We use PFSense firewalls at three installations with the following LAN networks:
1.) Datacenter #1: 10.0.0.0/16
2.) Datacenter #2: 10.1.0.0/16
3.) HQ: 10.2.0.0/16
All of these locations are linked via an IPSEC tunnel that works properly. Hosts in any of the above networks can communicate with hosts in any other of the above networks.
Now, for our laptops etc. we established a road warrior network 10.3.0.0/16 and have implemented OpenVPN to link the laptops etc. to Datacenter #1. This works great too, so our laptops can connect and communicate with any host in Datacenter #1 (anything on 10.0.0.0/16)
The problem is the laptops can't communicate with any hosts that Datacenter #1 can reach by its IPSEC tunnel to Datacenter #2 (and/or the HQ for that matter).
Does anyone know what to do configuration wise on the PFSense box in Datacenter #1 to configure to route packets received on the OpenVPN tunnel to Datacenter #2 over the IPSEC tunnel? It could be a setting on the OpenVPN or some sort of static route or some such.
Any ideas?
Best Answer
Traffic must match your SPD local and remote subnets to go across IPsec. Easiest is put your OpenVPN subnet within the IPseec local subnet of the site where the OpenVPN server resides. Also need to push appropriate routes to the OpenVPN client. That's all covered in detail in http://pfsense.org/book