Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Is this possible? 1 Internet connection, 2 networks, 2 gateways (default and VPN)

    Scheduled Pinned Locked Moved General pfSense Questions
    25 Posts 4 Posters 2.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • R
      rottonpeech
      last edited by

      Thank you all for your responses!

      Let see if i can get to them all...

      @JKnott , @Bob-Dig is correct. Only one Ethernet cable to the internet modem. The second "gateway" is a virtual gateway created by the VPNClient.

      I have tried to setup firewall rules in the SEC interface with source SEC/any destination any/any use VPN gateway (GW2) but alas, this seems to fail the test when i connect to that network and tracert, I see my traffic goes over the default GW1 instead.

      As for "machines" on that network, most are VMs and or Dockers. Only one physical device that I have connected becides the PFsense machine.

      Long and short of it, I want my VMs and Dockers on the SEC network to route all traffic to the VPN tunnel. The main network uses manages inbound SSL traffic as well as other internal outbound traffic.

      1 Reply Last reply Reply Quote 0
      • Bob.DigB
        Bob.Dig LAYER 8 @Bob.Dig
        last edited by Bob.Dig

        @Bob-Dig said in Is this possible? 1 Internet connection, 2 networks, 2 gateways (default and VPN):

        Just "copy" the Default allow LAN to any rule to "SEC" if it not already exist there and then change the gateway under advanced to the VPN-Client, done.

        This is everything you need to do, if the vpn-Client was setup correctly in the first place.

        If it was not or is not connected, then traffic would go automatically out to WAN. For this to stop you have to tag that traffic and then block it with a special floating-rule.

        R 1 Reply Last reply Reply Quote 0
        • R
          rottonpeech @Bob.Dig
          last edited by

          @Bob-Dig said in Is this possible? 1 Internet connection, 2 networks, 2 gateways (default and VPN):

          If it was not or is not connected, then traffic would go automatically out to WAN. For this to stop you have to tag that traffic and then block it with a special floating-rule.

          Sorry, if im kinda newbish, but how would i go about this?

          Bob.DigB 1 Reply Last reply Reply Quote 0
          • Bob.DigB
            Bob.Dig LAYER 8 @rottonpeech
            last edited by

            @rottonpeech said in Is this possible? 1 Internet connection, 2 networks, 2 gateways (default and VPN):

            Sorry, if im kinda newbish, but how would i go about this?

            You won't. You would first setup a working VPN-Client.

            1 Reply Last reply Reply Quote 0
            • R
              rottonpeech
              last edited by

              yes. i figured out what you meant, and i also found a few other things that did some magic (like not making a change, but re-saving and committing all my interfaces)

              Now I see that all the interfaces are up, and the Client is up... but still cannot route across the VPN client.

              Here is a pic if it helps at all
              40a18c16-44ff-45e9-9161-f56e3f604297-image.png

              P.S. i also have a open VPN site-to-site that is working, where i am hosting the server side. ![alt text](image url)

              1 Reply Last reply Reply Quote 0
              • Bob.DigB
                Bob.Dig LAYER 8
                last edited by Bob.Dig

                Please show what you got under
                FirewallNATOutbound

                Maybe you should do a much simpler setup in the beginning for testing with WAN, LAN, VPN-Client only.

                1 Reply Last reply Reply Quote 0
                • R
                  rottonpeech
                  last edited by

                  here are a few other screens
                  f00fe276-47d6-40f4-8520-62c26b2434c8-image.png
                  fc26c530-b5de-4047-a8b0-68da7cdcb6e8-image.png
                  1844ae8f-e1d6-4c77-b197-a81ae2301bd3-image.png
                  bb0fb70f-3592-4a71-a334-d31f3924ca9e-image.png

                  Bob.DigB 1 Reply Last reply Reply Quote 0
                  • Bob.DigB
                    Bob.Dig LAYER 8 @rottonpeech
                    last edited by Bob.Dig

                    @rottonpeech Firewall NATO utbound still missing.

                    R 1 Reply Last reply Reply Quote 0
                    • R
                      rottonpeech
                      last edited by

                      missed a few
                      a83bbf32-b841-489c-b083-2425d0571ead-image.png
                      8d0b1a49-7569-42f3-ba34-7eea0eddb85f-image.png
                      0819e71f-eb4a-468e-bc76-17e680fad363-image.png
                      751fb078-7122-4099-92e1-e4e6a3b8fa3e-image.png

                      ok, i think thats about all of them

                      1 Reply Last reply Reply Quote 0
                      • R
                        rottonpeech @Bob.Dig
                        last edited by

                        @Bob-Dig - Sorry, here it is

                        a2b301e8-8c9d-4d6f-b75b-24b3a65a4716-image.png

                        Bob.DigB 1 Reply Last reply Reply Quote 0
                        • Bob.DigB
                          Bob.Dig LAYER 8 @rottonpeech
                          last edited by Bob.Dig

                          @rottonpeech And there is your problem. Your VPN Client Setup isn't complete. It was never working in the beginning.

                          R 1 Reply Last reply Reply Quote 0
                          • R
                            rottonpeech @Bob.Dig
                            last edited by

                            @Bob-Dig
                            okay, im sorry.. what am i missing? its 4am here and i think my eyes are about to bleed from looking at this stuff so much today. :-\

                            would you be so kind as to outline what im missing?

                            /beg 🍺 🍺

                            Bob.DigB 1 Reply Last reply Reply Quote 0
                            • Bob.DigB
                              Bob.Dig LAYER 8 @rottonpeech
                              last edited by Bob.Dig

                              @rottonpeech For every subnet you want to be able to use the VPN-client, you need something like this:
                              Capture.JPG

                              R 1 Reply Last reply Reply Quote 0
                              • R
                                rottonpeech @Bob.Dig
                                last edited by

                                @Bob-Dig Well, I'll be a monkeys uncle... or maybe the monkey... definately the goofball who screwed it up.. You are AWESOME!

                                thank you very much for that!

                                Bob.DigB 1 Reply Last reply Reply Quote 0
                                • Bob.DigB
                                  Bob.Dig LAYER 8 @rottonpeech
                                  last edited by Bob.Dig

                                  @rottonpeech And the wan rule there in your picture, I don't think it is needed, although I am not sure.
                                  Once your vpn client is working, it is easy like described in my first post.

                                  1 Reply Last reply Reply Quote 0
                                  • First post
                                    Last post
                                  Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.