Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Attempting to port forward with an OpenVPN client [SOLVED]

    Scheduled Pinned Locked Moved General pfSense Questions
    28 Posts 4 Posters 18.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • E
      esde
      last edited by

      Is your router showing a connection to StrongVPN?

      : Status / OpenVPN-

      Yes, I am connected to StrongVPN.

      Take a peek here-

      http://forum.pfsense.org/index.php/topic,29944.0.html

      This is the tutorial I began with. I was confused by his Part two - Step one, he has four interfaces where I would only have two. At Part two - Step four, under System > Routing > Gateways, I only have two gateways, where he has three. After three attempts of setting it up and resetting pfSense, I gave up and looked for another tutorial. That's when I found the tutorial with more screenshots and had better success.

      When I get home, should I reset and try to reconfigure according to the tutorial on pfSense? Is it too far gone to work with?

      ![pfsenselocaldomain - Status OpenVPN.png_thumb](/public/imported_attachments/1/pfsenselocaldomain - Status OpenVPN.png_thumb)
      ![pfsenselocaldomain - Status OpenVPN.png](/public/imported_attachments/1/pfsenselocaldomain - Status OpenVPN.png)

      1 Reply Last reply Reply Quote 0
      • chpalmerC
        chpalmer
        last edited by

        Save your config.   Go to the Diagnostics page and to Backup/Restore.

        If you decide to try something else then you can easily go back.

        Since your connection is active then its just a matter of getting everything to route over the VPN.

        Im of the belief that this can be done simply with the VPN client page and the "Advanced Config" box on the client config page on pfSense.  (someone correct me if Im wrong.)

        Im doing a little playing here with that idea meantime as my day kinda changed.

        Triggering snowflakes one by one..
        Intel(R) Core(TM) i5-4590T CPU @ 2.00GHz on an M400 WG box.

        1 Reply Last reply Reply Quote 0
        • E
          esde
          last edited by

          Done and done. I've already made a backup and a full set of screenshots just in case the backup fails somehow I can recreate it manually.

          1 Reply Last reply Reply Quote 0
          • chpalmerC
            chpalmer
            last edited by

            http://doc.pfsense.org/Create-OpenVPN-client-to-TUVPNcom.pdf

            Start at page 9.  Might be some helpful hints…

            Im noting that routing seems to work different between using certs and using shared key.  I use shared key and it just works. If I try to do the same using certs, I connect fine but can't seem to route.

            Im doing some crash coarse stuff right now myself I guess.

            Triggering snowflakes one by one..
            Intel(R) Core(TM) i5-4590T CPU @ 2.00GHz on an M400 WG box.

            1 Reply Last reply Reply Quote 0
            • E
              esde
              last edited by

              It's working correctly, following ericab's tutorial.  ;D

              I want to route internet from address 192.168.1.123 through to the VPN so that if I connect via VPN_IP_Address:Forwarded_port, I am connecting to my home LAN IP 192.168.1.123. I'm just not sure on how to.. exactly..

              1 Reply Last reply Reply Quote 0
              • chpalmerC
                chpalmer
                last edited by

                Cool!   :)

                For your port forward go to   Firewall/NAT

                create a new Port Forward rule.

                Allow any

                Allow any port.

                Heres one I use for my HTTPS webpage-  If you follow my settings (obviously enter your ports and ip) it will build a firewall rules automatically when you click save then apply.      :)

                NAT1.jpg
                NAT1.jpg_thumb

                Triggering snowflakes one by one..
                Intel(R) Core(TM) i5-4590T CPU @ 2.00GHz on an M400 WG box.

                1 Reply Last reply Reply Quote 0
                • E
                  esde
                  last edited by

                  I'm trying to create a port forward in NAT like you have in your screenshot but I'm not seeing "Rule NAT" under Filter Rule Association.

                  ![pfsenselocaldomain - Firewall NAT Port Forward Edit 2013-04-27 16-25-24.png](/public/imported_attachments/1/pfsenselocaldomain - Firewall NAT Port Forward Edit 2013-04-27 16-25-24.png)
                  ![pfsenselocaldomain - Firewall NAT Port Forward Edit 2013-04-27 16-25-24.png_thumb](/public/imported_attachments/1/pfsenselocaldomain - Firewall NAT Port Forward Edit 2013-04-27 16-25-24.png_thumb)

                  1 Reply Last reply Reply Quote 0
                  • chpalmerC
                    chpalmer
                    last edited by

                    Use "Create New Associated Filter Rule".

                    After that if you come back to edit that Rule NAT will be there.

                    Triggering snowflakes one by one..
                    Intel(R) Core(TM) i5-4590T CPU @ 2.00GHz on an M400 WG box.

                    1 Reply Last reply Reply Quote 0
                    • E
                      esde
                      last edited by

                      Added the rule, using your screenshot as a guide. I'm trying to connect to port 8462 from open internet and it appears closed still.

                      ![2013-04-28 09_24_51-pfsense.png](/public/imported_attachments/1/2013-04-28 09_24_51-pfsense.png)
                      ![2013-04-28 09_24_51-pfsense.png_thumb](/public/imported_attachments/1/2013-04-28 09_24_51-pfsense.png_thumb)

                      1 Reply Last reply Reply Quote 0
                      • chpalmerC
                        chpalmer
                        last edited by

                        On your firewall rules page /WAN    can you provide a screenshot of that rule?    Also on that rule turn on logging. That way if the attempts make it to the firewall they will show up in the system logs.

                        rule.JPG_thumb
                        rule.JPG

                        Triggering snowflakes one by one..
                        Intel(R) Core(TM) i5-4590T CPU @ 2.00GHz on an M400 WG box.

                        1 Reply Last reply Reply Quote 0
                        • W
                          wallabybob
                          last edited by

                          @esde:

                          Added the rule, using your screenshot as a guide. I'm trying to connect to port 8462 from open internet and it appears closed still.

                          Does the server on port 8462 need to be configured to allow connects from the open internet?

                          1 Reply Last reply Reply Quote 0
                          • E
                            esde
                            last edited by

                            I did not see an option to enable logging for this specific rule.

                            Also, wallabybob, yes the server is configured to listen on 8462. I just changed the default RDP port, when I am able to see an open port I can connect via RDP no problem. The port is just not showing as open for the VPN IP:Forwarded Port.  :-\

                            Just to clarify on the last sentence, if I take out the pfSense router and replace it with my old dd-wrt router with 8462 forwarded through the VPN with iptables, the port will show open and I can connect via RDP. So the workstation/server (whatever term you prefer) that I'm trying to connect to is properly configured to accept connections. It seems the problem is definitely in the routing on the pfSense box.

                            ![2013-04-28 09_24_51-pfsense.png_thumb](/public/imported_attachments/1/2013-04-28 09_24_51-pfsense.png_thumb)
                            ![2013-04-28 09_24_51-pfsense.png](/public/imported_attachments/1/2013-04-28 09_24_51-pfsense.png)
                            ![2013-04-28 17_28_29-pfsense.esdehome - Firewall_ Rules.png_thumb](/public/imported_attachments/1/2013-04-28 17_28_29-pfsense.esdehome - Firewall_ Rules.png_thumb)
                            ![2013-04-28 17_28_29-pfsense.esdehome - Firewall_ Rules.png](/public/imported_attachments/1/2013-04-28 17_28_29-pfsense.esdehome - Firewall_ Rules.png)

                            1 Reply Last reply Reply Quote 0
                            • W
                              wallabybob
                              last edited by

                              I suspect your firewall rule for port 8462 is wrong but I don't know enough about your configuration. If you re really doing port forwarding (rather than routing) then the destination IP address in an incoming (on the WAN interface) connection to your server won't have a destination IP address = the server address, the destination IP address will probably be the WAN interface IP address.

                              Further, the destination address in the rule is a private IP address so it will match the first rule and hence will be blocked.

                              1 Reply Last reply Reply Quote 0
                              • chpalmerC
                                chpalmer
                                last edited by

                                I did not see an option to enable logging for this specific rule.

                                Look at my example above.  The arrow points to the logging which is found on the firewall rule.

                                I suspect your firewall rule for port 8462 is wrong but I don't know enough about your configuration. If you re really doing port forwarding (rather than routing) then the destination IP address in an incoming (on the WAN interface) connection to your server won't have a destination IP address = the server address, the destination IP address will probably be the WAN interface IP address.

                                Further, the destination address in the rule is a private IP address so it will match the first rule and hence will be blocked.

                                When you do a port forward- that is the way the associated rule is written by the box. Works here.

                                Triggering snowflakes one by one..
                                Intel(R) Core(TM) i5-4590T CPU @ 2.00GHz on an M400 WG box.

                                1 Reply Last reply Reply Quote 0
                                • chpalmerC
                                  chpalmer
                                  last edited by

                                  Ive got a feeling that on your WAN rule that the Gateway needs to be associated with the VPN but logging will help to see if anything is making it.

                                  Triggering snowflakes one by one..
                                  Intel(R) Core(TM) i5-4590T CPU @ 2.00GHz on an M400 WG box.

                                  1 Reply Last reply Reply Quote 0
                                  • W
                                    wallabybob
                                    last edited by

                                    @chpalmer:

                                    When you do a port forward- that is the way the associated rule is written by the box. Works here.

                                    Yes, you are correct. My mistake

                                    But then, won't first firewall rule on the WAN interface block the (attempted) port forward?

                                    1 Reply Last reply Reply Quote 0
                                    • chpalmerC
                                      chpalmer
                                      last edited by

                                      @wallabybob:

                                      @chpalmer:

                                      When you do a port forward- that is the way the associated rule is written by the box. Works here.

                                      Yes, you are correct. My mistake

                                      But then, won't first firewall rule on the WAN interface block the (attempted) port forward?

                                      I see what your saying..  Doesn't affect me here.  I think that means initiated from a private network…

                                      Triggering snowflakes one by one..
                                      Intel(R) Core(TM) i5-4590T CPU @ 2.00GHz on an M400 WG box.

                                      1 Reply Last reply Reply Quote 0
                                      • T
                                        thermo
                                        last edited by

                                        Don't do the Port Forward on the WAN, place it on the StrongVPN interface as incoming traffic on the public vpn IP address will 'appear' on your strong VPN interface which is where you also need to place an allow rule.

                                        1 Reply Last reply Reply Quote 0
                                        • E
                                          esde
                                          last edited by

                                          @thermo:

                                          Don't do the Port Forward on the WAN, place it on the StrongVPN interface as incoming traffic on the public vpn IP address will 'appear' on your strong VPN interface which is where you also need to place an allow rule.

                                          Thank you sir, for your time and help!!! The port is now forwarded!!!  ;D ;D ;D

                                          Also, thank you to chpalmer and and wallabybob!!!

                                          1 Reply Last reply Reply Quote 0
                                          • chpalmerC
                                            chpalmer
                                            last edited by

                                            Don't do the Port Forward on the WAN, place it on the StrongVPN interface as incoming traffic on the public vpn IP address will 'appear' on your strong VPN interface which is where you also need to place an allow rule.

                                            Of coarse!  ::)    (hanging head in shame)

                                            Awsome- glad you got it going!  And thanks Thermo!  :)

                                            Triggering snowflakes one by one..
                                            Intel(R) Core(TM) i5-4590T CPU @ 2.00GHz on an M400 WG box.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.