Odd issue with setup
-
I'm not sure where to put this, but I think this is the correct forum.
I use my work laptop here at the house and VPN into my office. This is all working, and the only firewall rules specific to the laptop is to set all traffic to/from the laptop's IP into the high QOS queue so that my VOIP phone works better.
The VPN software on my laptop (Junos if that matters) is configured to allow me to print to a local network printer as long as the printer has a specific IP address. IT at work tells me that they just allow that one IP address outside the VPN connection.
This worked for me and I could print to my local printer before moving to Pfsense. However, now I cannot see the printer at the appropriate IP address. If I pause or disconnect the VPN connection, the printer is seen and works without issue.
IT cannot reproduce the issue, so I got to thinking that maybe something in pfsense is blocking it?
Any ideas on where I can start looking to figure out what is wrong?
thanks
david -
Your description is a little confusing. Where is pfSense in this mix, your home or your office? When a VPN is configured, you tell it whether or not to make all traffic go through the tunnel, and which networks are local. Looks like your VPN connection isn't allowing you to talk to your local networks, so your local printer is inaccessible.
-
pfsense is at home.
How you describe handling the one IP address matches what I was told by IT, but when I keep getting told by IT that "it works for me" I started wondering if something could be screwed up on my end. Printing to my local printer, while connected to the office with VPN use to work for me, but at what time after changing my router over to psfsense did it stop working? I don't know.
Just checking here to see if I was missing something.
thanks,
david@KOM:
Your description is a little confusing. Where is pfSense in this mix, your home or your office? When a VPN is configured, you tell it whether or not to make all traffic go through the tunnel, and which networks are local. Looks like your VPN connection isn't allowing you to talk to your local networks, so your local printer is inaccessible.
-
If your printer is on the same LAN as your PC then pfSense has nothing to do with it. Like I said earlier, it appears that your VPN client is forcing all traffic through the tunnel. Check your VPN client settings to see if there is anything there you can twiddle but it may be a server setting that you can't change. I have a dedicated system so that I can connect to our customers (mainly hospitals and other medical facilities) using a dog's breakfast of VPN clients (Cisco, Juniper, etc). The vast majority are configured to not allow local access when the tunnel is up, so I have to use hacks like FTPing files to/from the remote end to my local FTP site just to exchange files since my local network access is cut off when the tunnel is up.
-
Ok I looked at the routing tables when I have VPN on and see something odd:
IPv4 Route Table
Active Routes:
Network Destination Netmask Gateway Interface Metric192.168.1.204 255.255.255.255 192.168.1.1 192.168.1.56 10
204 is the printer, 56 is my laptop.
Why is that going to the Gateway (router) and not directly to the printer. When i look at my routing tables with VPN suspended there is no route for that. Is this a NAT thing that the router doesn't know to send it back onto the LAN? If I do a traceroute it goes out the router and gets lost in the internet.
david
-
Why is that going to the Gateway (router) and not directly to the printer.
Because your VPN connection is most likely configured to send everything through the tunnel. Your local network doesn't exist when your VPN is connected. This can be changed but you have to look at your VPN software and potentially the server end if you've been given a prepackaged client like with pfSense's OpenVPN.
-
No the VPN software is told to route that one IP outside the tunnel. that is why I'm trying to figure out why it isn't working.
I do see that the software creates that route in the routing table, and removes it when VPN is suspended.
david
@KOM:
Why is that going to the Gateway (router) and not directly to the printer.
Because your VPN connection is most likely configured to send everything through the tunnel. Your local network doesn't exist when your VPN is connected. This can be changed but you have to look at your VPN software and potentially the server end if you've been given a prepackaged client like with pfSense's OpenVPN.
-
You wouldn't happen to be using the same subnet for your LAN as well as VPN network?
-
What do I need to look for to determine this?
My laptop IP is: ..1.56
My laptop VPN IP is: ..74.4 (internal corporate IP)Printer is: *.*1.204
so I think the answer is no, they are not on the same subnet.
david
-
how can you tell what subnet those are on - you left off the 2 first couple of octets and the mask… All of those could be on the same network if your mask was say /16 or /17 even that would include x.x.0-127
So your vpn IP is on a tap vs tun connection.. Why would that vpn connection not just be a tunnel network?
If your remote network is say 192.168.1.0/24 and your network behind vpn is also 192.168.1.0/24 your not going to be able to get to stuff because your remote client thinks anything on 192.168.1.0/24 is just local and no reason to go down the vpn tunnel.
-
Ok wondered if those first two numbers mattered :)
Local is 192.168.1.
Remote: 70.12.67.4 seems this number changes during the day, unless I typed the wrong the first time, but he first two numbers stay the same.david
-
If you are on 192.168.1.56 and your printer is on 192.168.1.204 and the netmask is a /24 (255.255.255.0) then pfSense is not involved at all. It is same-subnet traffic and doesn't rely on a router.
-
Exactly what I thought, and yes my net mask is 255:255:255:0
the odd this is that I see the VPN software create a route:
192.168.1.204 255.255.255.255 192.168.1.1 192.168.1.56 10
Not sure why this is necessary, and if it is causing the issue. I wonder if I could remove that route . . .
Additionally both the laptop and the printer are on the same physical switch.
EDIT: I removed the route and it didn't address the issue. What happened instead, is that tracert went into the corporate network and got lost looking for the printer, instead of going out my WAN and getting lost in my ISP network.
david
If you are on 192.168.1.56 and your printer is on 192.168.1.204 and the netmask is a /24 (255.255.255.0) then pfSense is not involved at all. It is same-subnet traffic and doesn't rely on a router.
-
Ok as I suspected IT is saying get a different router :(
They route 192.168.1.204 in the VPN tunnel to the default gateway expecting the router to route it back into the internal network, but what I see is that it gets sent out the WAN interface.
Is there a way I could put an explicit directive in the router to route this IP back into my network and not out the WAN? Why would this be different for pfsense but not all the consumer routers available?
I won't get a new router, if I have to live with it I'll just use suspend/resume, but would really like to get it to work.
thanks,
david -
OK I got it to work!!!!
Now maybe someone can tell me why I had to do this change to my firewall rules?
I added a new rule for destination 192.168.1.204, from any source to the default gateway. You can see it at the top of the rules attached.
One thing to not in the rules, is that the laptop in questions is 192.168.1.56, and there are rules for it. Could this be causing the 192.168.1.204 traffic to be caught up and sent out the WAN?
Why was this necessary?
thanks,
david
