<div class="bbWrapper"><blockquote data-attributes="member: 80103" data-quote="Sasquatch" data-source="post: 604862"
class="bbCodeBlock bbCodeBlock--expandable bbCodeBlock--quote js-expandWatch">
<div class="bbCodeBlock-title">
<a href="/community/goto/post?id=604862"
class="bbCodeBlock-sourceJump"
rel="nofollow"
data-xf-click="attribution"
data-content-selector="#post-604862">Sasquatch said:</a>
</div>
<div class="bbCodeBlock-content">
<div class="bbCodeBlock-expandContent js-expandContent ">
Second that, feature request? add tick box: "give vpn clients access to local network" ??<br />
<br />
At the moment only trueanas GUI and ssh is accessible for build in OpenVpn clients.<br />
And that only on desktop, for some reason neither works on mobile...
</div>
<div class="bbCodeBlock-expandLink js-expandLink"><a role="button" tabindex="0">Click to expand...</a></div>
</div>
</blockquote><br />
<br />
Did have you any luck making this routable?</div>
<div class="bbWrapper">mine upgraded without issues.<br />
Thing is, i can connect and access SMB shares and GUI on windows/linux desktops(trough openvpn from remote location), but on android I can't access neither despite being able to ping in both directions, no errors or warnings in openvpn log.</div>
<div class="bbWrapper"><blockquote data-attributes="member: 80103" data-quote="Sasquatch" data-source="post: 606496"
class="bbCodeBlock bbCodeBlock--expandable bbCodeBlock--quote js-expandWatch">
<div class="bbCodeBlock-title">
<a href="/community/goto/post?id=606496"
class="bbCodeBlock-sourceJump"
rel="nofollow"
data-xf-click="attribution"
data-content-selector="#post-606496">Sasquatch said:</a>
</div>
<div class="bbCodeBlock-content">
<div class="bbCodeBlock-expandContent js-expandContent ">
mine upgraded without issues.<br />
Thing is, i can connect and access SMB shares and GUI on windows/linux desktops(trough openvpn from remote location), but on android I can't access neither despite being able to ping in both directions, no errors or warnings in openvpn log.
</div>
<div class="bbCodeBlock-expandLink js-expandLink"><a role="button" tabindex="0">Click to expand...</a></div>
</div>
</blockquote><br />
Are you able to share your client config? Did you make any changes?</div>
<div class="bbWrapper">just changed remote to my domain name( I'm on dynamic dns), everything else is as generated from GUI.<br />
<br />
my server additional parameters:<br />
<div class="bbCodeBlock bbCodeCode"><div class="type">Code:</div><pre>push "route 192.168.69.0 255.255.255.0"
client-to-client
verb 4</pre></div></div>
<div class="bbWrapper">Thank you for the additional server parameters. I can now ping my Freenas box that's where my access stops. I'm not able to get anywhere else on the Lan. In regards to the android issue are you using TAP? If you are it appears it's not compatible with Android or IOS.<br />
<br />
<div>
<a href="https://community.openvpn.net/openvpn/wiki/BridgingAndRouting"
class="link link--external"
target="_blank"
rel="nofollow ugc noopener"
data-proxy-href="">
https://community.openvpn.net/openvpn/wiki/BridgingAndRouting
</a>
</div></div>
<div class="bbWrapper">Has anyone figured out LAN routing? Maybe something like promiscuous mode on a NIC and/or a route from the vpn subnet on the tun interface to the local net. I’d very much like to get this working.</div>
<div class="bbWrapper">I was able to get routing to my local network "working".<br />
<br />
My Truenas is 10.15.207.10 on my lan, main nic is bge0<br />
My VPN server is configured Server = 10.9.0.0/24, Device Type=TUN, Topolgy=SUBNET<br />
<br />
Services > OpenVPN Server > Additional Parameters:<br />
<div class="bbCodeBlock bbCodeCode"><div class="type">Code:</div><pre>local 10.15.207.10
push "route 10.15.207.0 255.255.255.0"
route 10.15.207.10 255.255.255.0 10.9.0.1
push "dhcp-option DNS 10.15.207.1"</pre></div><br />
<br />
Create a file on the USB drive...Admittedly, I don't know where this should go. I put it in /data/ipfw.rules If there is a more proper place for me to store this file, please let me know.<br />
/data/ipfw.rules<br />
<div class="bbCodeBlock bbCodeCode"><div class="type">Code:</div><pre>ipfw -q -f flush
ipfw -q nat 1 config if bge0
ipfw -q add nat 1 all from 10.9.0.0/24 to any out via bge0
ipfw -q add nat 1 all from any to any in via bge0</pre></div><br />
<br />
Create the following tunables<br />
<br />
System > Tunables:<br />
<div class="bbCodeBlock bbCodeCode"><div class="type">Code:</div><pre>Variable=gateway_enable
Value=yes
Type=rc
Description=ip forwarding
Enabled=yes</pre></div><br />
<br />
<div class="bbCodeBlock bbCodeCode"><div class="type">Code:</div><pre>Variable=firewall_enable
Value=YES
Type=rc
Description=firewall for openvpn
Enabled=yes</pre></div><br />
<br />
<div class="bbCodeBlock bbCodeCode"><div class="type">Code:</div><pre>Variable=firewall_script
Value=/data/ipfw.rules
Type=rc
Description=firewall rules for openvpn
Enabled=yes</pre></div><br />
<br />
Reboot, once the machine is up, vpn in and try to access a machine on your LAN.</div>
<div class="bbWrapper">I've found bottlenecks when testing throughput of the OpenVPN. I've seen this in Freenas 11.3 as well. Scenario in Truenas is running the OpenVpn Server Service, scenario on Freenas was OpenVPN installed in an iocage jail with NAT & VNET. <br />
<br />
LAN to LAN transfer to-from Truenas shows 105-110MB/s within my network (full utilization of my local 1gbps network).<br />
<br />
In my testing (500/500 internet connection at my house) went to neighbor's house (500/500 internet at neighbor's house just down the street) I routinely saw 10-11MB/s on SCP of files to/from the NAS. While getting files inside a jail which has a mountpoint to the nas OR other machines on the LAN was yielding 30-35MB/s. Straight SCP using a DMZ to a computer on the LAN (bypassing VPN completely) yielded 50-55MB/s transfer.<br />
<br />
I'm guessing there is something in the FreeBSD network tuning that just doesn't like routing files out the VPN interface faster than 100mbit...but I have no idea what the issue is. My work around is to host an iocage jail with a mountpoint. I still see vpn overhead (in theory max rates would be close to 60MB/s), but transfers are 30MB/sec which is 3X better than the 10MB/sec I see when hitting the storage pool directly over VPN .</div>
<div class="bbWrapper"><blockquote data-attributes="member: 40428" data-quote="deanhuff" data-source="post: 611177"
class="bbCodeBlock bbCodeBlock--expandable bbCodeBlock--quote js-expandWatch">
<div class="bbCodeBlock-title">
<a href="/community/goto/post?id=611177"
class="bbCodeBlock-sourceJump"
rel="nofollow"
data-xf-click="attribution"
data-content-selector="#post-611177">deanhuff said:</a>
</div>
<div class="bbCodeBlock-content">
<div class="bbCodeBlock-expandContent js-expandContent ">
I was able to get routing to my local network "working".<br />
<br />
My Truenas is 10.15.207.10 on my lan, main nic is bge0<br />
My VPN server is configured Server = 10.9.0.0/24, Device Type=TUN, Topolgy=SUBNET<br />
<br />
Services > OpenVPN Server > Additional Parameters:<br />
<div class="bbCodeBlock bbCodeCode"><div class="type">Code:</div><pre>local 10.15.207.10
push "route 10.15.207.0 255.255.255.0"
route 10.15.207.10 255.255.255.0 10.9.0.1
push "dhcp-option DNS 10.15.207.1"</pre></div><br />
<br />
Create a file on the USB drive...Admittedly, I don't know where this should go. I put it in /data/ipfw.rules If there is a more proper place for me to store this file, please let me know.<br />
/data/ipfw.rules<br />
<div class="bbCodeBlock bbCodeCode"><div class="type">Code:</div><pre>ipfw -q -f flush
ipfw -q nat 1 config if bge0
ipfw -q add nat 1 all from 10.9.0.0/24 to any out via bge0
ipfw -q add nat 1 all from any to any in via bge0</pre></div><br />
<br />
Create the following tunables<br />
<br />
System > Tunables:<br />
<div class="bbCodeBlock bbCodeCode"><div class="type">Code:</div><pre>Variable=gateway_enable
Value=yes
Type=rc
Description=ip forwarding
Enabled=yes</pre></div><br />
<br />
<div class="bbCodeBlock bbCodeCode"><div class="type">Code:</div><pre>Variable=firewall_enable
Value=YES
Type=rc
Description=firewall for openvpn
Enabled=yes</pre></div><br />
<br />
<div class="bbCodeBlock bbCodeCode"><div class="type">Code:</div><pre>Variable=firewall_script
Value=/data/ipfw.rules
Type=rc
Description=firewall rules for openvpn
Enabled=yes</pre></div><br />
<br />
Reboot, once the machine is up, vpn in and try to access a machine on your LAN.
</div>
<div class="bbCodeBlock-expandLink js-expandLink"><a role="button" tabindex="0">Click to expand...</a></div>
</div>
</blockquote><br />
Alternatively if you do not want to do nat and enable firewalling on your freenas you can just enable the gateway_enable tunable and add a static route to your default router for the vpn network.<br />
<br />
For your example adding :<br />
<br />
<div class="bbCodeBlock bbCodeCode"><div class="type">Code:</div><pre>push "route 10.15.207.0 255.255.255.0"
push "dhcp-option DNS 10.15.207.1"</pre></div><br />
<br />
to Services > OpenVPN Server > Additional Parameters: <br />
<br />
and static route<br />
<div class="bbCodeBlock bbCodeCode"><div class="type">Code:</div><pre>10.9.0.1/24 via 10.15.207.10</pre></div><br />
<br />
to your router will work without nating and firewalling . The source of the ip packets that local clients will receive will be of the vpn network .<br />
This way you can add more 'pushed' networks to your ovpn clients if you have more vlans for example.</div>
<div class="bbWrapper"><blockquote data-attributes="member: 91543" data-quote="tumpanaios" data-source="post: 613743"
class="bbCodeBlock bbCodeBlock--expandable bbCodeBlock--quote js-expandWatch">
<div class="bbCodeBlock-title">
<a href="/community/goto/post?id=613743"
class="bbCodeBlock-sourceJump"
rel="nofollow"
data-xf-click="attribution"
data-content-selector="#post-613743">tumpanaios said:</a>
</div>
<div class="bbCodeBlock-content">
<div class="bbCodeBlock-expandContent js-expandContent ">
Alternatively if you do not want to do nat and enable firewalling on your freenas you can just enable the gateway_enable tunable and add a static route to your default router for the vpn network.
</div>
<div class="bbCodeBlock-expandLink js-expandLink"><a role="button" tabindex="0">Click to expand...</a></div>
</div>
</blockquote><br />
I've run into problems with this approach due to my terrible ISP provided router/gateway at the office. If I can persuade the boss to spring for a real router, I think this is certainly the way to go. <br />
<br />
As it stands with my current fios G1100 router, I was able to get the route added and I have connectivity. <br />
<br />
VPN clients ping LAN addresses.<br />
LAN addresses can ping VPN clients.<br />
<br />
LAN addresses can SSH into VPN clients<br />
VPN clients can SSH into the NAS via the VPN subnet<br />
VPN clients can SSH into the router/gateway<br />
If immediately after reboot of a LAN computer, VPN clients can SSH into LAN Addresses<br />
Aprox 30 seconds after boot, VPN clients fail to ssh into LAN addresses and receive: Connection reset by peer<br />
<br />
I suspect the router is blocking access from my routed vpn subnet into the primary net. But, there is no packet filtering option in the "firewall" (and i use that term loosely) of the router.</div>
<div class="bbWrapper"><blockquote data-attributes="member: 91543" data-quote="tumpanaios" data-source="post: 613743"
class="bbCodeBlock bbCodeBlock--expandable bbCodeBlock--quote js-expandWatch">
<div class="bbCodeBlock-title">
<a href="/community/goto/post?id=613743"
class="bbCodeBlock-sourceJump"
rel="nofollow"
data-xf-click="attribution"
data-content-selector="#post-613743">tumpanaios said:</a>
</div>
<div class="bbCodeBlock-content">
<div class="bbCodeBlock-expandContent js-expandContent ">
This way you can add more 'pushed' networks to your ovpn clients if you have more vlans for example.
</div>
<div class="bbCodeBlock-expandLink js-expandLink"><a role="button" tabindex="0">Click to expand...</a></div>
</div>
</blockquote>Thanks for this explanation and guidance. It is exactly what I was looking for. Now I can access my Lan and Vlan's via OpenVPN connection.</div>
<div class="bbWrapper"><blockquote data-attributes="member: 91543" data-quote="tumpanaios" data-source="post: 613743"
class="bbCodeBlock bbCodeBlock--expandable bbCodeBlock--quote js-expandWatch">
<div class="bbCodeBlock-title">
<a href="/community/goto/post?id=613743"
class="bbCodeBlock-sourceJump"
rel="nofollow"
data-xf-click="attribution"
data-content-selector="#post-613743">tumpanaios said:</a>
</div>
<div class="bbCodeBlock-content">
<div class="bbCodeBlock-expandContent js-expandContent ">
Alternatively if you do not want to do nat and enable firewalling on your freenas you can just enable the gateway_enable tunable and add a static route to your default router for the vpn network.
</div>
<div class="bbCodeBlock-expandLink js-expandLink"><a role="button" tabindex="0">Click to expand...</a></div>
</div>
</blockquote><br />
Just wanted to say that this method worked perfectly.<br />
<br />
Add those 2 lines in the OpenVPN Server additional attributes, add the "gateway_enabled" tunable and add a static route entry in your router.<br />
<br />
Thanks!</div>
<div class="bbWrapper"><blockquote data-attributes="member: 91543" data-quote="tumpanaios" data-source="post: 613743"
class="bbCodeBlock bbCodeBlock--expandable bbCodeBlock--quote js-expandWatch">
<div class="bbCodeBlock-title">
<a href="/community/goto/post?id=613743"
class="bbCodeBlock-sourceJump"
rel="nofollow"
data-xf-click="attribution"
data-content-selector="#post-613743">tumpanaios said:</a>
</div>
<div class="bbCodeBlock-content">
<div class="bbCodeBlock-expandContent js-expandContent ">
Alternatively if you do not want to do nat and enable firewalling on your freenas you can just enable the gateway_enable tunable and add a static route to your default router for the vpn network.<br />
<br />
For your example adding :<br />
<br />
Code:<br />
push "route 10.15.207.0 255.255.255.0"<br />
push "dhcp-option DNS 10.15.207.1"<br />
<br />
<br />
to Services > OpenVPN Server > Additional Parameters:<br />
<br />
and static route<br />
Code:<br />
10.9.0.1/24 via 10.15.207.10
</div>
<div class="bbCodeBlock-expandLink js-expandLink"><a role="button" tabindex="0">Click to expand...</a></div>
</div>
</blockquote><br />
Hi guys, I aslo have some issues with open VPN<br />
<br />
I can connect to my VPN but I don't have acces to my local network by enterring IP adress. I can only reach Truenas on 10.8.0.1.<br />
<br />
I would try Tumpanaios solution but I'm not sure of how to do it.<br />
<br />
First I code the "gateway_enable" in system > Tunables<br />
<br />
<blockquote data-attributes="member: 40428" data-quote="deanhuff" data-source="post: 611177"
class="bbCodeBlock bbCodeBlock--expandable bbCodeBlock--quote js-expandWatch">
<div class="bbCodeBlock-title">
<a href="/community/goto/post?id=611177"
class="bbCodeBlock-sourceJump"
rel="nofollow"
data-xf-click="attribution"
data-content-selector="#post-611177">deanhuff said:</a>
</div>
<div class="bbCodeBlock-content">
<div class="bbCodeBlock-expandContent js-expandContent ">
System > Tunables:<br />
Code:<br />
Variable=gateway_enable<br />
Value=yes<br />
Type=rc<br />
Description=ip forwarding<br />
Enabled=yes
</div>
<div class="bbCodeBlock-expandLink js-expandLink"><a role="button" tabindex="0">Click to expand...</a></div>
</div>
</blockquote><br />
<br />
Then I code these two lignes below in Services > OpenVPN Server > Additional Parameters.<br />
<br />
<blockquote data-attributes="member: 91543" data-quote="tumpanaios" data-source="post: 613743"
class="bbCodeBlock bbCodeBlock--expandable bbCodeBlock--quote js-expandWatch">
<div class="bbCodeBlock-title">
<a href="/community/goto/post?id=613743"
class="bbCodeBlock-sourceJump"
rel="nofollow"
data-xf-click="attribution"
data-content-selector="#post-613743">tumpanaios said:</a>
</div>
<div class="bbCodeBlock-content">
<div class="bbCodeBlock-expandContent js-expandContent ">
Code:<br />
push "route 10.15.207.0 255.255.255.0"<br />
push "dhcp-option DNS 10.15.207.1"
</div>
<div class="bbCodeBlock-expandLink js-expandLink"><a role="button" tabindex="0">Click to expand...</a></div>
</div>
</blockquote><br />
<br />
Finally I add a static route into my router parameter, is that right?<br />
I'm not sure of the parameter like interface and metric.<br />
<br />
<script class="js-extraPhrases" type="application/json">
{
"lightbox_close": "Close",
"lightbox_next": "Next",
"lightbox_previous": "Previous",
"lightbox_error": "The requested content cannot be loaded. Please try again later.",
"lightbox_start_slideshow": "Start slideshow",
"lightbox_stop_slideshow": "Stop slideshow",
"lightbox_full_screen": "Full screen",
"lightbox_thumbnails": "Thumbnails",
"lightbox_download": "Download",
"lightbox_share": "Share",
"lightbox_zoom": "Zoom",
"lightbox_new_window": "New window",
"lightbox_toggle_sidebar": "Toggle sidebar"
}
</script>
<div class="bbImageWrapper js-lbImage" title="Static route Truenas.png"
data-src="https://www.truenas.com/community/attachments/static-route-truenas-png.43415/" data-lb-sidebar-href="" data-lb-caption-extra-html="" data-single-image="1">
<img src="https://www.truenas.com/community/attachments/static-route-truenas-png.43415/"
data-url=""
class="bbImage"
data-zoom-target="1"
style="width: 454px"
alt="Static route Truenas.png"
title="Static route Truenas.png"
width="1200" height="882" loading="lazy" />
</div>
<br />
<br />
Thanks in advance for the help.</div>
<div class="bbWrapper"><blockquote data-attributes="member: 91119" data-quote="ChrisChros" data-source="post: 619005"
class="bbCodeBlock bbCodeBlock--expandable bbCodeBlock--quote js-expandWatch">
<div class="bbCodeBlock-title">
<a href="/community/goto/post?id=619005"
class="bbCodeBlock-sourceJump"
rel="nofollow"
data-xf-click="attribution"
data-content-selector="#post-619005">ChrisChros said:</a>
</div>
<div class="bbCodeBlock-content">
<div class="bbCodeBlock-expandContent js-expandContent ">
What is your IP for TrueNAS and what is the Subnet for your VPN network.
</div>
<div class="bbCodeBlock-expandLink js-expandLink"><a role="button" tabindex="0">Click to expand...</a></div>
</div>
</blockquote>Truenas has IP 192.168.1.26 and the VPN 10.8.0.0</div>
<div class="bbWrapper"><blockquote data-attributes="member: 91119" data-quote="ChrisChros" data-source="post: 619108"
class="bbCodeBlock bbCodeBlock--expandable bbCodeBlock--quote js-expandWatch">
<div class="bbCodeBlock-title">
<a href="/community/goto/post?id=619108"
class="bbCodeBlock-sourceJump"
rel="nofollow"
data-xf-click="attribution"
data-content-selector="#post-619108">ChrisChros said:</a>
</div>
<div class="bbCodeBlock-content">
<div class="bbCodeBlock-expandContent js-expandContent ">
Hi <a href="https://www.truenas.com/community/members/105807/" class="username" data-xf-init="member-tooltip" data-user-id="105807" data-username="@thierry333">@thierry333</a> ,<br />
This is how I would config your system:<br />
<br />
OpenVPN-Service Additional Parameters:<br />
push "route 192.168.1.0 255.255.255.0"<br />
push "dhcp-option DNS 192.168.1.1"<br />
<br />
Static Route:<br />
Destination IP: 10.8.0.0/24<br />
Gateway IP: 192.168.1.26
</div>
<div class="bbCodeBlock-expandLink js-expandLink"><a role="button" tabindex="0">Click to expand...</a></div>
</div>
</blockquote><br />
Thanks forum the reply, so if I've good understood the gateway_enable is not needed.<br />
<br />
One more point is the interface that I must choose and also the metric but auto should be good. Do you have an idea? IP_DATA?</div>
<div class="bbWrapper">the gateway_enable you have to enable.<br />
<br />
regarding the interface you have to chose, i don't know. i am not familiar with your router.</div>
