Plex through surfshark wireguard pfsense vpn
-
@stephenw10 said in Plex through surfshark wireguard pfsense vpn:
Having outbound rules with 'any' source can easily over-match traffic that should not be NAT'd like traffic from the firewall itself.
Like traffic from the WAN-address will be NATed to the WAN-address? I see, one can not invert that.
-
Yup, exactly. We have seen that break VPN tunnels from the firewall itself because it also randomises the source port.
-
@stephenw10 Thanks. I guess I have to write a Feature request.
-
@stephenw10
So I don’t need to do anything with my NAT outbound rules?
I Tried creating a nat rule for Plex IP but it just defaults to 192.168.0.0 -
You need a add a rule like I showed in my example where the source is set to the Plex server IP address.
You could set the source to the full LAN subnet but I'm assuming you don't want any other LAN side hosts to be able to use the WAN directly.
-
@stephenw10 I did what you said but when I add my Plex server ip address for eg. (192.168.0.90) and I save it, it changes back to 192.168.0.0
-
I assume your Plex server is actually 10.84.62.X?
What are you setting that keeps switching back to 0.0?
You should be setting the source like so:
-
@stephenw10 is there a way I can send a small vid on here to show you?
-
You can upload it here: https://nc.netgate.com/nextcloud/s/iRCYoGnH6KsMrXR
-
@stephenw10
Uploaded the video -
You have to set the subnet to /32 for a single host like in my screenshot above.
-
@stephenw10 apologies I thought your subnet was different to mine hence why I put the 24 in thanks, I’ll give it a go tomorrow and let you know how it goes
-
Yup it would be clearer if it showed an 'address' option there. Those rules are almost always used for larger subnets.
-
@stephenw10 so i got it to work. But I'm having this trouble at the moment:
-
What is failing there?
What is now working?
How are you testing?
-
@stephenw10 so I allowed it in Nat outbound like you said. I also had to create a firewall rule to allow internet to be accessible and I’m running Plex, but my Plex ip says insecure where ssl is meant to be, so I don’t know if that’s normal???
But I went on Plex.tv on my laptop and it showed the error above.
But at the moment I’m on holiday and my Plex server is at home so my laptop is connected to Tailscale so I can work on my local IP’s at home.
My Plex ip let’s me see my server just not working via the Plex.tv website -
Ah, so you are trying to connect to the Plex server from some remote location.
So using the IP directly allows you to connect but shows as insecure? Dos it show a bad cert, like self signed?
That seems like a setting in Plex. I don't run it I can't comment specifically.Using the app is it trying to access Plex over the VPN or dircetly? Via a port forward or some external relay?
-
@stephenw10 I managed to get around it. I got a feeling my laptop that has a vpn was making it unsecured, or it may be a Tailscale issue. All I know is that the NAT record u helped me with is working perfect. If I cat ifconfig.me it replies with my ISP’s Public IP not the vpn. So thanks for your help. I don’t know if it a pfsense problem or if it’s because I haven’t port forwarded my isp router to the pfsense. But I still get remote access to enable it just says error. Could it be because my ISP router doesn’t have a port forward to the pfsense? Because the port forwarding rule is set for Plex in pfsense.
-
If it does rely on a port forward then, yes, you would need that traffic to arrive at the pfSense WAN. So if you ISP router is still routing it too would need to forward the traffic.
I know @johnpoz runs Plex in all sorts of interesting configs so there's a good chance he could diagnose this in seconds if he's around.
-
@stephenw10 see the idea was port forward pfsense but not my isp modem/router but if u need to port forward isp one to the pfsense then I’ll do it
