Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    1 WAN interface, 3 LAN interfaces, OpenVPN allow communication to all networks

    Scheduled Pinned Locked Moved General pfSense Questions
    44 Posts 4 Posters 3.0k Views 4 Watching
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • J Offline
      jg8000 @stephenw10
      last edited by

      @stephenw10

      Ok, you are correct. It was the local firewall restricting the response. I turned off the local firewall and I can now ping. I did not try other services yet.

      The real world scenario is access the LAN via ssh from the VPN Net, and to access the IMPI/iLO also.

      Right now it's not working, can't access ssh or ping, it's Rocky 8/9 so a firewall could be the issue. Not sure about iLO, it should be accessible via https but that isn't working either.

      1 Reply Last reply Reply Quote 0
      • stephenw10S Offline
        stephenw10 Netgate Administrator
        last edited by

        You can work around it with an outbound NAT rule so traffic appears to be sourced from the pfSense interface address.

        But a cleaner solution is to add rules on the targets to allow the access.

        J 1 Reply Last reply Reply Quote 0
        • J Offline
          jg8000 @stephenw10
          last edited by jg8000

          @stephenw10

          Thank you, so if I wanted to add an Outbound NAT rule to make it seem like the traffic is originating on the same subnet, how can I set this up?

          If I come in via VPN on 192.168.50.0/24 and want to connect to 192.168.3.1/24 how is the rule configured?

          This is my attempt on my test bench trying to get to an IPMI device on 192.168.3.101 (OPT2) from 192.168.1.5 (LAN). I can get to IPMI only if I configure the network port to be on the 192.168.3.1/24 (OPT2) interface

          a4de983e-e023-4b1b-a8d7-3d770508a043-image.png

          1 Reply Last reply Reply Quote 0
          • stephenw10S Offline
            stephenw10 Netgate Administrator
            last edited by

            That rule will work if you put it on the OPT2 interface. It gets applied outbound on the interface so must be on OPT2.

            J 1 Reply Last reply Reply Quote 0
            • J Offline
              jg8000 @stephenw10
              last edited by

              @stephenw10

              Should the rule be greyed out like this? I still can't get it to go, I changed the interface to OPT2. My test client is on the LAN interface (192.168.1.5)

              2e64df91-b2f7-4b83-8f2c-47af09840fdd-image.png

              2ba6dcff-32f2-4d85-9342-000b5c30524b-image.png

              1 Reply Last reply Reply Quote 0
              • stephenw10S Offline
                stephenw10 Netgate Administrator
                last edited by

                Oh sorry you need to set outbound NAT to hybrid or manual to apply user rules. I suggest hybrid so auto rules are still updated.

                J 1 Reply Last reply Reply Quote 0
                • J Offline
                  jg8000 @stephenw10
                  last edited by

                  @stephenw10
                  Thank you, it's no longer greyed out but still not working.

                  8ddeaca9-b24c-415a-8c69-4532063f297c-image.png

                  The idea is for (LAN) 192.168.1.5 to access (OPT2) 192.168.3.101 as if it were on the 192.168.3.0/24 subnet. Do I need to specify port ranges or anything? I hope not.

                  I can verify access by switching from (LAN)192.168.1.5 to (OPT2) 192.168.3.5 on the windows test client and accessing the web IPMI interface.

                  231e7b23-899b-4b63-9cf8-196114acb27f-image.png

                  stephenw10S 1 Reply Last reply Reply Quote 0
                  • stephenw10S Offline
                    stephenw10 Netgate Administrator
                    last edited by

                    Check the state table again. You should see the translation on the OPT2 state.

                    J 1 Reply Last reply Reply Quote 0
                    • J Offline
                      jg8000 @stephenw10
                      last edited by

                      @stephenw10

                      I only see activity from 192.168.15 to the pfsense admin web admin. Nothing for 192.168.3

                      96348263-af11-46c6-94a2-bc95071e72a6-image.png

                      1 Reply Last reply Reply Quote 0
                      • stephenw10S Offline
                        stephenw10 Netgate Administrator @jg8000
                        last edited by

                        @jg8000 said in 1 WAN interface, 3 LAN interfaces, OpenVPN allow communication to all networks:

                        I can verify access by switching from (LAN)192.168.1.5 to (OPT2) 192.168.3.5 on the windows test client

                        How exactly are you making that switch? Does that client have NICs in both subnets? If so it's probably not sending traffic through pfSense at all.

                        J 1 Reply Last reply Reply Quote 0
                        • J Offline
                          jg8000 @stephenw10
                          last edited by

                          @stephenw10

                          I just use it as a sanity check. I change the adapter IP from the 192.168.1 to the 192.168.3. and the IPMI port is on the same switch. So no, I doubt pfsense is involved. It only tells me that it's up and accessible.

                          1 Reply Last reply Reply Quote 0
                          • stephenw10S Offline
                            stephenw10 Netgate Administrator
                            last edited by

                            Hmm, but sending from 1.5 to 3.5 should go through pfSense and seemingly isn't (no states). So either something else is routing between those subnets, layer 3 switch maybe, or the client itself can access both subnets directly. Or perhaps it's just not sending, no default route?

                            J 2 Replies Last reply Reply Quote 0
                            • J Offline
                              jg8000 @stephenw10
                              last edited by jg8000

                              @stephenw10

                              The IPMI has a default route, I set it to 192.168.3.1. The 192.168.1.5 interface has no gateway.

                              No layer 3 switch, IPMI cable to cheap netgear switch, and cable from same switch to windows client. I can't have the windows test client 192.168.1.5 have a gateway because it's dual homed with a WAN interface and the WAN needs it.

                              1 Reply Last reply Reply Quote 0
                              • J Offline
                                jg8000 @stephenw10
                                last edited by jg8000

                                @stephenw10

                                On the real server setup, I am able to see the states when going to the 192.168.3.0/24 from the VPN net 192.168.50.0/24. I'm not sure what to make of it.

                                Although it doesn't seem to matter if the target http address is real or not, but I guess that doesn't matter, looks like it's making an attempt?

                                af1fd218-4385-4985-88cb-d829fc28bf81-image.png

                                1 Reply Last reply Reply Quote 0
                                • stephenw10S Offline
                                  stephenw10 Netgate Administrator
                                  last edited by

                                  The states are correct but there is no translation. Did you add an appropriate OBN rule there too?

                                  J 1 Reply Last reply Reply Quote 0
                                  • J Offline
                                    jg8000 @stephenw10
                                    last edited by

                                    @stephenw10

                                    I see those states no matter if the OBN is there or not.

                                    1 Reply Last reply Reply Quote 0
                                    • stephenw10S Offline
                                      stephenw10 Netgate Administrator
                                      last edited by

                                      What OBN rule are you setting there?

                                      J 1 Reply Last reply Reply Quote 0
                                      • J Offline
                                        jg8000 @stephenw10
                                        last edited by

                                        @stephenw10 Screenshot 2024-05-24 at 8.36.46 AM.png

                                        1 Reply Last reply Reply Quote 0
                                        • stephenw10S Offline
                                          stephenw10 Netgate Administrator
                                          last edited by

                                          Is that destination the address or subnet? It needs to be the OPT2 subnet there to match.

                                          J 1 Reply Last reply Reply Quote 0
                                          • J Offline
                                            jg8000 @stephenw10
                                            last edited by

                                            @stephenw10

                                            It's the subnet. Does I need this Outbound rule when setting the OPT2 (192.168.3.0/24) as local networks in the OpenVPN config?

                                            Screenshot 2024-05-24 at 8.50.02 AM.png .

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.