Linux/FreeBSD VPN solution

T

TC10284

Limp Gawd
Joined
Jan 8, 2006
Messages
213
I am pulling my hair out trying to find a free Linux/FreeBSD VPN solution.

My only requirements:
Must support site-to-site VPN (IPSEC, PPTP, OpenVPN, any) and roadwarrior VPN concurrently
Must support some way of utilizing DNS servers within the router to ping the NetBIOS/computer hostname/DNS name of workstations on the OTHER side of the VPN tunnel.
Secure

So far I can get the distros I have tried to work on a VPN tunnel, but can only ping other computers by IP address. This is my ultimate goal aside from accomplishing the site-to-site tunnel itself.

Any help will be much appreciated!
 
OpenVPN should be able to do all of this pretty easily. Though I'd agree with matt that if these are truly site-site VPNs a dedicated appliance running IPsec and an appropriate configuration for your needs makes more sense.
 
Hmm, if you can live with DNS only ...
How about adding a caching DNS server in the local router, set up to use the IP of the remote DNS server to resolve everything? Then you can set that server as the DNS server for all local clients and things should work.

(Or just set the IP of the remote DNS server as the resolver for all the local computers, but a bit of caching never hurts.)


... feel free to list what I'm missing here, of course. I have a feeling there's something. ;)


edit:
Are you running one DNS server per site? If so, the easiest is probably to set them as primary and secondary DNS servers on all the clients, though you could also construct a DNS server configuration that would ask both existing servers. I think.
 
Last edited:
Yep, I have been working with pfSense. It's nice, but having difficulty still pinging by computer hostname instead of IP. http://forum.pfsense.org/index.php/topic,21772.0.html
I'm probably just ignorant of a setting. I'm going to try what was suggested in the last post on that forum for now.

Also, if a dedicated VPN appliance is suggested, what kinds would you suggest? I considered getting two VPN routers from Newegg, but I don't want to cheapo's that will die in a few months like a lot of low-end routers I've had to replace. My IPCop router made from three NICs and an old P3 933 has been rock solid for years now.
 
TC10284 said:
Yep, I have been working with pfSense. It's nice, but having difficulty still pinging by computer hostname instead of IP.
Click to expand...

As I tried to say, though it drowned in the general mess of my last post:
If you want to resolve remote host names by DNS you have to point the clients at the remote DNS server, or at a DNS server that will fall back to the remote DNS server. Since you have IP working, try putting the remote DNS server as the secondary (or tertiary, I guess) DNS server and see if you can resolve anything.


If you don't have a DNS server but if it's all NetBIOS (or whatever the relevant windows protocol is), you'll have to make sure broadcasts make it through the VPN link.
 
When I said vpn appliance what I really meant was something like pfSense, not trying to run a vpn client directly on the hosts which you seemed to be asking about. pfSense does a good job of p2p ipsec, I would suggest you just use that and leave the netwoking duties on the router instead of the client machines.

As for your dns issues, if you just want local hostnames to resolve, there's a checkbox in either the DNS forwarder or DHCP server config to register client DHCP names in DNS that needs to be checked, and your machines either need to use DHCP or be statically set up in DNS forwarder. If you just want remote hostnames to work, you can override the name servers in DNS configuration for a partiicular domain. Set that to a nameserver on the main LAN that can resolve them, and obviously set the DHCP search domain appropriately.

I don't like the idea of doing split DNS with secondaries as suggested, it's really not how that is intended to be used IMO. Unfortunately what I suggested may not work because of shortcomings of pfSense and IPsec so you might be forced to do it like that or let that remote resolver do everything ( remote hosts too ).

Finally, OpenVPN (also pfSense) can do a bridged VPN which requires much less networking skill to get working with this kind of thing. You get one big flat network instead of a bunch of them routed.
 
Mh, indeed- both your primary and secondary are supposed to be able to resolve everything.
If the two sites have different domains, your idea sounds very sensible to me - and if not, how about a third caching DNS server set up to check both the remote and local DNS server? Sort of the same primary/secondary abuse, but centralized ...
 
Here's what I posted on the pfSense forum:

C:\Documents and Settings\TC10284>tracert cashback.32inc.local

Tracing route to cashback.32inc.local [192.168.200.252]
over a maximum of 30 hops:

1 <1 ms <1 ms <1 ms pfsense-east.32inc.local [192.168.100.1]
2 1 ms <1 ms <1 ms 192.168.50.2
3 1 ms 2 ms 1 ms cashback.32inc.local [192.168.200.252]

Trace complete.

I did what you said. After hours of troubleshooting and problems, I think I finally got it. I do have to use the domain suffixes to get pings/tracerts to work, but I guess I can't be too picky.

Sweet.
So far, so good. Now if I can get the roadwarrior part of OpenVPN working as needed...

I also ran into an issue of not having the address pool setup correctly on the client side of the site-to-site (which is where the hours of troubleshooting/problems came into play). Fixed that and things seemed to start making more sense.
 
OK - so now I have a roadwarrior VPN setup in OpenVPN. It is working great with one client.

My only issue and question is:
How can I get the roadwarrior client to be able to ping a computer on the west side when connected to the east side? Nslookup resolves the IP of the system on westside fine, but when I do a ping it times out. When I tracert, it routes all the way out to the Internet. My pfSense DNS servers are 8.8.8.8 and 192.168.200.1 in the pfsense General Setup. However, the VPN client is using 192.168.60.1 or 192.168.100.1 (cannot recall) as the DNS server. I've tried pushing the DNS servers to the vpn client via the VPN server config page but that does not help. I've tried adding another network (push route) on the VPN server config page and that does not help.

Is there any way I can get this working? So far things are working satisfactorily other than this.

One more question: for the OpenVPN client setup, can I configure OpenVPN to work with more than one VPN server (not simultaneously of course). Just have it setup to where it can either connect to east or west side VPN routers, depending upon the roadwarrior's location in the US.
 
You need to either push a route from the vpn server to the client for the 'east' subnet to go through the vpn, or you need to override the default gateway and make all traffic go over the vpn. Both are possible with either the client or server config iirc. Probably want to do it on the server so you can change the routing later easily.

You will also need to add routes on both networks so that they know where to send traffic to the other side vpn clients. Need a diagram of your network and subnets to tell you exactly what's necessary.

Obviously the west vpn box will need to be able to route to the east vpn box on its own and have firewall rules to allow the forwarded traffic etc. Post a diagram if you need more assistance.
 
keenan said:
You need to either push a route from the vpn server to the client for the 'east' subnet to go through the vpn, or you need to override the default gateway and make all traffic go over the vpn. Both are possible with either the client or server config iirc. Probably want to do it on the server so you can change the routing later easily.

You will also need to add routes on both networks so that they know where to send traffic to the other side vpn clients. Need a diagram of your network and subnets to tell you exactly what's necessary.

Obviously the west vpn box will need to be able to route to the east vpn box on its own and have firewall rules to allow the forwarded traffic etc. Post a diagram if you need more assistance.
Click to expand...

I have a push "route 192.168.200.0 255.255.255.0" in the East VPN server settings but that doesn't allow me to ping.

I've tried adding firewall rules on the WAN and LAN on East to allow anything from 192.168.60.0/24 inside, then anything from ANY to 192.168.60.0 outside.

Is this what you need? http://i.imgur.com/w6hwp.png
Do you need any more information?
 
TC10284 said:
I have a push "route 192.168.200.0 255.255.255.0" in the East VPN server settings but that doesn't allow me to ping.
Click to expand...

I think what you're missing is any routes for the VPN subnets. When you ping the host in 192.168.200.0/24, the traffic should reach that box since the pfSense router knows how to get it there (or it will go to the IPcop as default gateway which will then route it back, assuming the firewall is set up to allow that). However, the host that receives the traffic from 192.168.60.0/24 doesn't have a route to send return traffic, so sends it to the default gateway which also doesn't know about that subnet and it's either discarded or sent to *that* router's default gateway which is probably going to the internet - the return traffic ends up essentially blackholed.

What I'd suggest is that you set up RIP between your pfSense boxes so they have information about each others connected subnets and can route between each other. If you have clients directly attached to the L2 switch in your diagram, you'll probably need to do the same with your IPcop gateway. Otherwise I would just set static routes on each box for the other box's VPN subnet - ie. 192.168.60.0/24 to 192.168.100.1 and 192.168.70.0/24 to 192.168.200.1 (assuming .70.0/24 is the west VPN subnet). If you want a VPN client on east to communicate with a VPN client on west you similarly need to add a push route for those subnets as well, or override the default gateway. Alternatively you can NAT the VPN traffic onto an address in your LAN subnets. I'm not really sure how to do that with pfSense + OpenVPN, it's not a configuration I've ever had to use.

I am curious why you don't replace the IPcop+2x pfSense configuration with a single pfSense box and multiple interfaces/switches or one managed switch.
 
keenan said:
I think what you're missing is any routes for the VPN subnets. When you ping the host in 192.168.200.0/24, the traffic should reach that box since the pfSense router knows how to get it there (or it will go to the IPcop as default gateway which will then route it back, assuming the firewall is set up to allow that). However, the host that receives the traffic from 192.168.60.0/24 doesn't have a route to send return traffic, so sends it to the default gateway which also doesn't know about that subnet and it's either discarded or sent to *that* router's default gateway which is probably going to the internet - the return traffic ends up essentially blackholed.

What I'd suggest is that you set up RIP between your pfSense boxes so they have information about each others connected subnets and can route between each other. If you have clients directly attached to the L2 switch in your diagram, you'll probably need to do the same with your IPcop gateway. Otherwise I would just set static routes on each box for the other box's VPN subnet - ie. 192.168.60.0/24 to 192.168.100.1 and 192.168.70.0/24 to 192.168.200.1 (assuming .70.0/24 is the west VPN subnet). If you want a VPN client on east to communicate with a VPN client on west you similarly need to add a push route for those subnets as well, or override the default gateway. Alternatively you can NAT the VPN traffic onto an address in your LAN subnets. I'm not really sure how to do that with pfSense + OpenVPN, it's not a configuration I've ever had to use.

I am curious why you don't replace the IPcop+2x pfSense configuration with a single pfSense box and multiple interfaces/switches or one managed switch.
Click to expand...

I'm going to try your suggestions now to see what I can get going.

Also, to answer your curiosity, this is just a test setup. I need two VPN servers - one that will actually be placed on the West coast, and one that will actually be placed here on the East coast. They will be communicating with each other and support VPN clients. I've got most of the dirty work done, except the above issues I'm dealing with.
 
this is straightforward.
how many DNS servers at each site?
Are domain names the same or different?
is this active directory at either side?
DHCP servers at either side?
use IPCop and the built in vpn.
For road warrior forward 17xx whatever and gre to a windows pptp server at one or either site. or do it at the IPCop.
What services do they need to access at the sites.
 
You must log in or register to reply here.
Back
Top