Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Lan access to OpenVPN

    Scheduled Pinned Locked Moved OpenVPN
    16 Posts 5 Posters 4.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • K
      kejianshi
      last edited by

      Its not going to work well with TUN on UDP more than likely because NAT reflection in UDP doesn't work on pfsense reliably.
      jg3 is using TCP - He should get decent mileage  ;)

      (My advice - Use UDP for Openvpn on one port - Run TCP on another port - like 80 if you don't have a server on 80.  Prefer UDP.)

      1 Reply Last reply Reply Quote 0
      • J
        jg3
        last edited by

        @kejianshi:

        jg3 is using TCP - He should get decent mileage  ;)

        TCP:  It's the 4-wheel-drive of network protocols.  It's for knowing you can get there and get back out, and screw the gas mileage.  ;D

        1 Reply Last reply Reply Quote 0
        • K
          kejianshi
          last edited by

          UDP is just plain better 90% of the time for VPN, especially at a distance where things get really really laggy on TCP. 
          I use TCP only when I must when some overly controlling net-nanny blocks everything except TCP 80.
          As long as I have 2 cores, I don't mind running two instances of VPN server on pfsense.

          1 Reply Last reply Reply Quote 0
          • P
            Pim
            last edited by

            Well switching to TCP did the job and everything works perfectly now. I don't really care about a bit "laggy" might that happen in the future somewhere. I mostly use the devices to receive email and then security overrules a bit lag.

            Thanks again :)

            1 Reply Last reply Reply Quote 0
            • K
              kejianshi
              last edited by

              I'm glad that helps.  Its definitely a NAT mirror issue. 
              If you ever do find yourself needing that to work well far from home, set up UDP also on a separate port.
              Good to see a plan come together anyway ;)

              1 Reply Last reply Reply Quote 0
              • P
                Pim
                last edited by

                @kejianshi:

                I'm glad that helps.  Its definitely a NAT mirror issue. 
                If you ever do find yourself needing that to work well far from home, set up UDP also on a separate port.
                Good to see a plan come together anyway ;)

                Is this a problem with my ISP, with my router, pfsense firewall settings or openvpn config itself?

                1 Reply Last reply Reply Quote 0
                • K
                  kejianshi
                  last edited by

                  Well - Its no longer a problem since you switched to TCP right?

                  But the NAT mirroring issue on UDP is a pfsense thing.

                  I have no need for VPNing into my network from inside my network, but if I had that strange desire, I'd use TCP inside the LAN and UDP outside the LAN.

                  1 Reply Last reply Reply Quote 0
                  • P
                    Pim
                    last edited by

                    @kejianshi:

                    Well - Its no longer a problem since you switched to TCP right?

                    But the NAT mirroring issue on UDP is a pfsense thing.

                    I have no need for VPNing into my network from inside my network, but if I had that strange desire, I'd use TCP inside the LAN and UDP outside the LAN.

                    Well if UDP is better and there is a solution to solve this issues while keeping UDP I would like to solve it.

                    1 Reply Last reply Reply Quote 0
                    • K
                      kejianshi
                      last edited by

                      Do you need to use the VPN from inside your own network or are you just doing this to test it?

                      1 Reply Last reply Reply Quote 0
                      • P
                        Pim
                        last edited by

                        @kejianshi:

                        Do you need to use the VPN from inside your own network or are you just doing this to test it?

                        The goal is/was to be able to have my devices always connected to OpenVPN so I can't forget to activate it once I arrive somewhere. (and it's just easier to not have to activate openvpn 5 times a day)

                        1 Reply Last reply Reply Quote 0
                        • K
                          kejianshi
                          last edited by

                          Leave it on TCP unless you travel far far away - hundreds of miles or more.
                          After that, switch over to UDP.
                          Pretty much all devices will allow multiple configurations and are easily selectable via GUI in the clients.
                          So, just run 2 instances of openvpn on your server.
                          This is good idea for anyone really - Just to guarantee access with multiple accessible ports/protocols.

                          1 Reply Last reply Reply Quote 0
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.