Hello all! First I would like to apologize for any misspelling, English is not my native language. I have worked with setting up a OpenVPN tunnel to a remote location for a couple of days now and now I am beginning to loose my mind over this, what seems to be a routing issue but I have no idea of where to start. The tunnel itself is created just fine, all certificates works and is up and running. I drawed a small picture to describe the scene: [url=http://postimage.org/image/t2lyg09wx/][img]http://s16.postimage.org/t2lyg09wx/VPN.jpg[/img][/url] The only way I get it to "somewhat work" is when i enable the "Create NAT over Tunnel" on the Tomato Client. Then everything on the Client side can contact the server side. But as the NAT being performed everything comes to the server side translated to a address of the VPN Tunnel (10.200.0.0/16) Refering to the picture, I would like "Craig" to be able to contact "Janet" using her IP-Address 192.168.30.2. And the other way around, "Janet" to contact "Craig" using his IP-Address 10.30.1.1. Could someone please help me ? Best Regards /Tobias

Pfsense and Tomato OpenVPN Routing

cryptomaster

Hello all!

First I would like to apologize for any misspelling, English is not my native language.

I have worked with setting up a OpenVPN tunnel to a remote location for a couple of days now and now I am beginning to loose my mind over this, what seems to be a routing issue but I have no idea of where to start.

The tunnel itself is created just fine, all certificates works and is up and running.

I drawed a small picture to describe the scene:

The only way I get it to "somewhat work" is when i enable the "Create NAT over Tunnel" on the Tomato Client.
Then everything on the Client side can contact the server side.
But as the NAT being performed everything comes to the server side translated to a address of the VPN Tunnel (10.200.0.0/16)

Refering to the picture, I would like "Craig" to be able to contact "Janet" using her IP-Address 192.168.30.2.
And the other way around, "Janet" to contact "Craig" using his IP-Address 10.30.1.1.

Could someone please help me ?

Best Regards
/Tobias

cryptomaster

Hello Everyone !
I solved this during the weekend 😃

I will post my steps here for future reference.

OpenVPN with PfSense 2.0.2 Server and Tomato 1.28 Client

This guide will show the steps of connecting 2 different subnets with a OpenVPN connection securely over WAN.

As server:
PfSense 2.0.2

As client:
Netgear WNR3500LV2
Flashed with Tomato 1.28 Shibby's Firmware

My Goal is to make remote subnet 192.168.30.0/24 talk to local subnet 10.30.0.0/16 and the other way around, still make the traffic to internet go the normal way.

What we will need to know for configuring:
Remote Network,
-the site we want to connect to. Eg; 192.168.30.0/24

Local Network, -in my case, the network where I run PfSense and I want the Remote Network to connect to. Eg; 10.0.0.0/8

We begin with making sure that the OpenVPN Client Export utility package is installed in PfSense.
It's under "System -> Packages", find the package in the list and install it.

Now we will need to create certificates for the encryption.
For this we will need:
Certificate Authority
Certificate for Server
Certificate for User

We go to "System -> Cert Manager".
Under the tab "CA's", klick the + sign to create a new Certificate Authority.
Fill in a desctriptive name of your liking so you can recognize this later on.

Method: "Create an internal Certificate Authority"
Key length: 2048 bits
Lifetime: 3650 days
Common name: Something you recognize.
The rest of the fields according to your localization.
And Save

Now change tab to "Certificates"
Change the method to "Create an internal Certificate"
Certificate Authority: Choose the CA you created recently
Key length: 2048 bits
Certificate Type: Server Certificate
Common Name: Something you recognize.
The rest of the localization settings same as before.

Do the same thing again but now choose "User Certificate" as Certificate Type.
Now you should have 2 certificates in the list.
1 User certificate
1 Server certificate

Now we should create a user for authorization.
Go up to "System -> User manager" and the + sign to add a new user.
Fill in a Username and a Password but remember it.
And Save.
Now choose to edit the user you just created, and now you have the option to add a certificate to that user, choose the User certificate you created earlier.

Now we shall create the VPN Server.
Choose menu "VPN -> OpenVPN". And choose "Wizards".
Type of Server: Local User Access
Certificate Authority: -The one you created earlier.
Certificate: -The Server certificate created before.

The server settings in text:

Interface: WAN
Protocol: UDP
LocalPort: 1194
Description: -Your choice
TLS Authentication: Uncheck
Generate TLS Key: Uncheck
TLS-Shared key: Blank
DH Parameters length: 1024bit
Encryption Algorithm: AES-128-CBC (128-bit)
Hardware Crypto: No Hardware Crypto Acceleration
Tunnel Network: 10.200.0.0/16
Redirect Gateway: Unchecked
Local Network: Blank
Concurrent Connections: 5
Compression: Unchecked
Type-Of-Service: Unchecked
Inter-Client Communication: Checked
Duplicate Connections: Unchecked
Dynamic IP: Checked
Address Pool: Checked
DNS Default Domain. Blank
DNS Server 1: Blank
DNS Server 2: Blank
DNS Server 3: Blank
DNS Server 4: Blank
NTP Server: Blank
NTP Server 2: Blank
NetBios Options: Unchecked
NetBios Node type: None
NetBios Scope ID: Blank
WINS Server 1: Blank
WINS Server 2: Blank

Advanced: route 192.168.30.0 255.255.255.0;
push “route 10.0.0.0 255.0.0.0”;

This first line adds a route in the gateway for the remote clients.
And the second line pushes a route for the local network to the remote clients.

And Next.

Now we choose that the wizard creates the appropriate rules in the firewall for us.
And Next.

Now we need to create a client override.
Under the Tab "Client Specific Override".
Press the + sign to add a new override.

Client Override Settings:
Everything blank and unchecked, except:

Common Name: The name you choose before for the client
Advanced: iroute 192.168.30.0 255.255.255.0

This last line tells the OpenVPN client what network it should route to from the tunnel. That's the remote subnet.
Save.

Now we should export the settings and necessary keys.
Under “OpenVPN” menu. Choose the tab “Client Export”.

Remote Access Server: The server you've created before.
Host name resolution: In our case this is the dyndns to the server
Everything else: Blank

A bit further down we will see the name of our user we created before.
To the right of that user, Inline configurations, choose “Others” and save the .ovpn file on a drive.

Go up to “Status” and “Services” and make sure the openvpn is Running.
Now we are finished with the server part.

OpenVPN Client on Tomato 1.28
Choose menu "VPN Tunneling -> OpenVPN Client"

Settings in the "Basic" Tab:

Start with WAN: Checked
Interface Type: TUN
Protocol: UDP
Server Address/Port: the address to vpn server / 1194
Firewall: Automatic
Authorization Mode: TLS
Username/Password, auth: Checked
Username: The username you created on the server
Password: The password you created for the user
Username Authen. Only: Unchecked
Extra HMAC, tls-auth: Disabled
Create NAT on Tunnel: Unchecked

Save

Advanced tab:
Poll interval: 0
Redirect Internet traffic: Unchecked
Accept DNS Configuration: Disabled
Encryption cipher: AES-128-CBC
Compression: Disabled
TLS-Renegotiation Time: -1
Connection Retry: 30
Verify server certificate (tls-remote): The common name

Keys tab:
Now you should open the .ovpn file in a text editor.

The first big hash you see and enclosed with the <ca> goes in the first window. Second in second window. Third in third window.
Copy and paste everything from
---BEGIN..
to
----END..

Now Save and press “Start now”
If everything went smooth the tunnel is now up and running.
I've confirmed this with traceroute.
Traffic to google.com goes through local gateway and remote network traffic goes through VPN.

Have tested this with an infinite ping command over the weekend and the connection is rock solid ! No package loss and overall really low latency.