Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Tunnel GRE from linux server to pfsens

    Scheduled Pinned Locked Moved General pfSense Questions
    37 Posts 3 Posters 2.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • stephenw10S
      stephenw10 Netgate Administrator
      last edited by

      Well I suggested adding it on localhost but it should respond from any interface on pfSense. Adding it on VLAN201 should be fine.

      Ok so you can ping that from some external address and see pings come back from pfSense? I would want to confirm that in Diag > States.

      If so then you should be able to route that IP to an internal VM in pfSense. Just add a static route to it.

      J 1 Reply Last reply Reply Quote 0
      • J
        Jsetive @stephenw10
        last edited by

        Well I suggested adding it on localhost but it should respond from any interface on pfSense. Adding it on VLAN201 should be fine.

        411c8c9b-9d04-476f-a541-670de063ea25-image.png

        State:

        10d72df1-cfac-4c27-8c87-d49bd9b9e005-image.png
        f2ab3b4c-714f-450e-8172-697cd4dd8dba-image.png

        If so then you should be able to route that IP to an internal VM in pfSense. Just add a static route to it.

        3c36156b-413f-4626-8242-e6e8b7e33e39-image.png

        1 Reply Last reply Reply Quote 0
        • stephenw10S
          stephenw10 Netgate Administrator
          last edited by

          So 198.x.x.140 is the provided IP used in the alias?

          You only have that one IP as I understand it? You can't use the full /24 that contains it. You have to use some other subnet there and add the single IP as a VIP on the VM instead of pfSense.

          Unless the Provider are routing the full /24 to you. Which seems very unlikely!

          J 1 Reply Last reply Reply Quote 0
          • J
            Jsetive @stephenw10
            last edited by

            So 198.x.x.140 is the provided IP used in the alias?

            Yes

            You only have that one IP as I understand it? You can't use the full /24 that contains it. You have to use some other subnet there and add the single IP as a VIP on the VM instead of pfSense.

            Yes

            /24 is showned in route because the gateway/ip of interface VLAN 201 is gateway of that ip: 198.x.x.1/24

            33053cb4-0536-435d-b804-902d0f035f5a-image.png

            What is the alternative i have to be able to use the IP directly in VM?

            stephenw10S 1 Reply Last reply Reply Quote 0
            • stephenw10S
              stephenw10 Netgate Administrator @Jsetive
              last edited by

              @Jsetive said in Tunnel GRE from linux server to pfsens:

              the gateway/ip of interface VLAN 201 is gateway of that ip: 198.x.x.1/24

              You can't use that it's not your IP address, the provider is likely already using that upstream.

              You can only use a full public subnet on VLAN201 if the provider is routing it to you and that is only going to happen if you're paying them for it. Otherwise use a private subnet there and route the public IP to the private IP on the VM. Add the public IP as a VIP on the VM.

              J 1 Reply Last reply Reply Quote 0
              • J
                Jsetive @stephenw10
                last edited by

                Sorry if i don't understand, but it seems in the above topics, they are able to use in VM directly:

                https://forum.netgate.com/topic/173892/gre-tunnel-to-protect-ip
                https://forum.netgate.com/topic/189477/the-curl-command-is-not-working-correctly

                1 Reply Last reply Reply Quote 0
                • stephenw10S
                  stephenw10 Netgate Administrator
                  last edited by

                  There they are using an IP that is in the same subnet as the VPS public IP. That means they cannot route it and have to bridge the interfaces at both ends to create a single layer 2 segment.
                  So there they used OpenVPN in TAP mode a bridged it.

                  You don't need to do that because your additional IP is not in the same subnet. You can just route it to the VM directly. But you still need to use a private subnet between pfSense and the VM to route it across.

                  1 Reply Last reply Reply Quote 0
                  • J
                    Jsetive
                    last edited by

                    Hello,

                    How can i create that route to GRE.
                    If i use VLAN 201 - 10.0.201.0/24
                    I need to configure the ip as alias and made nat translation ? Just that?

                    1 Reply Last reply Reply Quote 0
                    • stephenw10S
                      stephenw10 Netgate Administrator
                      last edited by

                      You can use NAT and put the IPAlias on the firewall.

                      Or you can put the public IP on the VM directly as a virtual IP and route to it in pfSense. Which is what I thought you are trying to achieve.

                      J 1 Reply Last reply Reply Quote 0
                      • J
                        Jsetive @stephenw10
                        last edited by

                        @stephenw10

                        Or you can put the public IP on the VM directly as a virtual IP and route to it in pfSense. Which is what I thought you are trying to achieve.

                        You mean configure 198.x.x.x directly in VM and some how route in pfsense? How should i do that?

                        1 Reply Last reply Reply Quote 0
                        • stephenw10S
                          stephenw10 Netgate Administrator
                          last edited by

                          You have to add it to the VM as a virtual / secondary IP. Then add a static route in pfSense to that IP via the private IP on the VM.

                          J 1 Reply Last reply Reply Quote 0
                          • J
                            Jsetive @stephenw10
                            last edited by

                            Hello Again,

                            Sorry for delay.
                            I've mantained the configuration in Linux server, in pfsense i made this configuration:

                            Created a VLAN with gateway so i can reach the gateway localy (?)
                            ef148dc8-37b8-42c6-a703-41bc9f584087-image.png

                            Created a VirtualIP with ip i wan't:
                            be4febb1-e5c7-4704-b775-2d71355bc79c-image.png

                            And route it to GRE Interface:
                            7ffa39a3-2ac5-4c53-9011-068ff97ae742-image.png

                            Config in VM:
                            d97ddc7d-f826-4243-8f9d-af3495914cad-image.png

                            It seems i made something wrong :/

                            GertjanG 1 Reply Last reply Reply Quote 0
                            • GertjanG
                              Gertjan @Jsetive
                              last edited by

                              @Jsetive

                              GRE is not TCP neither UDP, not ICMP.

                              The network connection is done via the GRE protocol (IP protocol number 47. For more information, refer to Wikipedia: List of IP protocol numbers. Since GRE is an IP protocol, it is not based on either TCP or UDP and has no concept of ports. It is an IP protocol by itself.

                              So, when I see this :

                              f60a21be-6a76-44de-be6d-ead6ea0a220b-image.png

                              that that rule will never match ;)

                              eb41540b-f45e-4c45-bd43-9560cbcbc0e5-image.png

                              No "help me" PM's please. Use the forum, the community will thank you.
                              Edit : and where are the logs ??

                              J 1 Reply Last reply Reply Quote 1
                              • J
                                Jsetive @Gertjan
                                last edited by

                                @Gertjan Thank you for reply, i didn't know that. Already fix the rule.

                                1 Reply Last reply Reply Quote 0
                                • GertjanG
                                  Gertjan @Jsetive
                                  last edited by

                                  @Jsetive said in Tunnel GRE from linux server to pfsens:

                                  They have one guide

                                  If you have NAT rules on one side of your tunnel, remember to chose 'GRE' as the protocol as well.

                                  No "help me" PM's please. Use the forum, the community will thank you.
                                  Edit : and where are the logs ??

                                  1 Reply Last reply Reply Quote 0
                                  • stephenw10S
                                    stephenw10 Netgate Administrator
                                    last edited by

                                    No you should not have a gateway on the VLAN201 interface directly.

                                    You will need a gateway but you should add it separately and it should be the VM internal private IP.

                                    You need to add a static route to 198.x.x.40 via that gateway.

                                    You should not have a VIP on pfSense. You need to add 198.x.x.40 on the VM dircetly so you can route to it.

                                    The policy route should work OK for outbound traffic.

                                    J 1 Reply Last reply Reply Quote 0
                                    • J
                                      Jsetive @stephenw10
                                      last edited by

                                      @stephenw10 said in Tunnel GRE from linux server to pfsens:

                                      You will need a gateway but you should add it separately and it should be the VM internal private IP.

                                      Im confuse, you mean, i need to create a "custom" range to this vlan (eg 172.16.201.x/24) and the gatewa on VM will be that?
                                      In vm i configure:
                                      IP 172.16.201.40
                                      Nmask /24
                                      GTW 172.16.201.254

                                      Then i create a static route to 198.x.x.40?

                                      1 Reply Last reply Reply Quote 0
                                      • stephenw10S
                                        stephenw10 Netgate Administrator
                                        last edited by

                                        Yes, that would work. The static route in pfSense would then be to 198.x.x.40 via 172.16.201.40.

                                        J 1 Reply Last reply Reply Quote 0
                                        • J
                                          Jsetive @stephenw10
                                          last edited by

                                          @stephenw10

                                          I know this is not the same issue, tell if i need to create other topic.
                                          I can't get DHCP from this VLAN, i CAN GET DHCP from VLAN.

                                          I've created VLAN 30 but still not getting ip:

                                          VLAN 30 (not working):

                                          d4054546-4257-42ee-8db6-1f8beee179c2-image.png

                                          VLAN 200 (working):

                                          1db6cdad-f893-4feb-b9e6-649995ca4e9b-image.png

                                          GertjanG 1 Reply Last reply Reply Quote 0
                                          • stephenw10S
                                            stephenw10 Netgate Administrator
                                            last edited by

                                            Did you enable DHCP on the new interface? Servcies > DHCP Server > VLAN30

                                            J 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.