Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Multi-LAN

    Scheduled Pinned Locked Moved Routing and Multi WAN
    22 Posts 4 Posters 5.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • P
      phil.davis
      last edited by

      It is time to post a network diagram - I think we are misunderstanding something.
      Does WAN go directly to the real internet? or is it attached to some other "real" LAN that then gets to the internet?
      Does traffic from pfSense LAN devices get out through pfSense WAN OK?
      Can you ping to the internet (like 8.8.8.8) from pfSense itself?

      also I've noticed today is when I am connected with the VPN, I can't reach the machines behind the WAN.

      I don't quite understand what you mean by "behind the WAN"? Do you mean machines in LAN and LAB?
      Post more detail of your OpenVPN server config - what is in "Local Network/s" and your OpenVPN rules…

      As the Greek philosopher Isosceles used to say, "There are 3 sides to every triangle."
      If I helped you, then help someone else - buy someone a gift from the INF catalog http://secure.inf.org/gifts/usd/

      1 Reply Last reply Reply Quote 0
      • C
        cyberbot
        last edited by

        @phil.davis:

        It is time to post a network diagram - I think we are misunderstanding something.
        Does WAN go directly to the real internet? or is it attached to some other "real" LAN that then gets to the internet?
        Does traffic from pfSense LAN devices get out through pfSense WAN OK?
        Can you ping to the internet (like 8.8.8.8) from pfSense itself?

        also I've noticed today is when I am connected with the VPN, I can't reach the machines behind the WAN.

        I don't quite understand what you mean by "behind the WAN"? Do you mean machines in LAN and LAB?
        Post more detail of your OpenVPN server config - what is in "Local Network/s" and your OpenVPN rules…

        Dear Phil,
        Internet >>>> ISP Gateway>>>>>PFSENSE with 3 NICS
        PFSENSE >>>>> NIC1 192.168.2.X
        PFSENSE >>>>> NIC 2 ( LAN ) 192.168.4.x
        PFSENSE >>>>> NIC 3 LAB 192.168.5.X

        so when the VMS are configured to use the LAB NIC as Gateway they can't browse to the internet dont know yet why !
        when the VMS are configured to use the LAN NIC as gateway the internet works fine no issues !

        i have configured the Tunnel Subnet to use 192.168.200.0/24 so when my VPN client is connect with VPN recieved 192.168.200.x as IP after that they can reach all the VMWARE are behind the NIC2/NIC3 of Pfsense  but not the Machines are behind the NIC1 like my ISP gateway.

        waiting for your answer
        thank you so much

        1 Reply Last reply Reply Quote 0
        • P
          phil.davis
          last edited by

          For reaching devices on the private part of the WAN (192.168.2.x) , you will need to include that in Local Network/s on the OpenVPN server settings, so the OpenVPN client receives a route to it.
          Your LAB settings should work! Automatic Outbound NAT should NAT anything from LAN, LAB and OpenVPN tunnel when going out WAN. Look in /tmp/rules.debug for <tonatsubnets>- there should be a list including LAN, LAB and OpenVPN tunnel.
          I can't think what to change next, so post screenshots of your rules now, and an "ifconfig" or "ipconfig /all" of a LAB client.</tonatsubnets>

          As the Greek philosopher Isosceles used to say, "There are 3 sides to every triangle."
          If I helped you, then help someone else - buy someone a gift from the INF catalog http://secure.inf.org/gifts/usd/

          1 Reply Last reply Reply Quote 0
          • C
            cyberbot
            last edited by

            @phil.davis:

            For reaching devices on the private part of the WAN (192.168.2.x) , you will need to include that in Local Network/s on the OpenVPN server settings, so the OpenVPN client receives a route to it.
            Your LAB settings should work! Automatic Outbound NAT should NAT anything from LAN, LAB and OpenVPN tunnel when going out WAN. Look in /tmp/rules.debug for <tonatsubnets>- there should be a list including LAN, LAB and OpenVPN tunnel.
            I can't think what to change next, so post screenshots of your rules now, and an "ifconfig" or "ipconfig /all" of a LAB client.</tonatsubnets>

            Dear Phili,
            do you mean create rules on both sides ( LAB+LAN) to allow to WAN subnet ?

            1 Reply Last reply Reply Quote 0
            • P
              phil.davis
              last edited by

              Sorry, I was off-line for a while - had a major fibre cut here, and ISPs don't have working failover!
              I think your LAN and LAB firewall rules already have rules that allow general internet access, and that will include to the WAN-side private IP address subnet. You would also need a rule/s on the OpenVPN tab to permit traffic to the WAN-side network. But I think those are already there?
              The main thing I suspect is the the OpenVPN server "Local Network/s" box needs to have the full list of LAN, LAB and WAN-side private subnets specified so that routes are given to the OpenVPN client.
              Post some OpenVPN settings and rules, and the definition of <tonatsubnets>from /tmp/rules.debug</tonatsubnets>

              As the Greek philosopher Isosceles used to say, "There are 3 sides to every triangle."
              If I helped you, then help someone else - buy someone a gift from the INF catalog http://secure.inf.org/gifts/usd/

              1 Reply Last reply Reply Quote 0
              • C
                cyberbot
                last edited by

                @phil.davis:

                For reaching devices on the private part of the WAN (192.168.2.x) , you will need to include that in Local Network/s on the OpenVPN server settings, so the OpenVPN client receives a route to it.
                Your LAB settings should work! Automatic Outbound NAT should NAT anything from LAN, LAB and OpenVPN tunnel when going out WAN. Look in /tmp/rules.debug for <tonatsubnets>- there should be a list including LAN, LAB and OpenVPN tunnel.
                I can't think what to change next, so post screenshots of your rules now, and an "ifconfig" or "ipconfig /all" of a LAB client.</tonatsubnets>

                Dear Phil,
                thank you so much for your help once again,
                attached are screenshots from a LAB client and VPN rules
                please note : LAB-LAN isn't attached to a fysique NIC as showed on the screenshots

                waiting for your answer

                ipconfig.jpg
                ipconfig.jpg_thumb
                OpenVPN.jpg
                OpenVPN.jpg_thumb
                Vmware-NIC.jpg
                Vmware-NIC.jpg_thumb

                1 Reply Last reply Reply Quote 0
                • T
                  timthetortoise
                  last edited by

                  The first rule is allowing everything on that side to everything, no need for the second rule.

                  1 Reply Last reply Reply Quote 0
                  • C
                    cyberbot
                    last edited by

                    @timthetortoise:

                    The first rule is allowing everything on that side to everything, no need for the second rule.

                    do you mean removing the second rules would allow the connection to the WAN over the VPN ?

                    1 Reply Last reply Reply Quote 0
                    • T
                      timthetortoise
                      last edited by

                      I mean that the second rule is redundant, since the first rule is already allowing anything anywhere on that interface.

                      1 Reply Last reply Reply Quote 0
                      • C
                        cyberbot
                        last edited by

                        @timthetortoise:

                        I mean that the second rule is redundant, since the first rule is already allowing anything anywhere on that interface.

                        i was thinking the same however the client can still not reach the WAN from VPN and also not to the internet,
                        any more suggestions please?

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.