Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    1 WAN interface, 3 LAN interfaces, OpenVPN allow communication to all networks

    Scheduled Pinned Locked Moved General pfSense Questions
    44 Posts 4 Posters 2.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • stephenw10S
      stephenw10 Netgate Administrator
      last edited by

      Can you grab a screenshot of that?

      J 1 Reply Last reply Reply Quote 0
      • J
        jg8000 @stephenw10
        last edited by

        @stephenw10

        Sure

        Screenshot 2024-05-23 at 1.06.02 PM.png

        Screenshot 2024-05-23 at 1.06.40 PM.png

        1 Reply Last reply Reply Quote 0
        • stephenw10S
          stephenw10 Netgate Administrator
          last edited by

          Ok, so in both cases that ping is coming in the VPN and leaving the internal interface correctly but no replies come back.

          So either the target devices are not replying or the replies are not coming back to pfSense. More likely they just don't reply to pings from outside their own subnet because of local firewall restrictions.

          What are those target devices?

          J 2 Replies Last reply Reply Quote 0
          • J
            jg8000 @stephenw10
            last edited by

            @stephenw10

            Thank you for your help.

            I have duplicated the issue on a separate setup.

            I have 3 interfaces setup:

            WAN

            LAN: set to static 192.168.1.1/24

            OPT1 - set to static 192.168.2.1/24

            I enabled DHCP for both, and setup a windows client on each LAN. I don't have OpenVPN on this setup but I think the problem is similar.

            The machines can't ping each other. They both get DHCP addresses, I can ping the statically assigned interface IP, access the pfsense admin .1 address from each client. I can even get to the other interface .1 pfsense login from each client.

            But I can't get them to ping each other.

            I don't understand what I'm doing wrong.

            1 Reply Last reply Reply Quote 0
            • J
              jg8000 @stephenw10
              last edited by

              @stephenw10

              Ok, you are correct. It was the local firewall restricting the response. I turned off the local firewall and I can now ping. I did not try other services yet.

              The real world scenario is access the LAN via ssh from the VPN Net, and to access the IMPI/iLO also.

              Right now it's not working, can't access ssh or ping, it's Rocky 8/9 so a firewall could be the issue. Not sure about iLO, it should be accessible via https but that isn't working either.

              1 Reply Last reply Reply Quote 0
              • stephenw10S
                stephenw10 Netgate Administrator
                last edited by

                You can work around it with an outbound NAT rule so traffic appears to be sourced from the pfSense interface address.

                But a cleaner solution is to add rules on the targets to allow the access.

                J 1 Reply Last reply Reply Quote 0
                • J
                  jg8000 @stephenw10
                  last edited by jg8000

                  @stephenw10

                  Thank you, so if I wanted to add an Outbound NAT rule to make it seem like the traffic is originating on the same subnet, how can I set this up?

                  If I come in via VPN on 192.168.50.0/24 and want to connect to 192.168.3.1/24 how is the rule configured?

                  This is my attempt on my test bench trying to get to an IPMI device on 192.168.3.101 (OPT2) from 192.168.1.5 (LAN). I can get to IPMI only if I configure the network port to be on the 192.168.3.1/24 (OPT2) interface

                  a4de983e-e023-4b1b-a8d7-3d770508a043-image.png

                  1 Reply Last reply Reply Quote 0
                  • stephenw10S
                    stephenw10 Netgate Administrator
                    last edited by

                    That rule will work if you put it on the OPT2 interface. It gets applied outbound on the interface so must be on OPT2.

                    J 1 Reply Last reply Reply Quote 0
                    • J
                      jg8000 @stephenw10
                      last edited by

                      @stephenw10

                      Should the rule be greyed out like this? I still can't get it to go, I changed the interface to OPT2. My test client is on the LAN interface (192.168.1.5)

                      2e64df91-b2f7-4b83-8f2c-47af09840fdd-image.png

                      2ba6dcff-32f2-4d85-9342-000b5c30524b-image.png

                      1 Reply Last reply Reply Quote 0
                      • stephenw10S
                        stephenw10 Netgate Administrator
                        last edited by

                        Oh sorry you need to set outbound NAT to hybrid or manual to apply user rules. I suggest hybrid so auto rules are still updated.

                        J 1 Reply Last reply Reply Quote 0
                        • J
                          jg8000 @stephenw10
                          last edited by

                          @stephenw10
                          Thank you, it's no longer greyed out but still not working.

                          8ddeaca9-b24c-415a-8c69-4532063f297c-image.png

                          The idea is for (LAN) 192.168.1.5 to access (OPT2) 192.168.3.101 as if it were on the 192.168.3.0/24 subnet. Do I need to specify port ranges or anything? I hope not.

                          I can verify access by switching from (LAN)192.168.1.5 to (OPT2) 192.168.3.5 on the windows test client and accessing the web IPMI interface.

                          231e7b23-899b-4b63-9cf8-196114acb27f-image.png

                          stephenw10S 1 Reply Last reply Reply Quote 0
                          • stephenw10S
                            stephenw10 Netgate Administrator
                            last edited by

                            Check the state table again. You should see the translation on the OPT2 state.

                            J 1 Reply Last reply Reply Quote 0
                            • J
                              jg8000 @stephenw10
                              last edited by

                              @stephenw10

                              I only see activity from 192.168.15 to the pfsense admin web admin. Nothing for 192.168.3

                              96348263-af11-46c6-94a2-bc95071e72a6-image.png

                              1 Reply Last reply Reply Quote 0
                              • stephenw10S
                                stephenw10 Netgate Administrator @jg8000
                                last edited by

                                @jg8000 said in 1 WAN interface, 3 LAN interfaces, OpenVPN allow communication to all networks:

                                I can verify access by switching from (LAN)192.168.1.5 to (OPT2) 192.168.3.5 on the windows test client

                                How exactly are you making that switch? Does that client have NICs in both subnets? If so it's probably not sending traffic through pfSense at all.

                                J 1 Reply Last reply Reply Quote 0
                                • J
                                  jg8000 @stephenw10
                                  last edited by

                                  @stephenw10

                                  I just use it as a sanity check. I change the adapter IP from the 192.168.1 to the 192.168.3. and the IPMI port is on the same switch. So no, I doubt pfsense is involved. It only tells me that it's up and accessible.

                                  1 Reply Last reply Reply Quote 0
                                  • stephenw10S
                                    stephenw10 Netgate Administrator
                                    last edited by

                                    Hmm, but sending from 1.5 to 3.5 should go through pfSense and seemingly isn't (no states). So either something else is routing between those subnets, layer 3 switch maybe, or the client itself can access both subnets directly. Or perhaps it's just not sending, no default route?

                                    J 2 Replies Last reply Reply Quote 0
                                    • J
                                      jg8000 @stephenw10
                                      last edited by jg8000

                                      @stephenw10

                                      The IPMI has a default route, I set it to 192.168.3.1. The 192.168.1.5 interface has no gateway.

                                      No layer 3 switch, IPMI cable to cheap netgear switch, and cable from same switch to windows client. I can't have the windows test client 192.168.1.5 have a gateway because it's dual homed with a WAN interface and the WAN needs it.

                                      1 Reply Last reply Reply Quote 0
                                      • J
                                        jg8000 @stephenw10
                                        last edited by jg8000

                                        @stephenw10

                                        On the real server setup, I am able to see the states when going to the 192.168.3.0/24 from the VPN net 192.168.50.0/24. I'm not sure what to make of it.

                                        Although it doesn't seem to matter if the target http address is real or not, but I guess that doesn't matter, looks like it's making an attempt?

                                        af1fd218-4385-4985-88cb-d829fc28bf81-image.png

                                        1 Reply Last reply Reply Quote 0
                                        • stephenw10S
                                          stephenw10 Netgate Administrator
                                          last edited by

                                          The states are correct but there is no translation. Did you add an appropriate OBN rule there too?

                                          J 1 Reply Last reply Reply Quote 0
                                          • J
                                            jg8000 @stephenw10
                                            last edited by

                                            @stephenw10

                                            I see those states no matter if the OBN is there or not.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.