@mav3rick said in OpenVPN on 2 pfsense instance with HA - service is running on both pfsense instances:

So setting openvpn to bind only to the CARP VIP works fine for me

Multi-WAN with HA there?
If so, it would be a better idea to run openVPN server on localhost instead.
This would allow it to receive connections from all WANs.

No need to select a VIP, just forward packets from the WANs VIPs to localhost.
You can use DNS, thus the client would connect to the WAN that is UP.
Or
You can use two remote entries in the .ovpn, with timeout lets say, 2 seconds.

Then, just create the NAT rule to access the firewall-2, using the SYNC address as previously mentioned.

@viragomann I lost oversight. The customer edited stuff on his own ... and wrote he succeeded by adding fw rules and policy-based-routing. Sounds like overkill a bit, but ok if he's happy.
I have to accept that this box is out of my control somehow now ;-)

thanks for your help. I might report back if I get access again and see things.

@phthatcher said in SG-1100 as VPN client only (no dhcp) adding to existing network:

just assure that when the server reaches out to the web it is behind the vpn

So all you need is to configure pfSense as default gateway on the server.

The pfSense only needs a single interface (LAN, router-on-a-stick), connected to your LAN.
On the VPN interface you have to add an outbound NAT rule, as mentioned in the ExpressVPN tutorial.

@viragomann banally ho quest problem, per riassumere
If you download your pc from the lan dove and install the pfsense with opnvpn site to site client, pingo i server windows o i pc della lan pfsense server, invece dalla parte server non pingo nessun pc, nemmeno il pfsense client. Invece dal ping di pfsense pinggo calmly. What can you control that the server does not function?

Hi Jens,

I would suggest the following: Set the ‘WebCfg – OpenVPN: Client Export Utility’ permission as the user's first permission (i.e. so that it appears at the top of the list).

This will allow the user to access the Client Export Utility via the pfSense logo, as the first permission effectively sets the ‘homepage’.

Best regards,
Hagen

Just in case anyone else is losing hair over this for me with pfsense + 24.11 OpenSUSE 15.6 (I'm sure other distros are similar) and OpenVPN client 2.6.8 though NetworkManager.

No edit of /etc/ss/openssl.conf was needed
No hacking of OpenVPN conf files was needed.
No exporting user certs from System-Certificates was needed.

In VPN-OpenVPN Client Export
Microsoft Certificate Storate - Untick (We are using Linux)
Password Protect Certificate - Tick
Certificate Password - Add something meaningful.

Download from Bundled Configuration - Archive (Inline did not work)
Extract somewhere sensible

In NetworkManager:
Client on "+" Add New Connection in bottom left
Scroll down to bottom
Import VPN Connection & choose the .ovpn from the extracted archive zip.

Optional but sensible: fill in the certificate password
Change to save password for user only (not system-wide)

Make sure you fill in the username (required) and password (optional) or client login fails
Change to save password for user only (not system-wide)

Really could have used this in the pfsense documentation!

@johnpoz ...good point on the lease time, I would have not thought of that, and wondered why things were not working... Cheers!!

Well Comcast was the fault - WAN_DCHP gateway ping automatically set to ip address but no response gateway down - only it wasn’t and the straight to isp was working
Reset to 8.8.8.8 VPN vlan came back

@Aadrem said in 🔒 OpenVPN: Allow Internet via WAN IP but Block LAN Access (Hybrid Split/Full Tunnel):

push "route 0.0.0.0 128.0.0.0";
push "route 128.0.0.0 128.0.0.0";

This is the same as checking "redirect gateway".

This setup behaves like a split tunnel, so the client continues using its local internet connection.

No, it adds routes to the client for the whole IPv4 range. This is not split tunneling.
The client will only be able to access devices within his local subnet, but any other traffic will be routed over the VPN, and this is what you need in fact.

I already have other VPNs configured as full tunnel, so I cannot apply restrictive firewall rules globally, as that might affect those existing VPNs.

You can restrict the rule for pass traffic to WAN / block local subnets to the clients source IP.

You can also assign an interface the the respective OpenVPN server. Then you get a firewall rule tab, where you can add rules for this instance only.

If you only want to allow internet access it's a good advice to create an alias, which includes all private network ranges like this:
d4dab693-0eb8-4b58-99da-109081f6e881-grafik.png

Then you can use it as destination in firewall rules, either in a pass rule with "invert match" checked to restrict the rule to non-private networks only, or in a block rule followed by an allow-any rule.

Yes, both are configured to to listen to the wan gateway group, but different ports.

I've tried doing this a NAT:

044467cb-9aba-43cd-9478-da27475ebcfe-image.png
Resolving in no port open and no trafik towards my host, as a simple nginx page.
This is what I would Normally do NAT a port to a service.
I'm testing with https://ismyportopen.com/ - or directly onb the IP:PORT

With my VPN-CLient created as a Interface - without any rules for that Interface:
4f35e0a9-d1fa-42c2-93a0-5cb8d1a679aa-image.png
Since my VPN-client are created as an Interface - I would like to think there should be the rules under this interface for incomming rules.
Where I should believe (as the torguard as a Interface) should look like this instead:
498a8fdc-11a4-41ff-990f-983764915838-image.png.

But I'm not getting through in any of the 2 ways to my nginx. No issue with internal IP and port - which showing nginx testpage

@itinfo

PICNIC

☺
I'm glad, that it was as simple to resolve.

@rajukarthik As I'm sure you've found, you can bind the OpenVPN to both WAN interfaces, so that's the first part.

After that, I can think of a couple of ways to sort out incoming clients.

Quick and dirty - publish 2 A records for vpn.mycompany.com with the respective WAN IPs in each. The downside is that there's no real way to have the clients 'prefer' one WAN over the other (so not great if you have a fast leased line primary and DSL backup, for instance) and that if you have a failure it'll take a while for clients to sort themselves out and use the other IP.

Use DDNS - sign up a DDNS address to use for VPN. You should be able to configure configure PFsense to update it with the 'main' WAN when that is in use and then drop back to the backup if you loose your connection. I'm sure there are guides about on this.

Has anyone found a solution to this?