Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Openvpn TAP. Can Access everything but not pfsense GUI! (Solved)

    Scheduled Pinned Locked Moved OpenVPN
    17 Posts 3 Posters 1.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • G
      geek00990
      last edited by geek00990

      (Solved) Please note I switched to TUN as advised by experts in the forum

      I have a weird problem:

      I have setup openvpn in TAP mode (I can explain why I switched from tun to tap if need be)

      • Openvpn client connects successfully

      • I get IP from DHCP pool as defined in openvpn settings

      • Can access everything on LAN. 192.168.0.0/22

      • Can ping pfsense LAN IP Address

      • Cannot Access pfsense GUI via SSH or Web browser!

      • Gave allow all rules on ALL interfaces to rule out firewall blocking but to no success.

      Am I missing something?
      No obvious errors in openvpn logs

      C 1 Reply Last reply Reply Quote 0
      • C
        coffeecup25
        last edited by

        I have 3 OpenVPN servers configured on my router: Pass-through only, Routed, and Bridged. Bridged is TAP, the others TUN. All can be active simultaneously, if desired. Both Bridged and Routed can access the home network via Windows.

        I also noticed a long time ago that Bridged will not connect to the network via a browser very well. I dimly remember using remote desktop via Bridged to connect to a home PC and then using it to connect to the network. Remote desktop works fine using Bridged. Weird, I agree. Routed works perfectly well in the connection department so I use it more often.

        Pass-through is used for secure public wifi only and has no network access by design. It also uses a password file for easy login since it has no network access. (different passwords, of course plus user must match certificate name)

        1 Reply Last reply Reply Quote 0
        • G
          geek00990
          last edited by

          I fail to understand what any of what you said has relevance to the problem I mentioned above

          1 Reply Last reply Reply Quote 0
          • C
            coffeecup25 @geek00990
            last edited by

            Am I missing something?
            No obvious errors in openvpn logs

            1. Sorry for trying to help. I won't make that mistake again. Sometimes you have to think a little and not be gifted with something.
            2. Yes, you are missing something.
            3. Best wishes.
            4. I don't have your problems. OpenVPN works for me.
            5. Read my reply again. TAP might not work as you want.
            1 Reply Last reply Reply Quote 0
            • G
              geek00990
              last edited by

              My apologies. I genuinely did not understand your post. what I meant to say in the original post was is there somewhere you could point me?

              1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator
                last edited by johnpoz

                What network are you coming from when you attached to this TAP? /22 is pretty freaking large lan.. So you something close to 1k devices on this lan of yours? If your trying to connect from any network that overlaps that /22 your going to have issues.

                Could you access web gui when you were running tun?

                I would love to hear why you switch from tun to tap - because for the life of me I can not see a actual valid use case for it ;) Love to hear why you feel you need to use it vs just routing via a tun.

                If you can access the lan thre is nothing saying you could not access the web gui - you actually sure the IP your using to ping for your pfsense web gui is actually pfsense and not some other device?

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                1 Reply Last reply Reply Quote 0
                • G
                  geek00990
                  last edited by geek00990

                  Hello,

                  1. My local lan (laptop / pc) is 172.16.1.0/24
                  2. I was able to access the pfsense GUI when I was using TUN
                  3. I loved tun, didnt wanna switch, but here is why:

                  The main network is connected to several other networks via MPLS.
                  I wanted to be able to access those MPLS networks that are accessible from the LAN.
                  I simply push those remote MPLS networks in the openvpn advanced configuration and so I can access them through vpn.
                  With TUN, I would have had to add routes in those mpls routers (And tell the dumb ISPs to publish those routes)

                  I can access the LAN, all of the remote MPLS networks, but I just cannot access the pfsense GUI.

                  Edit: And yes sir, I am sure that the IP address is infact of pfsense GUI. It works when someone accesses it sitting physically inside the lan.

                  The weird part is I can even ping the pfsense IP!

                  You are correct when you say "If you can access the lan thre is nothing saying you could not access the web gui"

                  Hence I say "weird problem"

                  johnpozJ 1 Reply Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator @geek00990
                    last edited by

                    @namek said in Openvpn TAP. Can Access everything but not pfsense GUI!:

                    The main network is connected to several other networks via MPLS.
                    I wanted to be able to access those MPLS networks that are accessible from the LAN.

                    How is that exactly? Your saying there is some other router on this 192.168/22 lan that connects. Or there is a connection hanging off the pfsense that is connected via mpls..

                    Why would you need to run tap for this? If your upstream/downstream networks know how to get to 192.168/22 then just source NAT your vpn clients connecting into pfsense so they look like 192.168/22

                    There is no reason to try and bridge your vpn clients into this 192.168/22

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    1 Reply Last reply Reply Quote 0
                    • G
                      geek00990
                      last edited by

                      The other router is in the LAN (same as pfsense)

                      so its like this:

                      Internet -> Pfsense -> Switch -> MPLS router - Connects to many other networks.

                      When you say "source NAT your vpn clients connecting into pfsense "
                      Are you talking about using outbound nat?

                      1 Reply Last reply Reply Quote 0
                      • johnpozJ
                        johnpoz LAYER 8 Global Moderator
                        last edited by

                        That screams asymmetrical to me... So these lan devices on your 192.168/22 all hav routes pointing to this mpls gateway?

                        lets say there is some remote network 10.0.0/24 via the mpls... Your saying your client at 192.168.1.100 sends its traffic to pfsense at say 192.168.0.1 and pfsense sends it to the mpls router at 192.168.0.2 for example?

                        Or does the client on 192.168.1.100 have a route on it say hey to get to 10.0.0/24 talk to 192.168.0.2?

                        Yes it would be a simple outbound nat but vs doing it on your wan, you would do it on your pfsense interface connected to this 192.168/22 network.

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                        1 Reply Last reply Reply Quote 1
                        • G
                          geek00990
                          last edited by

                          The clients in the physical LAN have routes added in them locally to access the remote networks to prevent asymmetric routing.

                          So its like you said : "client on 192.168.1.100 have a route on it say hey to get to 10.0.0/24 talk to 192.168.0.2"

                          I will abandon this Bridge nonsense and go back to TUN, and try the outbound NAT that you suggested

                          1 Reply Last reply Reply Quote 0
                          • johnpozJ
                            johnpoz LAYER 8 Global Moderator
                            last edited by

                            Why don't you just connect the mpls to pfsense so you don't have to worry about host routing?

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                            1 Reply Last reply Reply Quote 0
                            • G
                              geek00990
                              last edited by

                              That is a very good question.
                              The network was always like that. I recently took over and replaced a fortinet gateway with pfsense.

                              If I want to connect the MPLS Router directly to pfsense, how might I go about that?
                              I get that I'll just add another interface, but what would be the subnet / IP for this interface (that connects directly to the MPLS router)

                              I also assume that I will still have to do the outbound NAT configuration even if the above is achieved.

                              1 Reply Last reply Reply Quote 0
                              • johnpozJ
                                johnpoz LAYER 8 Global Moderator
                                last edited by

                                Do you not have access or the ability to add routes to the mpls router? You would connect it to pfsense via a transit network.

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                SG-4860 24.11 | Lab VMs 2.8, 24.11

                                1 Reply Last reply Reply Quote 0
                                • G
                                  geek00990
                                  last edited by

                                  I do, However, adding the routes on my end is not enough. We have to go through a long procedure to notify the ISP.
                                  (I am guessing there are intermediate routers that they need to publish the routes to)

                                  But thanks a LOT for your help. I will get rid of TAP and go about the routing method.

                                  1 Reply Last reply Reply Quote 0
                                  • G
                                    geek00990
                                    last edited by

                                    Hello John,

                                    Your suggestion for using outbound NAT works!
                                    TUN works fine and I can access the MPLS networks without touching the MPLS router on any end!

                                    Thanks a LOT! Appreciate your help.
                                    P.S (how do I mark this thread as solved?)

                                    1 Reply Last reply Reply Quote 0
                                    • johnpozJ
                                      johnpoz LAYER 8 Global Moderator
                                      last edited by

                                      Just edit the subject of the thread and put in solved at the beginning {solved]

                                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                                      If you get confused: Listen to the Music Play
                                      Please don't Chat/PM me for help, unless mod related
                                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                                      1 Reply Last reply Reply Quote 0
                                      • First post
                                        Last post
                                      Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.