Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    OpenVPN questions and issues

    Scheduled Pinned Locked Moved OpenVPN
    15 Posts 3 Posters 4.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • L
      LordZ
      last edited by

      Thank's a lot. I have already discovered it last night, but didn't reply here.

      But when i put option  push "redirect-gateway" it indeed makes all traffic go to the OpenVPN, but how can I make the NAT'ing to the OpenVPN subnet.

      For the other issue i will have to work on it because I don't use WINS on my network.

      I have discovered one more issue.

      On my network I have 3 servers.

      2 Windows 2003 that are used as Terminal Servers for an accounting application. They work perfectly pinging and connecting rdp session.

      The 3-rd server is an Win XP machine providing folder sharing…I know this is stupid but it was left by the old system administrator and has a lot of data on it so no way to reinstall it now.

      So this machine doesn't ping and no rdp connection to it when trying to ping it from the vpn client...but when connected thru rdp to win2003 machines it does ping and work. I can ping it when ssh to pfsense. Any thoughts about this?

      Thank's a lot.

      1 Reply Last reply Reply Quote 0
      • GruensFroeschliG
        GruensFroeschli
        last edited by

        @LordZ:

        But when i put option  push "redirect-gateway" it indeed makes all traffic go to the OpenVPN, but how can I make the NAT'ing to the OpenVPN subnet.

        Not.
        It's not possible to NAT into the VPN tunnel. (currently, should be possible with 2.0)
        Though you can do the opposite –> NAT everything from the tunnel to the IP of the pfSense.

        Why would you want to NAT something going into the tunnel?

        Your issue with the windows XP machine sounds like the firewall on the XP machine itself is activated. (or some other firewall).

        Edit: now that i think about it.....
        With 1.2.3 it's possible to create firewall rules for the OpenVPN interface.
        I'm not sure if this works, but if you follow the instructions to set up firewall rules for the OpenVPN interface, the OpenVPN interface "should" be treated like a normal interface. Meaning after you assigned it, it should show up in the dropdownlist of the NAT rules.

        To create an outbound NAT rule go to firewall-->NAT-->outbound and activate "manual outbound rules". Then you can specirfy below your own rules how traffic should be NATed.
        Creating a rule with as Interface the OpenVPN interface, source any, destination any "should" do the trick (if this even works... i'm just speculating here).

        We do what we must, because we can.

        Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

        1 Reply Last reply Reply Quote 0
        • L
          LordZ
          last edited by

          Guess I will wait for 2.0 version…hope it will be released soon...I tried the manual outbound nat but it doesn't work.

          1 Reply Last reply Reply Quote 0
          • GruensFroeschliG
            GruensFroeschli
            last edited by

            So you did assign the OpenVPN interface first under firewall–>assign?

            We do what we must, because we can.

            Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

            1 Reply Last reply Reply Quote 0
            • L
              LordZ
              last edited by

              no I did not…I use 1.2.2 now and guess this is impossible at the moment

              1 Reply Last reply Reply Quote 0
              • GruensFroeschliG
                GruensFroeschli
                last edited by

                Well if i'm right this would already be possible with 1.2.3 and you dont have to wait for 2.0 (which is still at least a year away until we first see a beta/RC).
                Since 1.2.3 is RC it wont be long until its status will be changed to RELEASE.

                But you still didnt answered why you want to NAT into the tunnel in the first place :)

                We do what we must, because we can.

                Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

                1 Reply Last reply Reply Quote 0
                • L
                  LordZ
                  last edited by

                  I have 3 shops in the city they all now have direct connection to the internet and connect to rdp via port redirection. I am working on installing vpn clients on them and want to direct all their traffic via main office gateway on which I have installed squid as transparent proxy with squid guard to filter their traffic and don't allow them to access unwanted sites in the working hours.

                  1 Reply Last reply Reply Quote 0
                  • GruensFroeschliG
                    GruensFroeschli
                    last edited by

                    I dont see why you would need NAT for this.
                    The push "redirect-gateway" should take care that nothing goes directly to the internet.

                    Or what was your idea behind NATing everything?

                    We do what we must, because we can.

                    Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

                    1 Reply Last reply Reply Quote 0
                    • L
                      LordZ
                      last edited by

                      They need the internet but don't need access to different sites like dating, social networks, etc…I have already done this for the main office and indeed the option push gateway routes everything to the VPN but then they have no Internet.

                      1 Reply Last reply Reply Quote 0
                      • GruensFroeschliG
                        GruensFroeschli
                        last edited by

                        Well you need an OUTBOUND NATrule.

                        @http://forum.pfsense.org/index.php/topic:

                        Every locally connected subnet, whether defined and reachable via a static route or attached to a LAN or OPT interface, will have its outbound traffic leaving any WAN interfaces NATed to that WAN interface's IP. You can change this behavior by enabling Advanced Outbound NAT (AON) but this is usually unnecessary and adds unneeded complexity.
                        For OpenVPN if you want the OpenVPN subnet NAT'ed to WAN, you will have to use AON.

                        (screenshots to clarify: http://forum.pfsense.org/index.php/topic,7693.0.html )
                        This might create a problem for FTP with multiWAN
                        more here: http://forum.pfsense.org/index.php/topic,7096.msg40810.html#msg40810

                        So you dont want to actually NAT "INTO" the tunnel, but NAT "FROM" the tunnel.
                        This already works perfectly.

                        We do what we must, because we can.

                        Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

                        1 Reply Last reply Reply Quote 0
                        • L
                          LordZ
                          last edited by

                          Thank's it helped a lot everything is clear to me now. But now when I connect to server via VPN i have acces to all the sites. Is there a way to push all the traffic into squid?

                          1 Reply Last reply Reply Quote 0
                          • GruensFroeschliG
                            GruensFroeschli
                            last edited by

                            Not sure on that.
                            I dont really know squid.
                            You probably need to configure it so it listens on the OpenVPN interface as well.

                            You most likely find more help on this if you open a new thread in the packages subforum.

                            We do what we must, because we can.

                            Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

                            1 Reply Last reply Reply Quote 0
                            • L
                              LordZ
                              last edited by

                              This is solved. I managed to have the remote clients go thru the office gateway and the Win XP machine had as default gateway the old gateway in the office.

                              1 Reply Last reply Reply Quote 0
                              • First post
                                Last post
                              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.