Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Cannot get to shared folders

    Scheduled Pinned Locked Moved IPsec
    29 Posts 3 Posters 2.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • D
      dalicollins @viragomann
      last edited by

      @viragomann
      I do double the backslash. The forum removes one in the post

      V 1 Reply Last reply Reply Quote 0
      • V
        viragomann @dalicollins
        last edited by

        @dalicollins
        I meant, I need to write them double to get one.

        D 1 Reply Last reply Reply Quote 0
        • V
          viragomann @dalicollins
          last edited by

          @dalicollins
          I forgot to ask one essential question: is pfSense the default gateway on the file server?

          D 1 Reply Last reply Reply Quote 0
          • D
            dalicollins @viragomann
            last edited by

            @viragomann
            lol. I think I am really close. probably just missing a rule. Is the IPsec rule I show above correct?

            V S 2 Replies Last reply Reply Quote 0
            • V
              viragomann @dalicollins
              last edited by

              @dalicollins said in Cannot get to shared folders:

              @viragomann
              lol. I think I am really close. probably just missing a rule. Is the IPsec rule I show above correct?

              Yes, it allows any protocol to the server. So access to the file share should be allowed.

              You can restrict it later if you want.

              1 Reply Last reply Reply Quote 0
              • D
                dalicollins @viragomann
                last edited by dalicollins

                @viragomann
                Yes there is only one default gateway and everything on pfsense uses it. All other functions of pfsense work great. But you brought up an interesting question. The server has two NIC's each connected to a different pfsense firewall. But the other computers on the same firewall can get to the shared folders.

                V 1 Reply Last reply Reply Quote 0
                • S
                  SteveITS Galactic Empire @dalicollins
                  last edited by

                  @dalicollins Your IPsec rule allows all traffic and is matching packets so should be fine.

                  [slash-slash-slash-text seems to work fine. It shows in the preview to the right while typing. ]

                  Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                  When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                  Upvote 👍 helpful posts!

                  1 Reply Last reply Reply Quote 0
                  • V
                    viragomann @dalicollins
                    last edited by

                    @dalicollins said in Cannot get to shared folders:

                    Yes there is only one default gateway and everything on pfsense uses it.

                    The question was if the server uses the pfSense running the IPSec server as default gateway.

                    Run

                    route print

                    on the command line to show the default route.

                    D 1 Reply Last reply Reply Quote 0
                    • D
                      dalicollins @viragomann
                      last edited by dalicollins

                      @viragomann
                      On the server
                      IPv4 Route Table

                      Active Routes:
                      Network Destination Netmask Gateway Interface Metric
                      0.0.0.0 0.0.0.0 192.168.100.1 192.168.100.26 1255
                      0.0.0.0 0.0.0.0 192.168.1.1 192.168.1.100 266
                      10.10.10.100 255.255.255.255 On-link 10.10.10.100 315
                      10.10.10.102 255.255.255.255 10.10.10.102 10.10.10.100 60
                      10.10.10.105 255.255.255.255 10.10.10.105 10.10.10.100 60
                      10.10.10.107 255.255.255.255 10.10.10.107 10.10.10.100 60
                      10.10.10.109 255.255.255.255 10.10.10.109 10.10.10.100 60
                      127.0.0.0 255.0.0.0 On-link 127.0.0.1 331
                      127.0.0.1 255.255.255.255 On-link 127.0.0.1 331
                      127.255.255.255 255.255.255.255 On-link 127.0.0.1 331
                      192.168.1.0 255.255.255.0 On-link 192.168.1.100 266
                      192.168.1.100 255.255.255.255 On-link 192.168.1.100 266
                      192.168.1.101 255.255.255.255 On-link 192.168.1.100 266
                      192.168.1.255 255.255.255.255 On-link 192.168.1.100 266
                      192.168.100.0 255.255.255.0 On-link 192.168.100.26 1255
                      192.168.100.26 255.255.255.255 On-link 192.168.100.26 1255
                      192.168.100.255 255.255.255.255 On-link 192.168.100.26 1255
                      224.0.0.0 240.0.0.0 On-link 127.0.0.1 331
                      224.0.0.0 240.0.0.0 On-link 192.168.100.26 1255
                      224.0.0.0 240.0.0.0 On-link 192.168.1.100 266
                      224.0.0.0 240.0.0.0 On-link 10.10.10.100 315
                      255.255.255.255 255.255.255.255 On-link 127.0.0.1 331
                      255.255.255.255 255.255.255.255 On-link 192.168.100.26 1255
                      255.255.255.255 255.255.255.255 On-link 192.168.1.100 266
                      255.255.255.255 255.255.255.255 On-link 10.10.10.100 315

                      Persistent Routes:
                      Network Address Netmask Gateway Address Metric
                      0.0.0.0 0.0.0.0 192.168.1.1 Default
                      0.0.0.0 0.0.0.0 26.0.0.1 9256
                      0.0.0.0 0.0.0.0 192.168.100.1 Default
                      0.0.0.0 0.0.0.0 192.168.1.1 Default

                      192.168.1.1 is the IP going to the other pfsense firewall.
                      10.10.10.100 is the servers internal Windows VPN which is what I want to switch the uses from.

                      V 1 Reply Last reply Reply Quote 0
                      • V
                        viragomann @dalicollins
                        last edited by viragomann

                        @dalicollins said in Cannot get to shared folders:

                        192.168.1.1 is the IP going to the other pfsense firewall.

                        So access from the VPN cannot work.
                        This would be worth to mention at first of all.

                        To get access you have to either add a static route to the server for the VPN tunnel pool and point it to the IPSec pfSense or you can masquerade the outgoing traffic on pfSense.

                        However, if the other router is a pfSense as well, I'm wondering why you fire up an additional to run a VPN on it.

                        D 2 Replies Last reply Reply Quote 0
                        • D
                          dalicollins @viragomann
                          last edited by dalicollins

                          @viragomann
                          Not sure how to do that. I also tried changing the IPsec rule to an IP of a local computer with only one connection and I can ping that IP. So how do I masquerade the outgoing traffic?

                          V 1 Reply Last reply Reply Quote 0
                          • V
                            viragomann @dalicollins
                            last edited by

                            @dalicollins
                            Masquerading is only recommended if you know, what it does and if you have restrict firewall rules. It's a workaround for different issues.
                            But since this VPN is obviously for your own purposes only, you can do this to get a step beyond.

                            It's done by Firewall > NAT > Outbound

                            Select hybride mode and save this first.
                            Add a new rule:
                            interface: LAN
                            source: IPSec tunnel pool (or maybe any, since there is no other passing this pfSense)
                            destination: any
                            translation: interface address

                            Should work then.

                            1 Reply Last reply Reply Quote 0
                            • D
                              dalicollins @viragomann
                              last edited by

                              @viragomann
                              I use two pfsense firewalls because I have I two Internet WAN's. One static and the other dynamic. They are totally isolated from one another and come from different ISP's. Each uses it's own subnet on separate NIC's

                              V S 2 Replies Last reply Reply Quote 0
                              • V
                                viragomann @dalicollins
                                last edited by

                                @dalicollins said in Cannot get to shared folders:

                                I use two pfsense firewalls because I have I two Internet WAN's. One static and the other dynamic. They are totally isolated from one another and come from different ISP's.

                                That's no reason for running two routers. You can have to WANs on a single pfSense if you have enough interfaces.

                                And since the are connected to the same LAN, they are not really isolated from each other.

                                D 1 Reply Last reply Reply Quote 0
                                • S
                                  SteveITS Galactic Empire @dalicollins
                                  last edited by

                                  @dalicollins said in Cannot get to shared folders:

                                  @viragomann
                                  I use two pfsense firewalls because I have I two Internet WAN's. One static and the other dynamic. They are totally isolated from one another and come from different ISP's. Each uses it's own subnet on separate NIC's

                                  pfSense can handle two WANs.

                                  In the above case though can you just connect to an IPSec server on the other firewall instead?

                                  The Outbound NAT trick will work too, that makes the connection come from the pfSense LAN IP.

                                  Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                                  When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                                  Upvote 👍 helpful posts!

                                  1 Reply Last reply Reply Quote 0
                                  • D
                                    dalicollins @viragomann
                                    last edited by dalicollins

                                    @viragomann
                                    I tried with two WANs in one firewall and it was a mess trying to set that up. The static firewall uses Virtual IP's and with two gateways I couldn't control what went where.
                                    By the way, the outbound NAT seem to fix the issue. It's a lot easier just using two firewalls to keep it all separate.
                                    By the way, Thanks a lot for the help.

                                    V 1 Reply Last reply Reply Quote 0
                                    • V
                                      viragomann @dalicollins
                                      last edited by

                                      @dalicollins
                                      pfSense can handle all this pretty well. It gives you full control which traffic to route out to which gateway. You can determine this by source IP or / and ports or destination IP or or / and ports or both.
                                      Just a few firewall rules on a single place.

                                      And the nicest part, it can failover the upstream traffic to the other WAN in case of a dropout of the primary connection. Also it's possible to load balance all upstream traffic permanently.

                                      I can't see any reason for running an additional router for VPN only.

                                      1 Reply Last reply Reply Quote 0
                                      • First post
                                        Last post
                                      Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.