Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    OVPN-Server in - OVPN-Client out?

    Scheduled Pinned Locked Moved OpenVPN
    19 Posts 3 Posters 1.3k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • Bob.DigB
      Bob.Dig LAYER 8
      last edited by Bob.Dig

      Is it possible to have Clients (internal and external) connected to the OVPN-Server on pfSense and then have them routed to a configured OVPN-Client on pfSense as a internet gateway? Had no luck so far.

      JKnottJ 1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator
        last edited by

        @Bob-Dig said in OVPN-Server in - OVPN-Client out?:

        Is it possible to have Clients (internal

        Curious why would you have local clients connect to vpn server on pfsense?

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        Bob.DigB 1 Reply Last reply Reply Quote 0
        • Bob.DigB
          Bob.Dig LAYER 8 @johnpoz
          last edited by Bob.Dig

          @johnpoz said in OVPN-Server in - OVPN-Client out?:

          Curious why would you have local clients connect to vpn server on pfsense?

          I have configured my android phone to be always connected to that vpn, so I don't have to change anything on that phone at any time. And also OpenVPN for Android act as an "app-Firewall" which I want to have working all the time. On a non rooted phone you can't have two apps, like a firewall and a vpn, at the same time.

          1 Reply Last reply Reply Quote 0
          • JKnottJ
            JKnott @Bob.Dig
            last edited by JKnott

            @Bob-Dig

            I just tried with my notebook computer and I can connect the VPN while on my LAN. Also, when I ping the other end of the tunnel, the ping goes through it. However, anything for the local network or elsewhere will bypass the VPN, unless you force all traffic through the VPN.

            Does the VPN work from elsewhere? Try connecting over the cell network, instead of WiFi to check.

            PfSense running on Qotom mini PC
            i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
            UniFi AC-Lite access point

            I haven't lost my mind. It's around here...somewhere...

            Bob.DigB 1 Reply Last reply Reply Quote 0
            • Bob.DigB
              Bob.Dig LAYER 8 @JKnott
              last edited by Bob.Dig

              @JKnott said in OVPN-Server in - OVPN-Client out?:

              @Bob-Dig

              I just tried with my notebook computer and I can connect the VPN while on my LAN. Also, when I ping the other end of the tunnel, the ping goes through it. However, anything for the local network or elsewhere will bypass the VPN, unless you force all traffic through the VPN.

              Does the VPN work from elsewhere? Try connecting over the cell network, instead of WiFi to check.

              I am not sure if I was clear enough what I want.
              I have NordVPN as a client running on pfSense. Now I want my clients of my VPNServer on pfSense to go out through this NordVPN tunnel to the internet.

              JKnottJ 1 Reply Last reply Reply Quote 0
              • JKnottJ
                JKnott @Bob.Dig
                last edited by

                @Bob-Dig

                It shouldn't make any difference. If you can get as far as pfSense, it should keep on going through to NordVPN. You'll have to do some testing to see where what's failing.

                PfSense running on Qotom mini PC
                i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                UniFi AC-Lite access point

                I haven't lost my mind. It's around here...somewhere...

                Bob.DigB 1 Reply Last reply Reply Quote 0
                • Bob.DigB
                  Bob.Dig LAYER 8 @JKnott
                  last edited by Bob.Dig

                  @JKnott Ok, so I tell you what actually happens, if I go to a whatsmyip website with the browser on my phone, my WAN-IP is shown, which is not what I wanted. So how to solve that?
                  I use policy routing for that Nord-vpn, so only clients which I had defined in an alias do exit to the vpn tunnel and I don't want to change that.
                  I don't know much about networking (I am a noob) and so I don't know where to start. I am pretty sure, if I had configured pfSense to always exit to that VPN-Tunnel, I wouldn't have this "problem" in the first place.

                  1 Reply Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator
                    last edited by johnpoz

                    Ok... Then do that.. Not sure why the question.. If you route all your traffic out your vpn, then all clients going through pfsense would use the vpn.. Be it local clients or vpn clients, be they from the public side or the local side..

                    You just need to make sure you have your outbound nat correct for your vpn tunnel, etc.. If this works how it should when your external.. Then it would/should work the exact same way when your internal..

                    Here I turned off my phone cellular (to make sure coming from lan side of pfsense, only connected to my wifi) - connected to my vpn instance that forces all traffic out my vpn.. Can see that my client is connected from my lan side..

                    connected.jpg

                    Then on my phone checked what my IP was to the public internet - and its my vps IP that I have vpn client setup to for pfsense.. I routed my vpn users out this via policy route on the vpn interface rules..

                    whatsmyip.png

                    If something is not working how you want, your going to have to show us what your doing or not doing in your setup... This took all of two seconds to change my config to do this.. I normally do not route traffic from vpn connections out my vpn.. I had to create an outbound nat to nat the vpn tunnel network.

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    Bob.DigB 1 Reply Last reply Reply Quote 1
                    • Bob.DigB
                      Bob.Dig LAYER 8 @johnpoz
                      last edited by Bob.Dig

                      @johnpoz said in OVPN-Server in - OVPN-Client out?:

                      Ok... Then do that.. Not sure why the question.. If you route all your traffic out your vpn, then all clients going through pfsense would use the vpn..

                      Sure but I don't want that... like I said before.

                      1 Reply Last reply Reply Quote 0
                      • johnpozJ
                        johnpoz LAYER 8 Global Moderator
                        last edited by johnpoz

                        What do you want?? You stated you want your vpn clients to use your vpn... Then do that! What are you not understanding?

                        Policy route in your vpn interface!

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                        Bob.DigB 1 Reply Last reply Reply Quote 0
                        • Bob.DigB
                          Bob.Dig LAYER 8 @johnpoz
                          last edited by Bob.Dig

                          @johnpoz said in OVPN-Server in - OVPN-Client out?:

                          What are you not understanding?

                          Sometimes, your reading comprehension.

                          1 Reply Last reply Reply Quote 0
                          • johnpozJ
                            johnpoz LAYER 8 Global Moderator
                            last edited by johnpoz

                            vpnpolicyroute.jpg

                            What do you not get about policy routing?

                            Just like any other interface!

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                            Bob.DigB 1 Reply Last reply Reply Quote 1
                            • Bob.DigB
                              Bob.Dig LAYER 8 @johnpoz
                              last edited by

                              Never looked there. Had to create the outbound NAT, like you had said before and it works like a charm, thank you...

                              1 Reply Last reply Reply Quote 0
                              • Bob.DigB
                                Bob.Dig LAYER 8
                                last edited by Bob.Dig

                                Now I have a new poblem. The email app on the phone can't connect to my local email server anymore. When I am switching the gateway in the OpenVPN tab back to WAN, it will work again, although the email-server is generally not reachable from the internet for clients. Any help would be appreciated.

                                1 Reply Last reply Reply Quote 0
                                • johnpozJ
                                  johnpoz LAYER 8 Global Moderator
                                  last edited by johnpoz

                                  Well you wouldn't of switched it to wan for the gateway, or that shouldn't of allowed access either. If you would of switched it back to not policy routing and just gateway as * should of worked..

                                  Create a rule in your vpn tab that allows access to your local networks.. This is just basic policy routing..

                                  pinginglocal.jpg

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                                  Bob.DigB 1 Reply Last reply Reply Quote 1
                                  • Bob.DigB
                                    Bob.Dig LAYER 8 @johnpoz
                                    last edited by

                                    @johnpoz said in OVPN-Server in - OVPN-Client out?:

                                    policy routing

                                    Thanks again, works!

                                    1 Reply Last reply Reply Quote 0
                                    • johnpozJ
                                      johnpoz LAYER 8 Global Moderator
                                      last edited by

                                      @Bob-Dig said in OVPN-Server in - OVPN-Client out?:

                                      works!

                                      Well yeah, its simple policy routing.. Which why my confusion to your problem in the first place

                                      I use policy routing for that Nord-vpn

                                      When someone says they are doing something, my bad for thinking they understood what that meant and what they were doing.. So its not "reading comprehension" to why I was confused to what you wanted ;)

                                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                                      If you get confused: Listen to the Music Play
                                      Please don't Chat/PM me for help, unless mod related
                                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                                      Bob.DigB 1 Reply Last reply Reply Quote 1
                                      • Bob.DigB
                                        Bob.Dig LAYER 8 @johnpoz
                                        last edited by Bob.Dig

                                        @johnpoz Sure. That rules-tab for OpenVPN is looking so different than the others. But it works like the others. I guess you don't have to assign the interface(s) and that's why it is looking different.
                                        With no networking background like me it is only learning by doing, not by studying or understanding. ^^

                                        1 Reply Last reply Reply Quote 0
                                        • johnpozJ
                                          johnpoz LAYER 8 Global Moderator
                                          last edited by

                                          @Bob-Dig said in OVPN-Server in - OVPN-Client out?:

                                          only learning by doing, not by studying or understanding.

                                          Ah the click random shit and hope it does what you want methodology of networking ;)

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                                          1 Reply Last reply Reply Quote 0
                                          • First post
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.