Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    Server listening on different interfaces

    OpenVPN
    2
    7
    196
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • B
      bozo.bogd last edited by

      Hello,

      I am new here, maybe you boiz already had this answered but i didn't managed to find it.

      Long story short :
      2.4.3-RELEASE-p1 (amd64)

      • Server is configured under wan interface
      • wan interface has private ip to which public ip is routed, so firewall has virual ip configured (public).
      • in order this to work i have port forward and corresponding rule (wan) : source any => destination public port udp 1195 to wan interface private

      Vpn connection works like this.

      However now i have request to enable vpn connection which comes to internal (trusted) interface. Don't ask why. it's long story.

      I tried with same port forward but now configured under internal interface, that didn't work. I can see traffic coming but vpn server doesn't respond. Or at least it's not responding trough internal interface.
      Internal interface has rule allow everything.

      I dont want to configure another vpn server tied to internal interface because than client would need two config files if they work from home or at the office in dmz lan (this dmz is behind cisco router and acl's)

      Thank you in advance.

      Regards

      1 Reply Last reply Reply Quote 0
      • johnpoz
        johnpoz LAYER 8 Global Moderator last edited by

        So you port forward to pfsense wan IP 1195..

        Why would you think you need another vpn instance to get anywhere from this vpn connection?

        I would suggest you draw up your network and where your vpn clients need to connect too.

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 23.01 | Lab VMs CE 2.6, 2.7

        B 1 Reply Last reply Reply Quote 0
        • B
          bozo.bogd last edited by

          This post is deleted!
          1 Reply Last reply Reply Quote 0
          • B
            bozo.bogd @johnpoz last edited by

            @johnpoz

            They need vpn connection to jump between vlan's

            Diagram would be looking something like this

            Pfsense firewall (at DataCenter)
            Cisco router (on-site using DMVPN to connect to DC)
            Cisco switch (on-site)

            Customer on-site has couple of corp vlans and DMZ for some testing purpose. DMZ is configured on router where access to rfc1819 is blocked, only internet access.
            Now they want to use vpn from DMZ if is sometimes they need resources in corp vlans.

            I can't get this vpn connection to work if it comes from DMZ, as i said from Internet it works, from internal i can see openvpn traffic coming but no connection established, or any packet replay.

            1 Reply Last reply Reply Quote 0
            • johnpoz
              johnpoz LAYER 8 Global Moderator last edited by

              How is that a diagram?

              Break out crayons and a napkin if you need to - and label the different networks.. With actual network address space as well ie 192.168.0/24, 172.16, 10/? etc. etc..

              Pfsense firewall (at DataCenter)
              Cisco router (on-site using DMVPN to connect to DC)
              Cisco switch (on-site)
              

              How as that a Diagram???

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 23.01 | Lab VMs CE 2.6, 2.7

              1 Reply Last reply Reply Quote 0
              • B
                bozo.bogd last edited by

                @johnpoz
                Ahhh, i am not able to draw now.

                I can type and send few screenshots

                interfaces
                0_1543588518104_interfaces.png

                virtual ip's
                0_1543588545558_virtual ip.png

                port forward for openvpn

                0_1543588569226_port forward.png

                rule to allow vpn traffic

                0_1543588605297_wan rule.png

                and finaly openvpn server
                0_1543588633000_vpn-server.png

                All this is fine if traffic is coming from Internet to public 141.....
                But when traffic is coming from internal_vlan1001688 it doesnt work

                Subnets coming to this internal interface
                192.168.11.0/24
                192.168.14.0/24
                192.168.111.0/24

                (192.168.11/14.0 are pushed trough vpn)

                192.168.111.0/24 is considered as DMZ and it's blocked to jump to other 2.
                That block is done on a router which comes before pfsense. Now i want to be able to turn on existing vpn and than users should be able to jump to other two vlans.

                Thanks

                1 Reply Last reply Reply Quote 0
                • johnpoz
                  johnpoz LAYER 8 Global Moderator last edited by

                  So your running HA pair setup... Kind of should of mentioned this out of the gate ;)

                  Why would you be running public IP vip on a rfc1918 network and then forwarding to it?

                  If you have traffic hitting interface X, and you wan it to be able to get to the IP and port your vpn instance is listing on - then just put a rule on that specific interface X to allow allow it.

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 23.01 | Lab VMs CE 2.6, 2.7

                  1 Reply Last reply Reply Quote 0
                  • First post
                    Last post