Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    NAT through openvpn tunnel

    Scheduled Pinned Locked Moved OpenVPN
    19 Posts 6 Posters 12.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      meluvalli
      last edited by

      @viragomann:

      @meluvalli:

      I have the exact same setup.  I am doing this for a mail server, so I must know the origin source from site A.

      Is this possible?  Right now it's showing everything is coming from my VPN server address.

      And like wessel you have forwarded internet traffic from A to a server behind B and also want to access it from other devices in A LAN network?
      And B has also its own upstream gateway?

      On site A I have:
          Firewall NAT–> B.
          Outbound Mappings (2 of them):
              Interface: OpenVPN
              Destination: 10.99.0.0 (B Network)
              Nat Address: OpenVPN Address

      Interface: WAN
              Source: 10.99.0.0 (B Network)
              Nat Address: Interface Address

      Then on site B I have:
              Default Gateway Set for VPN

      This all works, but anything coming from site A to 10.99.. shows from my VPN address (192.168..)

      1 Reply Last reply Reply Quote 0
      • V
        viragomann
        last edited by

        Deactivate or delete the first one of the outbound NAT rules you've listed.

        What was the reason for adding that rule? Since the S2S VPN is the default gateway on B you won't need it.
        Ensure that the vpn routes are set correctly (Local network, Remote network).

        1 Reply Last reply Reply Quote 0
        • M
          meluvalli
          last edited by

          @viragomann:

          Deactivate or delete the first one of the outbound NAT rules you've listed.

          What was the reason for adding that rule? Since the S2S VPN is the default gateway on B you won't need it.
          Ensure that the vpn routes are set correctly (Local network, Remote network).

          When I remove the first Outbound rule, then it doesn't work at all.

          I think I may have this really mixed up…  I'm re-looking at your original answer...
          @viragomann:

          So it will be okay to change the default route to the VPN server, I think. This can be done by checking "Redirect Gateway" in the OpenVPN server settings at site A.
          If you do that ensure, that you have an outbound NAT rule at site B to translate source IPs to interface IP on OpenVPN interface.

          From looking at that response, it appears I should have default gateway set for VPN on Site A's network (Not Site B's).
          And then the outbound NAT Rule would be on Site B.

          Again, I am trying to forward incoming connection from Site A to Site B.

          So would this be correct?  I have the Default Gateway set for the VPN on Site B (Not site A).  And I have the Outbound Rule on Site A (Not Site B)…

          1 Reply Last reply Reply Quote 0
          • V
            viragomann
            last edited by

            @meluvalli:

            When I remove the first Outbound rule, then it doesn't work at all.

            What exactly??
            A LAN > B LAN
            Internet > A WAN > B LAN
            both?

            If your routes are set well and B uses the VPN as defautlt gateway, there is no need for natting between A and B. You only need an additional outbound NAT rule at A WAN for the B sites LAN, only for upstream connections.

            1 Reply Last reply Reply Quote 0
            • M
              meluvalli
              last edited by

              @viragomann:

              @meluvalli:

              When I remove the first Outbound rule, then it doesn't work at all.

              What exactly??
              A LAN > B LAN
              Internet > A WAN > B LAN
              both?

              If your routes are set well and B uses the VPN as defautlt gateway, there is no need for natting between A and B. You only need an additional outbound NAT rule at A WAN for the B sites LAN, only for upstream connections.

              NAT A -> B is what doesn't work.

              Both A & B can get out fine.  But incoming connections from site A won't go to site B.  When I add back in that top outbound route, it works, but all traffic coming from A -> B shows as my VPN IP instead of the actual address of who's coming in.

              1 Reply Last reply Reply Quote 0
              • DerelictD
                Derelict LAYER 8 Netgate
                last edited by

                https://forum.pfsense.org/index.php?topic=82732.msg453269#msg453269

                Pay close attention to assigning an interface on the destination server side and that the rules passing the traffic there cannot match on the OpenVPN group tab but must match on the assigned interface tab instead.

                Chattanooga, Tennessee, USA
                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                1 Reply Last reply Reply Quote 0
                • M
                  meluvalli
                  last edited by

                  @Derelict:

                  https://forum.pfsense.org/index.php?topic=82732.msg453269#msg453269

                  Pay close attention to assigning an interface on the destination server side and that the rules passing the traffic there cannot match on the OpenVPN group tab but must match on the assigned interface tab instead.

                  Derelict:  I have made sure I don't have allow all on both OPT1 and OpenVPN tab.  Still have same issue.  Anything coming in from site A to site B show as my OpenVPN server's IP instead of coming from true IP of Client on WAN side.

                  :(

                  1 Reply Last reply Reply Quote 0
                  • DerelictD
                    Derelict LAYER 8 Netgate
                    last edited by

                    Then you are still performing NAT there. Turn that off.

                    Chattanooga, Tennessee, USA
                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                    1 Reply Last reply Reply Quote 0
                    • M
                      meluvalli
                      last edited by

                      Ok!  Got it working finally!

                      Thank you both for your help!  I tried to give thanks to both, but system wouldn't let me :(  Can only give thanks to one of you :(

                      Ok, so it turns out you were both right.    I needed the firewall setup for the opt1 and not the OpenVPN.  This was part of the fix.

                      The other part of the fix was removing the first Outbound rule as suggested by viragomann.  When I tested this before, it wasn't working….  Come to find out, it doesn't work if I telnet from A to B back to A.  I had to test it from an outside source and it worked.  I was thinking it was broken because i couldn't telnet into it from A's pfSense box...  pfSense doesn't like going out from A to B and back to A for some reason, but I'm ok with this!

                      I'm just VERY thankful it works and wanted to say thank you to the both of you!!!!!

                      1 Reply Last reply Reply Quote 1
                      • A
                        akron
                        last edited by

                        @meluvalli:

                        Ok!  Got it working finally!

                        Thank you both for your help!  I tried to give thanks to both, but system wouldn't let me :(  Can only give thanks to one of you :(

                        Ok, so it turns out you were both right.    I needed the firewall setup for the opt1 and not the OpenVPN.  This was part of the fix.

                        The other part of the fix was removing the first Outbound rule as suggested by viragomann.  When I tested this before, it wasn't working….  Come to find out, it doesn't work if I telnet from A to B back to A.  I had to test it from an outside source and it worked.  I was thinking it was broken because i couldn't telnet into it from A's pfSense box...  pfSense doesn't like going out from A to B and back to A for some reason, but I'm ok with this!

                        I'm just VERY thankful it works and wanted to say thank you to the both of you!!!!!

                        I have the exact same setup as you and also facing the issue of removing the First Outbound rule from site A, the NAT stops working.

                        I can live with all my traffic showing as coming from the VPN but wanted to know how did you achieve the clean NAT from Site A to site B without the first outbound rule on the VPN interface

                        Cheers

                        1 Reply Last reply Reply Quote 0
                        • A
                          akron
                          last edited by

                          @Derelict:

                          Then you are still performing NAT there. Turn that off.

                          Would you be able to explain?

                          Thank you

                          1 Reply Last reply Reply Quote 0
                          • B bartounet16000 referenced this topic on
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.