Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Pfsesne 2.7.0 OpenVPN Client connected, RDP Work OK BUT no internet access

    Scheduled Pinned Locked Moved OpenVPN
    34 Posts 4 Posters 3.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • UnoptanioU
      Unoptanio @Gertjan
      last edited by Unoptanio

      @Gertjan

      HI,
      that's what I've been trying to do for the last few hours. but at the moment I haven't succeeded yet.
      I would like to use the computer name in RDP sessions instead
      of the IP address

      RDP session using PC NAME not work.
      fda8aaac-4287-4672-8b01-0e053d475efe-image.png

      RDP session using ip address of PC work OK.
      a74d5a3f-1acd-4575-92d7-d621931782e4-image.png

      765b7893-2a07-4671-b78b-38e031a5d497-image.png

      i changed the pfsense config like you saids:

      9077cafa-f740-4a8e-b7a0-f1bae3e189b4-image.png
      e7957a13-cd73-4a73-a8cb-24579e434d95-image.png

      UnoptanioU 1 Reply Last reply Reply Quote 0
      • UnoptanioU
        Unoptanio @Unoptanio
        last edited by Unoptanio

        @Gertjan

        I find this in "services", "DNS RESOLVER?"

        e0694b42-e287-471f-9b40-4a41a2b81fb8-image.png

        I have not added the OPENVPN server in the interfaces.

        and consequently does not appear in the DNS resolver list.

        05e1edaf-35c6-4858-995d-2f752ecb7507-image.png

        S 1 Reply Last reply Reply Quote 0
        • S
          slu @Unoptanio
          last edited by

          @Unoptanio
          dou you have set firewall rules for the OpenVPN connection?

          pfSense Gold subscription

          UnoptanioU 1 Reply Last reply Reply Quote 0
          • UnoptanioU
            Unoptanio @slu
            last edited by

            @slu
            the openvpn wizard entered them automatically

            d3e5c548-273d-4a9a-8160-aecbcfc78dcd-image.png

            S GertjanG 2 Replies Last reply Reply Quote 0
            • S
              slu @Unoptanio
              last edited by

              @Unoptanio said in Pfsesne 2.7.0 OpenVPN Client connected, RDP Work OK BUT no internet access:

              the openvpn wizard entered them automatically

              no I mean internet access from your VPN client over the VPN into WAN.
              That was your question, or?

              pfSense Gold subscription

              1 Reply Last reply Reply Quote 0
              • GertjanG
                Gertjan @Unoptanio
                last edited by Gertjan

                @Unoptanio

                Observe :

                5494765c-9743-4e46-b0cf-777c1394c1f5-image.png

                As soon as you connect, the right number will raise.
                The left number will show the number of open states, so bigger then 0.

                This means traffic comes in ....
                Do you see the same ?
                To hit your perfect OpenVPN server Firewall rules :

                fb5b9d2c-13e4-4de0-a515-f8d8bd4c6f54-image.png

                as these are all pass rules (for me : IPv4 and Ipv6) traffic can get everywhere.
                Take note : the counter in front of the rules : do they go up ?

                If you were connecting to some device on LAN, then the traffic would get routed out to the LAN interface, and then it really try to reach that device ....
                Suspense : will this device (its firewall ?) accept this traffic 😊

                You can do a packet capturing on the LAN interface, as you know the destination IP, and destination port, and protocol used (UDP ?)
                Do you see it ?

                No "help me" PM's please. Use the forum, the community will thank you.
                Edit : and where are the logs ??

                UnoptanioU 1 Reply Last reply Reply Quote 0
                • UnoptanioU
                  Unoptanio @Gertjan
                  last edited by Unoptanio

                  @Gertjan

                  latest updates and tests:
                  I added a specific OPEN_VPN interface that I didn't have before

                  89e6c5cc-0483-4b81-85f8-f92dab25a92c-image.png

                  b77392ad-0b11-449b-8f7a-9828ba611795-image.png
                  here the numbers turn, there is traffic when there are rdp sessions

                  4ce21996-5d12-4d0a-9178-83753073d443-image.png

                  9df11b0b-f865-41be-beaa-9c4724498261-image.png

                  7248e85b-5f20-49b5-a1f2-aebc9f1f4258-image.png

                  5d36af37-8b3d-4efb-be23-262c84068843-image.png

                  08e7131d-d083-49aa-a229-2e2e8e48da08-image.png

                  The problem:
                  RDP work only with IP address of the pc
                  if i use PC name not working

                  240ff862-52c5-4ead-9422-ff7b68b2d19e-image.png

                  a0743670-277f-4f52-8353-ac42b4351e51-image.png

                  7b27e516-b49c-4ab7-b2d5-960e480a9cd1-image.png

                  GertjanG 1 Reply Last reply Reply Quote 0
                  • GertjanG
                    Gertjan @Unoptanio
                    last edited by Gertjan

                    @Unoptanio said in Pfsesne 2.7.0 OpenVPN Client connected, RDP Work OK BUT no internet access:

                    I added a specific OPEN_VPN interface that I didn't have before

                    9719e739-5b0f-4a93-9835-18c56b397cb0-image.png

                    This Open_VPN is assigned to the OpenVPN server instance ?

                    Like this (my OpenVPN server ) :

                    e0810a06-6255-4422-b3b1-dd5e0093d378-image.png

                    ?

                    Then you have probably an issue.
                    RDP is mostly, if not all, UDP based. Your firewall rule only permits IPv4-TCP and blocks IPv4-UDP.

                    As proposed : time to do some : Diagnostics > Packet Capture

                    Btw : read also : Cannot connect with RDP via openVPN for some out of the box thinking ;)

                    No "help me" PM's please. Use the forum, the community will thank you.
                    Edit : and where are the logs ??

                    UnoptanioU 1 Reply Last reply Reply Quote 0
                    • UnoptanioU
                      Unoptanio @Gertjan
                      last edited by Unoptanio

                      This post is deleted!
                      1 Reply Last reply Reply Quote 0
                      • UnoptanioU
                        Unoptanio @Gertjan
                        last edited by

                        @Gertjan said in Pfsesne 2.7.0 OpenVPN Client connected, RDP Work OK BUT no internet access:

                        s unbound also listens on 10.10.94.1, the OpenVPN server IP on the pfSense side.

                        Why ? Now

                        @Gertjan said in Pfsesne 2.7.0 OpenVPN Client connected, RDP Work OK BUT no internet access:

                        Why ? Now you can use local URL/host names like server.XXXXpfSense.homa.arpa to join a RDP session on "server" on your LAN.
                        8.8.8.8 and others don't know anything about your local devices ;)

                        I finally found it. it's about DNS resolver at the bottom

                        you need to add the hostnames in the override section of the DNS resolver.
                        This way you can access RDP using hostname.domain

                        Tried it works

                        693bd1c3-830a-48b5-b0e4-ee94df4b58c7-image.png

                        UnoptanioU 1 Reply Last reply Reply Quote 0
                        • UnoptanioU
                          Unoptanio @Unoptanio
                          last edited by Unoptanio

                          @Gertjan
                          Good morning, excuse me , in the openvpn log section I find these IP addresses unknown to me that are trying something.

                          Do I have to worry?
                          What I can do?

                          8f7ee4e1-fba5-4f99-9f3d-c63a2260ecc0-image.png

                          GertjanG 1 Reply Last reply Reply Quote 0
                          • GertjanG
                            Gertjan @Unoptanio
                            last edited by

                            @Unoptanio said in Pfsesne 2.7.0 OpenVPN Client connected, RDP Work OK BUT no internet access:

                            Do I have to worry?

                            Noop.
                            Example : you have a phone, and a SIM card. So you have a phone number.
                            Is is a surprise that very body on earth can call you right now ? Of course not. That's the way it should work.
                            ( although there are people that actually want to use world's public phone network but not want to be called by any one .... or drive on the public road, and not want to encounter other people with their cars - you understand what I mean )

                            Before, they had this perfect WAN firewall rule set :

                            b3daea7a-6178-4574-a35a-839b223942f9-image.png

                            Yep, that is right : no rules !!
                            The default firewall behaviour is : drop everything that comes in.
                            And if you had this one not checked :

                            bc5a1583-8999-4dbf-ac69-d9c1b1089a90-image.png

                            then you aren't even aware that there are actually incoming connection all the time.
                            Like something pressing on your doorbell, and even trying if the front door is open .... They try without stopping.

                            Now that your pfSense has a process that is actually listening on the WAN interface, (port 1194, protocol UDP), you suddenly can see them .....
                            Nothing changed. You just became aware of this aspect. It was always there already.

                            So nothing to worry about. It's part of becoming more "aware". Just keep on doing this ^;)

                            @Unoptanio said in Pfsesne 2.7.0 OpenVPN Client connected, RDP Work OK BUT no internet access:

                            What I can do?

                            Although I should not advising anybody to stop securing is infrastructure, I can tell you this :
                            I do nothing.
                            I have this rule :

                            2c599434-7fed-4d59-9b19-c67b8d4f0fcf-image.png

                            like you.
                            And if some one manages to 'pass along' the OpenVPN (the process listing) then I kneel down and will say : "I'm honoured to meet you". OpenVPN-server as of today, hasn't been broken yet.
                            When the entire planet went into a lock down and home working became the new thing, every company was implementing a OpenVPN access.
                            And noop ..... OpenVPN wasn't broken ....

                            So : again : let them have it.

                            You can, of course, do something about it.

                            Stupid, but valid example :

                            You saw the Source (IP) is a start which means : all the IPv4, so from 0.0.0.0 to 255.255.255.255.
                            You can change that.
                            Put an alias in place !
                            And set this alias to the IPv4 of your phone or device you use to connect to your OpenVPN server.

                            Now only you - your device - can connect to your OpenVPN.
                            And nobody else.

                            You'll find out quickly that you can't control what IPv4 your device is using while running around in your country.
                            So : note down the IPv4 - and call home, and have the alias used in the OpenVPN set to this IPv4.
                            Now you can connect again, using any IP.
                            And no one else.

                            You'll say : hey, that's tedious ! Of course it is. So, automate it !
                            Example use some dyndns client on your phone or PC. When it conects to the Internet, it will update your "your-device.dydns.org" so it point to your device.

                            On the pfSense side of things, decalre an URL/IP as "your-device.dydns.org". pgSEne will no refresh the IP of this your-device.dydns.org every 5 minutes or so (check this !).

                            So, your device gets an IPv4 - it will update it, and max 5 minutes later, the pfSense alias is 'resolved' and you can 'OpenVPN' into your pfSense as only that IP is now valid.

                            Btw : I just invented this procedure, I never actually tested and used it.

                            No "help me" PM's please. Use the forum, the community will thank you.
                            Edit : and where are the logs ??

                            UnoptanioU 2 Replies Last reply Reply Quote 1
                            • UnoptanioU
                              Unoptanio @Gertjan
                              last edited by Unoptanio

                              @Gertjan

                              OK thank you.
                              I follow your reasoning.
                              I agree with you.
                              Your advice is very valuable.

                              I already had the option enabled
                              b72aa94b-1fbf-4a57-8c4a-d913640ae75a-image.png

                              GertjanG 1 Reply Last reply Reply Quote 0
                              • GertjanG
                                Gertjan @Unoptanio
                                last edited by

                                @Unoptanio

                                Hummm.
                                From where in the GUI did you took this screen shot ?

                                No "help me" PM's please. Use the forum, the community will thank you.
                                Edit : and where are the logs ??

                                UnoptanioU 1 Reply Last reply Reply Quote 0
                                • UnoptanioU
                                  Unoptanio @Gertjan
                                  last edited by

                                  @Gertjan

                                  95473915-8cc1-4d47-9cb4-e72a0db7c0bd-image.png

                                  c69b52df-ff28-4967-9c71-bcc5d795b6c0-image.png

                                  1 Reply Last reply Reply Quote 0
                                  • UnoptanioU
                                    Unoptanio @Gertjan
                                    last edited by Unoptanio

                                    @Gertjan

                                    Where did you get this?
                                    061255a4-a839-45d0-9b24-1dc6c7360994-image.png

                                    GertjanG UnoptanioU 2 Replies Last reply Reply Quote 0
                                    • GertjanG
                                      Gertjan @Unoptanio
                                      last edited by

                                      @Unoptanio

                                      There where you set the log option : Status > System Logs >Settings

                                      No "help me" PM's please. Use the forum, the community will thank you.
                                      Edit : and where are the logs ??

                                      1 Reply Last reply Reply Quote 0
                                      • UnoptanioU
                                        Unoptanio @Unoptanio
                                        last edited by

                                        @Gertjan

                                        Found.
                                        You saw it here

                                        c6925c99-5aed-4f63-93bf-d4a9f05f1a3a-image.png

                                        UnoptanioU 1 Reply Last reply Reply Quote 0
                                        • UnoptanioU
                                          Unoptanio @Unoptanio
                                          last edited by

                                          @Gertjan
                                          but also in your firewall there are all these strangers ringing the bell?

                                          3b6b29dd-9b05-40d4-9dc6-4f2a1aadc099-image.png

                                          1 Reply Last reply Reply Quote 0
                                          • First post
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.