<![CDATA[NAT Hairpinning for OpenVPN Server]]>I'm running a OpenVPN Server on the pfsense router. I can connect to it just fine from the Internet, but not from inside my network. I understand that NAT Hairpinning is probably the problem. Has anybody got this working? Any instructions on how to achieve it?

]]>https://forum.netgate.com/topic/136499/nat-hairpinning-for-openvpn-serverRSS for NodeWed, 13 May 2026 15:47:27 GMTMon, 08 Oct 2018 19:00:03 GMT60<![CDATA[Reply to NAT Hairpinning for OpenVPN Server on Tue, 09 Oct 2018 16:20:51 GMT]]>That should of been addressed by your client and your AP as well. For example unifi release firmware back in oct 2017 to address 3.9.3 anything above should be fine.

But sure being able to leave the vpn on makes it simple.

]]>https://forum.netgate.com/post/796037https://forum.netgate.com/post/796037Tue, 09 Oct 2018 16:20:51 GMT<![CDATA[Reply to NAT Hairpinning for OpenVPN Server on Tue, 09 Oct 2018 15:52:13 GMT]]>I went through my firewall rules, and everything looked good. Dug into the VPN logs, and I can see the client trying to connect. I figured it was erroring out from routing issues with NAT Hairpinning. Figured out that it's trying to use IPv6. I disabled all IPv6 related options, and now it connects fine.

Now the VPN connects from my phone, regardless of what network I'm connected to. Doesn't matter if it's LTE or WiFi, it seemlessly transitions between both. So now I don't have to constantly toggle the VPN on and off whenever I leave my house.

Any vulnerabilities in WPA2 are now mitigated via the VPN:

https://arstechnica.com/information-technology/2017/10/severe-flaw-in-wpa2-protocol-leaves-wi-fi-traffic-open-to-eavesdropping/

]]>https://forum.netgate.com/post/796023https://forum.netgate.com/post/796023Tue, 09 Oct 2018 15:52:13 GMT<![CDATA[Reply to NAT Hairpinning for OpenVPN Server on Mon, 08 Oct 2018 20:26:54 GMT]]>You having a problem resolving the dynamic dns your pointing to your public IP? What are the firewall rules on interface wifi is connected to?

My question is more to what is the point of doing this in the first place - is your own local wifi a hostile network? Who else is on this wifi network?

]]>https://forum.netgate.com/post/795847https://forum.netgate.com/post/795847Mon, 08 Oct 2018 20:26:54 GMT<![CDATA[Reply to NAT Hairpinning for OpenVPN Server on Mon, 08 Oct 2018 20:21:32 GMT]]>Look at the created states. Probably filtering on the OpenVPN port is a good place to start.

]]>https://forum.netgate.com/post/795846https://forum.netgate.com/post/795846Mon, 08 Oct 2018 20:21:32 GMT<![CDATA[Reply to NAT Hairpinning for OpenVPN Server on Mon, 08 Oct 2018 20:17:09 GMT]]>If you don't think it's a hairpinning issue, I'll check my firewall rules again.

Is there any way to watch the packet hit pfsense, and see where it's trying to route it?

]]>https://forum.netgate.com/post/795842https://forum.netgate.com/post/795842Mon, 08 Oct 2018 20:17:09 GMT<![CDATA[Reply to NAT Hairpinning for OpenVPN Server on Mon, 08 Oct 2018 20:13:48 GMT]]>You can for sure connect to your public IP from your lan side - that is not a hairpin your just coming from the lan side.. Are you forwarding traffic that hits your public IP on your vpn port to loopback or something?

Are you saying its not connecting? What are you rules on the interface your wifi connection?

]]>https://forum.netgate.com/post/795841https://forum.netgate.com/post/795841Mon, 08 Oct 2018 20:13:48 GMT<![CDATA[Reply to NAT Hairpinning for OpenVPN Server on Mon, 08 Oct 2018 20:08:55 GMT]]>VPN endpoint DNS entry is a public DNS name, pointing to the WAN IP of the router.

My traffic flow is:

WiFi VLAN -> WAN IP -> OpenVPN on PFSense

Near as I can tell all my firewall rules should allow this. I figure it's being blocked by NAT Hairpinning, as it's a common issue when you have a flow like this:

WiFi VLAN -> WAN IP -> LAN IP VPN Server

]]>https://forum.netgate.com/post/795838https://forum.netgate.com/post/795838Mon, 08 Oct 2018 20:08:55 GMT<![CDATA[Reply to NAT Hairpinning for OpenVPN Server on Mon, 08 Oct 2018 19:46:37 GMT]]>Sounds like he wants to connect and talk to the internet, but be protected while on his inside unsecured wifi.

Seems that should "just work" but I have never tried it. If the same hostname is used to connect to as is the name of the firewall there are probably hosts file entries pointing that name to an inside address. That won't work.

]]>https://forum.netgate.com/post/795832https://forum.netgate.com/post/795832Mon, 08 Oct 2018 19:46:37 GMT<![CDATA[Reply to NAT Hairpinning for OpenVPN Server on Mon, 08 Oct 2018 19:27:25 GMT]]>So on your on your local wifi network - and you want to vpn to your pfsense public IP vpn server, to talk to your local network?? Huh??

]]>https://forum.netgate.com/post/795829https://forum.netgate.com/post/795829Mon, 08 Oct 2018 19:27:25 GMT<![CDATA[Reply to NAT Hairpinning for OpenVPN Server on Mon, 08 Oct 2018 19:26:56 GMT]]>OK. Where does NAT come into play? Are you port forwarding your OpenVPN connections into WAN to somewhere else?

]]>https://forum.netgate.com/post/795828https://forum.netgate.com/post/795828Mon, 08 Oct 2018 19:26:56 GMT<![CDATA[Reply to NAT Hairpinning for OpenVPN Server on Mon, 08 Oct 2018 19:06:39 GMT]]>The OpenVPN network and the network of the VPN client are different networks.

I have my phone set to require to send all traffic over VPN. But on WiFi the connection fails to connect and thus no data is transferred. This also allows you to connect to an Open WiFi network, with VPN for encryption.

]]>https://forum.netgate.com/post/795821https://forum.netgate.com/post/795821Mon, 08 Oct 2018 19:06:39 GMT<![CDATA[Reply to NAT Hairpinning for OpenVPN Server on Mon, 08 Oct 2018 19:03:47 GMT]]>Why would you want to do that?

If you connect from the same network that is the Local network in OpenVPN that won't work.

]]>https://forum.netgate.com/post/795818https://forum.netgate.com/post/795818Mon, 08 Oct 2018 19:03:47 GMT