[Solved]Setting up VPN on pfSense behind router
Posted: Wed Feb 25, 2015 4:56 pm
Hello guys,
First things first: I'm not an IT-professional and only have a basic understanding of most related concepts. I work for an NGO and am trying to upgrade our IT-infrastructure with limited resources. I've been reading some tutorials and forum topics, but I don't think they contain an answer to my question. So if the answer can already be found, my apologies for asking again, but that does mean I'm in need of a more detailed version of the existing answer
My goal is to reach the internal network at our HQ from several single remote computers.
Our setup at HQ: Modem --> Cisco router --> pfSense (an old PC) --> local network
The Cisco router is provided and managed by our ISP. The pfSense firewall is managed by us. This might seem like a strange setup, but this is what we have to work with for reasons I won't get into right now.
pfSense version 2.1-RELEASE (i386)
Our ISP has tried to build a VPN tunnel for us by setting up a VPN server on their Cisco router, but is unable to grant us access to our local network. They recommended setting up a server on our pfSense PC, which I have done using the OpenVPN wizard. When my laptop is in our local network, I can successfully connect to that VPN server, meaning OpenVPN creates a virtual LAN-connection on my PC and my PC is assigned an IP-address by the VPN server. (Ipv4 Tunnel Network)
I don't get very far however, trying to connect from my home network. Logfiles below.
I'm guessing that the router being in front of our pfSense is the cause of this problem. Port 1723 has been forwarded on the Cisco router to the pfSense WAN. (Because I asked our ISP to do so.) This port is specified as Local Port on the VPN server. Apparently, that doesn't do the trick.
What can I do to remedy this situation? I can of course modify the OpenVPN server settings if you guys can tell me what to do. An acceptable solution would als be to ask our ISP to make configuration changes to the Cisco router, but they too would have to be pretty specific.
On to the log files. Those I was able to retrieve, anyway.
I'm afraid I am unable to find a way to post the server config. If anyone could point me in the right direction, I'd be happy to do so.
Client config. It seems to try to connect to an address in our local network directly, so I'm not surprised it's not working. I have tried overwriting that IP with our HQ's external IP, and even tried external IP\\internal IP, but to no avail.
Client log when using this config:
And so on.
Server log:
First things first: I'm not an IT-professional and only have a basic understanding of most related concepts. I work for an NGO and am trying to upgrade our IT-infrastructure with limited resources. I've been reading some tutorials and forum topics, but I don't think they contain an answer to my question. So if the answer can already be found, my apologies for asking again, but that does mean I'm in need of a more detailed version of the existing answer
My goal is to reach the internal network at our HQ from several single remote computers.
Our setup at HQ: Modem --> Cisco router --> pfSense (an old PC) --> local network
The Cisco router is provided and managed by our ISP. The pfSense firewall is managed by us. This might seem like a strange setup, but this is what we have to work with for reasons I won't get into right now.
pfSense version 2.1-RELEASE (i386)
Our ISP has tried to build a VPN tunnel for us by setting up a VPN server on their Cisco router, but is unable to grant us access to our local network. They recommended setting up a server on our pfSense PC, which I have done using the OpenVPN wizard. When my laptop is in our local network, I can successfully connect to that VPN server, meaning OpenVPN creates a virtual LAN-connection on my PC and my PC is assigned an IP-address by the VPN server. (Ipv4 Tunnel Network)
I don't get very far however, trying to connect from my home network. Logfiles below.
I'm guessing that the router being in front of our pfSense is the cause of this problem. Port 1723 has been forwarded on the Cisco router to the pfSense WAN. (Because I asked our ISP to do so.) This port is specified as Local Port on the VPN server. Apparently, that doesn't do the trick.
What can I do to remedy this situation? I can of course modify the OpenVPN server settings if you guys can tell me what to do. An acceptable solution would als be to ask our ISP to make configuration changes to the Cisco router, but they too would have to be pretty specific.
On to the log files. Those I was able to retrieve, anyway.
I'm afraid I am unable to find a way to post the server config. If anyone could point me in the right direction, I'd be happy to do so.
Client config. It seems to try to connect to an address in our local network directly, so I'm not surprised it's not working. I have tried overwriting that IP with our HQ's external IP, and even tried external IP\\internal IP, but to no avail.
Code: Select all
dev tun
persist-tun
persist-key
cipher AES-128-CBC
auth SHA1
tls-client
client
resolv-retry infiniteremote 192.168.1.2 1723 udp
lport 0
verify-x509-name "VPNserver cert" name
auth-user-pass
pkcs12 openvpn-udp-1723-VPNbarts.p12
tls-auth openvpn-udp-1723-VPNbarts-tls.key 1
ns-cert-type server
comp-lzo
Code: Select all
Wed Feb 25 17:31:41 2015 OpenVPN 2.3.6 x86_64-w64-mingw32 [SSL (OpenSSL)] [LZO] [PKCS11] [IPv6] built on Dec 1 2014
Wed Feb 25 17:31:41 2015 library versions: OpenSSL 1.0.1j 15 Oct 2014, LZO 2.08
Wed Feb 25 17:31:50 2015 Control Channel Authentication: using 'openvpn-udp-1723-VPNbarts-tls.key' as a OpenVPN static key file
Wed Feb 25 17:31:50 2015 UDPv4 link local (bound): [undef]
Wed Feb 25 17:31:50 2015 UDPv4 link remote: [undef]
Wed Feb 25 17:33:50 2015 [UNDEF] Inactivity timeout (--ping-restart), restarting
Wed Feb 25 17:33:50 2015 SIGUSR1[soft,ping-restart] received, process restarting
Wed Feb 25 17:33:52 2015 UDPv4 link local (bound): [undef]
Wed Feb 25 17:33:52 2015 UDPv4 link remote: [undef]Server log:
Code: Select all
Feb 23 17:37:23 openvpn[69654]: 192.168.0.13:51336 TLS Auth Error: Auth Username/Password verification failed for peer
Feb 23 17:37:23 openvpn[69654]: 192.168.0.13:51336 [VPNingridf] Peer Connection Initiated with [AF_INET]192.168.0.13:51336
Feb 23 17:37:46 openvpn: user 'VPNingridf' authenticated
Feb 23 17:37:46 openvpn[69654]: 192.168.0.13:51337 [VPNingridf] Peer Connection Initiated with [AF_INET]192.168.0.13:51337
Feb 23 17:37:46 openvpn[69654]: VPNingridf/192.168.0.13:51337 MULTI_sva: pool returned IPv4=192.168.200.10, IPv6=(Not enabled)
Feb 23 17:37:48 openvpn[69654]: VPNingridf/192.168.0.13:51337 send_push_reply(): safe_cap=940
Feb 23 17:40:52 openvpn[69654]: VPNingridf/192.168.0.13:51337 [VPNingridf] Inactivity timeout (--ping-restart), restarting
Feb 23 17:48:55 openvpn[69654]: VPNbarts/192.168.0.49:54309 [VPNbarts] Inactivity timeout (--ping-restart), restarting
Feb 25 14:10:06 openvpn[69654]: event_wait : Interrupted system call (code=4)
Feb 25 14:10:06 openvpn[69654]: /usr/local/sbin/ovpn-linkdown ovpns1 1500 1558 192.168.200.1 192.168.200.2 init
Feb 25 14:10:06 openvpn[69654]: SIGTERM[hard,] received, process exiting
Feb 25 14:10:06 openvpn[9763]: OpenVPN 2.3.2 i386-portbld-freebsd8.3 [SSL (OpenSSL)] [LZO] [eurephia] [MH] [IPv6] built on Jul 24 2013
Feb 25 14:10:06 openvpn[9763]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Feb 25 14:10:06 openvpn[9763]: Control Channel Authentication: using '/var/etc/openvpn/server1.tls-auth' as a OpenVPN static key file
Feb 25 14:10:06 openvpn[9763]: TUN/TAP device ovpns1 exists previously, keep at program end
Feb 25 14:10:06 openvpn[9763]: TUN/TAP device /dev/tun1 opened
Feb 25 14:10:06 openvpn[9763]: do_ifconfig, tt->ipv6=1, tt->did_ifconfig_ipv6_setup=0
Feb 25 14:10:06 openvpn[9763]: /sbin/ifconfig ovpns1 192.168.200.1 192.168.200.2 mtu 1500 netmask 255.255.255.255 up
Feb 25 14:10:06 openvpn[9763]: /usr/local/sbin/ovpn-linkup ovpns1 1500 1558 192.168.200.1 192.168.200.2 init
Feb 25 14:10:06 openvpn[11310]: UDPv4 link local (bound): [AF_INET]192.168.1.2:1723
Feb 25 14:10:06 openvpn[11310]: UDPv4 link remote: [undef]
Feb 25 14:10:06 openvpn[11310]: Initialization Sequence Completed
Feb 25 15:06:36 openvpn[11310]: event_wait : Interrupted system call (code=4)
Feb 25 15:06:36 openvpn[11310]: /usr/local/sbin/ovpn-linkdown ovpns1 1500 1558 192.168.200.1 192.168.200.2 init
Feb 25 15:06:36 openvpn[11310]: SIGTERM[hard,] received, process exiting
Feb 25 15:06:36 openvpn[19717]: OpenVPN 2.3.2 i386-portbld-freebsd8.3 [SSL (OpenSSL)] [LZO] [eurephia] [MH] [IPv6] built on Jul 24 2013
Feb 25 15:06:36 openvpn[19717]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Feb 25 15:06:36 openvpn[19717]: Control Channel Authentication: using '/var/etc/openvpn/server1.tls-auth' as a OpenVPN static key file
Feb 25 15:06:36 openvpn[19717]: TUN/TAP device ovpns1 exists previously, keep at program end
Feb 25 15:06:36 openvpn[19717]: TUN/TAP device /dev/tun1 opened
Feb 25 15:06:36 openvpn[19717]: do_ifconfig, tt->ipv6=1, tt->did_ifconfig_ipv6_setup=0
Feb 25 15:06:36 openvpn[19717]: /sbin/ifconfig ovpns1 192.168.200.1 192.168.200.2 mtu 1500 netmask 255.255.255.255 up
Feb 25 15:06:36 openvpn[19717]: /usr/local/sbin/ovpn-linkup ovpns1 1500 1558 192.168.200.1 192.168.200.2 init
Feb 25 15:06:36 openvpn[20956]: UDPv4 link local (bound): [AF_INET]127.0.0.1:1723
Feb 25 15:06:36 openvpn[20956]: UDPv4 link remote: [undef]
Feb 25 15:06:36 openvpn[20956]: Initialization Sequence Completed
Feb 25 17:27:58 openvpn[20956]: event_wait : Interrupted system call (code=4)
Feb 25 17:27:58 openvpn[20956]: /usr/local/sbin/ovpn-linkdown ovpns1 1500 1558 192.168.200.1 192.168.200.2 init
Feb 25 17:27:58 openvpn[20956]: SIGTERM[hard,] received, process exiting
Feb 25 17:27:58 openvpn[39438]: OpenVPN 2.3.2 i386-portbld-freebsd8.3 [SSL (OpenSSL)] [LZO] [eurephia] [MH] [IPv6] built on Jul 24 2013
Feb 25 17:27:58 openvpn[39438]: NOTE: the current --script-security setting may allow this configuration to call user-defined scripts
Feb 25 17:27:58 openvpn[39438]: Control Channel Authentication: using '/var/etc/openvpn/server1.tls-auth' as a OpenVPN static key file
Feb 25 17:27:58 openvpn[39438]: TUN/TAP device ovpns1 exists previously, keep at program end
Feb 25 17:27:58 openvpn[39438]: TUN/TAP device /dev/tun1 opened
Feb 25 17:27:58 openvpn[39438]: do_ifconfig, tt->ipv6=1, tt->did_ifconfig_ipv6_setup=0
Feb 25 17:27:58 openvpn[39438]: /sbin/ifconfig ovpns1 192.168.200.1 192.168.200.2 mtu 1500 netmask 255.255.255.255 up
Feb 25 17:27:58 openvpn[39438]: /usr/local/sbin/ovpn-linkup ovpns1 1500 1558 192.168.200.1 192.168.200.2 init
Feb 25 17:27:58 openvpn[40767]: UDPv4 link local (bound): [AF_INET]127.0.0.1:1723
Feb 25 17:27:58 openvpn[40767]: UDPv4 link remote: [undef]
Feb 25 17:27:58 openvpn[40767]: Initialization Sequence Completed
