Connection to Client

[wturner69]

I am new to this forum and untangle so please forgive me of any stupidity that may ensue.

We just inherited a new business. Untangle is the firewall. They have an ipsec site to site tunnel set up to one of their clients and from the office I can get to it fine. We are trying to get the remote users that are using the openvpn app to connect to that site and cannot. Openvpn connects to untangle server. It can ping pc's and printers on the local lan. It cannot ping the client rdp server that is on the ipsec vpn. I can ping this server from the local lan. The site to site is added to the external network section. It also looks like the routs are good in the routing table (possibly not though). Should a client connecting with openvpn be able to get to the server on the other side of the ipsec tunnel?

Thanks for any help and configuration recommendations.

[sky-knight]

Oh... that's a fun one!

It's probably your exports, log into your Untangle's UI that's hosting the OpenVPN users, click settings on the OpenVPN module, or simply click on the OpenVPN button... depends on what skin you're using.

Anyway, once you're in the OpenVPN app's settings, click the server tab at the top, then check the exported networks subtab.

The IP range of the far side of the tunnel needs to be in this list, if it's not no OpenVPN user can access it. Add the range, click save, and have your OpenVPN users reconnect. Then try again.

[jcoffin]

https://support.untangle.com/hc/en-u...VPN-Over-IPsec

[wturner69]

Thanks. This looks like what I need but it is doing the same thing as shown in the document. When I add a 2nd address to the local network field it has the red circle around it and the done button is grayed out.

[jcoffin]

Red means it is invalid. Post a screen capture.

[sky-knight]

Check for spaces, spaces are bad!

[wturner69]

Before.jpgAfrer.jpg

Before & After

I tried a comma, colon and semi-colon also

[jcoffin]

Full screen capture. Cropped images are not helpful.

[wturner69]

Sorry about that. When doing the screen capture I see the problem which is listed at the top of the document you sent. I have an IKEv1 connection. I have to get with the admin at the other end to change that. Thanks for the help.