Traffic Not Routing Properly OpenBSD Routed VPN

alpha202ej

Hi everyone,

We have two locations that we are trying to connect via site-to-site VPN (routed VPN).

Our site is using OpenBSD 4.9 running PF (as the firewall). We are able to establish the VPN connection fine but what is getting us hung up is the routing over the VPN. Using tcpdump I can see that ssh and icmp traffic passes correctly over the tunnel as it is going over the tun0 adaptor. But RDP traffic (tcp 3389) and http/https traffic is getting routed to the IP address in question over one of the external interfaces (which I assume it should be going over the tun0 adaptor).

I have attached a ifconfig and my pf.conf as additional information

ifconfig

lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 33200
        priority: 0
        groups: lo
        inet 127.0.0.1 netmask 0xff000000
        inet6 ::1 prefixlen 128
        inet6 fe80::1%lo0 prefixlen 64 scopeid 0x4
vr0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
        lladdr 14:d6:4d:47:bd:6d
        priority: 0
        media: Ethernet autoselect (100baseTX full-duplex)
        status: active
        inet 10.0.0.1 netmask 0xffffff00 broadcast 10.0.0.255
        inet6 fe80::16d6:4dff:fe47:bd6d%vr0 prefixlen 64 scopeid 0x1
vr1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
        lladdr 14:d6:4d:47:be:f6
        priority: 0
        groups: egress
        media: Ethernet autoselect (100baseTX full-duplex)
        status: active
        inet ... netmask 0xfffffff0 broadcast ...
        inet6 ...vr1 prefixlen 64 scopeid 0x2
enc0: flags=0<>
        priority: 0
        groups: enc
        status: active
axe0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
        lladdr 00:10:60:2c:0a:5f
        priority: 0
        media: Ethernet autoselect (100baseTX full-duplex)
        status: active
        inet ... netmask 0xffffff00 broadcast ...
        inet6 ...axe0 prefixlen 64 scopeid 0x5
vlan100: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
        lladdr 14:d6:4d:47:bd:6d
        priority: 0
        vlan: 100 priority: 0 parent interface: vr0
        groups: vlan
        status: active
        inet6 fe80::16d6:4dff:fe47:bd6d%vlan100 prefixlen 64 scopeid 0x6
        inet 10.0.2.1 netmask 0xffffff00 broadcast 10.0.2.255
pflog0: flags=141<UP,RUNNING,PROMISC> mtu 33200
        priority: 0
        groups: pflog
tun0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1500
        priority: 0
        groups: tun
        status: active
        inet 172.25.0.10 --> 172.25.0.9 netmask 0xffffffff

And here is my pf.conf

############
## MACROS ##
############

# Interfaces
int_if  = "vr0" #Internal Interface
ext_if1 = "vr1" #External Interface T1
ext_if2 = "axe0" #External Interface WiMAX
ext_gw1 = "x.x.x.x"
ext_gw2 = "y.y.y.y"
vpn_if  = "tun0" #VPN Tunnel to remote
vlan100 = "vlan100" #VLAN Interface 10.0.2.0/24

# Misc
localnet = "10.0.0.0/24"
vlan100net = "10.0.2.0/24"
remotenet = "10.21.0.0/16"
vpnnet = "172.25.0.0/24"
snglextports = "{ 10000, 443, 1194, 22, 8008, 3389 }"
DHCP = "{ 67, 68 }"
icmp_types = "echoreq"
voipport = "{ 4569 }"

# Addresses
MFC8780 = "10.0.0.5"

# Ports
RDP = "{ 3389 }"

############
## TABLES ##
############


####################
## GLOBAL OPTIONS ##
####################

set skip on lo0

###########################
## TRAFFIC NORMALIZATION ##
###########################


####################
## QUEUEING RULES ##
####################


#########################################
## TRANSLATION RULES (NAT) & SCRUBBING ##
#########################################

match out quick log on $vpn_if from $localnet nat-to $vpn_if
match out log on $ext_if1 from $localnet nat-to ($ext_if1)
match out log on $ext_if2 from $localnet nat-to ($ext_if2)
match out log on $ext_if1 from $vlan100net nat-to ($ext_if1)
match out log on $ext_if2 from $vlan100net nat-to ($ext_if2)

###################
## FILTERS RULES ##
###################

block in log
block out log

# pass all outgoing packets on internal interface
pass out log on $int_if to $localnet
pass out log on $int_if to $vlan100net

# pass in quick any packets destined for the gateway itself
pass in log on $int_if from $localnet to $int_if
pass in log on $vlan100 from $vlan100net to $vlan100

### Dual WAN Configuration
pass in log on $int_if from $localnet route-to { ($ext_if1 $ext_gw1), ($ext_if2 $ext_gw2) } round-robin
pass in log on $vlan100 from $vlan100net route-to { ($ext_if1 $ext_gw1), ($ext_if2 $ext_gw2) } round-robin

# Single External Connection Path for Secure Ports
pass in log on $int_if proto { tcp, udp } from $localnet to port $snglextports route-to ($ext_if1 $ext_gw1)

# General "Pass Out" Rules For External Interface
pass out log on $vpn_if
pass out log on $ext_if1
pass out log on $ext_if2

# Route Packets From any IPs on on $ext_if1 to $ext_gw1 and the same for $ext_if2 and $ext_gw2
pass out log on $ext_if1 from $ext_if2 route-to ($ext_if2 $ext_gw2)
pass out log on $ext_if2 from $ext_if1 route-to ($ext_if1 $ext_gw1)

# SSH and ICMP
pass in log inet proto tcp to port ssh
pass log inet proto icmp

# VPN
pass quick log on $vpn_if
pass in quick log proto udp from any to port 1194

block in log on ! lo0 proto tcp to port 6000:6010

Any help on this would be greatly appreciated!
Thanks!

alpha202ej

I have a working version of my pf.conf

The trick to get it to pass out of the correct interface was to have have a rule that passes in from the remote network:

Pass in on !$ext_if1 to $remotenet
Pass in on !$ext_if2 to $remotenet

Hope that helps someone else that is facing a similar issue!