OpenVPN Server to OpenVPN Client on same box

[DJBenson]

I am using both server and client versions of OpenVPN on my pfSense install; the OpenVPN server allows me to access my network whilst away from home, and the OpenVPN client(s) allow me to access geo-restricted sites from inside my network using firewall rules and aliases with the domain names of the sites I need to route and over which OpenVPN client to route them.

What I want to be able to do is access the same OpenVPN client rules when I'm coming externally into my network using the OpenVPN client on my iPhone to the server on pfSense but I seem to have a routing issue so any sites that are on my alias list result in blank screen (removing the site and re-testing allows me to connect, so something is amiss with routing the inbound OpenVPN traffic back out of the OpenVPN client associated to the site I wish to access).

Something like this;

iPhone -> INTERNET -> pfSense -> LAN -> OpenVPN Client -> INTERNET -> Target Site

My OpenVPN server is on the 10.0.3.0/24 network
My LAN is on the 192.168.1.0/24 network

OpenVPN Server -> LAN works fine (and back out over WAN), as does LAN -> OpenVPN clients, just not the bit in the middle.

[viragomann]

Assuming you have already added an interface to the openVPN server, copy the relevant firewall rules from LAN to the openVPN interface.
Also check if pfSense has added an outbound NAT rule for 10.0.3.0/24 to the openVPN clients interface you want to go out, when you're using automatic outbound NAT rule generation. If not add it manually.

[DJBenson]

Hi

When I set up the OpenVPN server, I configured 10.0.3.0/24 as the IPv4 tunnel address. In all the firewall screens, I have an interface called "OpenVPN" but I've not explicitly created an interface (from the interfaces menu) for the server.

There is a default rule on the OpenVPN interface which is to pass everything which was created by the OpenVPN wizard. I manually created an outbound NAT rule as per the following;

Interface Source         Source Port Destination Destination Port NAT Address         NAT Port Static Port Description Actions
OpenVPN 10.0.3.0/24 tcp/udp/*         *                 tcp/udp/*         OpenVPN address *

But it doesn't work.

EDIT:

[DJBenson]

It looks like the rules above are working but it's taking an unacceptable amount of time to hit the target website when compared to LAN->OpenVPN->NET (and is timing out more often than not). If I browse the same site from my laptop (which is going LAN->OpenVPN->NET->Target Site) the site appears almost immediately. Sites not on my alias load instantly over the OpenVPN server connection, as do LAN connections.

Something is wrong with that hop from OpenVPN server to client :(

EDIT: Sussed it out. The NAT rule needed to allow from "any" not just the OpenVPN network (10.0.3.0/24) - changing that has made the whole thing work as I expected it to.

[viragomann]

So add an interface for the openVPN server first. On the interface assignment tab select the openVPN server (ovpnsX) from the dropdown next "Available network ports" and hit Add. Then open the interface settings and enable and save it, no other settings needed.

@DJBenson:

Interface Source         Source Port Destination Destination Port NAT Address         NAT Port Static Port Description Actions
OpenVPN 10.0.3.0/24 tcp/udp/*         *                 tcp/udp/*         OpenVPN address *

You have to add this rule to the client interfaces (OVPNNL, OVPNUS). These are outbound NAT rule, they have to be assigned to the outbound interface. At Translation address select interface address.
This rule translates the source address of an outgoing packet to the interface address, that one of the VPN client.
You have to add such rule to each VPN client interface you want to go out.

[DJBenson]

OK so I've followed that;

Created an interface from the OpenVPN interface (OPT5) - enabled it and changed nothing else
Removed the NAT rules from the OpenVPN server interface (OPENVPN)
Added the NAT rules to the OpenVPN client interfaces (OVPNNL, OVPNUS), from 10.0.3.0/24 to the interface address

The page sits loading for a while and then times out.

[viragomann]

Off course you may change the name of the interface.

You have  also to add appropriate firewall rule to the new VPN servers interface. Maybe you just want an allow anything to any rule.