My OpenVPN server has a local IP address 10.21.1.4 (it's on the 10.21.1.0/24 subnet), and uses the 10.21.4.0/24 subnet for the tunnel. What route should I push to grant VPN clients access to the LAN (10.21.1.0/24)?
Should it be push "route 10.21.1.0 255.255.255.0" or push "route 10.21.4.0 255.255.255.0"?
UPDATE 1
Doing push "route 10.21.1.0 255.255.255.0" still doesn't allow my VPN clients to access the LAN. Momentarily, I added the following rules on the WAN and LAN interfaces:
Protocol: IPv4* Source: * Port: * Destination: * Port: * Gateway: * 1 Answer
You don't need to push the tunnel route, the client and server will both know about that (they figure that out in the setup). The server will push things that aren't part of the tunnel -- it's other interfaces.
Also, pfSense will need explicit pass rules on the LAN and VPN interfaces for the VPN traffic. So, assign you VPN server to an interface, it makes things easier, On pfSense, lets use the (assign) option under the interfaces menu to assign it to OPT1. Then:
Firewall->Rules->OPT1 create a new rule (at the top is fine).
Action pass, Interface OPT1, IPv4, protocol any, source OPT1 net, destination any, description "let opt1 talk to anybody", save and apply
That rule says that all traffic that comes in from vpn clients is allowed to leave the firewall (to any destination)
Now we have to create a rule that says LAN clients are allowed to talk to VPN clients:
Firewall->Rules->LAN create a new rule (at the top is fine).
Action pass, Interface LAN, IPv4, protocol any, source LAN net, destination OPT1, description "let LAN talk to opt1", save and apply
note that we probably don't need this since the lan is very likely already allowed to talk to everybody but we're trying to make this easy right now.
Now, back to the OpenVPN options:
Say the server's lan interface is 10.20.30.40/24
push "route 10.20.30.40 255.255.255.0" You may want enable netbios if you use Samba/Microsoft. You probably want to add an in-office DNS.
Hope this helps.
8
