OpenVPN with transparent firewall

mullerit · Jul 12, 2017, 4:22 PM

Hello,

we are using pfSense in a transparent firewall mode, meaning we have public IP addresses behind the firewall and accomplish this with a WAN/LAN bridge (OPT1). This works well and we can filter traffic WAN>LAN and LAN>WAN, but I now also added a OpenVPN server into the mix and while the OpenVPN clients can connect to it and even access the firewalls public IP, they can not access any device in that network, nor anything remote.

The idea behind all this is that we close ports like 22 (SSH) on the WAN side, but would like to use OpenVPN to be able to access said ports of servers installed in that location.

Does anybody have an idea how to even start troubleshooting this scenario?

Thanks much!

mullerit · Jul 13, 2017, 9:37 PM

do I have a too unusual setup? …nobody ever came across this issue?

jimp · Jul 17, 2017, 4:59 PM

The firewall can't easily act as both a destination (routing) and a bridge.

You would have to manually set a route on each system in your local network, pointing the VPN subnet to the firewall's IP address.

When a VPN client tries to contact a server, the server's reply would be going to its default gateway (on the WAN side of the firewall) and not back to the firewall itself.

It may also be possible to put a route on the default gateway to point the VPN subnet back to the firewall's IP address, but that would be rather messy.

It is nearly always better to NOT bridge, but to do routing. If your ISP provides you with two blocks (one for WAN interconnect, second block routed to the firewall in the first block) then you can do away with bridging and use a proper routed setup instead.