Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Gre tunnel to protect IP.

    Scheduled Pinned Locked Moved General pfSense Questions
    63 Posts 2 Posters 10.7k Views 2 Watching
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • stephenw10S Online
      stephenw10 Netgate Administrator
      last edited by

      You need a policy based routing rule for 192.168.1.10 to force all it's traffic across the tunnel:
      https://docs.netgate.com/pfsense/en/latest/multiwan/policy-route.html

      Steve

      1 Reply Last reply Reply Quote 0
      • S Offline
        s_serra
        last edited by s_serra

        I added this rule but the traffic continues to go out through my gateway.

        c441615d-57cb-42f3-8b3a-62e10610eedf-image.png

        stephenw10S 1 Reply Last reply Reply Quote 0
        • stephenw10S Online
          stephenw10 Netgate Administrator @s_serra
          last edited by

          You will have to clear any existing states. You can see that rule has not matched anything yet.

          1 Reply Last reply Reply Quote 0
          • S Offline
            s_serra
            last edited by

            This post is deleted!
            1 Reply Last reply Reply Quote 0
            • S Offline
              s_serra
              last edited by

              It is, but the machine has no internet connection.

              df18d032-bc82-4c75-be99-e96e062311a2-image.png

              2ad42ac6-2760-4b62-a5d7-4305a6f29992-image.png

              1 Reply Last reply Reply Quote 0
              • stephenw10S Online
                stephenw10 Netgate Administrator
                last edited by

                Is the traffic going over the tunnel though? Do you see states on the GRE interface?

                You probably need to add a manual Outbounf NAT rule at the other end if you don't have a static route back to 192.168.1.0/24 there. Check the states at that end to see what's happening.

                Steve

                1 Reply Last reply Reply Quote 0
                • S Offline
                  s_serra
                  last edited by s_serra

                  The machine ping the other side
                  just don't have internet
                  Do I check the states in my host pfsense?
                  0dc02b02-20e1-4d36-864f-8ca5bd8db740-image.png

                  1 Reply Last reply Reply Quote 0
                  • stephenw10S Online
                    stephenw10 Netgate Administrator
                    last edited by

                    Yes, because it's probably not Outbound NATing the traffic. Add a rule for that.

                    S 1 Reply Last reply Reply Quote 0
                    • S Offline
                      s_serra @stephenw10
                      last edited by

                      In my host's pfsense? What rule do I set?

                      1 Reply Last reply Reply Quote 0
                      • stephenw10S Online
                        stephenw10 Netgate Administrator
                        last edited by

                        Yes. Check the states at the remote side and see if traffic is leaving the WAN without NAT. If it is switch Outbound NAT to hybrid mode and add a rule to cover it.

                        S 1 Reply Last reply Reply Quote 0
                        • S Offline
                          s_serra @stephenw10
                          last edited by

                          These are the remote host states
                          cda9d782-bece-43c9-bcab-0278735ded3a-image.png @stephenw10

                          1 Reply Last reply Reply Quote 0
                          • stephenw10S Online
                            stephenw10 Netgate Administrator
                            last edited by

                            You need to start a continuous ping from 192.168.1.15 so you can see where it's opening states.

                            S 1 Reply Last reply Reply Quote 0
                            • S Offline
                              s_serra @stephenw10
                              last edited by

                              I ping the local machine to the remote tunnel
                              8c8d2184-65eb-41da-8d7a-f3f3f1f886bc-image.png

                              These are the states on remote pfsense with continuous ping on the local machine

                              4a731909-8558-4152-b32b-c1a6ecb90add-image.png

                              1 Reply Last reply Reply Quote 0
                              • stephenw10S Online
                                stephenw10 Netgate Administrator
                                last edited by

                                You need to ping from 192.168.1.15 to something external like 8.8.8.8. Then look at the states it's generating at both ends.

                                S 1 Reply Last reply Reply Quote 0
                                • S Offline
                                  s_serra @stephenw10
                                  last edited by

                                  e2112f12-91c8-4bc3-8dc5-399382843cdd-image.png

                                  0ae9d213-9cb1-4518-9672-9a64b395065a-image.png

                                  This is how the states are with the continuous ping for 1.1.1.1. I put 1.1.1.1 because I have google dns to be used like this for a better view

                                  1 Reply Last reply Reply Quote 0
                                  • stephenw10S Online
                                    stephenw10 Netgate Administrator
                                    last edited by

                                    Ok, so it's actually outbound NATing at the other end of the tunnel. You can see it appears as 10.0.2.1 rather than 192.168.1.15. So you may want to disable the NAT for the GRE interface at the client end.
                                    You can also see it's not NATing the traffic out of the WAN at that end so you need a rule to add that there. That rule will depend on whether you disable the NAT at the client end.

                                    S 2 Replies Last reply Reply Quote 0
                                    • S Offline
                                      s_serra @stephenw10
                                      last edited by s_serra

                                      @stephenw10
                                      Can you tell me where I can disable NAT?
                                      For GRE tunnel only. I have the ip 192.168.1.2 with NAT for port 8006 going out through my WAN since it doesn't need protection that ip.
                                      Thanks

                                      1 Reply Last reply Reply Quote 0
                                      • S Offline
                                        s_serra @stephenw10
                                        last edited by

                                        @stephenw10

                                        I've already disabled NAT only in the tunnel on the pfsense client and it's already here without NAT. Now it will just be creating a static route right?

                                        5a3a5a16-c99d-432e-b042-de95bdc617d5-image.png

                                        1 Reply Last reply Reply Quote 0
                                        • stephenw10S Online
                                          stephenw10 Netgate Administrator
                                          last edited by

                                          Ok, so you need to add an Outbound NAT rule on that side for 192.168.1.0/24 on WAN.

                                          If you have added a static route back to the main side I would expect the auto outbound rules to cover that so I assume there is not.

                                          Steve

                                          S 1 Reply Last reply Reply Quote 0
                                          • S Offline
                                            s_serra @stephenw10
                                            last edited by s_serra

                                            I have now bought a new ip since I don't want to use the router's ip on the machines

                                            3bd3a726-de23-414b-8e09-21f4f37ea992-image.png

                                            I configured it on the windows machine like this and created a VLAN on the pfsense client.

                                            8abaab0c-f87a-4c2f-84d6-7e476b58e7fb-image.png

                                            I'm constantly pinging from the windows machine to 1.1.1.1 and in the pfsense host states it is received like this

                                            eef27ac0-ed55-4da3-a076-153c3abbc0e1-image.png

                                            In the NAT part of the pfsense host I configured it like this ie the ip 185.113.141.145 is the ip wan of the pfsense host and I don't want to use it for anything else. And the ip 185.113.141.150 I want to be used in my virtual machine.

                                            756694bf-d724-48a9-a364-f436d144cc5b-image.png

                                            The only problem is that the machine is without internet for the ip 185.113.141.150

                                            21a4ddc6-c82c-465c-ba80-6dcddbf48a8b-image.png

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.