Can not access Local network



  • Ok, so I am very new at this and have tried to follow the steps in getting this setup but I am failing somewhere. I have created the openvpn connection and have been able to get connected to the network. I have also been able to access the PF sense firewall page via the VPN connection but I can not connect to the camera system that resides on the same network.  I did a trace of traffic and I can see traffic flowing one way but not the other. I have also checked the Bypass firewall rules for traffic on the same interface. I have tried various firewall rules but can not seem to figure this out. Any suggestions or if you need more information please ask.

    16:20:41.495037 IP 10.10.8.2.35732 > 192.168.1.52.80: Flags , seq 3208726570, win 64240, options [mss 1289,nop,wscale 8,nop,nop,sackOK], length 0
    16:20:41.496151 IP 10.10.8.2.35733 > 192.168.1.52.80: Flags , seq 1541128180, win 64240, options [mss 1289,nop,wscale 8,nop,nop,sackOK], length 0
    16:20:41.745882 IP 10.10.8.2.35734 > 192.168.1.52.80: Flags , seq 2915606878, win 64240, options [mss 1289,nop,wscale 8,nop,nop,sackOK], length 0
    16:20:44.495061 IP 10.10.8.2.35733 > 192.168.1.52.80: Flags , seq 1541128180, win 64240, options [mss 1289,nop,wscale 8,nop,nop,sackOK], length 0
    16:20:44.496042 IP 10.10.8.2.35732 > 192.168.1.52.80: Flags , seq 3208726570, win 64240, options [mss 1289,nop,wscale 8,nop,nop,sackOK], length 0
    16:20:44.746778 IP 10.10.8.2.35734 > 192.168.1.52.80: Flags , seq 2915606878, win 64240, options [mss 1289,nop,wscale 8,nop,nop,sackOK], length 0



  • Is the pfSense internal interface IP set as default gateway on the camera?

    On which interface have you taken that capture?



  • I am not sure what you mean about the camera but locally we can access the camera's but can not access them via the VPN. The camera system does have the same gateway address as the pfsense firewall and not the 10.10.8.0/24 address range.

    That capture was taken on the Local interface or em1. The following capture is taken from ovpns1.

    [2.4.2-RELEASE][root@]/root: tcpdump -n -nn -i ovpns1 host 192.168.1.52
    tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
    listening on ovpns1, link-type NULL (BSD loopback), capture size 262144 bytes
    19:07:13.536621 IP 10.10.8.2.50353 > 192.168.1.52.80: Flags , seq 696807843, win 64240, options [mss 1289,nop,wscale 8,nop,nop,sackOK], length 0
    19:07:13.780103 IP 10.10.8.2.50354 > 192.168.1.52.80: Flags , seq 1411888200, win 64240, options [mss 1289,nop,wscale 8,nop,nop,sackOK], length 0
    19:07:16.538646 IP 10.10.8.2.50353 > 192.168.1.52.80: Flags , seq 696807843, win 64240, options [mss 1289,nop,wscale 8,nop,nop,sackOK], length 0
    19:07:16.788616 IP 10.10.8.2.50354 > 192.168.1.52.80: Flags , seq 1411888200, win 64240, options [mss 1289,nop,wscale 8,nop,nop,sackOK], length 0
    19:07:22.536466 IP 10.10.8.2.50353 > 192.168.1.52.80: Flags , seq 696807843, win 64240, options [mss 1289,nop,wscale 8,nop,nop,sackOK], length 0
    19:07:22.783167 IP 10.10.8.2.50354 > 192.168.1.52.80: Flags , seq 1411888200, win 64240, options [mss 1289,nop,wscale 8,nop,nop,sackOK], length 0



  • The VPN is another netword segment than the LAN. To send packets to devices in another network segment you need a gateway. In your case this must be the internal IP of pfSense.
    If the camera doesn't provide a gateway option or the gateway should not be the pfSense IP, you have to do NAT.



  • The IP range of pfsense and the camera's are all on the same 192.168.1.0/24 subnet. I am assuming that I will need to NAT traffic from 192.168.1.0/24 to 10.10.8.0/24 ? Sorry but I am new to this and I somewhat understand what I need to do but I am not familar what needs to be done in PFSense. Is there a guide or can you walk me through what I need to do?



  • Maybe I have something else wrong. It just feels like what I have been reading that I should be able to access local resources when connecting to the VPN without doing any NAT. I added 192.168.1.0/24 under the IPv4 Local network(s) but I just can not get it working.



  • Is the pfSense internal network interface IP set as gateway on the camera??
    I'd to ask you this question three times now - still not knowing what's the thing.



  • The camera ip address is 192.168.1.52 and the gateway for the camera is set to 192.168.1.150 (Which is the pfsense box).



  • So you should be able to access it from the VPN client.

    Was it set this way already as you've taken the capture you posted above?
    If the camera has a gateway option and it is set to pfSense you should also see responses there.


  • Rebel Alliance Global Moderator

    If the camera has a gateway that points back to pfsense, then yes you could be able to access it.  From your sniff pfsense is sending the traffic. Does the camera have a firewall or block access from networks not local?

    Pfsense can ping the camera IP?



  • Ok, so I was doing some more tracing and I was checking the config files when I found that someone changed the gateway on the camera system to 192.168.1.1 as soon as I changed it back to 192.168.1.150 everything started working again. Sorry for the problems but all is solved and working. Thanks very much for the help! It is much appreciated.