OpenVPN road warrior not being routed to WAN

Started by beyond, March 14, 2019, 10:35:39 PM

Previous topic - Next topic
March 14, 2019, 10:35:39 PM Last Edit: March 17, 2019, 12:38:18 AM by beyond
Hi everyone.

Short version of my problem is:
Are there differences in OpenVPN to WAN routing behaviour between pfSense and OPNsense?

Now here's the long version:

I had a pfSense instance running on a DigitalOcean droplet.
It had an OpenVPN server for road warrior connections that would be routed out to WAN.

Then I found out about OPNsense and redid the whole installation with that, or at least that was the plan.
The said OpenVPN server is also set up to allow road warriors to connect and get routed to WAN.
Connected as road warrior I can ping everything inside the router's private networks, but anything beyond that is either not reachable or doesn't get its replies routed back.
I have tried an accept all rule on the OpenVPN interface as well as an accept all rule for the VPN tunnel IP range, but to no avail.

Any hint would be appreciated.

Tried several rule combinations once more, but with no success at all.

Solution: Using pfSense again.  :-[

Are you using OpenVPN plugin in OPNsense or have separate OpenVPN server that needs to be routed by OPNsense?

I use an OpenVPN VM behind OPNsense that acts as road warrior VPN; I can connect to my OpenVPN remotely and have all my traffic routed through my home. Is this what you are trying to do?

Are you proposing a possible bug in the OpenVPN plugin? I was beginning to think in that direction at least.
Since I am using a DigitalOcean droplet (hence virtual machine) it also employs the OpenVPN plugin for sake of a minimum number of machines required.

If the WAN routing worked i would then set up a site to site vpn form/to my home network to this machine as well in order to reach home when being outside.
And that's because my home network only has a NATed IPv4 adress plus a public IPv6 adress, with the latter being useless as my mobile service provider doesn't have IPv6 implemented yet.