• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

offloading OpenVPN using external gateway

Scheduled Pinned Locked Moved Routing and Multi WAN
70 Posts 2 Posters 14.0k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • C
    chrispazz @bingo600
    last edited by Jan 4, 2021, 3:11 PM

    @bingo600 Currently I am using a "per IP" policy so only specific clients and specific traffic is going thru VPN.
    I am using only firewall rules by indicating specific outgoing gateway (WAN or VPN).

    B 1 Reply Last reply Jan 4, 2021, 3:25 PM Reply Quote 0
    • B
      bingo600 @chrispazz
      last edited by bingo600 Jan 4, 2021, 3:26 PM Jan 4, 2021, 3:25 PM

      @chrispazz said in offloading OpenVPN using external gateway:

      @bingo600 Currently I am using a "per IP" policy so only specific clients and specific traffic is going thru VPN.
      I am using only firewall rules by indicating specific outgoing gateway (WAN or VPN).

      Then i suppose you have to make policy routing.

      Make an IP host alias Ie. OVPN_FORWARDS , and put your IP's in that one.

      Then make a policy route rule , AF IPv4 , Proto any , matching Source IP = OVPN_FORWARDS , dest any.

      Click advanced options
      6a23b88e-97f1-4fba-9c76-0d4315c68a47-image.png

      Set the Raspi Gateway as Gateway
      13adb891-1911-44ab-baac-403118ba3d55-image.png

      Pray that you have enabled forwarding in Raspbian Linux 😊

      Remember that pfSense matches on inbound traffic , meaning the rule has to be applied on all interfaces where matching ip's could "enter" (Ingress traffic).

      /Bingo

      If you find my answer useful - Please give the post a 👍 - "thumbs up"

      pfSense+ 23.05.1 (ZFS)

      QOTOM-Q355G4 Quad Lan.
      CPU  : Core i5 5250U, Ram : 8GB Kingston DDR3LV 1600
      LAN  : 4 x Intel 211, Disk  : 240G SAMSUNG MZ7L3240HCHQ SSD

      C 1 Reply Last reply Jan 4, 2021, 3:27 PM Reply Quote 0
      • C
        chrispazz @bingo600
        last edited by chrispazz Jan 4, 2021, 3:29 PM Jan 4, 2021, 3:27 PM

        @bingo600 here we are! this is exactly what I did before writing here! ahahahah
        Yes I enabled forwarding in Raspbian but I cannot understand why it is going outside without using VPN 😕

        I am sure it is using the new rule because of some tests I did....

        I am starting to suppose that the problem could be on the RPI side....strange since it is working from SSH....

        B 1 Reply Last reply Jan 4, 2021, 3:30 PM Reply Quote 0
        • B
          bingo600 @chrispazz
          last edited by Jan 4, 2021, 3:30 PM

          @chrispazz said in offloading OpenVPN using external gateway:

          Yes I enabled forwarding in Raspbian but I cannot understand why it is going outside without using VPN 😕

          Does the package reach the RasPI (using the gateway you set) ?
          Or does the pfSense never send it to the Raspi ?

          If you find my answer useful - Please give the post a 👍 - "thumbs up"

          pfSense+ 23.05.1 (ZFS)

          QOTOM-Q355G4 Quad Lan.
          CPU  : Core i5 5250U, Ram : 8GB Kingston DDR3LV 1600
          LAN  : 4 x Intel 211, Disk  : 240G SAMSUNG MZ7L3240HCHQ SSD

          C 1 Reply Last reply Jan 4, 2021, 3:32 PM Reply Quote 0
          • C
            chrispazz @bingo600
            last edited by chrispazz Jan 4, 2021, 3:38 PM Jan 4, 2021, 3:32 PM

            @bingo600 I do not know how to check this on the RPI side.... 😐

            I followed this guide:

            https://www.instructables.com/Raspberry-Pi-VPN-Gateway/

            B 1 Reply Last reply Jan 4, 2021, 3:41 PM Reply Quote 0
            • B
              bingo600 @chrispazz
              last edited by Jan 4, 2021, 3:41 PM

              @chrispazz said in offloading OpenVPN using external gateway:

              @bingo600 I do not know how to check this on the RPI side.... 😐

              Quick hack
              Enable temporary logging on the Policy Rule , look for log entries to confirm your rule matches "interesting traffic".

              Real Packet capture (on pfSense).
              Diagnostic --> Packet Capture

              I suppose your pfSense Wan Interface is the one connecting to the "ISP Router LAN" ?

              Packet Capture on pfSense
              If you have a screen + kbd on the RasPi , you could install wireshark on that one , to do the packet capture.

              If only SSH , install tcpdump on the RasPI

              How about NAT ?
              Are you natting on your pfSense WAN IF ?

              /Bingo

              If you find my answer useful - Please give the post a 👍 - "thumbs up"

              pfSense+ 23.05.1 (ZFS)

              QOTOM-Q355G4 Quad Lan.
              CPU  : Core i5 5250U, Ram : 8GB Kingston DDR3LV 1600
              LAN  : 4 x Intel 211, Disk  : 240G SAMSUNG MZ7L3240HCHQ SSD

              1 Reply Last reply Reply Quote 0
              • B
                bingo600
                last edited by bingo600 Jan 4, 2021, 3:51 PM Jan 4, 2021, 3:48 PM

                You say your pfSense is 192.168.99.1 , but the drawing shows 99.250

                Is the 99.1 interface a pfSense "inside Lan" ip ?

                How does the 192.168.99.x interface relate on the drawing ?

                I expect your pfSense to have a WAN ip on the ISP router LAN , meaning the 192.168.5.x range.

                Since you say you can ping and prob SSH to the Raspi , i assume that is correct or ??

                If you find my answer useful - Please give the post a 👍 - "thumbs up"

                pfSense+ 23.05.1 (ZFS)

                QOTOM-Q355G4 Quad Lan.
                CPU  : Core i5 5250U, Ram : 8GB Kingston DDR3LV 1600
                LAN  : 4 x Intel 211, Disk  : 240G SAMSUNG MZ7L3240HCHQ SSD

                C 1 Reply Last reply Jan 4, 2021, 3:51 PM Reply Quote 0
                • C
                  chrispazz @bingo600
                  last edited by Jan 4, 2021, 3:51 PM

                  @bingo600 NAS is 99.250.
                  Inside NAS (Synology) I run a VM with pfsense (99.1).

                  I tried enabling logging on the rule and I can confirm it is using it.
                  Yes, my pfsense WAN interface is the one connecting to the ISP router.
                  And yes, I am using NAT on the pfsense WAN if....

                  B 2 Replies Last reply Jan 4, 2021, 3:52 PM Reply Quote 0
                  • B
                    bingo600 @chrispazz
                    last edited by Jan 4, 2021, 3:52 PM

                    @chrispazz

                    Just for completeness
                    What is your pfSense WAN IP ?

                    If you find my answer useful - Please give the post a 👍 - "thumbs up"

                    pfSense+ 23.05.1 (ZFS)

                    QOTOM-Q355G4 Quad Lan.
                    CPU  : Core i5 5250U, Ram : 8GB Kingston DDR3LV 1600
                    LAN  : 4 x Intel 211, Disk  : 240G SAMSUNG MZ7L3240HCHQ SSD

                    C 1 Reply Last reply Jan 4, 2021, 3:53 PM Reply Quote 0
                    • C
                      chrispazz @bingo600
                      last edited by Jan 4, 2021, 3:53 PM

                      @bingo600 it is 192.168.5.254

                      B 1 Reply Last reply Jan 4, 2021, 3:55 PM Reply Quote 0
                      • B
                        bingo600 @chrispazz
                        last edited by Jan 4, 2021, 3:55 PM

                        @chrispazz

                        ??

                        Then what is your ISP router inside ip ?

                        If you find my answer useful - Please give the post a 👍 - "thumbs up"

                        pfSense+ 23.05.1 (ZFS)

                        QOTOM-Q355G4 Quad Lan.
                        CPU  : Core i5 5250U, Ram : 8GB Kingston DDR3LV 1600
                        LAN  : 4 x Intel 211, Disk  : 240G SAMSUNG MZ7L3240HCHQ SSD

                        C 1 Reply Last reply Jan 4, 2021, 3:57 PM Reply Quote 0
                        • B
                          bingo600 @chrispazz
                          last edited by Jan 4, 2021, 3:57 PM

                          @chrispazz said in offloading OpenVPN using external gateway:

                          I tried enabling logging on the rule and I can confirm it is using it.

                          Ok

                          Now try to do a packet trace on the pfSense WAN

                          Set host address to the Raspi IP

                          63beebf6-8231-43a9-965c-b3349295c4c7-image.png

                          And generate some traffic destined for VPN

                          If you find my answer useful - Please give the post a 👍 - "thumbs up"

                          pfSense+ 23.05.1 (ZFS)

                          QOTOM-Q355G4 Quad Lan.
                          CPU  : Core i5 5250U, Ram : 8GB Kingston DDR3LV 1600
                          LAN  : 4 x Intel 211, Disk  : 240G SAMSUNG MZ7L3240HCHQ SSD

                          C 1 Reply Last reply Jan 4, 2021, 4:00 PM Reply Quote 0
                          • C
                            chrispazz @bingo600
                            last edited by Jan 4, 2021, 3:57 PM

                            @bingo600 oops....sorry. Inside IP of router is 192.168.5.254.

                            Pf sense has 192.168.5.1 on the WAN side...

                            1 Reply Last reply Reply Quote 0
                            • C
                              chrispazz @bingo600
                              last edited by Jan 4, 2021, 4:00 PM

                              @bingo600

                              Activated packet capture on host 192.168.5.9 and opened a webpage with www.google.it:

                              16:58:57.410983 IP 192.168.5.1 > 192.168.5.9: ICMP echo request, id 43267, seq 8815, length 9
                              16:58:57.920985 IP 192.168.5.1 > 192.168.5.9: ICMP echo request, id 43267, seq 8816, length 9

                              B 1 Reply Last reply Jan 4, 2021, 4:04 PM Reply Quote 0
                              • B
                                bingo600 @chrispazz
                                last edited by Jan 4, 2021, 4:04 PM

                                @chrispazz said in offloading OpenVPN using external gateway:

                                @bingo600

                                Activated packet capture on host 192.168.5.9 and opened a webpage with www.google.it:

                                16:58:57.410983 IP 192.168.5.1 > 192.168.5.9: ICMP echo request, id 43267, seq 8815, length 9
                                16:58:57.920985 IP 192.168.5.1 > 192.168.5.9: ICMP echo request, id 43267, seq 8816, length 9

                                Where did 192.168.5.9 come from ??
                                did you mean 5.99

                                If you find my answer useful - Please give the post a 👍 - "thumbs up"

                                pfSense+ 23.05.1 (ZFS)

                                QOTOM-Q355G4 Quad Lan.
                                CPU  : Core i5 5250U, Ram : 8GB Kingston DDR3LV 1600
                                LAN  : 4 x Intel 211, Disk  : 240G SAMSUNG MZ7L3240HCHQ SSD

                                C 1 Reply Last reply Jan 4, 2021, 4:05 PM Reply Quote 0
                                • C
                                  chrispazz @bingo600
                                  last edited by chrispazz Jan 4, 2021, 4:06 PM Jan 4, 2021, 4:05 PM

                                  @bingo600 yes is 5.99 :) don't hate me eheheh

                                  B 1 Reply Last reply Jan 4, 2021, 4:08 PM Reply Quote 0
                                  • B
                                    bingo600 @chrispazz
                                    last edited by Jan 4, 2021, 4:08 PM

                                    @chrispazz

                                    So we have confirmed that the ICMP (ping) packages are actually being "policy routed" from 5.1 (pfSense) to 5.99 (RasPI)

                                    We don't see any Echo reply ... The issue is probably on the RasPI

                                    If you find my answer useful - Please give the post a 👍 - "thumbs up"

                                    pfSense+ 23.05.1 (ZFS)

                                    QOTOM-Q355G4 Quad Lan.
                                    CPU  : Core i5 5250U, Ram : 8GB Kingston DDR3LV 1600
                                    LAN  : 4 x Intel 211, Disk  : 240G SAMSUNG MZ7L3240HCHQ SSD

                                    C 1 Reply Last reply Jan 4, 2021, 4:15 PM Reply Quote 1
                                    • B
                                      bingo600
                                      last edited by Jan 4, 2021, 4:15 PM

                                      On the Raspi (as root)

                                      What does a : sudo iptables -L show ?

                                      And this one ?
                                      92d9b6a4-89e6-402d-aeb5-c359a7092195-image.png

                                      If you find my answer useful - Please give the post a 👍 - "thumbs up"

                                      pfSense+ 23.05.1 (ZFS)

                                      QOTOM-Q355G4 Quad Lan.
                                      CPU  : Core i5 5250U, Ram : 8GB Kingston DDR3LV 1600
                                      LAN  : 4 x Intel 211, Disk  : 240G SAMSUNG MZ7L3240HCHQ SSD

                                      C 1 Reply Last reply Jan 4, 2021, 4:17 PM Reply Quote 0
                                      • C
                                        chrispazz @bingo600
                                        last edited by Jan 4, 2021, 4:15 PM

                                        This post is deleted!
                                        1 Reply Last reply Reply Quote 0
                                        • B
                                          bingo600
                                          last edited by Jan 4, 2021, 4:17 PM

                                          Did you reboot the RasPI after enabling forwarding ?

                                          If you find my answer useful - Please give the post a 👍 - "thumbs up"

                                          pfSense+ 23.05.1 (ZFS)

                                          QOTOM-Q355G4 Quad Lan.
                                          CPU  : Core i5 5250U, Ram : 8GB Kingston DDR3LV 1600
                                          LAN  : 4 x Intel 211, Disk  : 240G SAMSUNG MZ7L3240HCHQ SSD

                                          1 Reply Last reply Reply Quote 0
                                          26 out of 70
                                          • First post
                                            26/70
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                            This community forum collects and processes your personal information.
                                            consent.not_received