1:1 NAT with dynamic OpenVPN External subnet IP

  • I have an OpenVPN client on pfSense. I how do I keep a 1:1 NAT with a dynamic OpenVPN External subnet IP?

    For example lets say I have a VPN service for remote network testing purposes and I want to use the VPN service on one node of my network. My current setup requires me to change the External subnet IP on the 1:1 NAT web gui every time the IP changes of the service. How do I fix this?

  • LAYER 8 Netgate

    Sounds like you're going about it all wrong. 1:1 NAT (along with outbound NAT) make zero decisions about what traffic flows where. They only determine what NAT happens when matching traffic flows in or out (or just out in the case of outbound NAT) an interface.

    Search for the countless (and I mean countless) threads about policy routing out a VPN provider with Outbound NAT.

    You don't use 1:1 NAT. You use policy routing and outbound NAT on the assigned interface to the interface address. In your case you would limit the policy routing to a single test node's address.

  • @derelict
    How would I map one internal IP to one OpenVPN External subnet IP?

    I have the outbound in place and the firewall rules set for the internal interface to hit the OpenVPN interface, but how do I make it so that everything hitting the OpenVPN External subnet IP hits the specified internal IP?

  • LAYER 8 Netgate

    How many OpenVPN IP addresses do you have?

  • One

  • LAYER 8 Netgate

    And that is configured to accept inbound connections on any port? Note the difference between inbound connections and reply traffic for outbound connections.

  • Yes *

  • LAYER 8 Netgate

    As far as I know you cannot 1:1 NAT on a dynamic address.

    You might be able to get what you need by port forwarding entire swaths of ports on the interface address instead.

    0_1534917887524_Screen Shot 2018-08-21 at 11.04.09 PM.png

    I have not tested that. Not exactly sure if there are any adverse effects or gotchas.

  • I will try it again. I am fairly sure that is what I did at first without luck.

  • That works! I had tried it that way previously, a few years ago, without luck.
    It now seems to work.
    Thank you!