Hello all,
I'm a network administrator for a small business. I use the term "network administrator" very loosely, because I've never received proper training or education, but I like to pretend that I can hold my own. I actually have a degree in electrical engineering and am more of a hardware person... so just keep that in mind.
Those writing the checks have decided that we need to migrate our L2TP/IPSec VPN server over to OpenVPN server (much to my delight, as I run an OpenVPN server running on FreeBSD at home). The VPN server runs a site-to-site tunnel and allows us to manage clients machines remotely (typically hotel/corporate networks).
Basic stick diagram as follows:
(InternalNetwork) <--> {VPN Server "Bunker"} <--> (Public internet) <--> {Foreign Gateway/Firewall/Router} <--> {VPN Client "Remote"} <--> (RemoteNetwork)
Our VPN servers are both PFSense servers.
Subnet information
- Internal Network: 192.168.1.0/24
Remote Network: 192.168.2.0/24
Tunnel Network: 192.168.254.0/24
Network inside foreign gateway: 10.0.0.0/24
IP Information
- WAN IP of “Bunker”: xxx.xxx.xxx.xxx/0
LAN IP of “Bunker”: 192.168.1.1/24
WAN IP of “Remote”: 10.0.0.254/24; upstream gateway: 10.0.0.11/24
LAN IP of “Remote”: 192.168.2.1/24
Normally I’d just post the config files, but I’m not sure how to extract the config files out of the pfsense web interface (anyone know how?)… so I’ll summarize them:
Server “Bunker” Config
- Type: Peer-to-peer via UDP
IPv4 Tunnel: 192.168.254.0/24
IPv4 Local Networks: 192.168.1.0/24
IPv4 Remote Network: 192.168.2.0/24
Client Specific Overrides
- IPv4 Remote Network: 192.168.2.0/24 (it is my understanding this is PFSense’s version of iroute)
The “remote” PFsense box successfully connects to the “bunker” PFsense box just fine. And the clients behind the remote network can can connect to the clients behind the bunker network. But clients behind the bunker network are completely unaware of the remote network. To me, this means my iroute entry is incorrect... but I've double-checked and triple-checked that it is indeed there.
I assume this means there is a routing issue somewhere between the foreign gateway and the remote… but I’m not exactly sure, or how to fix it.
-----
Somewhat of a side note, but if anyone knows how to access the PFsense OpenVPN configs and logs that would be extremely helpful. I'm relatively new to PFsense and am more used to the command-line approach I take on my FreeBSD machine.
