Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've a strange behavior of the pfSense system when establishing a multiple site-to-site connection. All sites use the same version of pfSense (2.1). I've three sites which are all in different subnets.

Sites and subnets:

  • Site A: 10.1.0.0/16
  • Site B: 192.168.0.0/16
  • Site C: 10.3.0.0/16

Linking sites:

  • Site A (Server) < 10.10.10.0/24 > Site B (Client)
  • Site A (Server) < 10.10.11.0/24 > Site C (Client)
  • Site B (Server) < 10.10.12.0/24 > Site C (Client)

All sites need to be connected directly. I've managed to set this up without a problem. All sites were connected and I was reaching the different networks from each site. However, the connections are unstable.

When I remove all configurations for site C the connection between A and B works perfectly. As soon as I enable the connection with site C, A-B will be unstable (PING works randomly).

Is there a limit of setting up active site-to-site connections with OpenVPN in pfSense? Any suggestions for other configurations?

Thanks, Sead

share|improve this question

2 Answers 2

What you're describing is fine, and widely done. Your description makes it sound like it's all correct. My first guess is you have the routes wrong on one or more of the connections for site C, like trying to route the same network across two different OpenVPN instances.

share|improve this answer
    
I will check that again. Thanks Chris. –  skolic Sep 27 '13 at 18:40

I removed one OpenVPN connection and used IPSec instead. Site C has a low-speed internet connection, so this was not an issue for me. I've been testing the same setup between all three sites with IPSec and it worked without issues. There were no errors with routing. The connection remained stable. The only problem with IPSec is that the link between the sites was slower for about 80% than usual. Finally, i've set the links between the sites as following...

Tunnels:

  • SITE A (OpenVPN Server UDP 14447) <- 10.10.10.0/16 -> SITE B (OpenVPN Client)
  • SITE A (OpenVPN Server UDP 14448) <- 10.10.11.0/16 -> SITE C (OpenVPN Client)
  • SITE B (IPSec) --- WAN (B) --- INTERNET --- WAN (C) ---- SITE C (IPSec)

Internet connection speed:

  • SITE A connection: 1Gbps UP/DOWN
  • SITE B connection: 100Mbps UP/DOWN
  • SITE C connection: ADSL 20Mbps DOWN / 5Mbps UP

Speed testing

  • SITE A - SITE B OpenVPN download test: ~10MB/s
  • SITE A - SITE B IPSec download test: ~2MB/s

Now all sites are directly connected with each other. I will try to setup everything with OpenVPN, using a second WAN IP on site B for the tunnel. I will then create a OpenVPN Server on site B and connect C as client to B on that interface. Maybe this will resolve my issues with a full OpenVPN solution.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.