OpenVPN through two pfsenses
-
Hi netgate-community,
I have an issue, maybe somebody out there can help me:
My task is to create an OpenVPN config file for an Android-Device which is connected to a second pfsense in our office.
The architecture looks like this:
I have a NAT-Rule in pfsense 1 (VMSDEV = 10.9.9.245):
This is the OpenVPN-Server on pfsense 1
I put on an OpenVPN-Server on pfsense 2. But it works just if I am in the WIFI of pfsense 1.
So how can I tell the OpenVPN config file, that it has to pass also the pfsense 1 before it gets to pfsense 2?
Also just a hint would help me very much. I tried already quite a few things but I didn't get it to work.
Thank you very much!
-
Why would you have it setup like that? No reason to run 2 in line pfsense like that..
-
It is a simulation for an installation somewhere else. So the second pfsense is a copy of that installation and we test a new software version of our product. Behind the second pfsense is a copy of the server in this installation and the whole pfsense2 config is also the same. And behind the pfsense1 is our office. So it has to be like this
-
Well if you want to get openvpn to the 2nd one, then you would have to port forward on the first 1, and have your open vpn client use the IP of your first 1 wan.. This is your typical double nat setup.
-
Ok, sounds reasonable. Is my actual rule on pfsense 1 ok, like in the screenshot?
-
dude you can not run openvpn on 1, and expect to forward the same port to 2??
Oh your forwarding 1195, to 1194 on 2, while running 1194 on 1..
Yeah you could do that.. Just point your client to pfsense 1 port 1195
-
So would it be in theory enough when I change this in the openVPN-config file directly?
If my openVPN Server on pfsense 2 is configured already. -
You can do it in the export package in the drop down list..
Oh that will allow you to do custom for IP or name but not the port, yeah you need to edit the ovpn file directly
-
Hm, could you maybe help me with the correct line? That would be awesome!
It would be someththing like:
remote WAN1-IP 1195 udp
am I right? :-) -
It still doesn't work :(
-
yup its that simple..
Export the config from pfsense 2 openvpn... Validate it works by being on the pfsense 2 wan network... Then just change the IP and port so you hit pfsense 1 IP and the 1195 port.
If it doesn't work then validate your port forwarding is correct sniff on wan of pfsense 1, sniff on pfsense 1 lan - do you see it sending the traffic?
-
Thank you very much for your help.
I had to leave the office now...I will retry it on Monday and let you know.
Thank you very, very much!
