Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    OpenVPN Static Ip, Routing Problem, NAT

    Scheduled Pinned Locked Moved OpenVPN
    openvpn routingrulesopen vpnnat
    17 Posts 3 Posters 1.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • ?
      A Former User
      last edited by

      I already assigned the OpenVPN to an interface and also to a Gateway.
      I tried a lot of different Firewall/NAT Settings but i cant get them to work so that my outgoing traffic is routed threw the VPN.

      I made some screenshots for you.

      Maybe you can find the mistake.
      (I will change the floating firewall rule to a normal firewall rule later if i manage to get this working.)

      alt text
      alt text
      alt text
      alt text
      alt text
      alt text

      DerelictD 1 Reply Last reply Reply Quote 0
      • V
        viragomann
        last edited by

        In the firewall rule the source port has to be "any" and the destination port must be "SMTP".

        1 Reply Last reply Reply Quote 0
        • ?
          A Former User
          last edited by

          I changed the firewall rule as you said, but it still doesnt work.

          1 Reply Last reply Reply Quote 0
          • DerelictD
            Derelict LAYER 8 Netgate @A Former User
            last edited by

            @schamschi

            "Don't pull routes" has to be checked in the client VPN settings.

            Chattanooga, Tennessee, USA
            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
            Do Not Chat For Help! NO_WAN_EGRESS(TM)

            1 Reply Last reply Reply Quote 0
            • ?
              A Former User
              last edited by A Former User

              Hello Derelict, if i check the box my port forwarding to my server isnt working anymore somehow, so i am not able to check if this helps.

              My Port Forwards will work if i check the box below: Don't add or remove routes automatically

              But also with this checked i got no success in my outbound/firewall problem.

              1 Reply Last reply Reply Quote 0
              • DerelictD
                Derelict LAYER 8 Netgate
                last edited by Derelict

                If you are port forwarding into a server over OpenVPN you have to:

                1. Assign an interface
                2. Make sure the rules on the OpenVPN tab DO NOT match the incoming traffic. They must match on the assigned interface tab to get the benefit of pf's reply-to.

                Since your OpenVPN should probably be treated as a WAN, I would delete all of the rules on the OpenVPN tab and only add rules on the assigned interface tab that pass the proper mail ports to the proper server. Passing any there is bad news.

                Chattanooga, Tennessee, USA
                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                ? 1 Reply Last reply Reply Quote 0
                • ?
                  A Former User @Derelict
                  last edited by A Former User

                  @Derelict The Interface is assigned and also the Rules are in the Assigned Interface Tab and they work as long as i pull the vpn routes.

                  It seems to be and problem dedicated to the routes of my firewall.

                  Sadly i dont know further.

                  Maybe someone can look directly into it, if this isnt to timetaking.

                  1 Reply Last reply Reply Quote 0
                  • DerelictD
                    Derelict LAYER 8 Netgate
                    last edited by

                    Is it also matching on the OpenVPN tab? If it matches on the OpenVPN tab the assigned interface tab will never be looked at and you will not get reply-to.

                    Chattanooga, Tennessee, USA
                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                    1 Reply Last reply Reply Quote 0
                    • ?
                      A Former User
                      last edited by

                      On the OpenVPN Tab there are no rules only on the assigned interface tab.

                      1 Reply Last reply Reply Quote 0
                      • DerelictD
                        Derelict LAYER 8 Netgate
                        last edited by

                        Then it should be working. Packet capture and see what's going on. Look at states and see what's going on.

                        Chattanooga, Tennessee, USA
                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                        ? 2 Replies Last reply Reply Quote 0
                        • ?
                          A Former User @Derelict
                          last edited by

                          @Derelict
                          It seems they are talking when i try to send a mail.

                          Paket Capture:
                          00:41:11.073926 IP MAIL.localdomain.56830 > mx01.emig.gmx.net.smtp: tcp 0
                          00:41:11.074317 IP mx01.emig.gmx.net.smtp > MAIL.localdomain.56830: tcp 0
                          00:41:11.074527 IP MAIL.localdomain.34318 > mx00.emig.gmx.net.smtp: tcp 0
                          00:41:11.074865 IP mx00.emig.gmx.net.smtp > MAIL.localdomain.34318: tcp 0

                          States:
                          LAN tcp 192.168.1.105:56812 -> 212.227.17.5:25 TIME_WAIT:TIME_WAIT 1 / 1 60 B / 40 B
                          WAN tcp 192.168.188.22:8701 (192.168.1.105:56812) -> 212.227.17.5:25 TIME_WAIT:TIME_WAIT 1 / 1 60 B / 40 B

                          192.168.1.105 (Mail)
                          192.168.188.22 (Pfsense)

                          1 Reply Last reply Reply Quote 0
                          • ?
                            A Former User @Derelict
                            last edited by

                            @Derelict i tried to set my default gateway at the routing tab to my vpn gateway and then the traffic seems to get routed threw the OpenVPN Tunnel.
                            Dont know if that helps.

                            1 Reply Last reply Reply Quote 0
                            • DerelictD
                              Derelict LAYER 8 Netgate
                              last edited by

                              Are you talking about outbound connections or inbound? What, specifically is not working.

                              Chattanooga, Tennessee, USA
                              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                              Do Not Chat For Help! NO_WAN_EGRESS(TM)

                              ? 1 Reply Last reply Reply Quote 0
                              • ?
                                A Former User
                                last edited by

                                Outbound.

                                1 Reply Last reply Reply Quote 0
                                • ?
                                  A Former User @Derelict
                                  last edited by

                                  @Derelict I think i got it to work. After i set the default gateway manually to the VPN and not automatic and saw that it worked,
                                  i transfered the Flowing Rule i made for the outbound traffic to the Lan interface.
                                  With the new knowledge of your help and the help of viragomann i changed some tiny things in the firewall rule.
                                  After that i changed the default gateway back to automatic and know the outbound traffic takes the vpn and everything works.
                                  I even rebootet the firewall to get lost of the states but everything still functions as it seems.

                                  Thank you so very much for your dedication and your help.

                                  1 Reply Last reply Reply Quote 1
                                  • First post
                                    Last post
                                  Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.