OVPN-Server in - OVPN-Client out?

[Bob.Dig]

Is it possible to have Clients (internal and external) connected to the OVPN-Server on pfSense and then have them routed to a configured OVPN-Client on pfSense as a internet gateway? Had no luck so far.

[johnpoz]

@Bob-Dig said in OVPN-Server in - OVPN-Client out?:

Is it possible to have Clients (internal

Curious why would you have local clients connect to vpn server on pfsense?

[Bob.Dig]

@johnpoz said in OVPN-Server in - OVPN-Client out?:

Curious why would you have local clients connect to vpn server on pfsense?

I have configured my android phone to be always connected to that vpn, so I don't have to change anything on that phone at any time. And also OpenVPN for Android act as an "app-Firewall" which I want to have working all the time. On a non rooted phone you can't have two apps, like a firewall and a vpn, at the same time.

[JKnott]

@Bob-Dig

I just tried with my notebook computer and I can connect the VPN while on my LAN. Also, when I ping the other end of the tunnel, the ping goes through it. However, anything for the local network or elsewhere will bypass the VPN, unless you force all traffic through the VPN.

Does the VPN work from elsewhere? Try connecting over the cell network, instead of WiFi to check.

[Bob.Dig]

@JKnott said in OVPN-Server in - OVPN-Client out?:

@Bob-Dig

I just tried with my notebook computer and I can connect the VPN while on my LAN. Also, when I ping the other end of the tunnel, the ping goes through it. However, anything for the local network or elsewhere will bypass the VPN, unless you force all traffic through the VPN.

Does the VPN work from elsewhere? Try connecting over the cell network, instead of WiFi to check.

I am not sure if I was clear enough what I want.
I have NordVPN as a client running on pfSense. Now I want my clients of my VPNServer on pfSense to go out through this NordVPN tunnel to the internet.

[JKnott]

@Bob-Dig

It shouldn't make any difference. If you can get as far as pfSense, it should keep on going through to NordVPN. You'll have to do some testing to see where what's failing.

[Bob.Dig]

@JKnott Ok, so I tell you what actually happens, if I go to a whatsmyip website with the browser on my phone, my WAN-IP is shown, which is not what I wanted. So how to solve that?
I use policy routing for that Nord-vpn, so only clients which I had defined in an alias do exit to the vpn tunnel and I don't want to change that.
I don't know much about networking (I am a noob) and so I don't know where to start. I am pretty sure, if I had configured pfSense to always exit to that VPN-Tunnel, I wouldn't have this "problem" in the first place.

[johnpoz]

Ok... Then do that.. Not sure why the question.. If you route all your traffic out your vpn, then all clients going through pfsense would use the vpn.. Be it local clients or vpn clients, be they from the public side or the local side..

You just need to make sure you have your outbound nat correct for your vpn tunnel, etc.. If this works how it should when your external.. Then it would/should work the exact same way when your internal..

Here I turned off my phone cellular (to make sure coming from lan side of pfsense, only connected to my wifi) - connected to my vpn instance that forces all traffic out my vpn.. Can see that my client is connected from my lan side..

Then on my phone checked what my IP was to the public internet - and its my vps IP that I have vpn client setup to for pfsense.. I routed my vpn users out this via policy route on the vpn interface rules..

If something is not working how you want, your going to have to show us what your doing or not doing in your setup... This took all of two seconds to change my config to do this.. I normally do not route traffic from vpn connections out my vpn.. I had to create an outbound nat to nat the vpn tunnel network.

[Bob.Dig]

@johnpoz said in OVPN-Server in - OVPN-Client out?:

Ok... Then do that.. Not sure why the question.. If you route all your traffic out your vpn, then all clients going through pfsense would use the vpn..

Sure but I don't want that... like I said before.

[johnpoz]

What do you want?? You stated you want your vpn clients to use your vpn... Then do that! What are you not understanding?

Policy route in your vpn interface!

[Bob.Dig]

@johnpoz said in OVPN-Server in - OVPN-Client out?:

What are you not understanding?

Sometimes, your reading comprehension.

[johnpoz]

What do you not get about policy routing?

Just like any other interface!

[Bob.Dig]

Never looked there. Had to create the outbound NAT, like you had said before and it works like a charm, thank you...

[Bob.Dig]

Now I have a new poblem. The email app on the phone can't connect to my local email server anymore. When I am switching the gateway in the OpenVPN tab back to WAN, it will work again, although the email-server is generally not reachable from the internet for clients. Any help would be appreciated.

[johnpoz]

Well you wouldn't of switched it to wan for the gateway, or that shouldn't of allowed access either. If you would of switched it back to not policy routing and just gateway as * should of worked..

Create a rule in your vpn tab that allows access to your local networks.. This is just basic policy routing..

[Bob.Dig]

@johnpoz said in OVPN-Server in - OVPN-Client out?:

policy routing

Thanks again, works!

[johnpoz]

@Bob-Dig said in OVPN-Server in - OVPN-Client out?:

works!

Well yeah, its simple policy routing.. Which why my confusion to your problem in the first place

I use policy routing for that Nord-vpn

When someone says they are doing something, my bad for thinking they understood what that meant and what they were doing.. So its not "reading comprehension" to why I was confused to what you wanted ;)

[Bob.Dig]

@johnpoz Sure. That rules-tab for OpenVPN is looking so different than the others. But it works like the others. I guess you don't have to assign the interface(s) and that's why it is looking different.
With no networking background like me it is only learning by doing, not by studying or understanding. ^^

[johnpoz]

@Bob-Dig said in OVPN-Server in - OVPN-Client out?:

only learning by doing, not by studying or understanding.

Ah the click random shit and hope it does what you want methodology of networking ;)