Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Opening VPN access

    Scheduled Pinned Locked Moved Firewalling
    15 Posts 3 Posters 1.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • J
      Joeri Michiels
      last edited by

      Hi,

      We have configured vpn on our Fortigate 200 and local connections tested out successfully.
      The Fortigate is behind a pfSense and I've already configured forwarding for ports 500, 4500 and ESP (IP50).
      However we still can't connect remotely.  According to Fortigate support this is because it is configured with Hybrid outbound nat : this should be set to manuel outbound nat and any automatic rules for port 500 should be deleted.

      I have a hard time believing that this cannot work in Hybrid mode.  Could this really be the case ?

      There is an another vpn server behind the pfsense and I can connect to that just fine.  Also I'm worried that changing to manual outbound nat might break vpn access to this other vpn server, since it is still used intensively.

      Thanks for your suggestions
      [Screenshot pfSense.jpg](/public/imported_attachments/1/Screenshot pfSense.jpg)

      1 Reply Last reply Reply Quote 0
      • DerelictD
        Derelict LAYER 8 Netgate
        last edited by

        Woefully lacking detail and your uploaded screenshot is 0 bytes.

        Chattanooga, Tennessee, USA
        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
        Do Not Chat For Help! NO_WAN_EGRESS(TM)

        1 Reply Last reply Reply Quote 0
        • J
          Joeri Michiels
          last edited by

          pfSense is v2.3.2 running on a FreeBSD 10.3 release p5, and this has been setup in a vm running on VMware vsphare 5.5.  The network setup is pretty basic : one interface connecting to the internet and one for the lan.  Let me know if you require any other details.

          Basically we need to allow vpn connections through our pfSense to our new Fortigate 200 (172.30.0.132).  At the moment we have an old vpn server (172.30.136) and that works just fine through the pfSense.  This old vpn server is going to be replace with the Fortigate 200.

          I would like to setup pfSense so we can establish a vpn connection to the Fortigate 200 without breaking the current vpn access.  According to Fortigate support, I need to change from Hybrid to Manual configuration and remove the automatically generated rules.  Is that correct and if so how will this impact my currenct vpn connections ?

          Note : I've upload the image file again.

          Screenshot.jpg
          Screenshot.jpg_thumb

          1 Reply Last reply Reply Quote 0
          • DerelictD
            Derelict LAYER 8 Netgate
            last edited by

            If you need connections from the internet to your inside VPN server, you should be looking at port forwards or 1:1 NAT, not outbound NAT.

            Chattanooga, Tennessee, USA
            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
            Do Not Chat For Help! NO_WAN_EGRESS(TM)

            1 Reply Last reply Reply Quote 0
            • J
              Joeri Michiels
              last edited by

              That's what I already assumed.  Thanks for confirming.  I've setup the following port forwards (see attached screenshot) to allow vpn traffic.  I notice in the Fortigate logs that a vpn connection is being setup, but then it breaks off so the connection is not established.

              2016_10_25_10_53_28_Settings.png
              2016_10_25_10_53_28_Settings.png_thumb

              1 Reply Last reply Reply Quote 0
              • DerelictD
                Derelict LAYER 8 Netgate
                last edited by

                Looks like that should be all that's necessary there. Are there firewall rules on WAN passing the same traffic to 172.30.0.132? Is the traffic arriving at your Fortigate?

                Chattanooga, Tennessee, USA
                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                1 Reply Last reply Reply Quote 0
                • J
                  Joeri Michiels
                  last edited by

                  We have indeed firewall rule on WAN passing the same traffic to 172.30.0.132.  (see screenshot - I'll attach a second screenshot in my next reply).

                  ![2016-10-25 11_11_19-Settings.jpg](/public/imported_attachments/1/2016-10-25 11_11_19-Settings.jpg)
                  ![2016-10-25 11_11_19-Settings.jpg_thumb](/public/imported_attachments/1/2016-10-25 11_11_19-Settings.jpg_thumb)

                  1 Reply Last reply Reply Quote 0
                  • J
                    Joeri Michiels
                    last edited by

                    And the remaining rules in this second screenshot.  We also see traffic arriving at the Fortigate 200, (I believe this is the initial handshake of the communication) and then the connection gets drop before it is completely established.

                    ![2016-10-25 11_12_01-Settings.jpg](/public/imported_attachments/1/2016-10-25 11_12_01-Settings.jpg)
                    ![2016-10-25 11_12_01-Settings.jpg_thumb](/public/imported_attachments/1/2016-10-25 11_12_01-Settings.jpg_thumb)

                    1 Reply Last reply Reply Quote 0
                    • DerelictD
                      Derelict LAYER 8 Netgate
                      last edited by

                      NAT Traversal should be all you need. I don't think you can port-forward ESP itself.

                      Is the traffic arriving on the fortigate?

                      Chattanooga, Tennessee, USA
                      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                      1 Reply Last reply Reply Quote 0
                      • J
                        Joeri Michiels
                        last edited by

                        Yes.  Traffic is arriving at the fortigate.  In the logs we see the initial communication being setup, but then the connection attempt gets dropped, and I'm assuming that's because there is still something that is blocked.

                        When I try to establish a vpn connection to the fortigate 200 directly via the local network, it works.  So I'm sure the fortigate is working.

                        1 Reply Last reply Reply Quote 0
                        • DerelictD
                          Derelict LAYER 8 Netgate
                          last edited by

                          Therefore it has to be pfSense at fault.

                          Chattanooga, Tennessee, USA
                          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                          Do Not Chat For Help! NO_WAN_EGRESS(TM)

                          1 Reply Last reply Reply Quote 0
                          • J
                            Joeri Michiels
                            last edited by

                            I agree.  But how can I troubleshoot what's wrong ?

                            1 Reply Last reply Reply Quote 0
                            • stephenw10S
                              stephenw10 Netgate Administrator
                              last edited by

                              Most likely problem: The Fortigate is sending it's local IP address as it's identifier and the device at the other end is expecting the pfSense WAN IP.

                              Check the expected identifier at the other end. Change the Fortigate to send the public IP if that's what is needed to match.

                              Or you could just use pfSense to setup the tunnel directly.  ;)

                              Steve

                              1 Reply Last reply Reply Quote 0
                              • J
                                Joeri Michiels
                                last edited by

                                According to Fortigate that is likely the cause of the problem.  Could you send me the instructions on how to change the configuration to send down the local identifier to the device ? Thanks.

                                1 Reply Last reply Reply Quote 0
                                • stephenw10S
                                  stephenw10 Netgate Administrator
                                  last edited by

                                  That's something you would need to configure in the Fortigate. I can't help you with that.

                                  Is there a reason you're not just terminating the VPN in pfSense directly? I could help you with that.  ;)

                                  Steve

                                  1 Reply Last reply Reply Quote 0
                                  • First post
                                    Last post
                                  Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.