1

I am trying to connect openvpn clients into an internal lan, so they can access a http server. pfSense as well as my http server are running on a virtual machine of my home proxmox node. Both are connected over a simple linux bridge and pfsense acts as a dhcp server.

On the pfSense VM I have also configured openvpn so clients everywhere from the word can connect to it. (Port forwarding etc...)

Network pfSense LAN: 10.44.2.0/24 (pfSense 10.44.2.254 gw) Network OpenVPN: 10.44.3.0/24 (server 10.44.3.1 no client-to-client allowed)

All routes are working and I AM ABLE TO PING from lan to vpn or from vpn to lan, both works fine. Only TCP is not working.

If I try to access the https server from 10.44.3.2 (VPN) [to 10.44.2.11 (LAN)], the connection state of the server is "SYN_RECV" and the client shows "SYN_SENT".

As far as I know, it seems that the second step (SYN,ACK) fails. I have disabled the whole pfSense firewall completely, but it didn't work.

After that, I log the network traffic:

Server:

14:18:57.571985 IP 10.44.3.2.42956 > 10.44.2.11.http: Flags [S], seq 3192289577, win 29200, options [mss 1308,sackOK,TS val 3098827 ecr 0,nop,wscale 7], length 0
14:18:57.572006 IP 10.44.2.11.http > 10.44.3.2.42956: Flags [S.], seq 2421464031, ack 3192289578, win 28960, options [mss 1460,sackOK,TS val 68259688 ecr 3098827,nop,wscale 7], length 0
14:18:57.825934 IP 10.44.3.2.42958 > 10.44.2.11.http: Flags [S], seq 2213274578, win 29200, options [mss 1308,sackOK,TS val 3098889 ecr 0,nop,wscale 7], length 0
14:18:57.825952 IP 10.44.2.11.http > 10.44.3.2.42958: Flags [S.], seq 595037825, ack 2213274579, win 28960, options [mss 1460,sackOK,TS val 68259752 ecr 3098889,nop,wscale 7], length 0
. . . . .

Client:

15:18:57.567020 IP 10.44.3.2.42956 > 10.44.2.11.http: Flags [S], seq 3192289577, win 29200, options [mss 1460,sackOK,TS val 3098827 ecr 0,nop,wscale 7], length 0
15:18:57.570249 IP 10.44.2.11.http > 10.44.3.2.42956: Flags [S.], seq 2421464031, ack 3192289578, win 28960, options [mss 1308,sackOK,TS val 68259688 ecr 3098827,nop,wscale 7], length 0
15:18:57.817649 IP 10.44.3.2.42958 > 10.44.2.11.http: Flags [S], seq 2213274578, win 29200, options [mss 1460,sackOK,TS val 3098889 ecr 0,nop,wscale 7], length 0
15:18:57.835985 IP 10.44.2.11.http > 10.44.3.2.42958: Flags [S.], seq 595037825, ack 2213274579, win 28960, options [mss 1308,sackOK,TS val 68259752 ecr 3098889,nop,wscale 7], length 0
15:18:58.567001 IP 10.44.3.2.42956 > 10.44.2.11.http: Flags [S], seq 3192289577, win 29200, options [mss 1460,sackOK,TS val 3099077 ecr 0,nop,wscale 7], length 0
15:18:58.568639 IP 10.44.2.11.http > 10.44.3.2.42956: Flags [S.], seq 2421464031, ack 3192289578, win 28960, options [mss 1308,sackOK,TS val 68259938 ecr 3098827,nop,wscale 7], length 0
15:18:58.570778 IP 10.44.2.11.http > 10.44.3.2.42956: Flags [S.], seq 2421464031, ack 3192289578, win 28960, options [mss 1308,sackOK,TS val 68259938 ecr 3098827,nop,wscale 7], length 0
15:18:58.815006 IP 10.44.3.2.42958 > 10.44.2.11.http: Flags [S], seq 2213274578, win 29200, options [mss 1460,sackOK,TS val 3099139 ecr 0,nop,wscale 7], length 0
. . . .

So it seems, that step one of tcp works fine. After that, SYN,ACK is sent but I cannot find a ACK package.

As I said, routes are fine, because ping is working.

Any Ideas?!

Improve this question

2 Answers 2

Reset to default
1

I solved problem with changing the network interfaces of pfsense from VIRTIO to E1000.

It seems that some packages get lost with Proxmox's VIRTIO drivers.

Improve this answer
0

This issue is not related to pfSense.

The real cause is that hardware offload on Virtio driver seems to be not supported or broken for BSD. You don't need to switch back to E1000.

Go to System -> Advanced -> Networking set mark on: Disable hardware checksum offload

Right after You save settings communication starts immediately - it even doesn't need to be rebooted.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy