Hello!
I am in the process of setting up a site-to-site VPN link using OpenVPN.
Primary site:
* 192.168.20.0/24
* OpenVPN server is 192.168.20.101
* Site does not run pfSense, OpenVPN runs on it's own server
Secondary site:
* 192.168.21.0/24
* OpenVPN client runs as part of pfSense
I have most of it working, the secondary clients can ping the servers at the primary site by DNS or IP address, but the primary site can't ping the secondary site's servers, either from the primary clients or from the OpenVPN server itself.
I suspect it's a routing issue, since at the secondary site pfSense is taking care of everything but at the primary site the router and VPN are different machines.
I tried to create a static route on the Primary OpenVPN server but haven't had much luck. From this box, I can ping the pfSense/VPN box at the secondary site (10.8.0.2) but it doesn't seem to be routing any 192.168.21.0 traffic over the tunnel.
The routing table looks like this:
root@xxx-vpn01:/etc/openvpn# route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
default 192.168.20.1 0.0.0.0 UG 0 0 0 eth0
10.8.0.0 * 255.255.255.0 U 0 0 0 tun0
192.168.20.0 * 255.255.255.0 U 0 0 0 eth0
I've tried playing with the routing by running a combination of these:
route add -net 192.168.21.0 netmask 255.255.255.0 gw 10.8.0.2 dev tun0
route add -net 192.168.21.0 netmask 255.255.255.0 gw 10.8.0.2
route add -net 192.168.21.0/24 dev tun0
...without any luck.
I've also tried disabling firewall (using pfctl -d), adding route 192.168.21.0 255.255.255.0 to server.conf, adding 192.168.20.0/24 to IPv4 Remote networks in OpenVPN client settings on the secondary site pfSense/OpenVPN box.. basically everything I can find through hours of Googling 🙂
If I can get the primary site OpenVPN endpoint to reach the secondary site, I think I'll be on the right track. There's only a few servers on the primary side, so I can add static routes in Windows to point them to the VPN endpoint for the secondary site traffic.. but I just can't get past this hurdle at the moment.
Here's my server.conf:
port 1194
proto udp
dev tun
user nobody
group nogroup
persist-key
persist-tun
keepalive 10 120
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "dhcp-option DNS 192.168.20.44"
push "dhcp-option DNS 192.168.20.2"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DOMAIN (ourdomain).com"
push "redirect-gateway def1 bypass-dhcp"
dh none
ecdh-curve prime256v1
tls-crypt tls-crypt.key 0
crl-verify crl.pem
ca ca.crt
cert server_xxxxxxxxxxxx.crt
key server_xxxxxxxxxxxx.key
auth SHA256
cipher AES-128-GCM
ncp-ciphers AES-128-GCM
tls-server
tls-version-min 1.2
tls-cipher TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256
status /var/log/openvpn/status.log
verb 3
log debuglog.log
