Real IP-addresses behind OpenVPN - why do I not see them in my logs?
-
This setup again: Win 7 -> VPNClient: Asus 4G AC-55-U (4G) -> VPNServer: pfSense 2.3 (ADSL) -> Webserver
If I view my firewall logs on pfSense I see all access from my Win 7 as the tunnel network instead of the actual ip-address my win 7 has.
I also have a OpenVPN-tunnel from VPNServer:pfSense -> VPNClient:pfsense, and when accessing from the "server side" to the "client side", I can see the real "server side" ip-addresses in the "client side" logs.
Is there a rule of thumb or factual information on how ip-addresses are seen on each side of the tunnel? I do not see any settings for forcing NATting or not, and I have no other NAT-rules other than the ones automatically generated on pfsense for outbound traffic.
-
So you have a site to site vpn tunnel..
"VPNServer:pfSense -> VPNClient:pfsense"
And then you have devices network that are not on the tunnel. So yeah your webserver would see the IP of the client on the other side of the tunnel.. In the case of your win7 actually running a vpnclient. He gets an IP address inside the tunnel. So yeah webserver would only see that IP address in its logs.
In your pfs to pfs the tunnel is just a transit network.. Unless you did a traceroute no it wouldn't show up for devices just routing over the tunnel.. You could hide those if you want with a nat to the tunnel IP if that is what your looking to do?
-
Site2site tunnel, yes. No clients on my win7 in this case. The opvnopvclient is the Asus-box, the opvnserver is the pfsense and the webserver and the win7 are just devices on each of the networks behind the opvnclient and the opvnserver.
What I would like to see is my win7 ipaddress on the psense firewall logs (and on my webserver logs). Furthermore, I would like to be able to create all my firewall rules with src=win7 instead of src=tunneaddress.
-
If you see the VPN clients IP on server side, obviously the NAT occurs in the ASUS box, when packets leaving it to the virtual vpn interface.
-
OK, here's the config. There are really no settings for setting NAT's etc in the Asus-box though. Although pricey, in many categories it's plain and simple.
dev tun persist-tun persist-key proto udp cipher AES-128-CBC auth SHA256 resolv-retry infinite remote 217.30.666.666 1196 route 192.168.1.0 255.255.255.0 route 10.10.1.0 255.255.255.0 route 10.99.0.0 255.255.0.0 route 194.100.666.666 255.255.255.255 ifconfig 10.100.101.2 10.100.101.1 keepalive 10 60 ping-timer-rem comp-lzo verb 5 [code][/code] -
That is the OpenVPN config. NAT is no part of OpenVPN.
Some routers do source NAT on upstream interfaces which can not be switched off. In pfSense this is done by outbound NAT and it's not set by default.
-
OK, so no way to override any NAT rules using OpenVPN configurations. As I thought. I guess it is not worth looking into this any further, just to accept the facts.
-
"I would like to be able to create all my firewall rules with src=win7 instead of src=tunneaddress."
Then you need to this client to connect to a router that has tunnel, not as a direct vpn client.
-
"I would like to be able to create all my firewall rules with src=win7 instead of src=tunneaddress."
Then you need to this client to connect to a router that has tunnel, not as a direct vpn client.
My Win7-computer is connecting to a router (Asus) which has a site-2-site tunnel to my main site (pfSense). So, connecting to a router that creates the tunnel does not seem to be a solution.
-
What IP are you expecting to see??
Lets get some details here..
So your win7 box is on a network lets call it 192.168.0/24 and your tunnel network, lets call it 10.0.8/24, and your webserver is on say 192.168.1/24
What IP are you seeing where?? If your tunnel was setup correctly or how it would normally be done your webservers logs would see 192.168.0.x.. If your seeing a 10.0.8.x address then your natting to the tunnel IP..
So your saying on the win7pc side if you ping from say your server on 192.168.1.x win7 sees the 192.168.1 address.. But when you access something off your webserver its logs are showing the 10.0.8 address?
-
This is exactly correct. I am currently assuming this is built in NAT feature in the Asus client, a feature which I cannot control.
-
Well if its natting then its not really a site to site, but just a client connection.. Like when you setup pfsense to use a vpn service.. Pfsense nats all your clients on your network to your tunnel IP so the vpn service knows what connection the traffic is from, etc.
But a site to site connection is just a transit network, you would not need to nat this. Use something better on the client side that allows you to actually create a site to site and route, say pfsense ;) for example..
-
Yes, I find it wierd behavior. But the device is otherwise good - and this has to be a one device environment. Asus AC-55U. It's got proper syslogging, good wifi and good 4G with antenna support. Compared to others, this is enterprisey. And comes with a OpenVPN -client built in. The specs with just one device is pretty unbeatable.
I hate the NATtin though, and hope to find some obvious misconfiguration being the reason.
