Pfsense openvpn site to site not reachable

1

I have a virtual pfsense in the datacenter and a mikrotik at home. I have a openvpn site to site between the to routers. Sinds unknown days the openvpn stopped working. I did an upgrade on the mikrotik a few days ago. Maybe this broke it. I don’t know what version I was using previously.

I get an error at the pfsense logging saying. mikrotik/{WanIpMikrotik}:51290 ip packet with unkown ip version=0 seen

The setup:
Pfsense in datacenter

  • public wan ip.
  • Lan 10.105.0.0/24
  • openvpn: 192.168.70.1

Mikrotik at home:

  • public wan ip.
  • lan 192.168.60.0/24
  • openvpn: 192.168.70.2

Ping works from public wan mikrotik to openvpn gateway(192.168.70.1). If I ping the openvpn gateway with source ip 192.168.60.1 the ping fails. Pinging 192.168.60.1 from the pfsense also fails.

I have access to the router (from isp) in between the two routers. If I ping the openvpn gateway with source ip 192.168.60.1 I see traffic over the isp router. pinging the other way around I see no traffic in the isp router.

So it looks like the pfsense doesn’t know how to reach 192.168.60.1. In the openvpn on the pfsense 192.168.60.0/24 is defined as the remote network.

What troubleshooting steps can I take to further figure out what the problem is?

2

Turn up the Verbosity level of the logs on the OpenVPN server, look for errors, see what is failing, google the errors. That option is towards the bottom in the pfsense config, I don’t use MikroTik so not sure where the settings are for those.

3

Thanks for the tip.

I see 2 errors where I think the issue is.
mikrotik/WAN_IP:51278 GET INST BY VIRT: 192.168.60.1 [failed]
mikrotik/WAN_IP:51278 MULTI: bad source address from client [192.168.60.1], packet dropped

If I google the error this is the result from openvpn.
They say it doesn’t know how to reach 192.168.60.1.
On the pfsense the remote network 192.168.60.0/24 is defined. So it should know how to get back to 192.168.60.1. If I ping 192.168.60.1 from the pfsense the ping timed out.

Are there any other reasons why I get this error?

4

My guess is that the MikroTik is not accepting the routes.