Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    OpenVPN and two pfSense

    Scheduled Pinned Locked Moved OpenVPN
    19 Posts 4 Posters 3.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • V
      viragomann
      last edited by

      The rules should permit traffic to WAN for both machines. You haven't mentioned which is the physical and which the virtual.
      Have you restarted the box? The outbound NAT sometimes need this to work.

      Is the server configured to set the client to redirect whole traffic through the tunnel (Redirect Gateway)?

      BTW: I don't understand the LAN rules for OPT3. OPT3 is the OpenVPN server, so why you want to access the server address from LAN? Should it be "OPT3 net"?

      1 Reply Last reply Reply Quote 0
      • S
        squirreldip
        last edited by

        Sorry - Server 1 is the VM (working) and 2 is the box.

        I've attached the Server configs…

        Also - Changing from OPT3 Address to OPT3 Net causes the server on the VM to stop working (and still not work on the box).

        ![OpenVPN Server 2.jpg_thumb](/public/imported_attachments/1/OpenVPN Server 2.jpg_thumb)
        ![OpenVPN Server 2.jpg](/public/imported_attachments/1/OpenVPN Server 2.jpg)
        ![OpenVPN Server 1.jpg_thumb](/public/imported_attachments/1/OpenVPN Server 1.jpg_thumb)
        ![OpenVPN Server 1.jpg](/public/imported_attachments/1/OpenVPN Server 1.jpg)

        1 Reply Last reply Reply Quote 0
        • V
          viragomann
          last edited by

          Try to remove the Advanced options in server settings. These are deprecated as far as I know

          Instead check the "Redirect Gateway" option and "DNS Servers" and enter your DNS servers there. Ensure that you have activated the DNS forwarder or the resolver and that it is listening at LAN interface if you use that IP.

          @squirreldip:

          Also - Changing from OPT3 Address to OPT3 Net causes the server on the VM to stop working (and still not work on the box).

          That's just a firewall rule and OPT3 address is part of OPT3 net. What's the rule good for?

          1 Reply Last reply Reply Quote 0
          • D
            doktornotor Banned
            last edited by

            @viragomann:

            Try to remove the Advanced options in server settings. These are deprecated as far as I know

            Yeah, when you look there there's a checkbox for redirect gateway in Tunnel Settings and DNS Servers in Client Settings.

            I don't really understand the OPT3 LAN rule at all. VM shut down or not.

            1 Reply Last reply Reply Quote 0
            • S
              squirreldip
              last edited by

              Thanks for the cleanup suggestions - Changed the server settings and removed the LAN rule…

              Connections are much faster...

              Still working as before:  VM passes net traffic box does not.

              Note about internal traffic:  I can only ping devices that have the same gateway as the OpenVPN device with the exception of the internal server - I get ping response from the server (192.168.2.2) regardless of which VPN I'm attached to.

              1 Reply Last reply Reply Quote 0
              • D
                doktornotor Banned
                last edited by

                I seriously do not get the point of the exercise here…

                -Shut down the redundant whatever that you don't intend to use.

                • Plug the "box" firewall in place.
                • Job done.

                Really cannot meaningfully test anything like this.

                1 Reply Last reply Reply Quote 0
                • S
                  squirreldip
                  last edited by

                  @doktornotor:

                  I seriously do not get the point of the exercise here…

                  -Shut down the redundant whatever that you don't intend to use.

                  • Plug the "box" firewall in place.
                  • Job done.

                  Really cannot meaningfully test anything like this.

                  Point taken…  I'll do this and re-test when I get home (can only do so much from a remote desktop).

                  1 Reply Last reply Reply Quote 0
                  • S
                    squirreldip
                    last edited by

                    @squirreldip:

                    @doktornotor:

                    I seriously do not get the point of the exercise here…

                    -Shut down the redundant whatever that you don't intend to use.

                    • Plug the "box" firewall in place.
                    • Job done.

                    Really cannot meaningfully test anything like this.

                    Point taken…  I'll do this and re-test when I get home (can only do so much from a remote desktop).

                    Okay…  Shutdown the VM and changed the IP of the 'box' - can connect to OpenVPN but it still will not pass internet traffic.

                    1 Reply Last reply Reply Quote 0
                    • S
                      squirreldip
                      last edited by

                      Hopefully this may spark something:

                      If I disable either of the OpenVPN client interfaces (either OPT1 or OPT2) the OPT3 (Server) will now pass Internet traffic.  As soon as I re-enable (and make sure all are up) then the VPN will stop passing traffic.  I've made no other changes other than disabling one of the client VPNs.

                      Are there known issues running multiple OpenVPN connections on a single pfSense system?

                      Update:  I've attempted to remove all the interfaces, disable all the VPNs then reboot and recreate all.  Same problem with no internet being passed by the OpenVPN Server (OPT3)

                      1 Reply Last reply Reply Quote 0
                      • S
                        squirreldip
                        last edited by

                        Another interesting thing:

                        If I connect to the OPT3 (server) and then stop and restart either of the other two (clients) using "Status:OpenVPN" then internet traffic will pass.

                        Once I disconnect from OPT3 then reconnect traffic will no longer pass (unless I stop/restart again).

                        1 Reply Last reply Reply Quote 0
                        • D
                          doktornotor Banned
                          last edited by

                          I do not get what's the point of assigning the OPT3 interface at all.

                          1 Reply Last reply Reply Quote 0
                          • 2
                            2chemlud Banned
                            last edited by

                            …here is a tutorial promoting an OPT interface for openVPN setup  if you want to route all traffic through your tunnel

                            https://forum.pfsense.org/index.php?topic=76015.0

                            :-)

                            1 Reply Last reply Reply Quote 0
                            • S
                              squirreldip
                              last edited by

                              @doktornotor:

                              I do not get what's the point of assigning the OPT3 interface at all.

                              I thought I required an interface defined to the OpenVPN server - I removed it…

                              Same problem persists - with both the clients up I cannot see internet traffic on the OpenVPN client.  Once one is disabled the traffic passes.

                              1 Reply Last reply Reply Quote 0
                              • 2
                                2chemlud Banned
                                last edited by

                                From my experience: Debugging VPN at this level is PITA. Start from scratch and do only the absolute necessary (preferably without wizzard for site-to-site) or import the config from the working pfSense. Everything else is usually a waste of time…

                                1 Reply Last reply Reply Quote 0
                                • D
                                  doktornotor Banned
                                  last edited by

                                  @squirreldip:

                                  Problem persists - with both the clients up I cannot see internet traffic on the OpenVPN client.  Once one is disabled the traffic passes.

                                  What do you mean? Are you trying to push all traffic via two different VPNs like some load ballancing?! Yeah obviously it will cause huge amount of trouble!

                                  1 Reply Last reply Reply Quote 0
                                  • S
                                    squirreldip
                                    last edited by

                                    @2chemlud:

                                    From my experience: Debugging VPN at this level is PITA. Start from scratch and do only the absolute necessary (preferably without wizzard for site-to-site) or import the config from the working pfSense. Everything else is usually a waste of time…

                                    The issues are actually on both boxes.  Once both clients are connected then the server does not pass internet traffic.  This occurs on both systems (VM or box)

                                    1 Reply Last reply Reply Quote 0
                                    • 2
                                      2chemlud Banned
                                      last edited by

                                      Once both clients are connected then the server does not pass internet traffic.  This occurs on both systems (VM or box)

                                      "does not pass internet traffic" from where? LAN? VPN clients? I don't even get what is not working in your setup…

                                      1 Reply Last reply Reply Quote 0
                                      • D
                                        doktornotor Banned
                                        last edited by

                                        @2chemlud:

                                        I don't even get what is not working in your setup…

                                        No wonder, with terminology like "see internet traffic on client". Why should some OpenVPN client "see internet traffic"?

                                        1 Reply Last reply Reply Quote 0
                                        • First post
                                          Last post
                                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.