Can I get OpenVPN clients to route to the LAN interface, instead of NAT?
-
This may end up in the "stupid question " bin, but I have someone who wants the actual IP of OpenVPN clients to show up in a remote server log when they connect to the remote server - the remote server is beyond a router on the LAN side of the firewall. What happens by defualt (or at least as currently configured) is that the IP of the LAN interface of the firewall shows up in the server log when it gets traffic sourced from OpenVPN connected users. I am assuming that OpenVPN clients are NATing behind the LAN interface by defualt. Maybe I'm wrong here, but I can't find where NAT for OpenVPN clients is specifically configured, nor can I find a setting that allows me to turn on/off that behaviour. Is there a place for me to set/check this behaviour?
-
If my mental picture matches your description correctly (hint: a simple diagram would help here…) then something is translating/NAT'ting the remote client's IP address oddly.
I would normally expect the remote server to see either the client's OpenVPN Tunnel IP address (if you setup a Remote Access OpenVPN server in pfSense) or it's local LAN IP address (if you setup a Peer to Peer OpenVPN server).
Have you checked the```
Status->OpenVPN -
Yeah you usually have to do some work to NAT OpenVPN clients. Especially if they're not going out a WAN port.
You want to look in Firewall > NAT, Outbound tab for any entries with LAN as the interface.
