Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Port Forwarding w/ OpenVPN Tunnel - What am I doing wrong?

    Scheduled Pinned Locked Moved NAT
    35 Posts 3 Posters 3.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • T
      techbooties @viragomann
      last edited by

      @viragomann - Thx for the response. To clarify your points:

      1. I was only saying that there is one IP (10.13.31.22) in the group "VPNAccess" which is an alias, per the guides followed. In my case, this is the only IP that should use the VPN (in the past, I had a few more in there but since consolidated.)

      2. Telnet locally to the client from another local machine works on the port:
        c8b2d77d-b0f9-4363-98b4-28a8220ef18b-image.png

      3. I sniffed on LAN, from the router to the client, and the ports show up. (When using another local to local host, it won't show up in the sniff, due to never hitting the router.) (Note: Ignore the hostname, it's a local domain, resolved locally at the moment.)
        c7518960-a31a-46ac-976d-a3f6a4b10652-image.png

      1 Reply Last reply Reply Quote 0
      • T
        techbooties
        last edited by

        Is there anyone else with a similar problem?

        V 1 Reply Last reply Reply Quote 0
        • V
          viragomann @techbooties
          last edited by

          @techbooties
          Again, sniff the traffic on LAN using packet capture, while you try to access the service via VPN.
          Post the result, please.

          T 1 Reply Last reply Reply Quote 0
          • T
            techboot @viragomann
            last edited by

            @viragomann - Thanks for the post. Was what I pasted previously in response to your question initially, not sufficient? I thought that I had done what you suggested?

            V 1 Reply Last reply Reply Quote 0
            • V
              viragomann @techboot
              last edited by

              @techboot
              You posted a pcap of LAN, while you obviously did a telnet from pfSense itself. And this seems to work.
              However, I requested to sniff the traffic on LAN, while you access the server from outside via VPN.

              T T 2 Replies Last reply Reply Quote 0
              • T
                techboot @viragomann
                last edited by

                @viragomann

                Thanks -- Just got back to this today.

                949012ac-4c16-42b6-9deb-c01277a4482c-image.png

                c0d90790-a118-4327-80d1-a8f7d180ebe6-image.png

                809aa112-8508-436b-8423-e3c2ed2ddd46-image.png

                When I try the same telnet as above, I don't get any kind of connection. When using Lan to Lan I get a connection via telnet, so I can't say that the host machine is blocking this?

                V 1 Reply Last reply Reply Quote 0
                • T
                  techbooties @viragomann
                  last edited by

                  @viragomann -- I wanted to add a detail that the VPN provider is issuing private IP addresses (ie: 10.X.X) but I imagine that is commonplace with every kind of VPN provider at this stage. Is there a rule I am missing?

                  I tried a block all rule on the VPN interface to see if I could get any kind of logging, and there was nothing even in the firewall block logs.

                  1 Reply Last reply Reply Quote 0
                  • V
                    viragomann @techboot
                    last edited by

                    @techboot
                    You're using a different destination port now, as allowed in the NAT rule?

                    Don't know, what kind of connection this is. It basically looks fine, but not any packet has a payload. So maybe it's just "keep alive" communication.

                    @techbooties said in Port Forwarding w/ OpenVPN Tunnel - What am I doing wrong?:

                    I wanted to add a detail that the VPN provider is issuing private IP addresses (ie: 10.X.X) but I imagine that is commonplace with every kind of VPN provider at this stage.

                    Changed the forum username?
                    No, it's not normal to masquerade the source IP.
                    And I was expecting to see a public IP.

                    T 2 Replies Last reply Reply Quote 0
                    • T
                      techboot @viragomann
                      last edited by techboot

                      @viragomann

                      I must have created a second account and didn't realize Google had an account linked and stored the other. Sorry for this confusion. I will clean up the duplicate account, but don't want to delete it mid-thread.

                      Yes, I changed the port number from the VPN provider... it's a static port, with the option to release and request a new one if needed.

                      So basically VPN provider (AirVPN) has public IP -> private IP with assigned port to route towards it (mine, when connected with the client) -> pfsense -> local machine

                      43b3f531-ddad-4611-a825-8be64dee5584-image.png

                      So my running theory now is that since I am being assigned a 10.x IP by the VPN provider upon connection to them, there is something I am missing fundamentally in my config?

                      V 1 Reply Last reply Reply Quote 0
                      • T
                        techboot @viragomann
                        last edited by

                        @viragomann

                        Adding my outbound NAT for your reference:

                        091b956c-cf2a-46d2-b58b-f095f056f83d-image.png

                        1 Reply Last reply Reply Quote 0
                        • V
                          viragomann @techboot
                          last edited by

                          @techboot
                          This whole thread is already pretty confusing. In the screenshot above on the VPN interface, I can see public source IP. But then you say, the provider replaces it with a private one (masquerading)...

                          To get a step beyond, do a simple test, please:
                          Add an outbound NAT rule for the incoming traffic:
                          Interface: LAN
                          source: any
                          destination: <server IP>/32
                          translation: interface address

                          Check if you get access from outside.

                          T 1 Reply Last reply Reply Quote 0
                          • T
                            techboot @viragomann
                            last edited by

                            @viragomann

                            To clarify when you say "server ip" do you want the public ip as seen in the screenshot or the assigned internal IP via Masquerading?

                            V 1 Reply Last reply Reply Quote 0
                            • V
                              viragomann @techboot
                              last edited by viragomann

                              @techboot
                              It's local IP.

                              Edit:
                              also flush the states after adding the rule.

                              T 1 Reply Last reply Reply Quote 0
                              • T
                                techboot @viragomann
                                last edited by

                                @viragomann

                                No change. To confirm:

                                NAT:
                                278e1196-ddc3-4de2-800b-591771b8ddee-image.png

                                Outbound NAT:
                                2c5e0bc5-587d-464c-83eb-7746c68c87b9-image.png

                                Rules (VPN Interface)
                                478e7003-ac92-4917-8e81-41408a451616-image.png

                                VPN Provider Port Check Tool: (Note, telnet to the public IP from an outside IP (ie: an Azure VPS, yields the same result)
                                28397b2c-c93e-4888-ad7b-291b61ee1cca-image.png

                                --

                                In an effort to maybe make this easier, should I delete this thread and re-make it? I will remove all of the rules, NAT, etc.. reboot for good measure and start over with all of the details / information in one post based on your feedback and comments thus far?

                                V 1 Reply Last reply Reply Quote 0
                                • V
                                  viragomann @techboot
                                  last edited by

                                  @techboot said in Port Forwarding w/ OpenVPN Tunnel - What am I doing wrong?:

                                  NAT:

                                  And the mess goes on...
                                  10.13.31.22 is your VPN interface address. The NAT IP has to be your internal server IP!

                                  Also you should limit the destination IP. Your may set it to the interface address.

                                  T 1 Reply Last reply Reply Quote 0
                                  • T
                                    techboot @viragomann
                                    last edited by

                                    @viragomann

                                    10.13.31.22 is my internal IP.

                                    The 10.65.130.4 is the IP assigned by the VPN provider.

                                    V 1 Reply Last reply Reply Quote 0
                                    • V
                                      viragomann @techboot
                                      last edited by

                                      @techboot
                                      Ah ya. So you need to edit the outbound NAT rule and correct the destination IP.

                                      T 1 Reply Last reply Reply Quote 0
                                      • T
                                        techboot @viragomann
                                        last edited by

                                        @viragomann

                                        Cleared States.

                                        7cf805f8-d2b9-433b-870d-eb8def925db5-image.png

                                        --
                                        8fb7dacc-2a54-4eaa-918e-b266c891c0d1-image.png

                                        --

                                        I am confused what you mean by limit the destination IP and limit to the interface address. I assume you mean on the port forward tab?

                                        V 1 Reply Last reply Reply Quote 0
                                        • V
                                          viragomann @techboot
                                          last edited by

                                          @techboot said in Port Forwarding w/ OpenVPN Tunnel - What am I doing wrong?:

                                          I assume you mean on the port forward tab?

                                          Yes.

                                          In the LAN outbound NAT rule correct the translation to interface address, please, which is the default setting.

                                          T 1 Reply Last reply Reply Quote 0
                                          • T
                                            techboot @viragomann
                                            last edited by

                                            @viragomann

                                            I think I have now gone and confused myself in all of this. Thank you for bearing with me.

                                            Like this?

                                            67d33750-6821-460f-94d2-656873739ca8-image.png

                                            V 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.