Openvpn TAP. Can Access everything but not pfsense GUI! (Solved)
-
@namek said in Openvpn TAP. Can Access everything but not pfsense GUI!:
The main network is connected to several other networks via MPLS.
I wanted to be able to access those MPLS networks that are accessible from the LAN.How is that exactly? Your saying there is some other router on this 192.168/22 lan that connects. Or there is a connection hanging off the pfsense that is connected via mpls..
Why would you need to run tap for this? If your upstream/downstream networks know how to get to 192.168/22 then just source NAT your vpn clients connecting into pfsense so they look like 192.168/22
There is no reason to try and bridge your vpn clients into this 192.168/22
-
The other router is in the LAN (same as pfsense)
so its like this:
Internet -> Pfsense -> Switch -> MPLS router - Connects to many other networks.
When you say "source NAT your vpn clients connecting into pfsense "
Are you talking about using outbound nat? -
That screams asymmetrical to me... So these lan devices on your 192.168/22 all hav routes pointing to this mpls gateway?
lets say there is some remote network 10.0.0/24 via the mpls... Your saying your client at 192.168.1.100 sends its traffic to pfsense at say 192.168.0.1 and pfsense sends it to the mpls router at 192.168.0.2 for example?
Or does the client on 192.168.1.100 have a route on it say hey to get to 10.0.0/24 talk to 192.168.0.2?
Yes it would be a simple outbound nat but vs doing it on your wan, you would do it on your pfsense interface connected to this 192.168/22 network.
-
The clients in the physical LAN have routes added in them locally to access the remote networks to prevent asymmetric routing.
So its like you said : "client on 192.168.1.100 have a route on it say hey to get to 10.0.0/24 talk to 192.168.0.2"
I will abandon this Bridge nonsense and go back to TUN, and try the outbound NAT that you suggested
-
Why don't you just connect the mpls to pfsense so you don't have to worry about host routing?
-
That is a very good question.
The network was always like that. I recently took over and replaced a fortinet gateway with pfsense.If I want to connect the MPLS Router directly to pfsense, how might I go about that?
I get that I'll just add another interface, but what would be the subnet / IP for this interface (that connects directly to the MPLS router)I also assume that I will still have to do the outbound NAT configuration even if the above is achieved.
-
Do you not have access or the ability to add routes to the mpls router? You would connect it to pfsense via a transit network.
-
I do, However, adding the routes on my end is not enough. We have to go through a long procedure to notify the ISP.
(I am guessing there are intermediate routers that they need to publish the routes to)But thanks a LOT for your help. I will get rid of TAP and go about the routing method.
-
Hello John,
Your suggestion for using outbound NAT works!
TUN works fine and I can access the MPLS networks without touching the MPLS router on any end!Thanks a LOT! Appreciate your help.
P.S (how do I mark this thread as solved?) -
Just edit the subject of the thread and put in solved at the beginning {solved]
