Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Tunnel GRE from linux server to pfsens

    Scheduled Pinned Locked Moved General pfSense Questions
    37 Posts 3 Posters 2.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • stephenw10S
      stephenw10 Netgate Administrator
      last edited by

      You have to add it to the VM as a virtual / secondary IP. Then add a static route in pfSense to that IP via the private IP on the VM.

      J 1 Reply Last reply Reply Quote 0
      • J
        Jsetive @stephenw10
        last edited by

        Hello Again,

        Sorry for delay.
        I've mantained the configuration in Linux server, in pfsense i made this configuration:

        Created a VLAN with gateway so i can reach the gateway localy (?)
        ef148dc8-37b8-42c6-a703-41bc9f584087-image.png

        Created a VirtualIP with ip i wan't:
        be4febb1-e5c7-4704-b775-2d71355bc79c-image.png

        And route it to GRE Interface:
        7ffa39a3-2ac5-4c53-9011-068ff97ae742-image.png

        Config in VM:
        d97ddc7d-f826-4243-8f9d-af3495914cad-image.png

        It seems i made something wrong :/

        GertjanG 1 Reply Last reply Reply Quote 0
        • GertjanG
          Gertjan @Jsetive
          last edited by

          @Jsetive

          GRE is not TCP neither UDP, not ICMP.

          The network connection is done via the GRE protocol (IP protocol number 47. For more information, refer to Wikipedia: List of IP protocol numbers. Since GRE is an IP protocol, it is not based on either TCP or UDP and has no concept of ports. It is an IP protocol by itself.

          So, when I see this :

          f60a21be-6a76-44de-be6d-ead6ea0a220b-image.png

          that that rule will never match ;)

          eb41540b-f45e-4c45-bd43-9560cbcbc0e5-image.png

          No "help me" PM's please. Use the forum, the community will thank you.
          Edit : and where are the logs ??

          J 1 Reply Last reply Reply Quote 1
          • J
            Jsetive @Gertjan
            last edited by

            @Gertjan Thank you for reply, i didn't know that. Already fix the rule.

            1 Reply Last reply Reply Quote 0
            • GertjanG
              Gertjan @Jsetive
              last edited by

              @Jsetive said in Tunnel GRE from linux server to pfsens:

              They have one guide

              If you have NAT rules on one side of your tunnel, remember to chose 'GRE' as the protocol as well.

              No "help me" PM's please. Use the forum, the community will thank you.
              Edit : and where are the logs ??

              1 Reply Last reply Reply Quote 0
              • stephenw10S
                stephenw10 Netgate Administrator
                last edited by

                No you should not have a gateway on the VLAN201 interface directly.

                You will need a gateway but you should add it separately and it should be the VM internal private IP.

                You need to add a static route to 198.x.x.40 via that gateway.

                You should not have a VIP on pfSense. You need to add 198.x.x.40 on the VM dircetly so you can route to it.

                The policy route should work OK for outbound traffic.

                J 1 Reply Last reply Reply Quote 0
                • J
                  Jsetive @stephenw10
                  last edited by

                  @stephenw10 said in Tunnel GRE from linux server to pfsens:

                  You will need a gateway but you should add it separately and it should be the VM internal private IP.

                  Im confuse, you mean, i need to create a "custom" range to this vlan (eg 172.16.201.x/24) and the gatewa on VM will be that?
                  In vm i configure:
                  IP 172.16.201.40
                  Nmask /24
                  GTW 172.16.201.254

                  Then i create a static route to 198.x.x.40?

                  1 Reply Last reply Reply Quote 0
                  • stephenw10S
                    stephenw10 Netgate Administrator
                    last edited by

                    Yes, that would work. The static route in pfSense would then be to 198.x.x.40 via 172.16.201.40.

                    J 1 Reply Last reply Reply Quote 0
                    • J
                      Jsetive @stephenw10
                      last edited by

                      @stephenw10

                      I know this is not the same issue, tell if i need to create other topic.
                      I can't get DHCP from this VLAN, i CAN GET DHCP from VLAN.

                      I've created VLAN 30 but still not getting ip:

                      VLAN 30 (not working):

                      d4054546-4257-42ee-8db6-1f8beee179c2-image.png

                      VLAN 200 (working):

                      1db6cdad-f893-4feb-b9e6-649995ca4e9b-image.png

                      GertjanG 1 Reply Last reply Reply Quote 0
                      • stephenw10S
                        stephenw10 Netgate Administrator
                        last edited by

                        Did you enable DHCP on the new interface? Servcies > DHCP Server > VLAN30

                        J 1 Reply Last reply Reply Quote 0
                        • J
                          Jsetive @stephenw10
                          last edited by

                          @stephenw10

                          Yes it is enabled:

                          8b941bb2-71fa-4e7d-bf20-7fe54e5b24d2-image.png

                          1 Reply Last reply Reply Quote 0
                          • GertjanG
                            Gertjan @Jsetive
                            last edited by

                            @Jsetive said in Tunnel GRE from linux server to pfsens:

                            VLAN 200 (working):

                            I've a small test for you 😊
                            On "VLAN 200", remove temporary all firewall rules. Empty the list.
                            Test your "VLAN 200" again : when you connect a device, it will get a DHCP lease !
                            When the DHCP server is activated, there will be 'hidden' firewall rules that accepts DHCP traffic.
                            Check the firewall rules for yourself : /var/rules.debug
                            Conclusion : the GUI firewall rules have no impact on the functioning of the DHCP server on that interface - afaik, the "the shoot in the foot" situation isn't possible. (although people tend to find out new ways to make live harder every day ^^)

                            About your "VLAN30" : use Diagnostics > Packet Capture, select the interface (VLAN30) and hit start.
                            Now, connect your device on that VLAN30.
                            The question is : does the packet capturing shows you the DHCP packets ?
                            I presume you know how to recognize them.

                            Another suggestion : switch from Kea to ISC and retry.

                            No "help me" PM's please. Use the forum, the community will thank you.
                            Edit : and where are the logs ??

                            1 Reply Last reply Reply Quote 0
                            • stephenw10S
                              stephenw10 Netgate Administrator
                              last edited by

                              Then I would guess it's an issue with the VLAN tagging in whatever is connected to it. Probably a switch.

                              J 1 Reply Last reply Reply Quote 0
                              • J
                                Jsetive @stephenw10
                                last edited by

                                @stephenw10 @Gertjan
                                Thank you both for your reply.

                                Check the firewall rules for yourself : /var/rules.debug

                                This file doesn't exist in my machine in that path.

                                About your "VLAN30" : use Diagnostics > Packet Capture, select the interface (VLAN30) and hit start.

                                Theres no packet in capture, can't see nothing:
                                (Untagged):
                                7b158ed8-ad1d-4e4e-8f53-f9d8a784ebb9-image.png

                                (Tagged):
                                c4034e6d-61b3-4b7d-a2fd-3ce3dd5719eb-image.png

                                Another suggestion : switch from Kea to ISC and retry.

                                I didn't tested change because others VLANs is pooling ips. but i tested and didn't worked as well. When i change VLAN in vm it get instantly the ip, when i change to VLAN 30 i get 169.254.x.x

                                Then I would guess it's an issue with the VLAN tagging in whatever is connected to it. Probably a switch.

                                Well i can agree with that, but the config is the same in pf and in switch for all VLANs, and other VLANs getting the ip, here is the config in port:

                                376cf0ff-0146-475e-8548-2a46dac2a2b5-image.png

                                1 Reply Last reply Reply Quote 0
                                • stephenw10S
                                  stephenw10 Netgate Administrator
                                  last edited by

                                  So port 4 is connected to pfSense there? You have VLAN 30 untagged on some of the other ports? Where the clients are attached?

                                  @Jsetive said in Tunnel GRE from linux server to pfsens:

                                  Check the firewall rules for yourself : /var/rules.debug
                                  

                                  This file doesn't exist in my machine in that path.

                                  That should be /tmp/rules.debug.

                                  J 1 Reply Last reply Reply Quote 0
                                  • J
                                    Jsetive @stephenw10
                                    last edited by

                                    @stephenw10

                                    So port 4 is connected to pfSense there?

                                    Yes, Port 4 is connected physically to pfsense then in proxmox choose which vlan i want to use in VM.

                                    You have VLAN 30 untagged on some of the other ports?

                                    No, it is tagged

                                    Where the clients are attached?

                                    Pfsense lead all dhcp and manage VLANs then a connect to switch where i tag all vlan in port 4 where are used in proxmox.

                                    That should be /tmp/rules.debug.

                                    d4a0e503-7211-43e9-82e6-ccf1a76b3406-image.png

                                    1 Reply Last reply Reply Quote 0
                                    • stephenw10S
                                      stephenw10 Netgate Administrator
                                      last edited by

                                      Hmm, might need a diagram here! If Proxmox is also tagging/untagging the issue could be in the config there.

                                      1 Reply Last reply Reply Quote 0
                                      • First post
                                        Last post
                                      Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.