The pfSense Store

Author Topic: How to create an OpenVPN client to StrongVPN  (Read 92948 times)

0 Members and 2 Guests are viewing this topic.

Offline cmb

  • Administrator
  • Hero Member
  • *****
  • Posts: 6333
  • Karma: +0/-0
    • LinkedIn
    • Twitter
    • View Profile
    • Chris Buechler
Re: How to create an OpenVPN client to StrongVPN
« Reply #60 on: October 02, 2011, 11:48:15 pm »
Nothing has changed in OpenVPN for quite some time, well before release. Upgrading is no different from clean install except possibly in cases of running early alpha versions years ago where they may have done something bad to your config.

Some of the symptoms described sound like letting the client get a default route from StrongVPN, which you do not want. Others who are configuring the interface as DHCP, don't do that, that's going to break things nicely, you don't get DHCP over a VPN. It has to be set to "none" which lets OpenVPN handle the addressing.

Offline cmb

  • Administrator
  • Hero Member
  • *****
  • Posts: 6333
  • Karma: +0/-0
    • LinkedIn
    • Twitter
    • View Profile
    • Chris Buechler
Re: How to create an OpenVPN client to StrongVPN
« Reply #61 on: October 02, 2011, 11:50:13 pm »
I see where people were getting DHCP, as it was stated in the original post. I updated it to fix that. The rest of it looks ok at a glance, but I don't have a StrongVPN connection.

Offline AuZZZie

  • Jr. Member
  • **
  • Posts: 30
  • Karma: +0/-0
    • View Profile
Re: How to create an OpenVPN client to StrongVPN
« Reply #62 on: October 03, 2011, 10:20:46 am »
You mention to set your NAT outbound rules to manual, but you don't actually create any rules. Is that correct?

Offline AuZZZie

  • Jr. Member
  • **
  • Posts: 30
  • Karma: +0/-0
    • View Profile
Re: How to create an OpenVPN client to StrongVPN
« Reply #63 on: October 03, 2011, 10:33:51 am »
Also, with your config exactly, I see my VPN gateway come online (Status -> Gateways) then always go offline after a few seconds. With the VPN interface assigned to DHCP the Gateway stays online and I can even ping out that interface from pfSense, but nothing behind pfSense will go out.

EDIT: Scratch that. It makes no difference. When you change from DHCP/None on the interface it refreshes something in the background. That is all that is changing. If I reboot the machine with the interface on DHCP the Gateway does the same thing.. Online for a few seconds then offline.
« Last Edit: October 03, 2011, 10:36:27 am by AuZZZie »

Offline acids7n

  • Newbie
  • *
  • Posts: 3
  • Karma: +0/-0
    • View Profile
Re: How to create an OpenVPN client to StrongVPN *solved*
« Reply #64 on: October 03, 2011, 05:05:32 pm »
Add another one to the list. I've gone over my config 100 times and it is correct. There is something up here.. I have the exact same symptoms as described.

Also using the 2.0 Official release.
I too have followed the guide to a T. And my problem is exactly the same. It connects in the logs. I get a strong vpn private ip. I can ping it from my pc. But I cannot surf or ping out beyond. I turn it off and everything works. I am only routing one ip logitech revue box rather than whole subnet. And I've made all the nat changes and aon etc.
PS first post. First time user of pfsense or any other linux router distribution. Loving this (pfsense)

EDIT***
well i added the option comp-lzo to the end of the long string of options in (vpn/openvpn/client/advanced configuration)
verb 5;tun-mtu 1500;fragment 1300;keysize 128;redirect-gateway def1;persist-key;comp-lzo

and now it all works great, hope that helps
« Last Edit: October 03, 2011, 11:24:15 pm by acids7n »

Offline AuZZZie

  • Jr. Member
  • **
  • Posts: 30
  • Karma: +0/-0
    • View Profile
Re: How to create an OpenVPN client to StrongVPN *solved*
« Reply #65 on: October 04, 2011, 09:57:57 am »
Add another one to the list. I've gone over my config 100 times and it is correct. There is something up here.. I have the exact same symptoms as described.

Also using the 2.0 Official release.
I too have followed the guide to a T. And my problem is exactly the same. It connects in the logs. I get a strong vpn private ip. I can ping it from my pc. But I cannot surf or ping out beyond. I turn it off and everything works. I am only routing one ip logitech revue box rather than whole subnet. And I've made all the nat changes and aon etc.
PS first post. First time user of pfsense or any other linux router distribution. Loving this (pfsense)

EDIT***
well i added the option comp-lzo to the end of the long string of options in (vpn/openvpn/client/advanced configuration)
verb 5;tun-mtu 1500;fragment 1300;keysize 128;redirect-gateway def1;persist-key;comp-lzo

and now it all works great, hope that helps


Thanks for posting mate. I'll give it a shot.. Can you clarify your other settings.

Are you using Manual NAT?
Is your VPN interface on DHCP or None?

Offline AuZZZie

  • Jr. Member
  • **
  • Posts: 30
  • Karma: +0/-0
    • View Profile
Re: How to create an OpenVPN client to StrongVPN
« Reply #66 on: October 04, 2011, 10:28:38 am »
Ok I'm to the point where I can reliably connect the OpenVPN client, pfSense Gateway shows online and pfSense itself can ping out the VPN interface. I still lose internet connectivity from any node behind pfSense though. I've attached all the relevant screenshots. Hopefully someone spots something I'm missing cause this is driving me wild.

Here you can see the config....








Here you can see the OpenVPN client connected and the pfSense box able to send out the VPN interface




Offline acids7n

  • Newbie
  • *
  • Posts: 3
  • Karma: +0/-0
    • View Profile
Re: How to create an OpenVPN client to StrongVPN *solved*
« Reply #67 on: October 04, 2011, 12:57:52 pm »
Add another one to the list. I've gone over my config 100 times and it is correct. There is something up here.. I have the exact same symptoms as described.

Also using the 2.0 Official release.
I too have followed the guide to a T. And my problem is exactly the same. It connects in the logs. I get a strong vpn private ip. I can ping it from my pc. But I cannot surf or ping out beyond. I turn it off and everything works. I am only routing one ip logitech revue box rather than whole subnet. And I've made all the nat changes and aon etc.
PS first post. First time user of pfsense or any other linux router distribution. Loving this (pfsense)

EDIT***
well i added the option comp-lzo to the end of the long string of options in (vpn/openvpn/client/advanced configuration)
verb 5;tun-mtu 1500;fragment 1300;keysize 128;redirect-gateway def1;persist-key;comp-lzo

and now it all works great, hope that helps


Thanks for posting mate. I'll give it a shot.. Can you clarify your other settings.

Are you using Manual NAT?
Is your VPN interface on DHCP or None?

Manual (aon)
And VPN is on none now (i tried dhcp before also and even though it showed as up it actually wasn't) but it works on none for me.

I'm too much of a newbie to really give you advice but your screen shots look like mine, i got the comp-lzo thing from looking at the system logs it showed up as warning, so i did a search on it and found another user on this forum with a different issue who put that option in and it worked for them. so maybe the logs hold the answer....
« Last Edit: October 04, 2011, 01:02:36 pm by acids7n »

Offline AuZZZie

  • Jr. Member
  • **
  • Posts: 30
  • Karma: +0/-0
    • View Profile
Re: How to create an OpenVPN client to StrongVPN
« Reply #68 on: October 07, 2011, 01:54:11 pm »
Still no success. I'm starting to wonder if something is different in the NanoBSD version that I'm using. It makes no sense that others have it working with the exact same config.

Offline AuZZZie

  • Jr. Member
  • **
  • Posts: 30
  • Karma: +0/-0
    • View Profile
Re: How to create an OpenVPN client to StrongVPN
« Reply #69 on: October 07, 2011, 03:00:38 pm »
So I restored to factory defaults.. Did everything the exact same and what do you know, it's working..  ???

Except now, despite the VPN route not being set as default and the ACL rules being in the correct order it routes EVERYTHING over the tunnel while it is connected. It completely ignores any of the PBR rules.

Losing faith in pfSense.

Offline AuZZZie

  • Jr. Member
  • **
  • Posts: 30
  • Karma: +0/-0
    • View Profile
Re: How to create an OpenVPN client to StrongVPN
« Reply #70 on: October 07, 2011, 05:13:21 pm »
VICTORY!!!

I don't know what is happening on the backend but this is what I determined. I had everything correct from the get go. The problem is I also have some IPSEC tunnels.

I blew away my config back to factory defaults and tried it again. Still couldn't get it to work. So I reset to factory defaults again, this time I created the OpenVPN client tunnel BEFORE my IPSEC tunnels. All of a sudden everything works nicely.

For whatever reason if I have my IPSEC tunnels created first I have issues. Makes no sense to me but I'm glad I've finally got it working.

Offline acids7n

  • Newbie
  • *
  • Posts: 3
  • Karma: +0/-0
    • View Profile
Re: How to create an OpenVPN client to StrongVPN
« Reply #71 on: October 10, 2011, 06:12:42 pm »
i too turned rules/settings/interfaces on and off multiple times, and the lzo compression was the last setting for me, glad us newbies got it to work, now if i can get the right firewall rule to route all netflix/hulu traffic through the vpn...

Offline AuZZZie

  • Jr. Member
  • **
  • Posts: 30
  • Karma: +0/-0
    • View Profile
Re: How to create an OpenVPN client to StrongVPN
« Reply #72 on: October 12, 2011, 10:14:15 am »
i too turned rules/settings/interfaces on and off multiple times, and the lzo compression was the last setting for me, glad us newbies got it to work, now if i can get the right firewall rule to route all netflix/hulu traffic through the vpn...

I haven't had a lot of luck routing JUST Netflix/Vudu etc traffic. I route based on source IP as I haven't managed to find definitive subnets for the Netflix content delivery system.

It works for my main devices, would be nice to route based on destination though.

Offline madbouy

  • Newbie
  • *
  • Posts: 1
  • Karma: +0/-0
    • View Profile
Re: How to create an OpenVPN client to StrongVPN
« Reply #73 on: October 23, 2011, 03:31:32 pm »
Thanks for the excellent article. I am now able to route AStrill Openvpn through my pfsense using your guide as a base. Excellent work. Thanks again.

Offline wanie

  • Newbie
  • *
  • Posts: 7
  • Karma: +0/-0
    • View Profile
Re: How to create an OpenVPN client to StrongVPN
« Reply #74 on: November 01, 2011, 05:11:12 pm »
Hi,

thanks for the howto.
I have configuratet all your steps correctly, but i'm using pp instead of strongvpn.
The VPN tunnel is working, but firewall is blocking my traffic.
AON is active.
I called the Interface "PP_CZ" and can see in the firewall log, that all traffic to the web is blocked.
I was allready trying with play arround the firewall rule, but no luck. :-(

Have anyone some advice?
If any screenshot are helpful, pleas let me know what you have to see.

regards,
wanie
« Last Edit: November 01, 2011, 05:30:27 pm by wanie »