Routing problems between virtual subnet and remote client machine

  • Dear pfsense pros,

    I'm new both to PfSense and BSD, and I reached a point where I don't know how to continue by myself. I read lots of threads and followed several manuals, without success. I guess my problem could be very simple, but I can't find the solution by myself using just trial and error. Maybe anybody would agree to give me a hand?

    What I have

    • A Windows 10 PC with IP, firewall disabled
    • A Pfsense virtual appliance with IP "in the front", and "in the back"
    • virtual Network is, Pfsense gets, the PC gets
    • There are several physical and virtual interfaces in subnet
    • The OpenVPN connection from the PC to the pfSense virtual appliance works inside the OpenVPN virtual network, I can ping the pfSense on interface and even administer it via Web-GUI.
    • Packet filtering in Pfsense menu "firewall" is set to "no filtering" -> act as a router only

    What I want

    • reach all interfaces of from that single Windows PC


    • I cannot reach any interface in, not even the pfsense interface

    When I perform a traceroute on machine (random machine in Subnet behind pfSense) to (virtual OpenVPN interface of the Windows PC), pfsense routes traffic via its default gateway:

    Tracing route to over a maximum of 30 hops

    1 <1ms <1ms <1ms
    2 <1ms <1ms <1ms
    3 2ms 2ms 2ms
    4 ….. default route outside company network, to the internet

    When I perform a traceroute on machine (random machine in Subnet behind pfSense) to (physical interface of the Windows PC), the pfsense uses it's default gateway too.

    Tracing route to over a maximum of 30 hops

    1 <1ms <1ms <1ms
    2 <1ms <1ms <1ms
    3 2ms 2ms 2ms
    4 3ms 3ms 3ms

    When I perform a traceroute on Windows PC with interface and virtual interface to random machine in subnet, it routes traffic to the virtual interface of the pfsense, but not further

    Tracing route to over a maximum of 30 hops

    1 3ms 3ms 3ms
    2 *      *    *      Request timed out.
    3 *      *    *      Request timed out.

    So it seems the pfsense doesn't route between its subnet for which it is the default gateway and its openVPN virtual network. is default gateway for traffic leaving the PFSense. is the IP of an Interface on a Fortigate 200B Firewall Appliance. There is an IPSEC connection between both interfaces (Fortigate) and (PfSense), and routing is dynamic using OSPF with Quagga_OSPF talking to the Fortigate interface.
    The virtual PFSense has 1 base-interface "vmx0" with a VMWare ESXi-interface tagged "vlan 4095" for "all vlans"
    pfSense interface "LAN" is untagged on "vmx0", is tagged in vlan 500 on "vmx0".
    OpenVPN is in "tun - Layer 3 Tunnel Mode"

    Ipv4 Routes in PFsense:

    default        UGS 659 1500 vmx0.500
    . link#1                   U 14565 1500 vmx0         link#1                   UHS 0 16384 lo0           UGS 0 1500 ovpns1         link#23                   UHS 0 16384 lo0         link#23                   UH     254 1500 ovpns1 link#22                   U 29301 1500 vmx0.500         link#22                   UHS 0 16384 lo0

    PFsense Version is

    2.4.1-RELEASE (amd64)
    built on Sun Oct 22 17:26:33 CDT 2017
    FreeBSD 11.1-RELEASE-p2

    I assume I do something wrong with routing since nothing goes back through the VPN tunnel, but I don't know what I'm doing wrong. What should be my next step in the troubleshooting list, could an expert help me out?

  • Asked 2 specialists and still no solution. It seems the problem is not that trivial :-(

  • can OpenVPNServer and IPSEC be used on the same interface? That's what I'm trying to do on IF vmx0.500. I guess that could be the source of the problem

Log in to reply