Messages

Hi,

you are right, my Phase 2 entry only contains the local LAN subnet (just too much trees in the forest :-) ). However: I don't seem to be able to put multiple networks there and can alternatively only select the physical interface adapters (WAN network, LAN network, HA network) which will most likely not contain my OpenVPN instances I guess. How would you have multiple subnets installed at this point?

Thanks!

A traceroute Lan -> IPSec looks good:

mtr -r -i 0.1 -c 10 10.242.108.2
Start: Wed Sep 6 05:59:10 2017
HOST: gitlab1 Loss% Snt Last Avg Best Wrst StDev
1.|-- 10.242.106.1 0.0% 10 0.2 0.2 0.2 0.4 0.0
2.|-- 10.242.108.2 0.0% 10 2.0 2.0 1.9 2.6 0.0

Hello,

I have the following setup running:

- the OPNsense has a working IPsec connection to Google cloud established via public Internet
- the OPNsense provides a working OpenVPN server
- the OPNsense provides direct LAN to local servers
- the local server can reach the IPsec IP subnet
- the OpenVPN clients cannot reach the IPsec IP subnet
- the firewall itself (using interface diagnostics) can't reach the IPsec subnet (ping an IP there)
- the IPsec subnet 10.242.108.0/24 has a route installed on the firewall pointing to the WAN Gateway which should be wrong in my eyes
- a traceroute via OpenVPN shows, that an attempt to reach a Google IPsec IP is routed via WAN and stops there
- a traceroute via LAN to IPSec is asked for, waiting for customer reply
- firewall permit rules are installed, the OpenVPN instances have a "permit any" but I suspect the issue to be the route

What else can I provide? Maybe someone already has an idea.


Best,
Nico