Server and Client config for site to site between OPNSense and UnTangle Routers

[deleted]

Hi all,

Trying to do a Site to Site VPN between and OPNSense router and and UnTangle Router. Both running latest OS/firmware. VPN connects, but something is wrong with routing. Routes are not being pushed right to client. OPNSense is server, UnTangle is client. I had to manually create the client config file, as OPNSense did not seem to have a way to create a file for site to site.

Brief overview of Topology.
Router ZillMain (running OPNSense acting as server) LAN = 192.168.124.0/24
Client SELAN (runing UnTangle acting as cleint) LAN = 192.168.110.0/24
The subnet for the tunnel is 172.16.72.192/26
Below are my server config file and the corresponding client file. Can anyone tell me if something is wrong with either.

dev ovpns1
verb 11
dev-type tun
tun-ipv6
dev-node /dev/tun1
writepid /var/run/openvpn_server1.pid
script-security 3
daemon
keepalive 10 60
ping-timer-rem
persist-tun
persist-key
proto udp4
cipher AES-256-CBC
auth SHA1
up /usr/local/etc/inc/plugins.inc.d/openvpn/ovpn-linkup
down /usr/local/etc/inc/plugins.inc.d/openvpn/ovpn-linkdown
multihome
client-connect "/usr/local/etc/inc/plugins.inc.d/openvpn/ovpn_setup_cso.php server1"
tls-server
server 172.16.72.192 255.255.255.192
client-config-dir /var/etc/openvpn-csc/1
ifconfig 172.16.72.193 172.16.72.194
tls-verify "/usr/local/etc/inc/plugins.inc.d/openvpn/ovpn_auth_verify tls 'OPNZillah.com' 1"
lport 1194
management /var/etc/openvpn/server1.sock unix
push "route 192.168.124.0 255.255.255.0"
route 192.168.110.0 255.255.255.0
ca /var/etc/openvpn/server1.ca
cert /var/etc/openvpn/server1.cert
key /var/etc/openvpn/server1.key
dh /usr/local/etc/dh-parameters.2048.sample
comp-lzo no

client
resolv-retry 20
keepalive 10 60
nobind
mute-replay-warnings
ns-cert-type server
comp-lzo
max-routes 500
verb 1
persist-key
persist-tun
explicit-exit-notify 1
dev tun5
proto udp
port 1194
cipher AES-256-CBC
cert keys/ZillMain-SELAN.crt
key keys/ZillMain-SELAN.key
ca keys/ZillMain-SELAN-ca.crt
remote 222.32.190.156 1194 # public address
remote 222.32.190.156 1194 # static WAN 1

TinCanTech

You are not using PTP openvpn a.k.a. site to site .. so you have to learn openvpn Multi-client per server.

[deleted]

Can you clarify please? Is that a setting I need to change on the server side?

TinCanTech

Please read the Openvpn Howto.

That may sound harsh .. but:

williamk777 wrote Brief overview of Topology.
Router ZillMain (running OPNSense acting as server) LAN =
Client SELAN (runing UnTangle acting as cleint) LAN =

Good luck..

If all else fails then I'll give you my email.

[deleted]

I have read it, but can read it again. Thank you.

[deleted]

OK, well I have read the how to, and a few other tutorials on OPNSense site to site. Have made a little progress. The tunnel comes up on both sides, but the server is for whatever reason not assigning an ip address to the tun interface on the client. Consequently the client is not receiving routes for other side of VPN. In Client logs I see this (note I have sanitized this to remove sensitive info):

Feb  8 14:55:45 : [Myopensensevpnserver.com] Inactivity timeout (--ping-restart), restarting
Feb  8 14:55:45 : SIGUSR1[soft,ping-restart] received, process restarting
Feb  8 14:55:45 : Restart pause, 5 second(s)
Feb  8 14:55:50 : WARNING: --ns-cert-type is DEPRECATED.  Use --remote-cert-tls instead.
Feb  8 14:55:50 : TCP/UDP: Preserving recently used remote address: [AF_INET]222.32.190.156:1194
Feb  8 14:55:50 : Socket Buffers: R=[212992->212992] S=[212992->212992]
Feb  8 14:55:50 : UDP link local: (not bound)
Feb  8 14:55:50 : UDP link remote: [AF_INET]222.32.190.156:1194
Feb  8 14:55:56 : TLS: Initial packet from [AF_INET]222.32.190.156:1194, sid=976df475 d06c103d
Feb  8 14:55:57 : VERIFY OK: depth=1, <blah,blah,blah>
Feb  8 14:55:57 : VERIFY OK: nsCertType=SERVER
Feb  8 14:55:57 : VERIFY OK: depth=0, <blah,blah,blah>
Feb  8 14:55:57 : WARNING: 'ifconfig' is present in remote config but missing in local config, remote='ifconfig 172.16.72.192 172.16.72.194'
Feb  8 14:55:57 : Control Channel: TLSv1.3, cipher TLSv1.3 TLS_AES_256_GCM_SHA384, 2048 bit RSA
Feb  8 14:55:57 : [MYopensensevpnserver.com] Peer Connection Initiated with [AF_INET]222.32.190.156:1194
Feb  8 14:55:58 : SENT CONTROL [Myopensensevpnserver.com]: 'PUSH_REQUEST' (status=1)
Feb  8 14:55:58 : PUSH: Received control message: 'PUSH_REPLY,route 192.168.124.0 255.255.255.0,peer-id 0'
Feb  8 14:55:58 : OPTIONS IMPORT: route options modified
Feb  8 14:55:58 : OPTIONS IMPORT: peer-id set
Feb  8 14:55:58 : OPTIONS IMPORT: adjusting link_mtu to 1625
Feb  8 14:55:58 : Outgoing Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Feb  8 14:55:58 : Outgoing Data Channel: Using 160 bit message hash 'SHA1' for HMAC authentication
Feb  8 14:55:58 : Incoming Data Channel: Cipher 'AES-256-CBC' initialized with 256 bit key
Feb  8 14:55:58 : Incoming Data Channel: Using 160 bit message hash 'SHA1' for HMAC authentication
Feb  8 14:55:58 : Preserving previous TUN/TAP instance: tun5
Feb  8 14:55:58 : Initialization Sequence Completed

If I do an ip add command on the client I see this for tun5:

61: tun5: <POINTOPOINT,MULTICAST,NOARP> mtu 1500 qdisc noop state DOWN group default qlen 100 link/none

Doing route command shows no route to 192.168.124.0 /24, even though log shows it recieved a PUSH_REPLY

This entry concerns me:

WARNING: 'ifconfig' is present in remote config but missing in local config, remote='ifconfig 172.16.72.192 172.16.72.194'

The ip addresses it is showing for the server and client are wrong. Shouldn't it show 172.16.72.193 172.16.72.194?

in the server config file I have this:

tls-server
ifconfig 172.16.72.193 172.16.72.194
tls-verify "/usr/local/etc/inc/plugins.inc.d/openvpn/ovpn_auth_verify tls 'Myopensensevpnserver.com' 1"
lport 1194
management /var/etc/openvpn/server1.sock unix
push "route 192.168.124.0 255.255.255.0"
route 192.168.110.0 255.255.255.0
ca /var/etc/openvpn/server1.ca
cert /var/etc/openvpn/server1.cert
key /var/etc/openvpn/server1.key
dh /usr/local/etc/dh-parameters.2048.sample
tls-auth /var/etc/openvpn/server1.tls-auth 0
comp-lzo adaptive
topology subnet

Seems like OPNSense is not sending right info to client. I can repost complete server and client configs if that helps. Is this a bug in OPNSense, or is my config just wrong?

TinCanTech

You are doing this all wrong.

You have tried to setup a point-to-point VPN using --tls-server, this is not supported.

Simply setup a standard server by following what ever guide you are following.

[deleted]

The server config file is created according to how you set things in the OPNSense GUI. In the GUI the only options for Server Mode are
Peer to Peer (SSL/TLS)
Peer to Peer (Shared Key)
Remote Access (SSL/TLS)
Remote Access (User Auth)
Remote Access (SSL/TLS + User Auth)

I choose the first option according to different tutorials. I will try to upload pics of all the settings in my GUI.

300000

Can you commend this line out
ifconfig 172.16.72.193 172.16.72.194

If you want site to site you need to create a folder CDD inside openvpn server folder and inside that folder name the file name as the same common name of certificate client on Untangle

For example you client name isuntangle open that file and add this in

iroute 192.168.110.0 255.255.255.0

That iroute need to make it work as site to site.

On the Untangle you need to NAT and do IP forward as you do on server . that is all need to be done and you can connect site to site all subnet.

At the moment your client Untangle cant get it ip so remove the first line should do the trick.

it is the best to use winscp to connect your server , download the config to pc , edit it and upload back to your server . It save a lot time ,All of my linux pc and raspberry do that way , Very quick and simple doing it on windows pc.

TinCanTech

williamk777 wrote The server config file is created according to how you set things in the OPNSense GUI. In the GUI the only options for Server Mode are
Peer to Peer (SSL/TLS)
Peer to Peer (Shared Key)
Remote Access (SSL/TLS) <-- Try this one first.
Remote Access (User Auth)
Remote Access (SSL/TLS + User Auth)

300000

It is very ease to connect to OPNsense by WinSCP , just create user with root and password and using WinSCP connect to it by sftp protocol. it like explore and you can go everywhere , copy and paste as normal.

[deleted]

Thanks for the replys and suggestions. I have been using SSH to connect to the OPNSense router. I can create my own config files and do as you suggest. However, if OPNSense is like UnTangle any changes I make will be overwritten the next time someone makes a change on the GUI. Have you been able to make changes to OPNSense openvpn files and not have them over written by the GUI?

I will try TinCanTechs suggestion of getting a Remote Access (SSL/TLS) setup to work first. I could also try Peer to Peer (Shared Key). I have read about others having issues with the Peer to Peer (SSL/TLS). Am thinking it is a bug and that the GUI is not creating the server.conf file correctly.

[deleted]

Update on this for anyone else trying to do something similar. OPNSense, does not seem to properly create a file in the CCD directory. Therefore there was no iroute statement. As such I had to create a static route to allow the server side subnets of the VPN to communicate with the client side subnets. The tun ip address had to be defined in the client config with the ifconfig statement. Untangle was not able to pull an IP from OPNSense. Not sure if that was UnTangle or OPNSense. Based on the server.conf file created by OPNSense, I will blame them. OPNSense, also does not automatically enable the tun interface and its gateway. It discovers the interface, but you have to add it, enable it, and than restart the openvpn service. After all this things started communicating. Am going to report these bugs on the OPNSense site and see what they come back with. Thanks all for your direction.

TinCanTech

Given the configs you have posted so far, it is far more likely that you have a bad Openvpn config file.

Also, Openvpn Server cannot route to a client subnet without an --iroute, which probably means,
what-ever you have done so far, is not configured correctly.

I will restate my previous opinion:

TinCanTech wrote You are doing this all wrong.

You have tried to setup a point-to-point VPN using --tls-server, this is not supported.

Simply setup a standard server

TinCanTech wrote Remote Access (SSL/TLS) <-- Try this one first.

If your server config does not have

server x.x.x.x 255.255.255.0

in it then you have done it wrong again.

300000

Free software so people like to do whatever until it work as they like. everybody have difference situation so let try on until finish.

TinCanTech

300000 wrote Free software so people like to do whatever until it work

I expect most people simply want it to work, how it works is secondary at best ..