How to configure openvpn pfsense with single nic, relay dhcp to vpn client… ?



  • Hi,
    How to configure openvpn pfsense with single nic, relay dhcp to vpn client and permit vpn client to access smb here from outside ?

    thx


  • LAYER 8 Global Moderator

    huh?  So your doing router on a stick with only 1 physical interface on pfsense.  And you want to run openvpn in tap so that some other dhcp server on your network hands it an IP?



  • Here a Draw :

    thx


  • LAYER 8 Global Moderator

    Wow that is bad design for sure..  So your pfsense is not even at the edge, its inside.. And you say its public, so is your smb server and dhcp also on this public segment?

    How does pfsense even get to the dhcp server or smb server in this setup when it only has a public IP..  Please post your IPs on this drawing?  So your firewall has a public segment routed behind it?  And what segment are the smb and dhcp on?

    Running vpn server inside a network normally leads to asymmetrical routing if you do not work around via a NAT or at best case you have a hairpin, etc.



  • And you say its public, so is your smb server and dhcp also on this public segment?

    All ip are potential public, i use CIDR, but router/firewall restrict incoming connection : internet can see pfsense ip with only vpn port open, but internet can't see or ping  dhcp or file server.


  • LAYER 8 Global Moderator

    So all 3 of your servers are on some public /?

    Why do you think you need the dhcp server to give this road warrior its IP address?  Your going to have an asymmetrical mess trying to run your 1 arm bandit vpn tunnel on the inside of the network your trying to access.

    Why do you not just run vpn server at your firewall in your picture?



  • So all 3 of your servers are on some public /?

    they are behind a firewall, so  not accessible on internet.
    dhcp provide on my lan (file server, vpn …)  routable ip adress 194.48.50 .../24, (that different of traditionnal "private use" 192.168... adress)

    PS: i can change my mind and put an another NIC , but it will be in same subnet.


Log in to reply