Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Tunnel GRE from linux server to pfsens

    Scheduled Pinned Locked Moved General pfSense Questions
    37 Posts 3 Posters 3.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • J
      Jsetive @stephenw10
      last edited by

      That 198.x.x.x IP address is the single public IP the VPS has been assigned?

      Negative, the VM have one ip and that 198.x.x.x is the Additional IP.

      It looks like you're trying to use that on the VM directly which is not how this can work. The VPS has that IP and forwards traffic coming into it to the VM across the tunnel. The VM itself has some private IP that you assign it.

      If you want to use a public IP at the Proxmox end directly you would need a separate subnet that provider routes to you via the VPS IP.

      I've this setup working with other provider, i can use their ip in my VM directly. What is the alternative i have to use this ip in my vm ? I don't wan't use NAT, because some apps might verify ip of NIC.

      stephenw10S 1 Reply Last reply Reply Quote 0
      • stephenw10S
        stephenw10 Netgate Administrator @Jsetive
        last edited by stephenw10

        @Jsetive said in Tunnel GRE from linux server to pfsens:

        the VM have one ip and that 198.x.x.x is the Additional IP.

        You mean the VPS has one IP and the 198.x.x.x IP is additional? Is it in the same subnet?

        Is your other setup also using pfSense?

        J 1 Reply Last reply Reply Quote 0
        • J
          Jsetive @stephenw10
          last edited by

          You mean the VPS has one IP and the 198.x.x.x IP is additional? Is it in the same subnet?
          Yes correct:

          2ef92e14-a35c-49b2-b778-67aac55f43bc-image.png

          Is your other setup also using pfSense?

          I don't understood clear what you've asked.
          In my other provider i have one pfsense in their end, i've tried here as well but i can't put it work with same configuration, with iptables was the closer i got.
          In my end i use the same pfsense, if you check again my prints you can see other GRE tunnel.

          stephenw10S 1 Reply Last reply Reply Quote 0
          • stephenw10S
            stephenw10 Netgate Administrator @Jsetive
            last edited by

            @Jsetive said in Tunnel GRE from linux server to pfsens:

            You mean the VPS has one IP and the 198.x.x.x IP is additional? Is it in the same subnet?
            Yes correct:

            Mmm, it looks like it's not in the same subnet.

            In which case you might be able to route it across the tunnel.

            The first test I would do here is to add that IP as a IPAlias VIP in pfSense on localhost and make sure that works as expected when pinged from something external.

            J 1 Reply Last reply Reply Quote 0
            • J
              Jsetive @stephenw10
              last edited by Jsetive

              In which case you might be able to route it across the tunnel.

              With iptables, i guess is how it is right now, right ? Im not expert in this matter.

              The first test I would do here is to add that IP as a IPAlias VIP in pfSense on localhost and make sure that works as expected when pinged from something external.

              Wich interface i use?
              I used WAN and VLAN201, it seems still pingable

              1 Reply Last reply Reply Quote 0
              • stephenw10S
                stephenw10 Netgate Administrator
                last edited by

                Well I suggested adding it on localhost but it should respond from any interface on pfSense. Adding it on VLAN201 should be fine.

                Ok so you can ping that from some external address and see pings come back from pfSense? I would want to confirm that in Diag > States.

                If so then you should be able to route that IP to an internal VM in pfSense. Just add a static route to it.

                J 1 Reply Last reply Reply Quote 0
                • J
                  Jsetive @stephenw10
                  last edited by

                  Well I suggested adding it on localhost but it should respond from any interface on pfSense. Adding it on VLAN201 should be fine.

                  411c8c9b-9d04-476f-a541-670de063ea25-image.png

                  State:

                  10d72df1-cfac-4c27-8c87-d49bd9b9e005-image.png
                  f2ab3b4c-714f-450e-8172-697cd4dd8dba-image.png

                  If so then you should be able to route that IP to an internal VM in pfSense. Just add a static route to it.

                  3c36156b-413f-4626-8242-e6e8b7e33e39-image.png

                  1 Reply Last reply Reply Quote 0
                  • stephenw10S
                    stephenw10 Netgate Administrator
                    last edited by

                    So 198.x.x.140 is the provided IP used in the alias?

                    You only have that one IP as I understand it? You can't use the full /24 that contains it. You have to use some other subnet there and add the single IP as a VIP on the VM instead of pfSense.

                    Unless the Provider are routing the full /24 to you. Which seems very unlikely!

                    J 1 Reply Last reply Reply Quote 0
                    • J
                      Jsetive @stephenw10
                      last edited by

                      So 198.x.x.140 is the provided IP used in the alias?

                      Yes

                      You only have that one IP as I understand it? You can't use the full /24 that contains it. You have to use some other subnet there and add the single IP as a VIP on the VM instead of pfSense.

                      Yes

                      /24 is showned in route because the gateway/ip of interface VLAN 201 is gateway of that ip: 198.x.x.1/24

                      33053cb4-0536-435d-b804-902d0f035f5a-image.png

                      What is the alternative i have to be able to use the IP directly in VM?

                      stephenw10S 1 Reply Last reply Reply Quote 0
                      • stephenw10S
                        stephenw10 Netgate Administrator @Jsetive
                        last edited by

                        @Jsetive said in Tunnel GRE from linux server to pfsens:

                        the gateway/ip of interface VLAN 201 is gateway of that ip: 198.x.x.1/24

                        You can't use that it's not your IP address, the provider is likely already using that upstream.

                        You can only use a full public subnet on VLAN201 if the provider is routing it to you and that is only going to happen if you're paying them for it. Otherwise use a private subnet there and route the public IP to the private IP on the VM. Add the public IP as a VIP on the VM.

                        J 1 Reply Last reply Reply Quote 0
                        • J
                          Jsetive @stephenw10
                          last edited by

                          Sorry if i don't understand, but it seems in the above topics, they are able to use in VM directly:

                          https://forum.netgate.com/topic/173892/gre-tunnel-to-protect-ip
                          https://forum.netgate.com/topic/189477/the-curl-command-is-not-working-correctly

                          1 Reply Last reply Reply Quote 0
                          • stephenw10S
                            stephenw10 Netgate Administrator
                            last edited by

                            There they are using an IP that is in the same subnet as the VPS public IP. That means they cannot route it and have to bridge the interfaces at both ends to create a single layer 2 segment.
                            So there they used OpenVPN in TAP mode a bridged it.

                            You don't need to do that because your additional IP is not in the same subnet. You can just route it to the VM directly. But you still need to use a private subnet between pfSense and the VM to route it across.

                            1 Reply Last reply Reply Quote 0
                            • J
                              Jsetive
                              last edited by

                              Hello,

                              How can i create that route to GRE.
                              If i use VLAN 201 - 10.0.201.0/24
                              I need to configure the ip as alias and made nat translation ? Just that?

                              1 Reply Last reply Reply Quote 0
                              • stephenw10S
                                stephenw10 Netgate Administrator
                                last edited by

                                You can use NAT and put the IPAlias on the firewall.

                                Or you can put the public IP on the VM directly as a virtual IP and route to it in pfSense. Which is what I thought you are trying to achieve.

                                J 1 Reply Last reply Reply Quote 0
                                • J
                                  Jsetive @stephenw10
                                  last edited by

                                  @stephenw10

                                  Or you can put the public IP on the VM directly as a virtual IP and route to it in pfSense. Which is what I thought you are trying to achieve.

                                  You mean configure 198.x.x.x directly in VM and some how route in pfsense? How should i do that?

                                  1 Reply Last reply Reply Quote 0
                                  • stephenw10S
                                    stephenw10 Netgate Administrator
                                    last edited by

                                    You have to add it to the VM as a virtual / secondary IP. Then add a static route in pfSense to that IP via the private IP on the VM.

                                    J 1 Reply Last reply Reply Quote 0
                                    • J
                                      Jsetive @stephenw10
                                      last edited by

                                      Hello Again,

                                      Sorry for delay.
                                      I've mantained the configuration in Linux server, in pfsense i made this configuration:

                                      Created a VLAN with gateway so i can reach the gateway localy (?)
                                      ef148dc8-37b8-42c6-a703-41bc9f584087-image.png

                                      Created a VirtualIP with ip i wan't:
                                      be4febb1-e5c7-4704-b775-2d71355bc79c-image.png

                                      And route it to GRE Interface:
                                      7ffa39a3-2ac5-4c53-9011-068ff97ae742-image.png

                                      Config in VM:
                                      d97ddc7d-f826-4243-8f9d-af3495914cad-image.png

                                      It seems i made something wrong :/

                                      GertjanG 1 Reply Last reply Reply Quote 0
                                      • GertjanG
                                        Gertjan @Jsetive
                                        last edited by

                                        @Jsetive

                                        GRE is not TCP neither UDP, not ICMP.

                                        The network connection is done via the GRE protocol (IP protocol number 47. For more information, refer to Wikipedia: List of IP protocol numbers. Since GRE is an IP protocol, it is not based on either TCP or UDP and has no concept of ports. It is an IP protocol by itself.

                                        So, when I see this :

                                        f60a21be-6a76-44de-be6d-ead6ea0a220b-image.png

                                        that that rule will never match ;)

                                        eb41540b-f45e-4c45-bd43-9560cbcbc0e5-image.png

                                        No "help me" PM's please. Use the forum, the community will thank you.
                                        Edit : and where are the logs ??

                                        J 1 Reply Last reply Reply Quote 1
                                        • J
                                          Jsetive @Gertjan
                                          last edited by

                                          @Gertjan Thank you for reply, i didn't know that. Already fix the rule.

                                          1 Reply Last reply Reply Quote 0
                                          • GertjanG
                                            Gertjan @Jsetive
                                            last edited by

                                            @Jsetive said in Tunnel GRE from linux server to pfsens:

                                            They have one guide

                                            If you have NAT rules on one side of your tunnel, remember to chose 'GRE' as the protocol as well.

                                            No "help me" PM's please. Use the forum, the community will thank you.
                                            Edit : and where are the logs ??

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.