@viragomann
Thank you very much for your great Idea!

I will check this out.
At the moment the Client is not setting the IP from Client Specified Override and we don't know why.
After this weekend it will work, I am sure.

Greetings

@viragomann ok thanks I'll do some tests

@Debian-Linux
So your setup should look like this in the future:

WAN ---- Forti ---- LAN | |--- pfSense-VPN-GW

?
In fact pfSense is a LAN device in this case. Maybe there is a switch in between, but this doesn't matter.

Yes, you can do this.

You have to separate pfSense from the LAN, however. Create an additional subnet (maybe VLAN) between the Fortigate and pfSense. Assuming you connect the WAN interface of pfSense to the Forti, state the Forti IP (of the VLAN) as upstream gateway in the interface settings. On the Fortigate forward the OpenVPN traffic to pfSense. On the Forti create static routes for the OpenVPN tunnel networks (assuming you run an access server. For a site-2-site create static routes for the remote networks) and point them to pfSense. On pfSense go to NAT > Outbound, enable the hybrid mode and add a rule for the destination of your local networks (can be an alias) to the WAN interface and set it to "no NAT". This enables the destination device to see the real client source IP instead of the pfSense WAN IP.

@McMurphy
The VPN_GW might arise from assigning an interface to an OpenVPN instance.
So go to Interfaces > Assignments and check if there is a related existing interface. If so delete it.

@DominikHoffmann
If the clients firewall rules on the VPN interface allow access I'd expect the ping to succeed.

@bebewold said in accessing work VM through a VPN:

but I don't see why it would not work

For starters its a rebind.. Did you set whatever your work domain up as private?

https://docs.netgate.com/pfsense/en/latest/services/dns/rebinding.html#dns-rebinding-protections

Security has little to do with it to be honest.. It has never been best practice to put rfc1918 in public dns..

Do they not even run a local dns at your work?

@Snailkhan

Hi,
I am implementing it right now and also had this question.

Just made it work though. Here is my example with Windows Server 2022 Standard:

Open Network Policy Server. Create new network policy in NPS. Give it a name for example hagrid-static-ip. Add a condition. I did not find a possibility to add a specific user, only a group. So, added a group with one user Hagrid just for a test. At Settings tab go to RADIUS Attributes => Standard. Add an attribute "Framed-IP-Netmask". My OpenVPN network is 10.10.10.0/24, so i put there 255.255.255.0 mask. At the same Settings table to to IP Settings. Choose "Assign a static IPv4 address" there. Put an address, for example 10.10.10.55. Save the policy and connect to OpenVPN Server on pfsense with Hagrid user. IP 10.10.10.55 must be assigned.

I do not claim that it is a valid and good to follow solution. Just sharing my ongoing experience.
My end goal is assigning pools to different groups of users and then manage access for them in pfsense firewall. For example group admins - pool 10.10.10.10-20. This pool is added to alias in pfsense firewall and rules afterwards for this alias.

This is quite typical task, I think. So, maybe there are another posts with much better explanations.

I also used this article https://docs.netgate.com/pfsense/en/latest/vpn/openvpn/client-parameters-radius.html, which gave me an idea to add mask as an additional attribute and made it work eventually.

@damianhl said in Block connection attemp from internal LANs:

there are many servers, printers, etc, with fixed IPs

You don't have to move them all at once.. But this is normally why you would use dhcp, so you could easy migrate 100 if not 1000s of devices to a new IP scheme.

But you can for sure just move one at a time if you so desired.. The outage on any specific device would be very short - the time it takes to come up on its new IP.

Such a scenario is one of the scenarios where it makes sense to run multiple layer 3 on the same network for a time, ie transition.

If me, I would as your migrating devices to a better network IP range change them to dhcp with a reservation so say server 1 always gets IP X, server 2 always gets IP Y, etc..

I would change your network to your new IP range, then put a vip on pfsense for its old 150 address, etc. Then slowly move over the devices to dhcp on the new network assigning the IP address you want for each device. You would just need to change the port forwards you currently have as you do.

@neba said in AirVPN + Open Port, I've tried everything and it's not worth it:

pfSense and that it would give me confirmation that the port is open. qBit must also be started.

Pfsense doesn't listen and answer - it just forwards traffic it sees. If you want the port to show open, then yes where you forward to would have to be listening on that port, and actually answer. Users also run into sim sort of problem where they think its pfsense port forwarding problem, when its just the client having its own firewall and not answering. All kinds of other problems as well - like were you sending the traffic through pfsense, isn't using pfsense as its gateway so sends the answer to some other gateway.

Pfsense port forwarding is pretty rock solid stable and easy enough to setup.. In all the years I have been here on the forums - to be honest I don't recall even one issue that was not user issue.

@br8bruno so gibberish that has zero to do with their interception of dns.

The only thing you could do to avoid interception would be to use say doh, or dot might not be intercepted or blocked and you would know if intercepted because there is no way you would trust the cert they send back. Unbound can forward to dot. But with normal resolving dns traffic is sent via 53, which they are intercepting.

Part of doh and dot is avoiding interception. And actually validating your talking to the NS you want to talk too. I have no issues with the technology in general, and sure it has some valid use cases. The problem I have with doh is how browsers and apps are turning it on without explicit user acknowledgement and signoff.. And make it difficult to block if you as the admin of your network do not want devices on your network using it. This is easy with dot, you can just block port 853 - but with doh it uses 443.. Which without knowing the actual endpoint they are going to talk to, is impossible to block without breaking the internet for your devices on your network.

Use some other vpn service is what I would do.. One that doesn't mess with your dns.

Thanks @viragomann and @Gertjan! Your suggestions gave me stuff to look into further and I now have it working. The net is, check to make sure the correct interface is specified in the firewall rules. I also think including IPv4 and IPv6 (ipv4+ipv6) in the same rule makes things confusing for you and for the firewall itself. Tim

Please see https://forum.netgate.com/post/1181349 and https://forum.netgate.com/post/1181336 for the final puzzle pieces that got it to work.

Please see https://forum.netgate.com/post/1181349 for the final puzzle piece that got it to work.

@viragomann said in Still no reliable peer-to-peer connection, but progress made:

And additionally all remote networks have to be stated in the server settings.

This was the crux of the matter!

Thank you very much!

just checking back if anyone knows why the connection works perfectly in android but wont work at all in pfsense firewall?

@viragomann Oh wow, thats true o.O

Thanks for that!