ML
    • Recent
    • Categories
    • Tags
    • Popular
    • Users
    • Groups
    • Register
    • Login

    UBNT EdgeRouter site to site VPN routes?

    IT Discussion
    6
    33
    7.9k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • Mike DavisM
      Mike Davis
      last edited by

      I have a site to site tunnel between to Ubiquiti EdgeRouters. The tunnel shows that it's up, but I can't ping stuff on the other side. I added interface routes. My tracerts hit the internal interface of the local ER and then die. What else should I check?

      JaredBuschJ 1 Reply Last reply Reply Quote 1
      • gjacobseG
        gjacobse
        last edited by

        is there any NAT being done?

        1 Reply Last reply Reply Quote 0
        • JaredBuschJ
          JaredBusch @Mike Davis
          last edited by

          @Mike-Davis said in UBNT EdgeRouter site to site VPN routes?:

          I have a site to site tunnel between to Ubiquiti EdgeRouters. The tunnel shows that it's up, but I can't ping stuff on the other side. I added interface routes. My tracerts hit the internal interface of the local ER and then die. What else should I check?

          What kind of tunnel? IPSEC site to site?

          Assuming you set this in the GUI, did you click the Show advanced options and then check the firewall checkbox?
          0_1467725433342_upload-3f2be454-70cb-4352-b2ad-ca114a966991

          1 Reply Last reply Reply Quote 1
          • Mike DavisM
            Mike Davis
            last edited by

            I used the OpenVPN command line example on https://help.ubnt.com/hc/en-us/articles/204949694-EdgeMAX-OpenVPN-Site-to-Site
            I didn't do anything with the firewall. Would you use IPsec over OpenVPN?

            Mike DavisM JaredBuschJ 2 Replies Last reply Reply Quote 0
            • Mike DavisM
              Mike Davis @Mike Davis
              last edited by

              I just noticed I don't have NAT hairpin enable on my internal interface. I can't seem to get the syntax right to try that.

              1 Reply Last reply Reply Quote 1
              • JaredBuschJ
                JaredBusch @Mike Davis
                last edited by

                @Mike-Davis said in UBNT EdgeRouter site to site VPN routes?:

                I used the OpenVPN command line example on https://help.ubnt.com/hc/en-us/articles/204949694-EdgeMAX-OpenVPN-Site-to-Site
                I didn't do anything with the firewall. Would you use IPsec over OpenVPN?

                Ah if you used OpenVPN, then you need to add static routes. this is easy then.

                1 Reply Last reply Reply Quote 0
                • JaredBuschJ
                  JaredBusch
                  last edited by

                  You use static routes like this form the command line.

                  jbusch@erl:~$ show configuration commands protocols
set protocols static interface-route 10.254.101.0/24 next-hop-interface vtun101
set protocols static interface-route 10.254.102.0/24 next-hop-interface vtun102
set protocols static interface-route 10.254.104.0/24 next-hop-interface vtun104
set protocols static interface-route 10.254.105.0/24 next-hop-interface vtun105
set protocols static interface-route 10.254.201.0/24 next-hop-interface vtun101
set protocols static interface-route 10.254.202.0/24 next-hop-interface vtun102
set protocols static interface-route 10.254.204.0/24 next-hop-interface vtun104
set protocols static interface-route 10.254.205.0/24 next-hop-interface vtun105
jbusch@erl:~$
                  1 Reply Last reply Reply Quote 0
                  • Mike DavisM
                    Mike Davis
                    last edited by

                    That's what I thought, and I have: (the local side is 192.168.1.254/24 and the far side is 192.168.2.253/23)
                    protocols {
                    static {
                    interface-route 192.168.2.0/23 {
                    next-hop-interface vtun0 {
                    description "route to other side"
                    distance 1
                    }
                    }
                    }
                    }

                    JaredBuschJ 1 Reply Last reply Reply Quote 1
                    • Mike DavisM
                      Mike Davis
                      last edited by

                      My interfaces look like this on both sides:
                      0_1467728712057_PAL-interfaces.png
                      in that both have traffic on the Tx side of the tunnel, but nothing on the receive.

                      1 Reply Last reply Reply Quote 0
                      • JaredBuschJ
                        JaredBusch @Mike Davis
                        last edited by

                        @Mike-Davis said in UBNT EdgeRouter site to site VPN routes?:

                        That's what I thought, and I have: (the local side is 192.168.1.254/24 and the far side is 192.168.2.253/23)

                        protocols {                                                                     
    static {                                                                    
        interface-route 192.168.2.0/23 {                                        
            next-hop-interface vtun0 {                                          
                description "route to other side"                                    
                distance 1
            }                                                                   
        }                                                                       
    }                                                                           
}

                        You did not specify, but I assume that you have the opposite on the other side?

                        1 Reply Last reply Reply Quote 0
                        • JaredBuschJ
                          JaredBusch
                          last edited by

                          What does your OpenVPN config look like on both sides?

                          jbusch@erl# show interfaces openvpn vtun101
 description "Globe Bldg to Someone"
 local-address 10.254.254.253 {
 }
 local-port 1195
 mode site-to-site
 openvpn-option --comp-lzo
 remote-address 10.254.254.254
 remote-host somesubdomain.mooo.com
 remote-port 1195
 shared-secret-key-file /config/auth/my_secret_file_is_here
[edit]
jbusch@erl#
                          1 Reply Last reply Reply Quote 0
                          • Mike DavisM
                            Mike Davis
                            last edited by Mike Davis 

                            vtun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN group default qlen 100
    link/none
    inet 10.99.99.1 peer xx.101.158.218/32 scope global vtun0
       valid_lft forever preferred_lft forever

    RX:  bytes    packets     errors    dropped    overrun      mcast
             0          0          0          0          0          0
    TX:  bytes    packets     errors    dropped    carrier collisions
       6418847      27196          0          0          0          0~~~
                            1 Reply Last reply Reply Quote 0
                            • JaredBuschJ
                              JaredBusch
                              last edited by Minion Queen

                              WTF is it with people not posting what is f***[moderated] asked for today?

                              1 Reply Last reply Reply Quote 0
                              • art_of_shredA
                                art_of_shred Banned
                                last edited by art_of_shred 

                                vtun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN group default qlen 100
    link/none
    inet 10.99.99.2 peer 10.99.99.1/32 scope global vtun0
       valid_lft forever preferred_lft forever

    RX:  bytes    packets     errors    dropped    overrun      mcast
             0          0          0          0          0          0
    TX:  bytes    packets     errors    dropped    carrier collisions
       3231942      44734          0          0          0          0


show interfaces openvpn vtun0
vtun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state                        UNKNOWN group default qlen 100
    link/none
    inet 10.99.99.1 peer x.x.x.218/32 scope global vtun0
       valid_lft forever preferred_lft forever

    RX:  bytes    packets     errors    dropped    overrun      mcast
             0          0          0          0          0          0
    TX:  bytes    packets     errors    dropped    carrier collisions
       6962847      28715          0          0          0          0
                                1 Reply Last reply Reply Quote 0
                                • art_of_shredA
                                  art_of_shred Banned
                                  last edited by

                                  I see one of the peers is using another IP... but I don't know how to change that.

                                  1 Reply Last reply Reply Quote 0
                                  • art_of_shredA
                                    art_of_shred Banned
                                    last edited by art_of_shred

                                    Ok, so the x.x.x.218 IP is the WAN IP of the opposite reouter, instead of using the openvpn IP.

                                    1 Reply Last reply Reply Quote 0
                                    • JaredBuschJ
                                      JaredBusch
                                      last edited by JaredBusch 

                                      #if not in config already 
configure

#then remove all the stuff.
delete interfaces openvpn vtun0
delete protocols static interface-route 192.168.1.0/24
delete protocols static interface-route 192.168.2.0/23

#recreate it
set interfaces openvpn vtun0 local-address 10.99.99.1 
set interfaces openvpn vtun0 local-port 1194
set interfaces openvpn vtun0 mode site-to-site
set interfaces openvpn vtun0 openvpn-option --float
set interfaces openvpn vtun0 openvpn-option "--ping 10"
set interfaces openvpn vtun0 openvpn-option "--ping-restart 20"
set interfaces openvpn vtun0 openvpn-option --ping-timer-rem
set interfaces openvpn vtun0 openvpn-option --persist-tun
set interfaces openvpn vtun0 openvpn-option --persist-key
set interfaces openvpn vtun0 openvpn-option "--user nobody"
set interfaces openvpn vtun0 openvpn-option "--group nogroup"
set interfaces openvpn vtun0 remote-address 10.99.99.2
set interfaces openvpn vtun0 remote-host x.x.x.218
set interfaces openvpn vtun0 remote-port 1194
set interfaces openvpn vtun0 shared-secret-key-file /config/auth/secret
set protocols static interface-route 192.168.1.0/24 next-hop-interface vtun0
commit

#if works
save
exit

                                      #other side

#if not in config already 
configure

#then remove all the stuff.
delete interfaces openvpn vtun0
delete protocols static interface-route 192.168.1.0/24
delete protocols static interface-route 192.168.2.0/23

#recreate it
set interfaces openvpn vtun0 local-address 10.99.99.2
set interfaces openvpn vtun0 local-port 1194
set interfaces openvpn vtun0 mode site-to-site
set interfaces openvpn vtun0 openvpn-option --float
set interfaces openvpn vtun0 openvpn-option "--ping 10"
set interfaces openvpn vtun0 openvpn-option "--ping-restart 20"
set interfaces openvpn vtun0 openvpn-option --ping-timer-rem
set interfaces openvpn vtun0 openvpn-option --persist-tun
set interfaces openvpn vtun0 openvpn-option --persist-key
set interfaces openvpn vtun0 openvpn-option "--user nobody"
set interfaces openvpn vtun0 openvpn-option "--group nogroup"
set interfaces openvpn vtun0 remote-address 10.99.99.1
set interfaces openvpn vtun0 remote-host x.x.x.51
set interfaces openvpn vtun0 remote-port 1194
set interfaces openvpn vtun0 shared-secret-key-file /config/auth/secret
set protocols static interface-route 192.168.2.0/23 next-hop-interface vtun0

commit

#if works
save
exit
                                      1 Reply Last reply Reply Quote 0
                                      • JaredBuschJ
                                        JaredBusch
                                        last edited by JaredBusch

                                        if i got the static routing protocols backwards, just reverse them. They should point to the LAN on the opposite router.

                                        That is the last line prior to each commit.

                                        1 Reply Last reply Reply Quote 1
                                        • art_of_shredA
                                          art_of_shred Banned
                                          last edited by

                                          Ok, so it all looks good. What would be the best test?

                                          1 Reply Last reply Reply Quote 0
                                          • art_of_shredA
                                            art_of_shred Banned
                                            last edited by

                                            I can't ping LAN IP's on the opposite side...

                                            JaredBuschJ 1 Reply Last reply Reply Quote 0
                                            • 1
                                            • 2
                                            • 1 / 2
                                            • First post
                                              Last post