Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    OpenVPN questions and issues

    Scheduled Pinned Locked Moved OpenVPN
    15 Posts 3 Posters 4.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • GruensFroeschliG
      GruensFroeschli
      last edited by

      @LordZ:

      But when i put option  push "redirect-gateway" it indeed makes all traffic go to the OpenVPN, but how can I make the NAT'ing to the OpenVPN subnet.

      Not.
      It's not possible to NAT into the VPN tunnel. (currently, should be possible with 2.0)
      Though you can do the opposite –> NAT everything from the tunnel to the IP of the pfSense.

      Why would you want to NAT something going into the tunnel?

      Your issue with the windows XP machine sounds like the firewall on the XP machine itself is activated. (or some other firewall).

      Edit: now that i think about it.....
      With 1.2.3 it's possible to create firewall rules for the OpenVPN interface.
      I'm not sure if this works, but if you follow the instructions to set up firewall rules for the OpenVPN interface, the OpenVPN interface "should" be treated like a normal interface. Meaning after you assigned it, it should show up in the dropdownlist of the NAT rules.

      To create an outbound NAT rule go to firewall-->NAT-->outbound and activate "manual outbound rules". Then you can specirfy below your own rules how traffic should be NATed.
      Creating a rule with as Interface the OpenVPN interface, source any, destination any "should" do the trick (if this even works... i'm just speculating here).

      We do what we must, because we can.

      Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

      1 Reply Last reply Reply Quote 0
      • L
        LordZ
        last edited by

        Guess I will wait for 2.0 version…hope it will be released soon...I tried the manual outbound nat but it doesn't work.

        1 Reply Last reply Reply Quote 0
        • GruensFroeschliG
          GruensFroeschli
          last edited by

          So you did assign the OpenVPN interface first under firewall–>assign?

          We do what we must, because we can.

          Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

          1 Reply Last reply Reply Quote 0
          • L
            LordZ
            last edited by

            no I did not…I use 1.2.2 now and guess this is impossible at the moment

            1 Reply Last reply Reply Quote 0
            • GruensFroeschliG
              GruensFroeschli
              last edited by

              Well if i'm right this would already be possible with 1.2.3 and you dont have to wait for 2.0 (which is still at least a year away until we first see a beta/RC).
              Since 1.2.3 is RC it wont be long until its status will be changed to RELEASE.

              But you still didnt answered why you want to NAT into the tunnel in the first place :)

              We do what we must, because we can.

              Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

              1 Reply Last reply Reply Quote 0
              • L
                LordZ
                last edited by

                I have 3 shops in the city they all now have direct connection to the internet and connect to rdp via port redirection. I am working on installing vpn clients on them and want to direct all their traffic via main office gateway on which I have installed squid as transparent proxy with squid guard to filter their traffic and don't allow them to access unwanted sites in the working hours.

                1 Reply Last reply Reply Quote 0
                • GruensFroeschliG
                  GruensFroeschli
                  last edited by

                  I dont see why you would need NAT for this.
                  The push "redirect-gateway" should take care that nothing goes directly to the internet.

                  Or what was your idea behind NATing everything?

                  We do what we must, because we can.

                  Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

                  1 Reply Last reply Reply Quote 0
                  • L
                    LordZ
                    last edited by

                    They need the internet but don't need access to different sites like dating, social networks, etc…I have already done this for the main office and indeed the option push gateway routes everything to the VPN but then they have no Internet.

                    1 Reply Last reply Reply Quote 0
                    • GruensFroeschliG
                      GruensFroeschli
                      last edited by

                      Well you need an OUTBOUND NATrule.

                      @http://forum.pfsense.org/index.php/topic:

                      Every locally connected subnet, whether defined and reachable via a static route or attached to a LAN or OPT interface, will have its outbound traffic leaving any WAN interfaces NATed to that WAN interface's IP. You can change this behavior by enabling Advanced Outbound NAT (AON) but this is usually unnecessary and adds unneeded complexity.
                      For OpenVPN if you want the OpenVPN subnet NAT'ed to WAN, you will have to use AON.

                      (screenshots to clarify: http://forum.pfsense.org/index.php/topic,7693.0.html )
                      This might create a problem for FTP with multiWAN
                      more here: http://forum.pfsense.org/index.php/topic,7096.msg40810.html#msg40810

                      So you dont want to actually NAT "INTO" the tunnel, but NAT "FROM" the tunnel.
                      This already works perfectly.

                      We do what we must, because we can.

                      Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

                      1 Reply Last reply Reply Quote 0
                      • L
                        LordZ
                        last edited by

                        Thank's it helped a lot everything is clear to me now. But now when I connect to server via VPN i have acces to all the sites. Is there a way to push all the traffic into squid?

                        1 Reply Last reply Reply Quote 0
                        • GruensFroeschliG
                          GruensFroeschli
                          last edited by

                          Not sure on that.
                          I dont really know squid.
                          You probably need to configure it so it listens on the OpenVPN interface as well.

                          You most likely find more help on this if you open a new thread in the packages subforum.

                          We do what we must, because we can.

                          Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

                          1 Reply Last reply Reply Quote 0
                          • L
                            LordZ
                            last edited by

                            This is solved. I managed to have the remote clients go thru the office gateway and the Win XP machine had as default gateway the old gateway in the office.

                            1 Reply Last reply Reply Quote 0
                            • First post
                              Last post
                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.