I am trying to connect openvpn clients into an internal lan, so they can access a http server. pfSense as well as my http server are running on a virtual machine of my home proxmox node. Both are connected over a simple linux bridge and pfsense acts as a dhcp server.
On the pfSense VM I have also configured openvpn so clients everywhere from the word can connect to it. (Port forwarding etc...)
Network pfSense LAN: 10.44.2.0/24 (pfSense 10.44.2.254 gw) Network OpenVPN: 10.44.3.0/24 (server 10.44.3.1 no client-to-client allowed)
All routes are working and I AM ABLE TO PING from lan to vpn or from vpn to lan, both works fine. Only TCP is not working.
If I try to access the https server from 10.44.3.2 (VPN) [to 10.44.2.11 (LAN)], the connection state of the server is "SYN_RECV" and the client shows "SYN_SENT".
As far as I know, it seems that the second step (SYN,ACK) fails. I have disabled the whole pfSense firewall completely, but it didn't work.
After that, I log the network traffic:
Server:
14:18:57.571985 IP 10.44.3.2.42956 > 10.44.2.11.http: Flags [S], seq 3192289577, win 29200, options [mss 1308,sackOK,TS val 3098827 ecr 0,nop,wscale 7], length 0
14:18:57.572006 IP 10.44.2.11.http > 10.44.3.2.42956: Flags [S.], seq 2421464031, ack 3192289578, win 28960, options [mss 1460,sackOK,TS val 68259688 ecr 3098827,nop,wscale 7], length 0
14:18:57.825934 IP 10.44.3.2.42958 > 10.44.2.11.http: Flags [S], seq 2213274578, win 29200, options [mss 1308,sackOK,TS val 3098889 ecr 0,nop,wscale 7], length 0
14:18:57.825952 IP 10.44.2.11.http > 10.44.3.2.42958: Flags [S.], seq 595037825, ack 2213274579, win 28960, options [mss 1460,sackOK,TS val 68259752 ecr 3098889,nop,wscale 7], length 0
. . . . .
Client:
15:18:57.567020 IP 10.44.3.2.42956 > 10.44.2.11.http: Flags [S], seq 3192289577, win 29200, options [mss 1460,sackOK,TS val 3098827 ecr 0,nop,wscale 7], length 0
15:18:57.570249 IP 10.44.2.11.http > 10.44.3.2.42956: Flags [S.], seq 2421464031, ack 3192289578, win 28960, options [mss 1308,sackOK,TS val 68259688 ecr 3098827,nop,wscale 7], length 0
15:18:57.817649 IP 10.44.3.2.42958 > 10.44.2.11.http: Flags [S], seq 2213274578, win 29200, options [mss 1460,sackOK,TS val 3098889 ecr 0,nop,wscale 7], length 0
15:18:57.835985 IP 10.44.2.11.http > 10.44.3.2.42958: Flags [S.], seq 595037825, ack 2213274579, win 28960, options [mss 1308,sackOK,TS val 68259752 ecr 3098889,nop,wscale 7], length 0
15:18:58.567001 IP 10.44.3.2.42956 > 10.44.2.11.http: Flags [S], seq 3192289577, win 29200, options [mss 1460,sackOK,TS val 3099077 ecr 0,nop,wscale 7], length 0
15:18:58.568639 IP 10.44.2.11.http > 10.44.3.2.42956: Flags [S.], seq 2421464031, ack 3192289578, win 28960, options [mss 1308,sackOK,TS val 68259938 ecr 3098827,nop,wscale 7], length 0
15:18:58.570778 IP 10.44.2.11.http > 10.44.3.2.42956: Flags [S.], seq 2421464031, ack 3192289578, win 28960, options [mss 1308,sackOK,TS val 68259938 ecr 3098827,nop,wscale 7], length 0
15:18:58.815006 IP 10.44.3.2.42958 > 10.44.2.11.http: Flags [S], seq 2213274578, win 29200, options [mss 1460,sackOK,TS val 3099139 ecr 0,nop,wscale 7], length 0
. . . .
So it seems, that step one of tcp works fine. After that, SYN,ACK is sent but I cannot find a ACK package.
As I said, routes are fine, because ping is working.
Any Ideas?!
