This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Computers behind OpenVPN Client cannot reach Clients behind Astaro

Good Afternoon guys,

since 7 days I am working on raspberrypi gateway solution in conjunction with the Astaro FW v9. The raspberryPi has the default ethernet NIC and  has been equpied with a WIFI stick. RaspberyPi shall open a OpenVPN connection over internet to Astaro. Simple client server connection. The OpenVPN linkage shall be initiated over WIFI. The computer which will be hooked up with the default ethernet NIC shall be capable to reach all networks behind Astaro over Tun0.

Initializing OpenVPN(SSL):
RaspberryPi_Wlan0-->Internet->Astaro_includingOpenVPNServer

Stationary Usage:
Computer_Eth0-->Eth1_RaspberryPi_Tun0-->LocalNet1
                                                              -->LocalNet2
                                                              -->LocalNet3

What I did already accomplish

Computer is able to reach Eth1 by ping
Eth1 is able to reach all LocaNet's behind Tun0

What I didn't
The computer cannot reach the LocalNet's

In a different board I've been advised to adapt the SSL (OpenVPN)Server according to command-> push "redirect-gateway def1".
HOWTO

Hence, clients are supposed to be able to reach networks behind tun0

Since Astaro hasn't the diversity to make real customized configs from a webinterface point of view would it be viable to adapt this SSL (OpenVPN)config manually via SSH?

I appreciate every advice

regards

This thread was automatically locked due to age.

0 Nobbi over 12 years ago

After thinking about it again...I think I got it theoretically

I've used the remote SSL variant it should be rather a site to site connection...hmm however, I am just struggling to convert apc file to ovpn! Is there now a convinient way to convert it or it is still required to set up a virtual machine as Astaro client?
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 12 years ago

Hi, Nobbi,

First, just to be sure this isn't something simple...  On the 'ICMP' tab of 'Firewall' is where pinging is regulated - does enabling more behavior fix your issue?

I'm afraid that I'm not following your description of what you're trying to accomplish, so let me try to say the same thing in my own words, and then you can correct any misunderstandings.

You have two sites that you want to connect via site-to-site SSL VPN.  An Astaro running OpenVPN server is at site "A" and there's a device at site "B" running the client side of the software.

Is that right?  Is your goal a full tunnel pushing all of the traffic from "B" computers through the tunnel to the Astaro?  Or, do you want the tunnel to handle only the traffic from "B" to local networks connected to the Astaro at "A"?

Here's a recent thread that addresses this: https://community.sophos.com/products/unified-threat-management/astaroorg/f/58/t/54797

If you don't get the result you want, please [Go Advanced] below and show a picture of your SSL VPN Server configuration.

Cheers - Bob
PS here's one solution going the other way: OVPN to APC Converter | WhoCares?

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 Nobbi over 12 years ago in reply to BAlfson

Hey Bob,

thanks for your reply

...I've attached a schematic overview.

You have two sites that you want to connect via site-to-site SSL VPN.
right

An Astaro running OpenVPN server is at site "A" and there's a device at site "B" running the client side of the software.
right

Is your goal a full tunnel pushing all of the traffic from "B" computers through the tunnel to the Astaro?
Or, do you want the tunnel to handle only the traffic from "B" to local networks connected to the Astaro at "A"?
I wanna reach the clients in each net! For instance in net 192.168.1.0 is a SSH server running.I wanna have access via Port22

regards
- Network.jpg
- View
- Hide
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 12 years ago

If the one laptop is the only thing that needs to reach the networks behind the OpenVPN server, I think I'd just make a Firewall rule
Allow : {192.168.0.243} -> {TCP/UDP 1:65535→1194} -> Internet

and then install an OpenVPN client in the laptop.

If not, then use the link in my PS above to configure the client side of a site-to-site in the Astaro.

One thing about your diagram confuses me. Under tun0 in the Astaro, you have 192.168.10.6. That would cause a conflict with 192.168.10.0/24 on the OpenVPN server site.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 Nobbi over 12 years ago in reply to BAlfson

Hi Bob,

I don't wanna have the Laptop as client. This has to be done by RaspberryPi

Regarding your confusion 192.168.10.6 is a IP of the DHCP VPN-Adresspool. I don't see any problems with that. Maybe you can explain your concerns a bit more.

Next issue I've followed the following HowTO I just stuck at item 5! There is no folder of the "Name of the Connection" only the config-default file! Have anyone an idea?..I am clueless

regards

1. You download the client configuration from the server connection
2. on the 2nd Astaro you configure the client endpoint by uploading the config file.
3. Make sure the tunnel is up and functional (green status).
4. Enable shell access for loginuser -> SSH into client Astaro -> "sudo -s" (don't passwd root!!).
5. cd /var/sec/chroot-openvpn/client/"NAMEOFYOURCONNECTION"/
6. "ls -al" shows you all the files you need for your openvpn-client.
-> Option a: scp these files to any backup location.
-> Option b: open every file with vim and copy it's contents and paste into a new file exactly matching the name
7. Now copy these files to any machine running openvpn and rename (only) the config file to smthg. like config.conf so it can be recognized as an openVPN configuration by openVPN. openVPN will look for a configuration in /etc/openvpn by default, so put it somewhere there so that openVPN is automatically started and configured with every disconnect or system reboot.
8. The forelast step is to vim the config.conf and check where it is looking for the cert, key and auth files. You may change the path entries to the new location of the files or you put all the files except the .conf where they are searched for.
Cancel
Vote Up 0 Vote Down

Cancel

Computers behind OpenVPN Client cannot reach Clients behind Astaro

Submitted a Tech Support Case lately from the Support Portal?