryxLinuX]

peer to peer ssl/tls
my server.conf

dev ovpns2
verb 1
dev-type tun
tun-ipv6
dev-node /dev/tun2
writepid /var/run/openvpn_server2.pid
#user nobody
#group nobody
script-security 3
daemon
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
proto udp
cipher AES-128-CBC
auth SHA256
up /usr/local/sbin/ovpn-linkup
down /usr/local/sbin/ovpn-linkdown
local xxxx.xxx.xxx.xxx
tls-server
server 10.0.8.0 255.255.255.0
client-config-dir /var/etc/openvpn-csc
ifconfig 10.0.8.1 10.0.8.2
tls-verify "/usr/local/sbin/ovpn_auth_verify tls 'cantonpfs' 1 "
lport 1194
management /var/etc/openvpn/server2.sock unix
push "route 192.168.114.0 255.255.255.0"
ca /var/etc/openvpn/server2.ca
cert /var/etc/openvpn/server2.cert
key /var/etc/openvpn/server2.key
dh /etc/dh-parameters.1024
tls-auth /var/etc/openvpn/server2.tls-auth 0
comp-lzo adaptive
persist-remote-ip
float
push "route 192.168.114.0 255.255.255.0"
route 192.168.140.0 255.255.255.0

client.conf

dev ovpnc1
verb 1
dev-type tun
tun-ipv6
dev-node /dev/tun1
writepid /var/run/openvpn_client1.pid
#user nobody
#group nobody
script-security 3
daemon
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
proto udp
cipher AES-128-CBC
auth SHA256
up /usr/local/sbin/ovpn-linkup
down /usr/local/sbin/ovpn-linkdown
local 10.1.10.11
tls-client
client
lport 0
management /var/etc/openvpn/client1.sock unix
remote xxx.xxxx.xxxx.xxxx 1194
ifconfig 10.0.8.2 10.0.8.1
ca /var/etc/openvpn/client1.ca
cert /var/etc/openvpn/client1.cert
key /var/etc/openvpn/client1.key
tls-auth /var/etc/openvpn/client1.tls-auth 1
comp-lzo adaptive
resolv-retry infinite

so my server ip is : 192.168.114.254
my client ip is : 192.168.140.254

i can ping from client(140.254) to server(114.254) , but not from server(114.254) to client(140.254)

any other info needed , sorry for giving less details

[johnpoz]

please just post up a gui shot of your client config and server config..  Your not editing the .conf manually are you?

What do you have in your outbound nat on the client?  On the server?  What is the routing table on pfsense of the client look like and on the server side..  On the client you should be putting in what networks are remote..

[jerryxLinuX]

herewith i have attached all the config screenshots


[johnpoz]

so your not natting anything through your vpn interfaces.. Fine since your just all local networks..  But you don't have anything in your remote or local networks  You don't normally have to push routes.. Unless your doing something specific odd..

Where are you routing tables from pfsense?

[jerryxLinuX]

Routing table means? how to get that?

[jerryxLinuX]

I think you are asking about this

[jerryxLinuX]

hey success man , i just made an entry in client specific overrides as " iroute 192.168.140.0 255.255.255.0" my client ip . it was success.
Thanks dude.
i have another question how to add multiple client in the server , do i want to continue my post in same thread or want to raise a new thread

[johnpoz]

no that is not your routing table…  under diagnostics routes, it will list out your routing table.

Why should you have to put it in overrides if you would just setup the server and client correctly in the first place?  With the local and remote network fields.

[divsys]

SSL/TLS still needs an iroute via the CSC section for each client.

Much easier in 2.2.5 than it used to be, but that iroute is often a last Gotcha in S2S links.

[jerryxLinuX]

ok then its necessary right.

[divsys]

Definitely necessary, in the current pfSense versions, you simply enter into the server screen a comma delimited list of all the subnet "LANs" on all the client OpenVPN's you want to reach.

Then in the Client Specific Overrides section you make an entry for each client and list the LAN subnets that client will use.

It seems a little convoluted for a single S2S connection, but it lets you setup a single server and easily connect many (I have a link that uses 20+) clients each with more than one subnet.

The only hitch is that the client subnets can't overlap -  takes a little planning, but welcome to networking  ;)

[jerryxLinuX]

Thank you all for helping me out . see you in next thread soon. going to configure multiple client ,if any error occurs reach you guys , please provide support….  ;D ;D 8) 8) ??? ??? ??? :P :P :P :P

[jerryxLinuX]

Dude another issue .
I cant export client .
there is no option in remote server what to do?

[divsys]

Client export is only for Remote access type OpenVPN servers ("Roadwarriors").

If you need both S2S and Remote access on the same pfSense box, I normally just create a second server instance listening on a different port and using different CA's and Server Certs.

Personally I prefer to keep them separate anyway, easier to track who's logging in remotely.