Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Plex through surfshark wireguard pfsense vpn

    Scheduled Pinned Locked Moved General pfSense Questions
    77 Posts 6 Posters 6.4k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • stephenw10S
      stephenw10 Netgate Administrator
      last edited by

      Like:
      Screenshot from 2024-05-21 00-56-20.png

      Assuming 10.0.5.2 is the Plex IP. I would probably add an alias for it and then use that everywhere so you can change it in one pace if you need to.

      jhmc93J 1 Reply Last reply Reply Quote 0
      • jhmc93J
        jhmc93 @stephenw10
        last edited by

        @stephenw10 can you guide me on what I need to do then? Please as I’m new to pfsense. And all I seem to be doing is messing it up. The ip I’m using is a temporary machine so when I get the pfsense to bypass the vpn for Plex I can put it on my main thanks again

        1 Reply Last reply Reply Quote 0
        • stephenw10S
          stephenw10 Netgate Administrator
          last edited by

          Your WAN IP doesn't matter. The NAT rule only has to reference the source as the Plex server IP.

          So add a rule like I showed above.

          What outbound NAT rules do you have currently?

          You could just switch Outbound NAT back to Auto or Hybrid and the rules will match the traffic from the Plex server.

          As I said in those VPN guides they have you remove the auto outbound NAT rues to prevent traffic from internal subnet leaving via the WAN directly. Here you need that to happen.

          jhmc93J 1 Reply Last reply Reply Quote 0
          • jhmc93J
            jhmc93 @stephenw10
            last edited by

            @stephenw10 dcd18421-cadf-4633-9074-039359c21b2e-image.png

            1 Reply Last reply Reply Quote 0
            • stephenw10S
              stephenw10 Netgate Administrator
              last edited by

              OK so you need to add rule on WAN for the Plex server IP as I showed above.

              As an aside you should add a source for the Tailscale rule you have there. Having outbound rules with 'any' source can easily over-match traffic that should not be NAT'd like traffic from the firewall itself.

              Bob.DigB jhmc93J 2 Replies Last reply Reply Quote 0
              • Bob.DigB
                Bob.Dig LAYER 8 @stephenw10
                last edited by

                @stephenw10 said in Plex through surfshark wireguard pfsense vpn:

                Having outbound rules with 'any' source can easily over-match traffic that should not be NAT'd like traffic from the firewall itself.

                Like traffic from the WAN-address will be NATed to the WAN-address? I see, one can not invert that.

                1 Reply Last reply Reply Quote 0
                • stephenw10S
                  stephenw10 Netgate Administrator
                  last edited by

                  Yup, exactly. We have seen that break VPN tunnels from the firewall itself because it also randomises the source port.

                  Bob.DigB 1 Reply Last reply Reply Quote 1
                  • Bob.DigB
                    Bob.Dig LAYER 8 @stephenw10
                    last edited by

                    @stephenw10 Thanks. I guess I have to write a Feature request.

                    1 Reply Last reply Reply Quote 0
                    • jhmc93J
                      jhmc93 @stephenw10
                      last edited by jhmc93

                      @stephenw10
                      So I don’t need to do anything with my NAT outbound rules?
                      I Tried creating a nat rule for Plex IP but it just defaults to 192.168.0.0

                      1 Reply Last reply Reply Quote 0
                      • stephenw10S
                        stephenw10 Netgate Administrator
                        last edited by

                        You need a add a rule like I showed in my example where the source is set to the Plex server IP address.

                        You could set the source to the full LAN subnet but I'm assuming you don't want any other LAN side hosts to be able to use the WAN directly.

                        jhmc93J 1 Reply Last reply Reply Quote 0
                        • jhmc93J
                          jhmc93 @stephenw10
                          last edited by

                          @stephenw10 I did what you said but when I add my Plex server ip address for eg. (192.168.0.90) and I save it, it changes back to 192.168.0.0

                          1 Reply Last reply Reply Quote 0
                          • stephenw10S
                            stephenw10 Netgate Administrator
                            last edited by

                            I assume your Plex server is actually 10.84.62.X?

                            What are you setting that keeps switching back to 0.0?

                            You should be setting the source like so:
                            Screenshot from 2024-05-21 22-46-56.png

                            jhmc93J 1 Reply Last reply Reply Quote 0
                            • jhmc93J
                              jhmc93 @stephenw10
                              last edited by

                              @stephenw10 is there a way I can send a small vid on here to show you?

                              1 Reply Last reply Reply Quote 0
                              • stephenw10S
                                stephenw10 Netgate Administrator
                                last edited by

                                You can upload it here: https://nc.netgate.com/nextcloud/s/iRCYoGnH6KsMrXR

                                jhmc93J 1 Reply Last reply Reply Quote 0
                                • jhmc93J
                                  jhmc93 @stephenw10
                                  last edited by

                                  @stephenw10 IMG_0131.png
                                  Uploaded the video

                                  1 Reply Last reply Reply Quote 0
                                  • stephenw10S
                                    stephenw10 Netgate Administrator
                                    last edited by

                                    You have to set the subnet to /32 for a single host like in my screenshot above.

                                    jhmc93J 1 Reply Last reply Reply Quote 0
                                    • jhmc93J
                                      jhmc93 @stephenw10
                                      last edited by

                                      @stephenw10 apologies I thought your subnet was different to mine hence why I put the 24 in thanks, I’ll give it a go tomorrow and let you know how it goes

                                      1 Reply Last reply Reply Quote 1
                                      • stephenw10S
                                        stephenw10 Netgate Administrator
                                        last edited by

                                        Yup it would be clearer if it showed an 'address' option there. Those rules are almost always used for larger subnets.

                                        jhmc93J 1 Reply Last reply Reply Quote 0
                                        • jhmc93J
                                          jhmc93 @stephenw10
                                          last edited by

                                          @stephenw10 so i got it to work. But I'm having this trouble at the moment:
                                          Screenshot 2024-05-22 175231.png

                                          1 Reply Last reply Reply Quote 0
                                          • stephenw10S
                                            stephenw10 Netgate Administrator
                                            last edited by

                                            What is failing there?

                                            What is now working?

                                            How are you testing?

                                            jhmc93J 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.