Accessing specific VLANs via VPN?
-
You have a mess on your hands. How about an example of two problematic, conflicting networks, all the IP schemes and interfaces involved, and what you have and do not have the power to control or change? Please be as detailed as possible, but stick to two (or three) "guest networks" and perhaps one community server.
-
Here is an example.
VLAN1
- Server A
- 172.16.1.1
- 172.16.1.0/24 Network
- FTP server
- I have control over this ip scheme
VLAN2
- Workstation A
- 172.16.2.1
- 172.16.2.0/24 Network
- Needs FTP access to Server A
- I need to be able to access any machine on any port on VLANS 10-12
- I have control over this ip scheme
VLAN10
- 172.16.10.0/24 Network full of devices
- All devices need ftp access to Server A
- I do not have control over this ip scheme
VLAN11
- 172.16.10.0/24 Network full of devices
- All devices need ftp access to Server A
- I do not have control over this ip scheme
VLAN12
- 172.16.1.0/24 Network full of devices
- All devices need ftp access to Server A
- I do not have control over this ip scheme
Thanks,
.dok -
And what are VLAN10 and VLAN11 using for routers? What is their default gateway? How do they get internet? Do you control that piece?
-
On VLAN10 and VLAN11 all devices are statically ip'd. They do not have (nor do they need) internet access. They are all connected to the pfsense box via a vpn connection.
I can set the gateway on all of the devices but that is all. Setting pfsense as the gateway would allow me to do routing on the pfsense box correct?
-
You're going to need to better describe your topology. What on VLAN10 and 11 is making the VPN connection? What type of VPN? If they're behind a VPN router why are you calling it a VLAN? Is there a managed switch somewhere? Do you control that?
I'm thinking some sort of 1:1 NAT might work for you, but it depends.
You really should tell them they have to renumber and do something sane with your subnets. That is the best solution to your problem. Let me guess: They don't want to spend any money either.
-
You called it.
I will simplify the setup some more.
VLAN 1
- Server A
- 172.16.1.1
- 172.16.1.0/24 Network
- FTP server
- I have control over this ip scheme
VLAN 2
- Workstation A
- 172.16.2.1
- 172.16.2.0/24 Network
- Needs FTP access to Server A
- I need to be able to access any machine on any port on Networks 2-4
- I have control over this ip scheme
Network 1
- Contains VLAN1 and VLAN 2
- Gateway is my pfsense box.
Network 2
- IPsec VPN to pfsense box
- 172.16.10.0/24 Network full of devices
- All devices need ftp access to Server A
- I do not have control over this ip scheme
- This network does not need to be able to talk to any other network directly
Network 3
- IPsec VPN to pfsense box
- 172.16.10.0/24 Network full of devices
- All devices need ftp access to Server A
- I do not have control over this ip scheme
- This network does not need to be able to talk to any other network directly
Network 4
- IPsec VPN to pfsense box
- 172.16.1.0/24 Network full of devices
- All devices need ftp access to Server A
- I do not have control over this ip scheme
- This network does not need to be able to talk to any other network directly
I assumed that Networks 2-4 would each have their own vlan but that is not necessary.
Is there anything else that I can do to make this easier to understand? Like drawing a picture?
-
Diagrams are always good. What type of IPsec VPN are they connecting with? Site-to-Site via a router (what are the routers) or are all the workstations individually connecting using Remote Access?
-
Here is a rough drawing.
site to site (I do not know the routers and they are guaranteed not to be the same since the number of these networks are growing.)
-
I'm going to have to build that. I honestly don't know if IPsec has enough flexibility for that. I know I could figure something out with OpenVPN assigned interfaces for each endpoint, but that does you no good.
Are you using pfSense 2.1.5 or 2.2?
-
I am using 2.2 but I can definitely change versions if that helps.
What options could I have with OpenVPN? I doubt I could make that an option but it would still be nice to know.
Thank you for your help.
-
I'm not going to waste any time labbing this. Jim pretty much sums it up here:
https://forum.pfsense.org/index.php?topic=47349.msg249020#msg249020
-
Thank you
-
And to answer your prior question…
With OpenVPN you can assign interfaces to OpenVPN server instances then, on that interface, perform 1:1 NAT.
So you would be connecting to distinct IP addresses and they would be NAT translated. You'd still have your work cut out for you. They would all have unique IP addresses as far as pfSense is concerned. On the ones that are the same scheme as the local pfSense networks, you'd have to translate both source and destination IPs.
