Access of OpenVPN clients to IPsec s2s vpn remote subnets

[HatalaTitla48]

Hi, Im searching for solution on howto let OpenVPN users access to the subnets behind IPsec vpn tunel. I did not find any up to date howto, just some hints here and there without any comprehensive text explaining how to setup this in current version of opnsense.

Connection schema is very basic, just: |*opnsensebox1 with (openvpn(for users) + ipsec vpn(s2s)*| --> |*opnsensebox1 with ipsec vpn(s2s)*|.

All I need right now is for users of openvpn(192.168.202.0/27 on box1) to access subnets(172.25.26.0/24) on box2 behind ipsec. So far I found only this "https://forum.opnsense.org/index.php?topic=40665.0" discussion, but it did not work for me. I must ommiting some additional steps needed for configuration. Do anybody has any functional instructions howto to achieve this?

Thx in sdvance.

[JamesFrisch]

So you want an IPsec site A to site B connection?
Plus VPN users to your side A?


I personally would not do it. Why connect over a hop, when clients could directly connect to site B?

And I would use Wireguard instead.

What we got:

Your wireguard clients on site A are in this subnet: 192.168.202.0/27

Your site A subnet you did not tell, so I will just assume 192.168.200.0/24 as example.

Your site B subnet is 172.25.26.0/24


Config on the wireguard clients:

[Peer]
PublicKey = <site-a-public-key>
Endpoint = <site-a-public-ip>:51820
AllowedIPs = 192.168.202.0/27, 192.168.200.0/24

road warrior clients config on site a
[Peer]
PublicKey = <client-public-key>
AllowedIPs = 192.168.202.2/32

site to site config on site a
[Peer]
PublicKey = <site-b-public-key>
Endpoint = <site-b-public-ip>:51821
AllowedIPs = 192.168.202.2/32, 172.25.26.0/24

site to site config on site b
[Peer]
PublicKey = <site-b-public-key>
Endpoint = <site-b-public-ip>:51821
AllowedIPs = 192.168.200.0/24, 192.168.202.2/32



AFAIK that should work. Even without NAT rules. But I haven't tested it.

[HatalaTitla48]

Thx for reply.

Well situation is given and I cant switch from openvpn for roadwariors to something else. I already have functional IPsec s2s vpn running between boxes and there is not problem with that. Now I just need my openvpn users get to the subnets behind ipsec vpn on boxB(172.25.26.0/24). Iv get to the point of "Manual SPD entries in the IPSec Phase2", but even with this, its not working, I must just misst some crutial next step to get this working...

[viragomann]

This assumes, that you administer both sites of the IPSec and that it's in tunnel mode. If so, there is no need for manual SPDs.

On both nodes add an IPSec child for 192.168.202.0/27 <> 172.25.26.0/24.
Ensure that both adds the respective sPDs properly.

In the OpenVPN server settings add 172.25.26.0/24 to the "Local Networks" to push to route to the clients.

[HatalaTitla48]

Uf, I already tried this, but I forgot to put openvpn internal route subnet 192.168.202.0/27 to ipsec internal subnets...I need vacation for real.
Thx boss!