Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Is this possible? 1 Internet connection, 2 networks, 2 gateways (default and VPN)

    Scheduled Pinned Locked Moved General pfSense Questions
    25 Posts 4 Posters 2.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • JKnottJ
      JKnott
      last edited by

      You say 2 gateways. What are they connected to? If the ISP, you'll need one that provides 2 addresses (mine does). As for connecting from one LAN to the other, that should be doable, as it's just plain routing over the Internet. In fact, I do that here when I use the 2nd IP for testing. In this case the 2 gateways are no different than 2 customers.

      PfSense running on Qotom mini PC
      i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
      UniFi AC-Lite access point

      I haven't lost my mind. It's around here...somewhere...

      1 Reply Last reply Reply Quote 0
      • Bob.DigB
        Bob.Dig LAYER 8
        last edited by Bob.Dig

        To me it sounds rather simple with IPv4, it is just a normal setup with a VPN-Client on pfSense and some easy policy routing.

        Just "copy" the Default allow LAN to any rule to "SEC" if it not already exist there and then change the gateway under advanced to the VPN-Client, done.

        JKnottJ Bob.DigB 2 Replies Last reply Reply Quote 0
        • JKnottJ
          JKnott @Bob.Dig
          last edited by

          @Bob-Dig

          Then again, if he has 2 pfSense systems, then just run an Ethernet connection between the 2. If it's on it's own interface, then you can use the firewall rules to control what's allowed.

          A little more info on what he needs would be useful.

          PfSense running on Qotom mini PC
          i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
          UniFi AC-Lite access point

          I haven't lost my mind. It's around here...somewhere...

          Bob.DigB 2 Replies Last reply Reply Quote 0
          • Bob.DigB
            Bob.Dig LAYER 8 @JKnott
            last edited by

            This post is deleted!
            1 Reply Last reply Reply Quote 0
            • Bob.DigB
              Bob.Dig LAYER 8 @JKnott
              last edited by

              @JKnott said in Is this possible? 1 Internet connection, 2 networks, 2 gateways (default and VPN):

              @Bob-Dig

              Then again, if he has 2 pfSense systems,

              I don't think he has. He just has WAN and the "virtual" gateway which is the VPN-CLient.

              JKnottJ 1 Reply Last reply Reply Quote 0
              • JKnottJ
                JKnott @Bob.Dig
                last edited by

                @Bob-Dig

                I don't see he mentioned virtual machines. As I said, we need more info. Otherwise we're just guessing and my crystal ball is busted.

                PfSense running on Qotom mini PC
                i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                UniFi AC-Lite access point

                I haven't lost my mind. It's around here...somewhere...

                Bob.DigB 1 Reply Last reply Reply Quote 0
                • Bob.DigB
                  Bob.Dig LAYER 8 @JKnott
                  last edited by Bob.Dig

                  @JKnott said in Is this possible? 1 Internet connection, 2 networks, 2 gateways (default and VPN):

                  @Bob-Dig

                  I don't see he mentioned virtual machines.

                  I didn't. I bet he just meant Gateways in the Sense what is showing under: System Routing Gateways
                  One box, WAN and the VPN Client as the two gateways (exits).

                  JKnottJ 1 Reply Last reply Reply Quote 0
                  • JKnottJ
                    JKnott @Bob.Dig
                    last edited by

                    @Bob-Dig

                    I prefer not to assume. In that case, he'll need a virtual Ethernet cable. ๐Ÿ˜‰

                    PfSense running on Qotom mini PC
                    i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                    UniFi AC-Lite access point

                    I haven't lost my mind. It's around here...somewhere...

                    1 Reply Last reply Reply Quote 0
                    • R
                      rottonpeech
                      last edited by

                      Thank you all for your responses!

                      Let see if i can get to them all...

                      @JKnott , @Bob-Dig is correct. Only one Ethernet cable to the internet modem. The second "gateway" is a virtual gateway created by the VPNClient.

                      I have tried to setup firewall rules in the SEC interface with source SEC/any destination any/any use VPN gateway (GW2) but alas, this seems to fail the test when i connect to that network and tracert, I see my traffic goes over the default GW1 instead.

                      As for "machines" on that network, most are VMs and or Dockers. Only one physical device that I have connected becides the PFsense machine.

                      Long and short of it, I want my VMs and Dockers on the SEC network to route all traffic to the VPN tunnel. The main network uses manages inbound SSL traffic as well as other internal outbound traffic.

                      1 Reply Last reply Reply Quote 0
                      • Bob.DigB
                        Bob.Dig LAYER 8 @Bob.Dig
                        last edited by Bob.Dig

                        @Bob-Dig said in Is this possible? 1 Internet connection, 2 networks, 2 gateways (default and VPN):

                        Just "copy" the Default allow LAN to any rule to "SEC" if it not already exist there and then change the gateway under advanced to the VPN-Client, done.

                        This is everything you need to do, if the vpn-Client was setup correctly in the first place.

                        If it was not or is not connected, then traffic would go automatically out to WAN. For this to stop you have to tag that traffic and then block it with a special floating-rule.

                        R 1 Reply Last reply Reply Quote 0
                        • R
                          rottonpeech @Bob.Dig
                          last edited by

                          @Bob-Dig said in Is this possible? 1 Internet connection, 2 networks, 2 gateways (default and VPN):

                          If it was not or is not connected, then traffic would go automatically out to WAN. For this to stop you have to tag that traffic and then block it with a special floating-rule.

                          Sorry, if im kinda newbish, but how would i go about this?

                          Bob.DigB 1 Reply Last reply Reply Quote 0
                          • Bob.DigB
                            Bob.Dig LAYER 8 @rottonpeech
                            last edited by

                            @rottonpeech said in Is this possible? 1 Internet connection, 2 networks, 2 gateways (default and VPN):

                            Sorry, if im kinda newbish, but how would i go about this?

                            You won't. You would first setup a working VPN-Client.

                            1 Reply Last reply Reply Quote 0
                            • R
                              rottonpeech
                              last edited by

                              yes. i figured out what you meant, and i also found a few other things that did some magic (like not making a change, but re-saving and committing all my interfaces)

                              Now I see that all the interfaces are up, and the Client is up... but still cannot route across the VPN client.

                              Here is a pic if it helps at all
                              40a18c16-44ff-45e9-9161-f56e3f604297-image.png

                              P.S. i also have a open VPN site-to-site that is working, where i am hosting the server side. ![alt text](image url)

                              1 Reply Last reply Reply Quote 0
                              • Bob.DigB
                                Bob.Dig LAYER 8
                                last edited by Bob.Dig

                                Please show what you got under
                                FirewallNATOutbound

                                Maybe you should do a much simpler setup in the beginning for testing with WAN, LAN, VPN-Client only.

                                1 Reply Last reply Reply Quote 0
                                • R
                                  rottonpeech
                                  last edited by

                                  here are a few other screens
                                  f00fe276-47d6-40f4-8520-62c26b2434c8-image.png
                                  fc26c530-b5de-4047-a8b0-68da7cdcb6e8-image.png
                                  1844ae8f-e1d6-4c77-b197-a81ae2301bd3-image.png
                                  bb0fb70f-3592-4a71-a334-d31f3924ca9e-image.png

                                  Bob.DigB 1 Reply Last reply Reply Quote 0
                                  • Bob.DigB
                                    Bob.Dig LAYER 8 @rottonpeech
                                    last edited by Bob.Dig

                                    @rottonpeech Firewall NATO utbound still missing.

                                    R 1 Reply Last reply Reply Quote 0
                                    • R
                                      rottonpeech
                                      last edited by

                                      missed a few
                                      a83bbf32-b841-489c-b083-2425d0571ead-image.png
                                      8d0b1a49-7569-42f3-ba34-7eea0eddb85f-image.png
                                      0819e71f-eb4a-468e-bc76-17e680fad363-image.png
                                      751fb078-7122-4099-92e1-e4e6a3b8fa3e-image.png

                                      ok, i think thats about all of them

                                      1 Reply Last reply Reply Quote 0
                                      • R
                                        rottonpeech @Bob.Dig
                                        last edited by

                                        @Bob-Dig - Sorry, here it is

                                        a2b301e8-8c9d-4d6f-b75b-24b3a65a4716-image.png

                                        Bob.DigB 1 Reply Last reply Reply Quote 0
                                        • Bob.DigB
                                          Bob.Dig LAYER 8 @rottonpeech
                                          last edited by Bob.Dig

                                          @rottonpeech And there is your problem. Your VPN Client Setup isn't complete. It was never working in the beginning.

                                          R 1 Reply Last reply Reply Quote 0
                                          • R
                                            rottonpeech @Bob.Dig
                                            last edited by

                                            @Bob-Dig
                                            okay, im sorry.. what am i missing? its 4am here and i think my eyes are about to bleed from looking at this stuff so much today. :-\

                                            would you be so kind as to outline what im missing?

                                            /beg ๐Ÿบ ๐Ÿบ

                                            Bob.DigB 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.