2

i'm currently building a s2s VPN using 2 pfsense appliances (2.0.2). the tunnel gets build but i'm unable to route traffic from one side to the other, check my testlab:


Okay, i build a fresh testlab to narrow the error down. Here's what i'm doing:

  • to be sure it's not a version problem, i switched to pfsense 2.0.1
  • Network A: 192.168.3.0/24
  • Network B: 192.168.2.0/24
  • "Internet simulation network": 10.10.10.0/24

PFSense Site A:

  • em0: WAN, 10.10.10.10
  • em1: LAN, 192.168.3.10

Client Site A:

  • if0: LAN, 192.168.3.100, gw: 192.168.3.10
  • Firewall disabled, pinging gw works.

PFSense Site B:

  • em0: WAN, 10.10.10.20
  • em1: LAN, 192.168.2.20

Client Site B:

  • if0: LAN, 192.168.2.100, gw: 192.168.2.20
  • Firewall disabled, pinging gw works.

PFSense Site B configuration:

  • ALL Firewall rules on EVERY SINGLE interface set to allow any
  • no GW or routes added, so only the default interface networks are known to pfsense
  • test CA created using the pfsense gui
  • server (type: server) certificate created using the pfsense gui and the created ca
  • client (type: user) certificate created using the pfsense gui
  • exported private and public key of the client cert
  • exported public key of the CA cert
  • created a new Open VPN server NOT using the wizard but clicking "add" (since i want a peer to peer OVPN which the wizard dosnt offer)
  • configured it like this: #Server Mode: Peer to Peer (SSL / TLS) #Protocol TCP #Device Mode: TUN #Interface: WAN #Port 443 #Disabled TLS Auth for testing #Using the created CA and the created server cert. # default crypto #Tunnel Network: 172.16.0.0/24

    Local Network: 192.168.2.0/24 #Remote Network: 192.168.3.0/24 #Concurrent connections: 2 #rest default / blank

  • added new interface OPT1 (ovpnc1)
  • enabled the OTP1 interface (type: none)
  • yes: FW rules on the OVPN interfaces are also set to allow ANY TO ANY
  • disabled and re-enabled the openvpn server
  • checked routes: routes to the remote network are present using the ovpnc1 NIC

PFSense Site A configuration:

  • ALL Firewall rules on EVERY SINGLE interface set to allow any
  • no GW or routes added, so only the default interface networks are known to pfsense
  • imported the CA from Site B using its public key
  • imported the Client cert vom Site B using its public and private key
  • created a new Open VPN client by clicking the "add" icon in the open vpn client section
  • configured it like this:
  • Server Mode: Peer to Peer (SSL / TLS) #Protocol TCP #Device Mode: TUN #Interface: WAN #Port 443 #Server host or address: 10.10.10.20

    Server port: 443 #Disabled TLS Auth for testing #Using the imported CA and the imported client cert. # default crypto #Tunnel

    Network: 172.16.0.0/24 #Remote Network: 192.168.2.0/24 #rest default / blank
  • added new interface OPT1 (ovpnc1)
  • enabled the OTP1 interface (type: none)
  • yes: FW rules on the OVPN interfaces are also set to allow ANY TO ANY
  • disabled and re-enabled the openvpn server
  • checked routes: routes to the remote network are present using the ovpnc1 NIC

--> VPN tunnel comes up and i see the up-state on both pfsense ends. NOTHING ELSE was configured in pfsense

Testing:

Client on site A is unable to ping client on site B and vice versa. pathping shows the route ends at the gw of the client (PFSense LAN port).

PFSense on site A is unable to ping client on site B using LAN and WAN interface, but successfull using the OTP1 interface. However, client on site B is unable to ping PFSense on site A.

This however is not true for pinging from PFSense on site B to the client on site A: ping dosn't work from any interface. Here again: pinging PFSense on site B from client on site A fails.

Also PFSense on site B is unable to ping client on site A and vice versa. Tested using the WAN, LAN and OTP1 interfaces to send the pings out.

Strange: PFsense on site A is able to ping PFSense on site B, but not vice versa!

Result:

Only the direct client, which is pfsense on site A, seems to be able to talk to ANYTHING on the remote network (pfsense or any client). clients which try to route via pfsense fail communicating, even tought they're on the same subnet as pfsense so the network should be kown to the remote site. also communication STARTING on the server site (B) seems not to reach anything on the client site (A).

This brings up two questions: - How do i tell PFsense / OpenVPN to also VPN transport traffic from any client that routes via pfsense (from the same subnet) (i guess NAT would work but is there really no other way?) - How do i allow traffic which is generated on my server site (B) to go via VPN to the client site?

Edit Nr. 2

I added this to the advanced config on the server side with no effect other then described above in the tests:

route 192.168.2.0 255.255.255.0;push "route 192.168.3.0 255.255.255.0";

also, using pfsense 2.0.1 i realized that when the vpn connection gets established i now have a gateway with the IP of the ovpn interface added to my gateways, which alowed me to add a static route to the remote network using that interface. i did this on both: site A and site B (or client and server if you like so).

Edit Nr. 3

here the screens showing the routes: Site B (server) routes: Site B (server) routes

Site A (client): Site A (client)

1 Answer 1

1

I would use static routes rather than push routes in a s2s situation. Or depending on how complex the network is use OSPF to exchange routes. But to be honest I've never tried to push routes in a s2s situation. It may work just fine for simple setups.

For setting up s2s with openvpn on pfsense you need to do 2 things once you've configured the openvpn server/client.

  1. You need to add s2s tunnel as an interface in Interfaces->Assign on each router.
  2. By default the firewall is going to block all traffic on these interfaces so you'll need to add some allow all rules to those interfaces. You can apply rules as necessary once you have things working
9
  • 1
    This seems to be true for pfsense <=2.0. In Pfsense 2.0.2 however a new tab for the openvpn connection is automatically added in the rules section (where i allready set any to any to PASS). However: the ovpn interface is NOT automaticaly added and if i do so i end up having two ovpn tabs within the rules section. another problem (since you mentioned static routes) is that if i set up the openvpn interface manually i would need a static interface ip, which i don't have. is there a way to set a static ip for the openvpn client?
    – omni
    Feb 24, 2013 at 6:34
  • I'm running this on a couple of pfSense boxes running 2.0.1. When I added the interfaces I didn't have to do any configuration on the interface itself. It just had to be present. I believe this is mostly for routing. Feb 24, 2013 at 15:19
  • but after you added the interface, you did enable it? if so, what type did you choose? none / static / DHCP ... ?
    – omni
    Feb 24, 2013 at 15:46
  • 1
    Yes they are enabled with a type of none. Feb 24, 2013 at 15:53
  • i created a testlab and revisited the problems. seems like i'm still missing some parameters which i have to tell openvpn. check my edited post.
    – omni
    Feb 24, 2013 at 17:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .