Access to remote ipsec site from OpenVPN client

[fonzie2k (T A)]

Hi!

I am having a hard time figuring out how openvpn clients (client to site) can access an remote network over an ipsec tunnel.

I have two sites, each site with an ipfire instance. They are connected by ipsec (192.168.1.0/24 and 192.168.10.0/24).

Traffic from green to green between those sites, works great.

But when i connect to one of the ipfires with an openvpn client, i can only reach green on that ipfire. I want to reach both.

I have successfully pushed routes to both green networks to the openvpn client. I can not see any drops in the firewall logs. I have also experimentet with some firewall rules to make sure the openvpn client subnet is allowed on the «remote ipsec green subnet», but with no luck.

Is it possible to do somehow?

[disturbeddragon]

The IPSEC connection should be transparent and allowed once connected to the first LAN segment by openvpn. There have been a few instances of proper rules not working when crossing subnets, especially interested.

Multiple subnets in IPsec: Only first one is reachable

The local IPFire initiates a connection to a partner’s remote system. The remote endpoint is not ipfire (don’t know what exactly) but capable of handling multiple subnets with one connection. Problem: The tunnel is established, and I can ping a host on the first subnet, but not on the second subnet. This used to work right after the connection had been configured in IPFire, but not anymore after we updated to Core 141 and restarted yesterday. I doubt it has something to do with the update as o…

Blue on Office2 to Green on Office1 with IPSec

Hi, i’ve have two Offices with IpFire, both IpFire’s connected with IPsec. All works fine without any issues on Green. My Issue: When a device is connected on Blue on Office2 i could not reach a device on Green in Office1. Think a solutuon could be IPSec N2N Blue to VPN connectivity but i don’t know what handle the two entrys. What have i todo? Or is there an other way? Thanks for help. Best Regards Nick Red > Internet, Green > Internal, Blue > WiFi

I would file a bug report.

[tg92 (T G)]

hi,

do you try to push a route to our ipsec network in the section " Advanced server options"?
no sure it is the good way to do it but …

Advanced server options - The IPFire Wiki

[disturbeddragon]

This should definitely work, but I tried this on my IPFIRE machine. Made it so openvpn access is allowed to local green subnet and remote IPSEC subnet but connections still fail to remote subnet.

Update - Tried making firewall rules pushing OVPN to IPSEC and vice versa using NAT forcing all to Green and not using NAT. None of the rules will work to access the remote subnet.

Fails.

Fails.

[odongarma]

Hi!

Is there any solution to this?

I run into the same situation:

• working IPSec VPN from green
• roadwarriors using OpenVPN to green
• pushing route to external IPSec Subnetz via OpenVPN
• no ping result at all from OPenVPN-Client to Host in ext. IPSec Subnet
• i tried some SNAT stuff but without any success

Someone has a hint?

Greetz

[tphz (iptom)]

I hope the following IPFire documentation pages will be helpful

Traverse Net-to-Net VPN from Road Warrior

"Hub & Spoke" Configuration

Regards

[nickh (Nick Howitt)]

In your IPsec configuration have you added the OpenVPN subnet to the configuration?

I don’t use OpenVPN in IPF so I don’t know what firewall rules it generates, but it may also work if the OpenVPN subnet gets MASQUERADE’d in the POSTROUTING chain of the firewall.

[tphz (iptom)]

Today I made a test so that the OpenVPN RoadWarior client connected to IPFireA has a connection to the green IPFireB network
(IPFireA and IPFireB connected by IPsec tunnel)

I added an “OpenVPN subnet” from IPFireA to:
-IPFireA (IPsec tunnel settings) to the “Local subnet” field.
-IPFireB (IPsec tunnel settings) to the “Remote subnet” field

And it seems to be working.

edit
If the RoadWarrior client has an address from the “Static IP address pool” then enter this subnet.

[odongarma]

Thanks for all the help.

But this does not work for me.

I guess becaus i can not “IPSec” the OpenVPN Network, the remote site does not accept this. I can only use my green subnet.
So my guess was SNAT??

My Setup

• Green: 192.168.2.0/24
• IPSec Remote: 172.22.33.0/24
• OpenVPN Roadwarrior Pool: 10.206.191.0/24
• OpenVPn dynamic Pool: 10.206.190.0/24

On green i can connect to servers on Remote IPsec site
Connecting via OpenVPN to green gives access to green Servers
i push the OpenVPN route to IPSec Remote
i played with firewall rules (SNAT, DNAT) but on OpenVPN Client i can not even ping a single IPsec Remote Server eq. 172.22.33.209. the result is “remote network not availiable”

Any advice?

[nickh (Nick Howitt)]

Try adding to your IPsec tunnel local subnet 10.206.190.0/23 <> 172.22.33.0/24.

[odongarma]

I can not add the OpenVPN Subnet to the IPSec connection, because the remote site only accept our green subnet but not our OpenVPN Subnet.

Is this mandatory to work?

I thought SNAT will do the magic?

Thanks

[nickh (Nick Howitt)]

IPsec is a weird beast and does some low level things to the packets in the kernel so it can bypass a lot of the firewall. I had a feeling SNAT (or MASQUERADE) would not work because of this.

Does your remote end allow you to add another tunnel definition, perhaps with the same credentials?

Another trick you can pull is to move your OpenVPN subnet adjacent to your LAN subnet. Then you just use one tunnel with IPsec with the larger subnet. e.g. if your LAN subnet is 172.16.0..0/24, make your OpenVPN subnet 172.16.1.0/24, then set up your IPsec tunnel with 172.16.0.0/23.

[odongarma]

Yeah, that is exactly what i feel about this.

Can any dev confirm this??

Greetz and big Thanks!!!

[nickh (Nick Howitt)]

Have you tried my trick of putting the subnets adjacent to each other.

[odongarma]

No i did not try that trick. It is charming yes, but due to this is a productiv system i need to setup a maintance window to try this out…

Greetz

[tphz (iptom)]

Yet another possibility is that RoadWarrior can be connected to multiple IPFires at the same time.

After adding multiple “virtual network adapters” , the RoadWarrior client can connect to multiple IPFires at one time.