Two pfsense in same LAN with diferent gateway clients
-
Hello, I have 2 pfsense in my network, each one with a wan and a lan, the LANs both belong to the same network 192.168.100.0/24, a pfsense has 192.168.100.254 and another the x.x.x.x.253, the servers of my network I have as default gw the .253 and the rest of clients I have as gw the .253, the problem is when I connect by openvpn to one of these pfsense, I can not ping or connect to those who have as GW the other pfsense, I have not managed to see information about it, most likely for not knowing how to define my network topology.
How could I access by openvpn to all my network?
-
@virusbcn if clients your wanting to talk to use some other device as their gateway.. You would have to do a source nat that the clients your talking to from your vpn, so they think the traffic came from the pfsense lan IP.
This would be done via a outbound nat on your lan interface of pfsense where the vpn connections are coming thru.
Or you would have to create a route on the device your talking to so it knows to send the return traffic back to the correct pfsense.
Why not just setup 1 pfsense with both wan connections and just policy route the traffic you want to use wan X and your other stuff uses wan Y, etc.
-
@johnpoz
yes, combining into a single pfsense would be the smartest option ;-)Instead of creating the route on the client, couldn't I create the route on the pfsense ?? i.e. if my vpns clients have the x.x.99.x put a route on the other pfsense that everything that is x.x.99.x goes to the other gw pfsense ????
-
@virusbcn that will lead to asymmetrical traffic flow. And the return traffic to the other pfsense would have no state.. Even if you created a transit between the pfsenses.
Use 1 pfsense, create 2 different lan side networks that your pfsenses have a transit network to talk to each other to get to each others networks. Do source natting of the traffic, use host routes on your devices.
There are many ways to skin this cat.. Pick one of the ways. The easiest solution is just to do a source nat, an outbound nat on the pfsense doing the vpn so that clients you talk to on this shared lan think the traffic is just coming from that pfsense lan IP.
