Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Cannot get to shared folders

    Scheduled Pinned Locked Moved IPsec
    29 Posts 3 Posters 2.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • V
      viragomann @dalicollins
      last edited by

      @dalicollins
      I meant, I need to write them double to get one.

      D 1 Reply Last reply Reply Quote 0
      • V
        viragomann @dalicollins
        last edited by

        @dalicollins
        I forgot to ask one essential question: is pfSense the default gateway on the file server?

        D 1 Reply Last reply Reply Quote 0
        • D
          dalicollins @viragomann
          last edited by

          @viragomann
          lol. I think I am really close. probably just missing a rule. Is the IPsec rule I show above correct?

          V S 2 Replies Last reply Reply Quote 0
          • V
            viragomann @dalicollins
            last edited by

            @dalicollins said in Cannot get to shared folders:

            @viragomann
            lol. I think I am really close. probably just missing a rule. Is the IPsec rule I show above correct?

            Yes, it allows any protocol to the server. So access to the file share should be allowed.

            You can restrict it later if you want.

            1 Reply Last reply Reply Quote 0
            • D
              dalicollins @viragomann
              last edited by dalicollins

              @viragomann
              Yes there is only one default gateway and everything on pfsense uses it. All other functions of pfsense work great. But you brought up an interesting question. The server has two NIC's each connected to a different pfsense firewall. But the other computers on the same firewall can get to the shared folders.

              V 1 Reply Last reply Reply Quote 0
              • S
                SteveITS Galactic Empire @dalicollins
                last edited by

                @dalicollins Your IPsec rule allows all traffic and is matching packets so should be fine.

                [slash-slash-slash-text seems to work fine. It shows in the preview to the right while typing. ]

                Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                Upvote 👍 helpful posts!

                1 Reply Last reply Reply Quote 0
                • V
                  viragomann @dalicollins
                  last edited by

                  @dalicollins said in Cannot get to shared folders:

                  Yes there is only one default gateway and everything on pfsense uses it.

                  The question was if the server uses the pfSense running the IPSec server as default gateway.

                  Run

                  route print

                  on the command line to show the default route.

                  D 1 Reply Last reply Reply Quote 0
                  • D
                    dalicollins @viragomann
                    last edited by dalicollins

                    @viragomann
                    On the server
                    IPv4 Route Table

                    Active Routes:
                    Network Destination Netmask Gateway Interface Metric
                    0.0.0.0 0.0.0.0 192.168.100.1 192.168.100.26 1255
                    0.0.0.0 0.0.0.0 192.168.1.1 192.168.1.100 266
                    10.10.10.100 255.255.255.255 On-link 10.10.10.100 315
                    10.10.10.102 255.255.255.255 10.10.10.102 10.10.10.100 60
                    10.10.10.105 255.255.255.255 10.10.10.105 10.10.10.100 60
                    10.10.10.107 255.255.255.255 10.10.10.107 10.10.10.100 60
                    10.10.10.109 255.255.255.255 10.10.10.109 10.10.10.100 60
                    127.0.0.0 255.0.0.0 On-link 127.0.0.1 331
                    127.0.0.1 255.255.255.255 On-link 127.0.0.1 331
                    127.255.255.255 255.255.255.255 On-link 127.0.0.1 331
                    192.168.1.0 255.255.255.0 On-link 192.168.1.100 266
                    192.168.1.100 255.255.255.255 On-link 192.168.1.100 266
                    192.168.1.101 255.255.255.255 On-link 192.168.1.100 266
                    192.168.1.255 255.255.255.255 On-link 192.168.1.100 266
                    192.168.100.0 255.255.255.0 On-link 192.168.100.26 1255
                    192.168.100.26 255.255.255.255 On-link 192.168.100.26 1255
                    192.168.100.255 255.255.255.255 On-link 192.168.100.26 1255
                    224.0.0.0 240.0.0.0 On-link 127.0.0.1 331
                    224.0.0.0 240.0.0.0 On-link 192.168.100.26 1255
                    224.0.0.0 240.0.0.0 On-link 192.168.1.100 266
                    224.0.0.0 240.0.0.0 On-link 10.10.10.100 315
                    255.255.255.255 255.255.255.255 On-link 127.0.0.1 331
                    255.255.255.255 255.255.255.255 On-link 192.168.100.26 1255
                    255.255.255.255 255.255.255.255 On-link 192.168.1.100 266
                    255.255.255.255 255.255.255.255 On-link 10.10.10.100 315

                    Persistent Routes:
                    Network Address Netmask Gateway Address Metric
                    0.0.0.0 0.0.0.0 192.168.1.1 Default
                    0.0.0.0 0.0.0.0 26.0.0.1 9256
                    0.0.0.0 0.0.0.0 192.168.100.1 Default
                    0.0.0.0 0.0.0.0 192.168.1.1 Default

                    192.168.1.1 is the IP going to the other pfsense firewall.
                    10.10.10.100 is the servers internal Windows VPN which is what I want to switch the uses from.

                    V 1 Reply Last reply Reply Quote 0
                    • V
                      viragomann @dalicollins
                      last edited by viragomann

                      @dalicollins said in Cannot get to shared folders:

                      192.168.1.1 is the IP going to the other pfsense firewall.

                      So access from the VPN cannot work.
                      This would be worth to mention at first of all.

                      To get access you have to either add a static route to the server for the VPN tunnel pool and point it to the IPSec pfSense or you can masquerade the outgoing traffic on pfSense.

                      However, if the other router is a pfSense as well, I'm wondering why you fire up an additional to run a VPN on it.

                      D 2 Replies Last reply Reply Quote 0
                      • D
                        dalicollins @viragomann
                        last edited by dalicollins

                        @viragomann
                        Not sure how to do that. I also tried changing the IPsec rule to an IP of a local computer with only one connection and I can ping that IP. So how do I masquerade the outgoing traffic?

                        V 1 Reply Last reply Reply Quote 0
                        • V
                          viragomann @dalicollins
                          last edited by

                          @dalicollins
                          Masquerading is only recommended if you know, what it does and if you have restrict firewall rules. It's a workaround for different issues.
                          But since this VPN is obviously for your own purposes only, you can do this to get a step beyond.

                          It's done by Firewall > NAT > Outbound

                          Select hybride mode and save this first.
                          Add a new rule:
                          interface: LAN
                          source: IPSec tunnel pool (or maybe any, since there is no other passing this pfSense)
                          destination: any
                          translation: interface address

                          Should work then.

                          1 Reply Last reply Reply Quote 0
                          • D
                            dalicollins @viragomann
                            last edited by

                            @viragomann
                            I use two pfsense firewalls because I have I two Internet WAN's. One static and the other dynamic. They are totally isolated from one another and come from different ISP's. Each uses it's own subnet on separate NIC's

                            V S 2 Replies Last reply Reply Quote 0
                            • V
                              viragomann @dalicollins
                              last edited by

                              @dalicollins said in Cannot get to shared folders:

                              I use two pfsense firewalls because I have I two Internet WAN's. One static and the other dynamic. They are totally isolated from one another and come from different ISP's.

                              That's no reason for running two routers. You can have to WANs on a single pfSense if you have enough interfaces.

                              And since the are connected to the same LAN, they are not really isolated from each other.

                              D 1 Reply Last reply Reply Quote 0
                              • S
                                SteveITS Galactic Empire @dalicollins
                                last edited by

                                @dalicollins said in Cannot get to shared folders:

                                @viragomann
                                I use two pfsense firewalls because I have I two Internet WAN's. One static and the other dynamic. They are totally isolated from one another and come from different ISP's. Each uses it's own subnet on separate NIC's

                                pfSense can handle two WANs.

                                In the above case though can you just connect to an IPSec server on the other firewall instead?

                                The Outbound NAT trick will work too, that makes the connection come from the pfSense LAN IP.

                                Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                                When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                                Upvote 👍 helpful posts!

                                1 Reply Last reply Reply Quote 0
                                • D
                                  dalicollins @viragomann
                                  last edited by dalicollins

                                  @viragomann
                                  I tried with two WANs in one firewall and it was a mess trying to set that up. The static firewall uses Virtual IP's and with two gateways I couldn't control what went where.
                                  By the way, the outbound NAT seem to fix the issue. It's a lot easier just using two firewalls to keep it all separate.
                                  By the way, Thanks a lot for the help.

                                  V 1 Reply Last reply Reply Quote 0
                                  • V
                                    viragomann @dalicollins
                                    last edited by

                                    @dalicollins
                                    pfSense can handle all this pretty well. It gives you full control which traffic to route out to which gateway. You can determine this by source IP or / and ports or destination IP or or / and ports or both.
                                    Just a few firewall rules on a single place.

                                    And the nicest part, it can failover the upstream traffic to the other WAN in case of a dropout of the primary connection. Also it's possible to load balance all upstream traffic permanently.

                                    I can't see any reason for running an additional router for VPN only.

                                    1 Reply Last reply Reply Quote 0
                                    • First post
                                      Last post
                                    Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.