Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    Selective NAT/Outbound to ISP or VPN Provider

    NAT
    3
    3
    109
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • R
      rsaanon last edited by

      ENV: pf 2.4.4, 3 LAN subnets, 1 WAN
      Goal: For one LAN subnet, outbound connectivity should go through the VPN Provider Interface (VPN). The other two LAN subnets need to have outbound connection through the WAN Interface.
      Problem: After configuring OpenVPN Client that connects to my VPN Provider, LAN segments that have an Outbound/NAT rule defined to go out the VPN interface is able to get Internet connectivity. The other two subnets have the NAT/Oubound rule to go through the WAN Interface do not have Internet connectivity.
      Troubleshooting: For testing purposes, I added Outbound/NAT rule for the second subnet to go through the VPN Interace instead of WAN. Upon doing so that subnet is able to connect to the Internet.
      Observation: Outbound traffic over the WAN interface doesn't get pass the pfSense/router

      NOTE:

      • I have NAT/Oubound set to 'Manual Outbound NAT rule generation - AON.
      • Two Outbound/NAT rules have been defined per interface to allow outbound via VPN:
        9cf7c61a-987a-43bb-91be-4167051b05e1-image.png
      1 Reply Last reply Reply Quote 0
      • KOM
        KOM last edited by

        First, don't obscure private IP addresses as it makes it harder to see what you're doing. You only really need to obscure public addresses.

        Second, you don't need that rule that NATs port 500 to your VPN so you can safely delete it.

        Third, what are your firewall rules for all these LANs? Screenshots please. You need rules to direct the traffic out the desired gateway.

        Lastly, do you have your WAN as the default gateway via Routing - Gateways?

        1 Reply Last reply Reply Quote 0
        • johnpoz
          johnpoz LAYER 8 Global Moderator last edited by johnpoz

          @rsaanon said in Selective NAT/Outbound to ISP or VPN Provider:

          For one LAN subnet, outbound connectivity should go through the VPN Provider Interface (VPN)

          Why would you not just policy route that? Don't pull routes, leave your rules on automatic, create a hybrid rule for the outbound nat for your vpn interface.

          And yeah as stated there just is no point to hide rfc1918 address space..

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 23.01 | Lab VMs CE 2.6, 2.7

          1 Reply Last reply Reply Quote 0
          • First post
            Last post