[SOLVED] VPN routing

viragomann

Funny thing is if I disable outbound NAT ping and tracert work but http not

As I mentioned above, that's the problem when the vpn endpoint is in the same network segment as the destination device, but the vpn endpoint is not the default gateway.

TCP which http is based on is a stateful protocol, ICMP (ping) is stateless.
When you try to access a device from vpn client, the request packets go from pfSense directly to the device, while response packets are sent to the default gateway (Cisco FW, presumably) where they should be directed to pfSense. However, your default gateway has no state for it since it didn't get the request packet and will drop it.
For a stateless protocol that doesn't matter.

When using outbound NAT, request packets have the source IP of pfSense, so responses are directed back to pfSense directly.

So as already suggested, put the pfSense in a separate network segment and set up a correct routing. This can also be done by VLAN.

maverick_slo

hmm.
pfsense IS on separate network on ASA.
routing works actually everything works but little thing I mentioned.

on server on different VLAN all requests are coming from pfsense WAN.
So how do I make them come from openvpn client instead.

viragomann

Turn off the outbound NAT on pfSense.

Consider that for routing vpn responses back you need a static route for the vpn tunnel network on your ASA?

maverick_slo

Well if I turn off outbound NAT things stop to work.

I have route on asa to route my tunnel network to pfsense WAN IP.

viragomann

If that's the case, the route won't work.

Try a traceroute from the device you tried to access.

maverick_slo

Tracert is OK.
Tried both ways both ways OK.

viragomann

If the routes are OK there is no need for the outbound NAT.

Sorry, no more ideas as long as I don't get more infos like tunnel network, network map, detailed routes, packets capture of an access attempt from a vpn client.

maverick_slo

Thanks, will check tomorrow with our fw guys as I don't see errors in my config...

maverick_slo

Closure:
I had it configured correctly.
So correct FW rules and outbound nat (SNAT) disabled.
Problem was on cisco router where network guys forgot to allow my traffic (even when they say they did, well doublecheck) :)

netdomon2

i have same problem thank