• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Issues with Subnet behind UDM Pro

Scheduled Pinned Locked Moved OpenVPN
57 Posts 5 Posters 14.0k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • M
    Misinthe @A Former User
    last edited by Feb 11, 2022, 5:19 PM

    @silence

    My apologies, that was my bad, here is the list of my networks.

    On the pfSense:
    LAN is basically just providing for the UDM Pro.
    OPT1 is my DMZ.
    OpenVPN is my VPN.
    6f502a61-8ac0-486f-9fe5-6828e1c08812-image.png
    3bf2d8a7-208d-44fa-940f-abda3a612a71-image.png

    On the UDM Pro:

    Default is my main LAN
    Guest is Guest
    IoT is for my IoT devices
    NoT is for things I don't want to go on the internet but I need access on the network.

    4ec50364-c193-45fa-89c6-97d185069a56-image.png

    My UDM Pro has a WAN address of 10.20.0.5 provided by pfSense.

    ? 1 Reply Last reply Feb 12, 2022, 2:38 AM Reply Quote 0
    • ?
      A Former User @Misinthe
      last edited by A Former User Feb 12, 2022, 2:46 AM Feb 12, 2022, 2:38 AM

      @misinthe, perfect
      Now explain what you want to accomplish? and I will help you as soon as possible.

      @misinthe said in Issues with Subnet behind UDM Pro:

      How my network is set up is, from the WAN, it goes into my PfSense firewall, then that splits into my DMZ and the other goes into a UDM Pro, which creates my main LAN for everything in my house.

      question: does your wan in pfsense by any chance have an RFC ip?

      @misinthe said in Issues with Subnet behind UDM Pro:

      OpenVPN is my VPN.

      Why don't I see an openvpn interface?

      126dbd1d-2c46-4447-ae59-e03375edc941-image.png

      M 1 Reply Last reply Feb 12, 2022, 3:25 AM Reply Quote 0
      • M
        Misinthe @A Former User
        last edited by Misinthe Feb 12, 2022, 3:26 AM Feb 12, 2022, 3:25 AM

        @silence said in Issues with Subnet behind UDM Pro:

        @misinthe, perfect
        Now explain what you want to accomplish? and I will help you as soon as possible.

        I just want to be able to VPN into the network inside the UDM Pro, with Open VPN, I am able to get into the 10.20.50.0 network, which is in the pfSense, but I cannot reach my 10.10.0.0 network from it.

        question: does your wan in pfsense by any chance have an RFC ip?

        I am not sure about this one, how can I verify this?

        Why don't I see an openvpn interface?

        126dbd1d-2c46-4447-ae59-e03375edc941-image.png

        I don't know, I used the Wizard to create the OpenVPN Server. This is how it looks. Maybe because it uses the WAN interface?
        2780b94e-2b8a-4920-9b35-e6cc8130ad0f-image.png

        V ? 2 Replies Last reply Feb 12, 2022, 8:13 AM Reply Quote 0
        • V
          viragomann @Misinthe
          last edited by Feb 12, 2022, 8:13 AM

          @misinthe
          There is no special VPN interface needed for your purposes.

          What is about filter rule on the UDM? Don't you know, how to configure it?
          You obviously cannot get from the UDM WAN to its LAN. So you may have to allow it.

          For testing again, you can connect a PC to the UDMs WAN 10.20.0.0/24. Configure its network interface IP manually and set the UDMs WAN IP as gateway. Then check if you can access a device in the UDMs LAN.
          From all you wrote here, I assume, you will not be able to. So the UDM blocks the access and there is nothing you can do on pfSense to resolve this.

          M 1 Reply Last reply Feb 12, 2022, 3:06 PM Reply Quote 0
          • M
            Misinthe @viragomann
            last edited by Feb 12, 2022, 3:06 PM

            @viragomann said in Issues with Subnet behind UDM Pro:

            @misinthe
            There is no special VPN interface needed for your purposes.

            What is about filter rule on the UDM? Don't you know, how to configure it?
            You obviously cannot get from the UDM WAN to its LAN. So you may have to allow it.

            For testing again, you can connect a PC to the UDMs WAN 10.20.0.0/24. Configure its network interface IP manually and set the UDMs WAN IP as gateway. Then check if you can access a device in the UDMs LAN.
            From all you wrote here, I assume, you will not be able to. So the UDM blocks the access and there is nothing you can do on pfSense to resolve this.

            That's what I was thinking, The UDMP has to be blocking something, but I've added a rule on Internet In, Internet Local, LAN In and LAN Local to allow traffic coming from 10.20.50.0 and it still won't work.

            V 1 Reply Last reply Feb 12, 2022, 3:32 PM Reply Quote 0
            • V
              viragomann @Misinthe
              last edited by Feb 12, 2022, 3:32 PM

              @misinthe said in Issues with Subnet behind UDM Pro:

              but I've added a rule on Internet In, Internet Local, LAN In and LAN Local to allow traffic coming from 10.20.50.0 and it still won't work

              Not even from 10.20.50.0/24 like ping from pfSense?

              Consider that access from the VPN client has an IP out of its tunnel network pool as source, so it's from outside of 10.20.50.0/24 and won't be covered by this rule.

              However, I'm still suspecting that the LAN PC is blocking access from outside. To check this out, allow another subnet behind the UDM to access the LAN and try to access from a device within this subnet.

              M 1 Reply Last reply Feb 12, 2022, 5:09 PM Reply Quote 0
              • M
                Misinthe @viragomann
                last edited by Feb 12, 2022, 5:09 PM

                @viragomann, I can't even ping the 10.10.0.0/24 from the pfSense LAN.
                e126bbc8-1754-402b-86da-ef54d8477493-image.png

                Everything within the UDM works fine, I have 4 different subnets and they work, I also had an L2TP VPN set on it before I added the pfSense to my setup and it worked fine.

                V 1 Reply Last reply Feb 12, 2022, 5:12 PM Reply Quote 0
                • V
                  viragomann @Misinthe
                  last edited by Feb 12, 2022, 5:12 PM

                  @misinthe said in Issues with Subnet behind UDM Pro:

                  Everything within the UDM works fine, I have 4 different subnets and they work,

                  You want to say, all subnets have internet access, I guess.
                  But can you access the main LAN from any other subnet across the UDM?

                  M 1 Reply Last reply Feb 12, 2022, 5:37 PM Reply Quote 0
                  • M
                    Misinthe @viragomann
                    last edited by Misinthe Feb 12, 2022, 5:37 PM Feb 12, 2022, 5:37 PM

                    @viragomann Well, I have rules to block my IoT and NoT from my main LAN, to be a bit safer.

                    0d3e9901-a633-42b2-8ae0-8bba3aa30335-image.png

                    I've also added this to static routes.
                    130dfd4f-a7d9-4bf2-903a-ee1b9b70141e-image.png

                    And this rule
                    67999c5d-103d-4c62-b882-30b7f78fd153-image.png

                    And this
                    189a805b-09f2-421d-af99-b0c4a58ad700-image.png

                    I'm not sure what else I can try.

                    V 1 Reply Last reply Feb 12, 2022, 5:56 PM Reply Quote 0
                    • V
                      viragomann @Misinthe
                      last edited by Feb 12, 2022, 5:56 PM

                      @misinthe
                      You must not state a source port in the rule!
                      The port has to be "any". It can be any from 1024 to 65535.

                      BTW: a route for the pfLAN might be useless, since the network is attached to the UDM directly.

                      M 1 Reply Last reply Feb 12, 2022, 6:02 PM Reply Quote 0
                      • M
                        Misinthe @viragomann
                        last edited by Feb 12, 2022, 6:02 PM

                        @viragomann Okay, I changed the rule to this, and removed the pfLAN route. (I just added it to see if it would work).

                        0f2ffd3e-fffe-4c49-9129-06ae1e023fdf-image.png
                        5faf28ca-44ad-490f-b4fc-c5c363e3088d-image.png

                        It still won't allow traffic through though.
                        52037252-7dea-43fb-a6d7-c7fd6c7cc66a-image.png

                        V 1 Reply Last reply Feb 12, 2022, 6:16 PM Reply Quote 0
                        • V
                          viragomann @Misinthe
                          last edited by Feb 12, 2022, 6:16 PM

                          @misinthe
                          Okay. Now you should do some investigations by testing access from another network on the UDM as I suggested already. You can add a temporary rule to allow access from a specific device or better allow any and remove other devices temporarly.

                          Alternatively you can sniff the traffic on the UDM main LAN and WAN interface while you ping the LAN from a VPN IP to see where it stucks.
                          As the UDM Pro is a router it should offer you this option, but I don't know.
                          Otherwise you won't get any further here, I'm afraid.

                          1 Reply Last reply Reply Quote 0
                          • ?
                            A Former User @Misinthe
                            last edited by Feb 12, 2022, 8:32 PM

                            @misinthe said in Issues with Subnet behind UDM Pro:

                            I am not sure about this one, how can I verify this?

                            If your 2 Router are connected in the same Lan Then, your problem is that it does not allow access between pfsense wan and UDM PRO.

                            That is why I ask you what is the wan IP of your pfsense and your UDM Pro, so it is seen in this publication that your Pfsense and UDM use IP RFC IN WAN.

                            -IF I'M RIGHT, THEN UNTIL NOW EVERYTHING @viragomann SUGGESTS IS WRONG.

                            M 1 Reply Last reply Feb 12, 2022, 9:36 PM Reply Quote 0
                            • M
                              Misinthe @A Former User
                              last edited by Feb 12, 2022, 9:36 PM

                              @silence @viragomann
                              This might help you understand my network.
                              6741f78c-16b4-4084-b9ad-1fbfdb4e3e54-image.png

                              V ? 2 Replies Last reply Feb 12, 2022, 11:04 PM Reply Quote 0
                              • V
                                viragomann @Misinthe
                                last edited by Feb 12, 2022, 11:04 PM

                                @misinthe
                                Yes, that's what I got from your description.

                                M 1 Reply Last reply Feb 12, 2022, 11:08 PM Reply Quote 0
                                • ?
                                  A Former User @Misinthe
                                  last edited by Feb 12, 2022, 11:08 PM

                                  @misinthe, it's just as i thought.

                                  1 Reply Last reply Reply Quote 0
                                  • M
                                    Misinthe @viragomann
                                    last edited by Misinthe Feb 12, 2022, 11:09 PM Feb 12, 2022, 11:08 PM

                                    @viragomann @Silence Man, doing all this testing messed my pfSense up, now it won't boot up, so I just deleted the VM, I don't know if I'll rebuild it or if I'll just remove it from the equation and just add a piHole VM to the network.

                                    ? V 3 Replies Last reply Feb 12, 2022, 11:14 PM Reply Quote 0
                                    • ?
                                      A Former User @Misinthe
                                      last edited by Feb 12, 2022, 11:14 PM

                                      @misinthe There are many ways to solve your problem here.

                                      Now my suggestion is the following:

                                      in my case I create the vlan in Pfsense and only use the UDM PRO FOR SWICTH

                                      In this way when connecting via openvpn to your pfsense and everything will be Ok.

                                      -If you decide to continue doing routing in pfsense and Routing in DM PRO then the suggestion is to start cleaning the openvpn configuration is wrong and static routes in pfsense.

                                      rule in wan for your UDM PRO and with that everything should work without problem.

                                      1 Reply Last reply Reply Quote 0
                                      • ?
                                        A Former User @Misinthe
                                        last edited by Feb 12, 2022, 11:15 PM

                                        @misinthe said in Issues with Subnet behind UDM Pro:

                                        Man, doing all this testing messed my pfSense up, now it won't boot up, so I just deleted the VM, I don't know if I'll rebuild it or if I'll just remove it from the equation and just add a piHole VM to the network.

                                        wtf, So if I delete his pfsense how does he have access to the internet?

                                        what is the ip of your computer?

                                        M 1 Reply Last reply Feb 12, 2022, 11:19 PM Reply Quote 0
                                        • M
                                          Misinthe @A Former User
                                          last edited by Feb 12, 2022, 11:19 PM

                                          @silence said in Issues with Subnet behind UDM Pro:

                                          @misinthe said in Issues with Subnet behind UDM Pro:

                                          Man, doing all this testing messed my pfSense up, now it won't boot up, so I just deleted the VM, I don't know if I'll rebuild it or if I'll just remove it from the equation and just add a piHole VM to the network.

                                          wtf, So if I delete his pfsense how does he have access to the internet?

                                          what is the ip of your computer?

                                          I just connected my ISP directly to the WAN port of the UDM Pro, the pfSense was acting mainly just for pfBlocker, DHCP is controlled by the UDMP and DNS is controlled by my Domain Controller, I only had to redirect that Domain Controller to the UDMP and that's it.

                                          1 Reply Last reply Reply Quote 0
                                          45 out of 57
                                          • First post
                                            45/57
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                            This community forum collects and processes your personal information.
                                            consent.not_received