Short: float
Long with explanation where, why and how:
I have had this problem when I simulated second firewall-router-ed LAN inside our physical LAN on VirtualBOX platform to simulate virtual LAN behind virtual ROUTER - because I wanted to test traffic shaping on Mikrotik CHR and/or OPNsense - compare options, funcionality and so one...
And the OPNsense's OpenVPN is the reason why I write this here, because at home the virtual enviroment works perfect, but at work it does allways make some strange errors :-) But I love it to solve them...
It does not matter what config I have had, allways I ended at this stupid message. But the solution was simple - like it is wroted in the message self - but it lacks information where to write or remove something... as seen here:
https://serverfault.com/questions/318371/openvpn-connection-from-within-2nd-subnet-in-office - scroll till END of thread.
Also I used the option "float" - I wrote it at the end of client config file "OPNsense-udp-1195-vpnuser01
.ovpn" and it looks now:
dev tun
persist-tun
persist-key
cipher AES-256-CBC
auth SHA256
tls-client
client
resolv-retry infinite
remote 192.168.2.15 1195 udp
lport 0
verify-x509-name "VPN Server Cert" name
auth-user-pass
pkcs12 OPNsense-udp-1195-vpnuser01.p12
tls-auth OPNsense-udp-1195-vpnuser01-tls.key 1
remote-cert-tls server
comp-lzo no
float
Because we have already one VPN Server here, therefore the port change to 1195.
If there is no "float" option, it makes this error:
Fri Feb 16 08:38:35 2018 TCP/UDP: Incoming packet rejected from [AF_INET]192.168.2.254:1195[2], expected peer address: [AF_INET]192.168.2.15:1195 (allow this incoming source address/port by
removing --remote or
adding --float)
- the 192.168.2.254 is LAN card of our physical firewall
Have a nice day... 🙂
p.s. first time I added "--float" - it also works... now it is only "float"
