OpenVPN site to site for IP Phone

sse450

I have two sites with pfSense: Office and Home. At home, I have an IP phone which I want to register to the FreePBX server running at the office through VPN tunnel.

I have already installed a tunnel between office and home (Site-to-Site through OpenVPN). Here, office pfsense is acting as server, home pfsense is connecting as client.

From this point on, I am clueless. What outbound NAT and firewall rules do I need?

My plan is something like this:

Create VPN Interfaces at both office and home.
Outbound NAT for Office (destination FreePBX)
Firewall pass rule on LAN interface (Dest FreePBX, gateway VPN connection)
Outbound NAT for Home (source IP Phone)
Firewall pass rule on LAN interface (Source IP Phone, gateway VPN connection)

Is this approach correct? I would appreciate any hint.
Thank you.

JKnott

@sse450

Why do you need NAT for the phone, when you have a VPN between sites? It's just plain routing. NAT not needed.

marvosa

@sse450 said in OpenVPN site to site for IP Phone:

My plan is something like this:

Create VPN Interfaces at both office and home.
Outbound NAT for Office (destination FreePBX)
Firewall pass rule on LAN interface (Dest FreePBX, gateway VPN connection)
Outbound NAT for Home (source IP Phone)
Firewall pass rule on LAN interface (Source IP Phone, gateway VPN connection)

You typically don't need VPN interfaces unless you're policy routing or don't have control of the server-side and can't make changes.
If you have control of both sides, there's no need for a NAT's because proper routing already exists
There's no need for policy routing. A LAN net/any rule will allow the traffic
If you have control of both sides, there's no need for a NAT's because proper routing already exists
If you already have a LAN net/any rule, there's no need for an additional pass rule. If your rules are restrictive, then go ahead and add it, but you don't need to policy route here... you can, but it's not needed.

sse450

@marvosa said in OpenVPN site to site for IP Phone:

LAN net/any rule,

Thank you for your help. Obviously, I mixed up the concepts.

I have 2 more dumb questions, if you don't mind:

Is LAN net/any on Office pfSense (OpenVPN server) or on Home pfSense (OpenVPN client)?
What is LAN net/any? Can you please elaborate?

By the way, I have control of both sides.

I appreciate your support.

marvosa

@sse450 said in OpenVPN site to site for IP Phone:

@marvosa said in OpenVPN site to site for IP Phone:

LAN net/any rule,

Thank you for your help. Obviously, I mixed up the concepts.

I have 2 more dumb questions, if you don't mind:

Is LAN net/any on Office pfSense (OpenVPN server) or on Home pfSense (OpenVPN client)?

What is LAN net/any? Can you please elaborate?

By the way, I have control of both sides.

I appreciate your support.

Unless you have (or want) super restrictive outgoing firewall rules on the LAN interface, there should be a LAN net/any rule for the LAN interface on both ends by default.
A LAN net/any rule means all outgoing traffic is allowed. More specifically, it's a rule that allows traffic sourced from the LAN subnet and destined to any IP, any interface, any port using any protocol.

sse450

@marvosa said in OpenVPN site to site for IP Phone:

Unless you have (or want) super restrictive outgoing firewall rules on the LAN interface, there should be a LAN net/any rule for the LAN interface on both ends by default.

A LAN net/any rule means all outgoing traffic is allowed. More specifically, it's a rule that allows traffic sourced from the LAN subnet and destined to any IP, any interface, any port using any protocol.

Thank you very much for trying help me. I did what you asked but still no go. Probably, I am still doing something wrong. So, I would like to present my situation in a more detailed way.

This is schematic of my Office and Home network:
https://imgur.com/DMVPBxL

These are from office pfSense:
https://imgur.com/pXR7l7o
https://imgur.com/dIHoC0v

These are from home pfSense:
https://imgur.com/Wl0X39a
https://imgur.com/pGPpAc5

OpenVPN interfaces are from configuring through OpenVPN wizard.

Still, FreePBX on 10.10.1.20 is not registering the IP phone (192.168.2.51) at home.

Do you see anything wrong with this setup?