Make a Túnnel trought IPSSEC and OpenVPN using PFSense

[felipefonsecabh]

Hi!
I have this network topology:
🔒 Log in to view

My intention is that the devices on network "external access" see the DVC1, for example. I can make changes in PFSense and Mikrotik.

The túnnel IPSEC between pfsense and external access is

Phase 2:
Local Network: 172.25.148.0/24
Remote Network: 192.168.15.0/24

And in Mikrotik (the OpenVPN Túnel is working, i can see the DVC1 through all devices in PFSense LAN for example), in IP -> Routes i set:

dst-address: 192.168.15.0/24
Gateway: (Gateway of OpenVPN Túnel on side PfSense).

But didn't work. I need the pfsense act as túnnel between two networks.

Any ideas? Thanks a lot!

[stephenw10]

That should work as long as there are firewall rules to pass it.

You will also need a route to 192.168.15.0/24 in the Mikrotik so it can reply.

Steve

[felipefonsecabh]

@stephenw10

So, as I said, I created a static route in Mikrotik.
IP -> Routes
dst-address: 192.168.15.0/24
Gateway: (pfsense address of ovpn tunnel)

In Firewall, i mark, accept all connections for testing.

In PFSense, in Firewall -> Rules -> Ipsec, i added:

Action: Pass
Interface: IPSec
Address Family: IPv4
Protocol: Any
Source: Network: 192.168.15.0/24
Destination Network: 172.25.148.0/24

In Firewall -> OpenVPN i allow all packets

After this, i have this situation:

Router of External Access can ping DVC1
IPs on LAN of External Access can't ping DVC1
Any Device in Mikrotik LAN (included the router) can't ping devices in External Access Network.

I missing any detail?

[stephenw10]

@felipefonsecabh said in Make a Túnnel trought IPSSEC and OpenVPN using PFSense:

Router of External Access can ping DVC1

What source IP does it use for that?
To pass the IPSec tunnel it must be in he 192.168.15.0/24 subnet.
In which case it can only be the External Access router blocking traffic clients on it's LAN. Or potentially redirecting traffic past the IPSec tunnel?
What is that device?

Steve