OpenVPN Server Setup, need internet access for clients (through VPN)

pfBasic

I currently have pfSense setup to route all network traffic through a client VPN configured in the pfSense box, it works great.

I also have an OpenVPN server configured on my pfSense box, with Server clients successfully able to connect and access the LAN. I just used the Wizard to do this and the exporter package to export, nothing fancy.

I need for my Server clients connecting to my pfSense OpenVPN server to be able to access the internet (not just the LAN) through my pfSense box's OpenVPN client. Basically I want a Server client connected to my OpenVPN server to behave as if it were connected to my wifi.

I'm pretty sure I can route the OpenVPN server traffic through my OpenVPN client interface with some firewall rules but don't know how to do this. (I haven't configured any rules other than the auto rules for this.)

Can you please tell me how to accomplish this?

johnpoz

well did you set your openvpn server to be default gateway for your remote users.. If so then yes they should route all their traffic through your pfsense, and then whatever pfsense uses for internet.

pfBasic

How do i do this? I dont see a setting for default gateway. Do i need to set the default gateway in a firewall or nat rule? Could you please give me an example?

viragomann

Check "Redirect gateway" in the OVPN server settings.

pfBasic

Redirect Gateway is already checked. My understanding of that option was that it will tell all of my ovpn servers clients to use the VPN connection for all traffic, and they are doing that, and the LAN connections work fine but when my remote clients try to access the Internet they can't get out.

So how can I get that Internet connection to work?

pfBasic

So I added some rules and got almost exactly what I was hoping for, I'm not sure if my ideal outcome is possible?

I added a pair of NAT outbound rules on my WAN and OpenVPN client interfaces: Source = My OpenVPN Servers Tunnel Network, Source Port, Destination & Destination Port All = ANY, NAT Address/Translation>Address = Interface Address (so for the WAN rule this = WAN ), Static Port = NO.

I left the OpenVPN Server firewall rule Gateway at Default, changing this to either my VPN Client or WAN Interface allowed internet access on the VPN but killed the LAN connection and exposed my IP address.

The end result is that if I disconnect my phone from wifi and connect to the VPN I can still access services that are LAN only (IP Cam, Media Center, etc. and LAN Scanner reveals my other LAN devices. I can browse the internet and if I check whatsmyip or dnsleakcheck they both check out for my VPN settings. So bottom line, when I VPN in to my network it is almost the same as using the internet from within my LAN, which is what I wanted.

The only thing missing is that my traffic is not filtered through squid or squidguard.
I have squid configured as a NON-transparent proxy and it works great on the actual LAN but nothing when connected via the VPN.

I'm not sure if it is possible to get this to work? Any guidance?

8ayM

How did you make out with this project?

I'm looking to do similar. I'm hoping to be able to use my OpenVPN as a sort of proxy as well to get around local filters and to ensure my traffic is being routed via a trusted connection.

pfBasic

It ended up working great. I've left it as is since the last post and use it occasionally and it always works as I want it to. Very handy!

stuck

@pfBasic:

It ended up working great. I've left it as is since the last post and use it occasionally and it always works as I want it to. Very handy!

@pfBasic
Would you be able to C/P or screenshot the 2 rules that you're referring to, which enabled you to access internet through the VPN server?
TIA

pfBasic

Sure, here are my NAT outbound rules pertaining to this. All is still working great as is.

Untitled.png_thumb

stuck

@pfBasic:

Sure, here are my NAT outbound rules pertaining to this. All is still working great as is.

Thank you for posting.
I'm still stuck. I have created 2 rules similar to your rules. But I'm still unable to connect the the internet through the tunnel.
I wonder if it is because I use a Torguard VPN on my pfsense?
These are my rules:
Oops, see the second one

NATout.jpg_thumb

stuck

Tried it like this… Still doesn't work

Untitled.png_thumb

stuck

I think my problem was these 2 check boxes. I unchecked it and now it seems to work…

Untitled.png_thumb

Derelict

You need outbound NAT rules that match whatever the tunnel network is on the VPN the clients connect to. No idea from the screen shots if that is the case. The comments there say "LAN"

https://doc.pfsense.org/index.php/Outbound_NAT

You can determine if you are having a DNS issue by pinging something by IP address.

https://doc.pfsense.org/index.php/Connectivity_Troubleshooting