Hello,
My colleague and I are trying to get a tunnel up between our offices to replace our other tunnel. We are using the latest version of OpenVPN and are running it on a box which uses OpenBSD 4.9.
We have gotten to the point where we can connect the two boxes if we BOTH disable our PF. When we have them enabled I get this on my end:
Fri Nov 18 11:12:04 2011 us=432238 UDPv4 link local: [undef]
Fri Nov 18 11:12:04 2011 us=432251 UDPv4 link remote: 1.2.3.4:5555
Fri Nov 18 11:12:04 2011 us=432427 write UDPv4: No route to host (code=65)
Fri Nov 18 11:12:06 2011 us=712506 write UDPv4: No route to host (code=65)
Fri Nov 18 11:12:10 2011 us=132511 write UDPv4: No route to host (code=65)
Any idea why this would be happening?
Here is the code for the pf.conf server side:
# Server PF Configuration
int_if="re0"
dmz_if="re1"
ext_if="re2"
vpn_if="tun0"
local_net="10.51.0.0/16"
open_fire_server="{ x.x.x.x }"
spark_ports="{ 1111, 2222, 3333, 4444 }"
open_vpn_ports="{ 5555 }"
tcp_services="{ 22, 113 }"
#icmp_types="{ 8 code 0 }"
#icmp_types="{ echoreq, unreach, 8 code 0 }"
# Options
set block-policy return
set loginterface re2
set skip on lo
# Match rules
match out on $ext_if inet from $local_net to any nat-to $ext_if
# Filter rules
block in log
pass out quick
antispoof quick for { lo $int_if }
pass in on $ext_if inet proto tcp from any to $ext_if port $tcp_services
pass in on $ext_if inet proto { tcp udp } from any to $ext_if port $spark_ports rdr-to $open_fire_server
pass in on $vpn_if keep state
pass in on $ext_if inet proto { udp } to $ext_if port $open_vpn_ports
pass in inet proto icmp all icmp-type $icmp_types keep state
pass in on $int_if
pass out on $ext_if inet proto { tcp udp icmp } from $local_net to any
#pass out on $int_if inet proto { tcp udp } to $open_fire_server port $spark_ports received-on $ext_if nat-to $int_if
This is the code for the pf.conf client side:
int_if = "vr0" #Internal Interface
ext_if = "vr1" #External Interface
vpn_if = "tun0" #VPN Tunnel
localnet = $int_if:network
match out on $ext_if from $localnet nat-to ($ext_if)
block all
pass inet proto tcp from { self, $localnet }
pass in inet proto tcp to port ssh
pass inet proto icmp
# VPN
pass quick on $vpn_if
pass in quick proto udp from any to port 5555
block in on ! lo0 proto tcp to port 6000:6010
Code for Server Side server.conf:
# Server Config File
local 1.2.3.4
port 5555
proto udp
dev tun0
ca /etc/openvpn/ca.crt
cert /etc/openvpn/cert.crt
key /etc/openvpn/key/key001.key # This file should be kept secret
dh /etc/openvpn/dh1024.pem
server 10.51.50.0 255.255.255.0
ifconfig-pool-persist ipp.txt
client-to-client
keepalive 10 120
cipher BF-CBC # Blowfish (default)
comp-lzo
user _openvpn
group _openvpn
persist-key
persist-tun
status openvpn-status.log
verb 3
Code for Server Side server.conf:
client
dev tun0
proto udp
remote 1.2.3.4 5555
resolv-retry infinite
nobind
user _openvpn
group _openvpn
persist-key
persist-tun
ca /etc/openvpn/ca.crt
cert /etc/openvpn/cert.crt
key /etc/openvpn/key/key001.key
ns-cert-type server
cipher BF-CBC
comp-lzo
verb 3
Any assistance is greatly appreciated!
