Hello,
I am using pfSense firewall OpenVPN in main office and branch office working fine. The scenario is:
-Main office: LAN 192.168.0.0/24. Server mode Peer to peer (Shared Key). Tun mode UDP. Default port 1194. Encryption AES-128-CBC. SHA1.
-Branch office: LAN 192.168.1.0/24. Same security configuration to match main office.
I have configured IPV4 Tunnel Network 192.168.168.0/24.
Well, now the pfsense of the branch office will disappear and I will provide a raspberry pi with raspbian. I have installed and configured openvpn. The vpn.conf file is:
dev tun
remote mainoffice.dyndns.org
ifconfig 192.168.1.12 192.168.0.67
secret static.key
cipher AES-128-CBC
verb 8
I have stored the shared key from main office in the static.key file.
In the raspbian system, I have used:
net.ipv4.ip_forward = 1
sysctl -p /etc/sysctl.conf
sudo iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE
sudo apt-get install iptables-persistent
sudo /etc/init.d/iptables-persistent save
sudo /etc/init.d/iptables-persistent reload
Well, in pfsense, I can see VPN up but, there is no traffic and in raspbian, it seems that the connection is not working at all. This is what I can see using "sudo openvpn --config vpn.conf":
Fri Dec 18 09:38:23 2015 us=537636 Current Parameter Settings:
Fri Dec 18 09:38:23 2015 us=542748 config = 'vpn.conf'
Fri Dec 18 09:38:23 2015 us=549778 mode = 0
Fri Dec 18 09:38:23 2015 us=550964 persist_config = DISABLED
Fri Dec 18 09:38:23 2015 us=552087 persist_mode = 1
Fri Dec 18 09:38:23 2015 us=554220 show_ciphers = DISABLED
Fri Dec 18 09:38:23 2015 us=555402 show_digests = DISABLED
Fri Dec 18 09:38:23 2015 us=558036 show_engines = DISABLED
Fri Dec 18 09:38:23 2015 us=559657 genkey = DISABLED
Fri Dec 18 09:38:23 2015 us=560858 key_pass_file = '[UNDEF]'
Fri Dec 18 09:38:23 2015 us=561856 show_tls_ciphers = DISABLED
Fri Dec 18 09:38:23 2015 us=564618 Connection profiles [default]:
Fri Dec 18 09:38:23 2015 us=570614 proto = udp
Fri Dec 18 09:38:23 2015 us=570967 local = '[UNDEF]'
Fri Dec 18 09:38:23 2015 us=571204 local_port = 1194
Fri Dec 18 09:38:23 2015 us=571424 remote = 'mainoffice.dyndns.org'
Fri Dec 18 09:38:23 2015 us=572761 remote_port = 1194
Fri Dec 18 09:38:23 2015 us=573093 remote_float = DISABLED
Fri Dec 18 09:38:23 2015 us=574788 bind_defined = DISABLED
Fri Dec 18 09:38:23 2015 us=575122 bind_local = ENABLED
Fri Dec 18 09:38:23 2015 us=576583 connect_retry_seconds = 5
Fri Dec 18 09:38:23 2015 us=576919 connect_timeout = 10
Fri Dec 18 09:38:23 2015 us=577835 connect_retry_max = 0
[...]
Fri Dec 18 09:38:23 2015 us=865374 pkcs11_id_management = DISABLED
Fri Dec 18 09:38:23 2015 us=867278 server_network = 0.0.0.0
Fri Dec 18 09:38:23 2015 us=867655 server_netmask = 0.0.0.0
Fri Dec 18 09:38:23 2015 us=868718 server_network_ipv6 = ::
Fri Dec 18 09:38:23 2015 us=871643 server_netbits_ipv6 = 0
Fri Dec 18 09:38:23 2015 us=872958 server_bridge_ip = 0.0.0.0
Fri Dec 18 09:38:23 2015 us=873307 server_bridge_netmask = 0.0.0.0
Fri Dec 18 09:38:23 2015 us=876570 server_bridge_pool_start = 0.0.0.0
Fri Dec 18 09:38:23 2015 us=878088 server_bridge_pool_end = 0.0.0.0
Fri Dec 18 09:38:23 2015 us=878387 ifconfig_pool_defined = DISABLED
Fri Dec 18 09:38:23 2015 us=878743 ifconfig_pool_start = 0.0.0.0
Fri Dec 18 09:38:23 2015 us=880921 ifconfig_pool_end = 0.0.0.0
Fri Dec 18 09:38:23 2015 us=882169 ifconfig_pool_netmask = 0.0.0.0
Fri Dec 18 09:38:23 2015 us=883981 ifconfig_pool_persist_filename = '[UNDEF]'
Fri Dec 18 09:38:23 2015 us=884336 ifconfig_pool_persist_refresh_freq = 600
Fri Dec 18 09:38:23 2015 us=884577 ifconfig_ipv6_pool_defined = DISABLED
Fri Dec 18 09:38:23 2015 us=884825 ifconfig_ipv6_pool_base = ::
Fri Dec 18 09:38:23 2015 us=891882 ifconfig_ipv6_pool_netbits = 0
Fri Dec 18 09:38:23 2015 us=893312 n_bcast_buf = 256
Fri Dec 18 09:38:23 2015 us=893588 tcp_queue_limit = 64
Fri Dec 18 09:38:23 2015 us=893822 real_hash_size = 256
Fri Dec 18 09:38:23 2015 us=894811 virtual_hash_size = 256
Fri Dec 18 09:38:23 2015 us=895603 client_connect_script = '[UNDEF]'
Fri Dec 18 09:38:23 2015 us=898580 learn_address_script = '[UNDEF]'
Fri Dec 18 09:38:23 2015 us=898985 client_disconnect_script = '[UNDEF]'
Fri Dec 18 09:38:23 2015 us=899226 client_config_dir = '[UNDEF]'
Fri Dec 18 09:38:23 2015 us=899588 ccd_exclusive = DISABLED
Fri Dec 18 09:38:23 2015 us=902465 tmp_dir = '/tmp'
Fri Dec 18 09:38:23 2015 us=902823 push_ifconfig_defined = DISABLED
Fri Dec 18 09:38:23 2015 us=903089 push_ifconfig_local = 0.0.0.0
Fri Dec 18 09:38:23 2015 us=904535 push_ifconfig_remote_netmask = 0.0.0.0
Fri Dec 18 09:38:23 2015 us=904880 push_ifconfig_ipv6_defined = DISABLED
Fri Dec 18 09:38:23 2015 us=905245 push_ifconfig_ipv6_local = ::/0
Fri Dec 18 09:38:23 2015 us=907550 push_ifconfig_ipv6_remote = ::
Fri Dec 18 09:38:23 2015 us=910700 enable_c2c = DISABLED
Fri Dec 18 09:38:23 2015 us=911006 duplicate_cn = DISABLED
Fri Dec 18 09:38:23 2015 us=911237 cf_max = 0
Fri Dec 18 09:38:23 2015 us=929025 cf_per = 0
Fri Dec 18 09:38:23 2015 us=930921 max_clients = 1024
Fri Dec 18 09:38:23 2015 us=931269 max_routes_per_client = 256
Fri Dec 18 09:38:23 2015 us=931511 auth_user_pass_verify_script = '[UNDEF]'
Fri Dec 18 09:38:23 2015 us=931743 auth_user_pass_verify_script_via_file = DISABLED
Fri Dec 18 09:38:23 2015 us=931979 ssl_flags = 0
Fri Dec 18 09:38:23 2015 us=932953 port_share_host = '[UNDEF]'
Fri Dec 18 09:38:23 2015 us=935658 port_share_port = 0
Fri Dec 18 09:38:23 2015 us=936004 client = DISABLED
Fri Dec 18 09:38:23 2015 us=936407 pull = DISABLED
Fri Dec 18 09:38:23 2015 us=937445 auth_user_pass_file = '[UNDEF]'
Fri Dec 18 09:38:23 2015 us=939406 OpenVPN 2.2.1 arm-linux-gnueabihf [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] [MH] [PF_INET6] [IPv6 payload 20110424-2 (2.2RC2)] built on Dec 1 2014
Fri Dec 18 09:38:23 2015 us=944178 IMPORTANT: OpenVPN's default port number is now 1194, based on an official port number assignment by IANA. OpenVPN 2.0-beta16 and earlier used 5000 as the default port.
Fri Dec 18 09:38:23 2015 us=947457 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Fri Dec 18 09:38:23 2015 us=949630 PO_INIT maxevents=4 flags=0x00000002
Fri Dec 18 09:38:23 2015 us=956459 PID packet_id_init seq_backtrack=64 time_backtrack=15
Fri Dec 18 09:38:23 2015 us=962012 WARNING: file 'static.key' is group or others accessible
Fri Dec 18 09:38:23 2015 us=963717 CRYPTO INFO: n_DES_cblocks=0
Fri Dec 18 09:38:23 2015 us=964644 CRYPTO INFO: n_DES_cblocks=0
Fri Dec 18 09:38:23 2015 us=966041 CRYPTO INFO: n_DES_cblocks=0
Fri Dec 18 09:38:23 2015 us=967731 CRYPTO INFO: n_DES_cblocks=0
Fri Dec 18 09:38:23 2015 us=970743 Static Encrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Fri Dec 18 09:38:23 2015 us=971171 Static Encrypt: CIPHER KEY: 021b599f 06446f72 abe331cd 3a8e13ee
Fri Dec 18 09:38:23 2015 us=973903 Static Encrypt: CIPHER block_size=16 iv_size=16
Fri Dec 18 09:38:23 2015 us=980721 Static Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Dec 18 09:38:23 2015 us=981953 Static Encrypt: HMAC KEY: 11b442c7 16a7f5d8 03c5f508 93d1641e 90bb31de
Fri Dec 18 09:38:23 2015 us=984715 Static Encrypt: HMAC size=20 block_size=64
Fri Dec 18 09:38:23 2015 us=986045 Static Decrypt: Cipher 'AES-128-CBC' initialized with 128 bit key
Fri Dec 18 09:38:23 2015 us=986433 Static Decrypt: CIPHER KEY: 021b599f 06446f72 abe331cd 3a8e13ee
Fri Dec 18 09:38:23 2015 us=987472 Static Decrypt: CIPHER block_size=16 iv_size=16
Fri Dec 18 09:38:23 2015 us=994974 Static Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Dec 18 09:38:23 2015 us=996856 Static Decrypt: HMAC KEY: 11b442c7 16a7f5d8 03c5f508 93d1641e 90bb31de
Fri Dec 18 09:38:24 2015 us=3185 Static Decrypt: HMAC size=20 block_size=64
Fri Dec 18 09:38:24 2015 us=6017 MTU DYNAMIC mtu=1450, flags=2, 1560 -> 1450
Fri Dec 18 09:38:24 2015 us=7529 Socket Buffers: R=[163840->131072] S=[163840->131072]
Fri Dec 18 09:38:24 2015 us=73511 RESOLVE_REMOTE flags=0x0101 phase=1 rrs=0 sig=-1 status=1
Fri Dec 18 09:38:24 2015 us=74492 GDG: route[1] 0.0.0.0/0.0.0.0/192.168.1.1 m=0
Fri Dec 18 09:38:24 2015 us=74763 GDG: route[2] 192.168.0.0/255.255.255.0/192.168.1.67 m=0
Fri Dec 18 09:38:24 2015 us=75064 GDG: route[3] 192.168.1.0/255.255.255.0/0.0.0.0 m=0
Fri Dec 18 09:38:24 2015 us=75279 GDG: route[4] 192.168.74.0/255.255.255.0/192.168.1.67 m=0
Fri Dec 18 09:38:24 2015 us=75489 GDG: route[5] 192.168.112.0/255.255.255.0/192.168.1.67 m=0
Fri Dec 18 09:38:24 2015 us=75844 GDG: best=192.168.1.1[1] lm=0
Fri Dec 18 09:38:24 2015 us=76058 WARNING: potential TUN/TAP adapter subnet conflict between local LAN [192.168.1.0/255.255.255.0] and remote VPN [192.168.1.12/255.255.255.255]
Fri Dec 18 09:38:24 2015 us=91322 TUN/TAP device tun0 opened
Fri Dec 18 09:38:24 2015 us=98371 TUN/TAP TX queue length set to 100
Fri Dec 18 09:38:24 2015 us=104282 do_ifconfig, tt->ipv6=0, tt->did_ifconfig_ipv6_setup=0
Fri Dec 18 09:38:24 2015 us=108057 /sbin/ifconfig tun0 192.168.1.12 pointopoint 192.168.0.67 mtu 1500
Fri Dec 18 09:38:24 2015 us=208517 Data Channel MTU parms [ L:1560 D:1450 EF:60 EB:4 ET:0 EL:0 ]
Fri Dec 18 09:38:24 2015 us=210440 Local Options String: 'V4,dev-type tun,link-mtu 1560,tun-mtu 1500,proto UDPv4,ifconfig 192.168.0.67 192.168.1.12,cipher AES-128-CBC,auth SHA1,keysize 128,secret'
Fri Dec 18 09:38:24 2015 us=214966 Expected Remote Options String: 'V4,dev-type tun,link-mtu 1560,tun-mtu 1500,proto UDPv4,ifconfig 192.168.1.12 192.168.0.67,cipher AES-128-CBC,auth SHA1,keysize 128,secret'
Fri Dec 18 09:38:24 2015 us=216493 Local Options hash (VER=V4): '86afb64e'
Fri Dec 18 09:38:24 2015 us=225036 Expected Remote Options hash (VER=V4): '0eb87086'
Fri Dec 18 09:38:24 2015 us=226503 UDPv4 link local (bound): [undef]
Fri Dec 18 09:38:24 2015 us=227658 UDPv4 link remote: [AF_INET]81.61.161.39:1194
Fri Dec 18 09:38:24 2015 us=233040 TIMER: coarse timer wakeup 1 seconds
Fri Dec 18 09:38:24 2015 us=238479 RANDOM USEC=239582
Fri Dec 18 09:38:24 2015 us=249211 PO_CTL rwflags=0x0001 ev=3 arg=0x7f5fd0c4
Fri Dec 18 09:38:24 2015 us=259761 PO_CTL rwflags=0x0001 ev=4 arg=0x7f5fd04c
Fri Dec 18 09:38:24 2015 us=261003 I/O WAIT TR|Tw|SR|Sw [1/239582]
Fri Dec 18 09:38:25 2015 us=504989 I/O WAIT status=0x0020
Fri Dec 18 09:38:25 2015 us=506399 TIMER: coarse timer wakeup 1 seconds
Fri Dec 18 09:38:25 2015 us=507506 PO_CTL rwflags=0x0001 ev=3 arg=0x7f5fd0c4
Fri Dec 18 09:38:25 2015 us=508582 PO_CTL rwflags=0x0001 ev=4 arg=0x7f5fd04c
Fri Dec 18 09:38:25 2015 us=509692 I/O WAIT TR|Tw|SR|Sw [1/239582]
^CFri Dec 18 09:38:25 2015 us=905701 event_wait : Interrupted system call (code=4)
Fri Dec 18 09:38:25 2015 us=905975 I/O WAIT status=0x0010
Fri Dec 18 09:38:25 2015 us=906205 TCP/UDP: Closing socket
Fri Dec 18 09:38:25 2015 us=906446 Closing TUN/TAP interface
Fri Dec 18 09:38:25 2015 us=906648 /sbin/ifconfig tun0 0.0.0.0
Fri Dec 18 09:38:26 2015 us=80403 PID packet_id_free
Fri Dec 18 09:38:26 2015 us=80800 SIGINT[hard,] received, process exiting
Fri Dec 18 09:38:26 2015 us=84253 PKCS#11: Removing providers
Fri Dec 18 09:38:26 2015 us=84504 PKCS#11: Releasing sessions
Fri Dec 18 09:38:26 2015 us=84646 PKCS#11: Terminating slotevent
Fri Dec 18 09:38:26 2015 us=84790 PKCS#11: Marking as uninitialized
The 192.168.0.67 is LAN interface of OpenVPN main office. 192.168.1.12 is RaspberryPi
Is there any missing configuration in my vpn.conf file?
Thank you so much
