pfsense as openvpn client

[Orddie]

Hey all!

I have been using openvpn server on a Linux host and connecting to that server from a windows host and bridging the connections together.

I tried configuring pfsense to replace the windows 7 box but it does not appear to be working correctly.

From the logs on the linux box... It would appear that pfsense is NOT making any attempt to connect to the Linux server.

Does anyone have suggestions where i can start?

 

[obrith]

Did you set up OpenVPN on the server tab or the client tab on pfSense?

 

[Orddie]

Did you set up OpenVPN on the server tab or the client tab on pfSense?

client tab.

 

[Orddie]

I can not see pfsense trying to talk to the openvpn server.

I'm getting the following in the openvpn server log
TLS Error: reading acknowledgement record from packet
TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)

and the following in the pfsense openvpn log
TLS Error: cannot locate HMAC in incoming packet from [AF_INET]XX.XXX.XXX.XXX:1194 (replaced ip w/ X's)

 

[Shockey]

after googling the error you get from pfsense. i got this link

http://forum.pfsense.org/index.php?topic=30329.0

says to do this

"TLS Error" sounds difficult but it's easy: Just take the TLS string from your server, put it into a textfile on your openvpn client.

 

[Orddie]

after googling the error you get from pfsense. i got this link

http://forum.pfsense.org/index.php?topic=30329.0

says to do this

i have no idea what that means....

the server is the linux box. the client is the pfsense box.


*server config*

management localhost 7505
client-config-dir /etc/openvpn
#route 10.1.1.0 255.255.255.0
route 192.168.1.0 255.255.255.0
local 97.X.X.227
port 1194
proto udp
dev tap0
ca ca.crt
cert server.crt
key server.key  # This file should be kept secret
dh dh1024.pem
#server 10.1.1.0 255.255.255.0
#server-bridge 10.0.1.25 255.255.255.0 10.0.1.26 10.0.1.27
server-bridge 192.168.1.1 255.255.255.0 192.168.1.2 192.168.1.3
ifconfig-pool-persist ipp.txt
client-to-client
duplicate-cn
keepalive 60 120
comp-lzo
max-clients 51
user nobody
group nobody
persist-key
persist-tun
status openvpn-status.log
log         openvpn.log
log-append  openvpn.log
#verb 4
verb 6


tls-server

*pfsense config*

server mode = Peer to peer (ssl/tls)
protocol = UDP
device mode = tap
interface = wan
server host = 97.XX.XX.227
server port = 1194
Enable authentication of tls packets = checked
advanced section = verb 6;tun-mtu 1532;fragment 1300;keysize 128;redirect-gateway def1;persist-key;

 

[Orddie]

okay. got it up and "working" now.

The connection appears to be connected but i can not ping the other network. I have done an iptables --flush on the linux box and did an allow any any in pfsense openvpn port.

any suggestions where to go from here?

 

[D-EJ915]

You have a route setup for the network you are VPNing into?

 

[Orddie]

You have a route setup for the network you are VPNing into?

Yep.

I added 192.168.1.0/24 to route over the opt1 interface.

The interface; once connected got an ip of 192.168.1.2 with a default route of 192.168.1.1 (the interface on the linux server).

I could never ping 192.168.1.2 from the linux server and could never ping 192.168.1.1 from my home network.

I could ping 192.168.1.2 (interface on pfsense server) from my home network.

@ times when the openvpn connection started up.... It would kill all of my internet connection. According to the logs it looks as if it changed the default route to force
everything over the openvpn connection. That's not my goal here. I'm looking to extend the network to be able to route traffic "internally".

I ended up moving the connection to the exchange server and bridging the tap interface with the servers network card. It's not how i wanted it... I still want pfsense to handle this but after 6 hours of working on it... I needed to move on.

Any suggestions?

 

[Nate Carmody]

Yep.

I added 192.168.1.0/24 to route over the opt1 interface.

The interface; once connected got an ip of 192.168.1.2 with a default route of 192.168.1.1 (the interface on the linux server).

I could never ping 192.168.1.2 from the linux server and could never ping 192.168.1.1 from my home network.

I could ping 192.168.1.2 (interface on pfsense server) from my home network.

@ times when the openvpn connection started up.... It would kill all of my internet connection. According to the logs it looks as if it changed the default route to force
everything over the openvpn connection. That's not my goal here. I'm looking to extend the network to be able to route traffic "internally".

I ended up moving the connection to the exchange server and bridging the tap interface with the servers network card. It's not how i wanted it... I still want pfsense to handle this but after 6 hours of working on it... I needed to move on.

Any suggestions?

I had the same problem, it was a Auth digest algorithm issue.
Once I switched server and client to SHA1 (160-bit), everything worked just great (aside from the inherent weakness in SHA1).