Bypass VPN VLAN to external IP?
-
@SubSeven said in Bypass VPN VLAN to external IP?:
So would you say that I don't need to do anything with NAT though?
Presumed, you have a gateway stated in the WAN interface settings and with outbound NAT in hybrid mode, pfSense nats traffic leaving the WAN to the WAN address automatically. So no further settings needed.
Automatically created outbound NAT rules are listed below the manual rules.
-
@stephenw10 Ok, thanks. I took out the firewall rule that had called for the WAN gateway, so it just looks like this now but still doesn't work:
@viragomann I kind of thought that, I took out the outbound NAT entry again. So now it looks like this but still doesn't work and I assume the portion in the yellow square is what you were referring to:
-
Check the state table in Diag > States while you're pinging.
-
Btw. I don't know if this means anything but under diagnostics/routes, I don't see 192.168.99.106 listed and I also don't see it under diagnostics/states or diagnostics/states summary.
I played around in diagnostics and found this port test and it succeeded, so at least that part works.
The ping also worked.
-
@stephenw10 Ok, I did that and something did show up:
-
@stephenw10 I don't know if this helps, but below is the same thing with ping happening, and trying to access web interface on port 80 and on port 8080:
I also tried turning off the firewall on the server:
sudo ufw disable
Firewall stopped and disabled on system startup -
Ok so that is the incoming state. There should be an outgoing state on WAN too.
If it's not going out of the WAN there may be firewall rules preventing it. Or there may be no route.
You said you don't see a route but the WAN should be in that subnet. What do you see in the routing table?
-
@stephenw10 I really appreciate you helping me btw.
For the WAN rules there are these:
All the tables seem to be pretty empty, unless I'm looking at the wrong thing:
-
Diag > Routes is where the routing table is.
The rules that might block that would be outgoing so on the floating tab. Unlikely there are any.
If you have an IPSec VPNs defined that might be grabbing the traffic.
-
@stephenw10 my bad!
The floating rules are empty yes.
This is what is under routes for IPv4 and 192.168.99.106 is not on the list:
-
@stephenw10 I don't know if this helps but here are all the rules:
-
Hmm, well it correctly shows the 192.168.99.0/24 subnet on the igc0 interface directly so it should send that traffic to it.
Something must be blocking it. I'd check IPSec tunnels.
-
Try pinging it from the firewall but setting the source to the OPT9 address then check the states.
-
@stephenw10 Those look empty. I'm going to restart pfSense to see if that does anything and I'll also restart the Win PC and the Linux server.
-
@stephenw10 I powered all 3 down, started pfSense back up, then Linux server, and then the Win 10 PC but the good old "restart your computer" trick didn't help :)
I tried the ping and that seems to work:
At the same time I was doing that I checked the states again and saw an entry for ...99.106:
-
Ok, so that is translating as expected.
One thing I see is that pfSense has two IP addresses in that subnet, 192.168.99.99 and 192.168.99.200. Which of those is the WAN address?
-
@stephenw10 192.168.99.99 is the gateway of the parent router, it is part of my old / original network which I want to eventually get rid of. That one is running OpnSense.
I access it from what I labeled as test PC (...99.111):
To get to the pfSense PC we've been talking about, I would go to 192.168.99.200 so that tells me that is the WAN IP.
-
@stephenw10 I also wanted to share the details of the outbound NAT that is used for the VPN in case there is something in there.
-
-
Ah I see. Yes that all looks OK. That outbound NAT rule is not in play here since traffic isn't leaving via the VPN.
It feels like the incoming rule on OPT9 is preventing it open the WAN state somehow. If you disable the policy routing rule and just pass traffic there without a gateway does it work?
