ML
    • Recent
    • Categories
    • Tags
    • Popular
    • Users
    • Groups
    • Register
    • Login

    UBNT EdgeRouter site to site VPN routes?

    IT Discussion
    6
    33
    8.0k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • art_of_shredA
      art_of_shred Banned
      last edited by

      I can't ping LAN IP's on the opposite side...

      JaredBuschJ 1 Reply Last reply Reply Quote 0
      • JaredBuschJ
        JaredBusch @art_of_shred
        last edited by JaredBusch

        @art_of_shred said in UBNT EdgeRouter site to site VPN routes?:

        I can't ping LAN IP's on the opposite side...

        Well if the tunnel is up, you should.

        I intentionally deleted the OpenVPN interfaces just to make sure there were no firewall policies hanging around on them.

        So start with the basic. is the tunnel actually up and able to pass traffic.

        From router 1 ping the IP on the other end of the OpenVP tunnel.

        ping 10.99.99.1 or ping 10.99.99.2 whichever is on the opposite side

        nothing but the routers will be able to use these addresses. they are only for pinning up the OpenVPN tunnel

        1 Reply Last reply Reply Quote 0
        • art_of_shredA
          art_of_shred Banned
          last edited by

          Yeah, no dice.

          JaredBuschJ 1 Reply Last reply Reply Quote 0
          • JaredBuschJ
            JaredBusch @art_of_shred
            last edited by

            @art_of_shred said in UBNT EdgeRouter site to site VPN routes?:

            Yeah, no dice.

            Then the tunnel is not up. Something else was done wrong.

            1 Reply Last reply Reply Quote 0
            • JaredBuschJ
              JaredBusch
              last edited by

              open up 2 ssh sessions to one of the routers.

              Do not go into config mode.

              in one, watch the log, show log tail

              in the other window, reset the OpenVPN connection reset openvpn interface vtun0

              see if anything in the log is useful

              1 Reply Last reply Reply Quote 0
              • coliverC
                coliver
                last edited by

                Out of curiosity is there a reason to use OpenVPN over IPSEC?

                JaredBuschJ 1 Reply Last reply Reply Quote 0
                • art_of_shredA
                  art_of_shred Banned
                  last edited by art_of_shred 

                  Jul  5 17:23:23 ubnt openvpn[3172]: Restart pause, 2 second(s)
Jul  5 17:23:25 ubnt openvpn[3172]: Re-using pre-shared static key
Jul  5 17:23:25 ubnt openvpn[3172]: Socket Buffers: R=[294912->131072] S=[294912                                  ->131072]
Jul  5 17:23:25 ubnt openvpn[3172]: Preserving previous TUN/TAP instance: vtun0
Jul  5 17:23:25 ubnt openvpn[3172]: UDPv4 link local (bound): [undef]
Jul  5 17:23:25 ubnt openvpn[3172]: UDPv4 link remote: [AF_INET]x.x.x.218:1                                  194
Jul  5 17:23:36 ubnt openvpn[3172]: event_wait : Interrupted system call (code=4                                  )
Jul  5 17:23:36 ubnt openvpn[3172]: SIGUSR1[hard,] received, process restarting
Jul  5 17:23:36 ubnt openvpn[3172]: Restart pause, 2 second(s)
Jul  5 17:23:38 ubnt openvpn[3172]: Re-using pre-shared static key
Jul  5 17:23:38 ubnt openvpn[3172]: Socket Buffers: R=[294912->131072] S=[294912                                  ->131072]
Jul  5 17:23:38 ubnt openvpn[3172]: Preserving previous TUN/TAP instance: vtun0
Jul  5 17:23:38 ubnt openvpn[3172]: UDPv4 link local (bound): [undef]
Jul  5 17:23:38 ubnt openvpn[3172]: UDPv4 link remote: [AF_INET]x.x.x.218:1                                  194
Jul  5 17:23:58 ubnt openvpn[3172]: Inactivity timeout (--ping-restart), restarting
Jul  5 17:23:58 ubnt openvpn[3172]: SIGUSR1[soft,ping-restart] received, process restarting
                  1 Reply Last reply Reply Quote 0
                  • JaredBuschJ
                    JaredBusch @coliver
                    last edited by

                    @coliver said in UBNT EdgeRouter site to site VPN routes?:

                    Out of curiosity is there a reason to use OpenVPN over IPSEC?

                    This is not my setup, so I have no idea on their reasons.
                    I use OpenVPN when connecting a home router into an office for site to site because OpenVPN has long worked better (for me) with dynamic IP addresses.
                    I will use IPSEC for static assigned offices because you get more throughput when offloading is enabled.

                    art_of_shredA 1 Reply Last reply Reply Quote 1
                    • art_of_shredA
                      art_of_shred Banned @JaredBusch
                      last edited by

                      @JaredBusch said in UBNT EdgeRouter site to site VPN routes?:

                      @coliver said in UBNT EdgeRouter site to site VPN routes?:

                      Out of curiosity is there a reason to use OpenVPN over IPSEC?

                      This is not my setup, so I have no idea on their reasons.
                      I use OpenVPN when connecting a home router into an office for site to site because OpenVPN has long worked better (for me) with dynamic IP addresses.
                      I will use IPSEC for static assigned offices because you get more throughput when offloading is enabled.

                      I don't see any reason we couldn't/shouldn't use IPSEC.

                      JaredBuschJ 1 Reply Last reply Reply Quote 1
                      • JaredBuschJ
                        JaredBusch @art_of_shred
                        last edited by JaredBusch

                        @art_of_shred said in UBNT EdgeRouter site to site VPN routes?:

                        @JaredBusch said in UBNT EdgeRouter site to site VPN routes?:

                        @coliver said in UBNT EdgeRouter site to site VPN routes?:

                        Out of curiosity is there a reason to use OpenVPN over IPSEC?

                        This is not my setup, so I have no idea on their reasons.
                        I use OpenVPN when connecting a home router into an office for site to site because OpenVPN has long worked better (for me) with dynamic IP addresses.
                        I will use IPSEC for static assigned offices because you get more throughput when offloading is enabled.

                        I don't see any reason we couldn't/shouldn't use IPSEC.

                        Run the delete commands from before, then go into the GUI and setup IPSEC.

                        delete blah blah
commit
save
exit

                        go to GUI.

                        1 Reply Last reply Reply Quote -1
                        • art_of_shredA
                          art_of_shred Banned
                          last edited by

                          well, I can ping from site B to site A now, so that's good. Both sides said the configuration was applied successfully. I'm trying to ping router-to-router and it only works one way. In advanced options, the NAT exclusion is set and applied.

                          1 Reply Last reply Reply Quote 0
                          • art_of_shredA
                            art_of_shred Banned
                            last edited by

                            My bad. I didn't realize that IMCP response was disabled on the site B router. I can ping across the tunnel to servers on the site B LAN. Success!

                            Huge thanks to @JaredBusch for all of your help today!

                            1 Reply Last reply Reply Quote 4
                            • Mike DavisM
                              Mike Davis
                              last edited by

                              Big thanks to @JaredBusch I was in a hurry to leave for a speaking engagement and had to hand off to @art_of_shred . It turns out part of the problem was that some of the servers on the far side had a persistent route set up so that even when we changed the gateway address from the Meraki to the EdgeRouter, they were still hitting the Meraki. Now that it's off hours I ripping through 19 servers to make sure the gateway is correct and there are no persistent routes configured that will mess things up.

                              scottalanmillerS 1 Reply Last reply Reply Quote 3
                              • scottalanmillerS
                                scottalanmiller @Mike Davis
                                last edited by

                                @Mike-Davis Assume everything dumb that could be done has been done down there. What a mess.

                                1 Reply Last reply Reply Quote 0
                                • 1
                                • 2
                                • 2 / 2
                                • First post
                                  Last post