Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    offloading OpenVPN using external gateway

    Scheduled Pinned Locked Moved Routing and Multi WAN
    70 Posts 2 Posters 13.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • C
      chrispazz @bingo600
      last edited by chrispazz

      @bingo600 here we are! this is exactly what I did before writing here! ahahahah
      Yes I enabled forwarding in Raspbian but I cannot understand why it is going outside without using VPN šŸ˜•

      I am sure it is using the new rule because of some tests I did....

      I am starting to suppose that the problem could be on the RPI side....strange since it is working from SSH....

      bingo600B 1 Reply Last reply Reply Quote 0
      • bingo600B
        bingo600 @chrispazz
        last edited by

        @chrispazz said in offloading OpenVPN using external gateway:

        Yes I enabled forwarding in Raspbian but I cannot understand why it is going outside without using VPN šŸ˜•

        Does the package reach the RasPI (using the gateway you set) ?
        Or does the pfSense never send it to the Raspi ?

        If you find my answer useful - Please give the post a šŸ‘ - "thumbs up"

        pfSense+ 23.05.1 (ZFS)

        QOTOM-Q355G4 Quad Lan.
        CPUĀ  : Core i5 5250U, Ram : 8GB Kingston DDR3LV 1600
        LANĀ  : 4 x Intel 211, DiskĀ  : 240G SAMSUNG MZ7L3240HCHQ SSD

        C 1 Reply Last reply Reply Quote 0
        • C
          chrispazz @bingo600
          last edited by chrispazz

          @bingo600 I do not know how to check this on the RPI side.... 😐

          I followed this guide:

          https://www.instructables.com/Raspberry-Pi-VPN-Gateway/

          bingo600B 1 Reply Last reply Reply Quote 0
          • bingo600B
            bingo600 @chrispazz
            last edited by

            @chrispazz said in offloading OpenVPN using external gateway:

            @bingo600 I do not know how to check this on the RPI side.... 😐

            Quick hack
            Enable temporary logging on the Policy Rule , look for log entries to confirm your rule matches "interesting traffic".

            Real Packet capture (on pfSense).
            Diagnostic --> Packet Capture

            I suppose your pfSense Wan Interface is the one connecting to the "ISP Router LAN" ?

            Packet Capture on pfSense
            If you have a screen + kbd on the RasPi , you could install wireshark on that one , to do the packet capture.

            If only SSH , install tcpdump on the RasPI

            How about NAT ?
            Are you natting on your pfSense WAN IF ?

            /Bingo

            If you find my answer useful - Please give the post a šŸ‘ - "thumbs up"

            pfSense+ 23.05.1 (ZFS)

            QOTOM-Q355G4 Quad Lan.
            CPUĀ  : Core i5 5250U, Ram : 8GB Kingston DDR3LV 1600
            LANĀ  : 4 x Intel 211, DiskĀ  : 240G SAMSUNG MZ7L3240HCHQ SSD

            1 Reply Last reply Reply Quote 0
            • bingo600B
              bingo600
              last edited by bingo600

              You say your pfSense is 192.168.99.1 , but the drawing shows 99.250

              Is the 99.1 interface a pfSense "inside Lan" ip ?

              How does the 192.168.99.x interface relate on the drawing ?

              I expect your pfSense to have a WAN ip on the ISP router LAN , meaning the 192.168.5.x range.

              Since you say you can ping and prob SSH to the Raspi , i assume that is correct or ??

              If you find my answer useful - Please give the post a šŸ‘ - "thumbs up"

              pfSense+ 23.05.1 (ZFS)

              QOTOM-Q355G4 Quad Lan.
              CPUĀ  : Core i5 5250U, Ram : 8GB Kingston DDR3LV 1600
              LANĀ  : 4 x Intel 211, DiskĀ  : 240G SAMSUNG MZ7L3240HCHQ SSD

              C 1 Reply Last reply Reply Quote 0
              • C
                chrispazz @bingo600
                last edited by

                @bingo600 NAS is 99.250.
                Inside NAS (Synology) I run a VM with pfsense (99.1).

                I tried enabling logging on the rule and I can confirm it is using it.
                Yes, my pfsense WAN interface is the one connecting to the ISP router.
                And yes, I am using NAT on the pfsense WAN if....

                bingo600B 2 Replies Last reply Reply Quote 0
                • bingo600B
                  bingo600 @chrispazz
                  last edited by

                  @chrispazz

                  Just for completeness
                  What is your pfSense WAN IP ?

                  If you find my answer useful - Please give the post a šŸ‘ - "thumbs up"

                  pfSense+ 23.05.1 (ZFS)

                  QOTOM-Q355G4 Quad Lan.
                  CPUĀ  : Core i5 5250U, Ram : 8GB Kingston DDR3LV 1600
                  LANĀ  : 4 x Intel 211, DiskĀ  : 240G SAMSUNG MZ7L3240HCHQ SSD

                  C 1 Reply Last reply Reply Quote 0
                  • C
                    chrispazz @bingo600
                    last edited by

                    @bingo600 it is 192.168.5.254

                    bingo600B 1 Reply Last reply Reply Quote 0
                    • bingo600B
                      bingo600 @chrispazz
                      last edited by

                      @chrispazz

                      ??

                      Then what is your ISP router inside ip ?

                      If you find my answer useful - Please give the post a šŸ‘ - "thumbs up"

                      pfSense+ 23.05.1 (ZFS)

                      QOTOM-Q355G4 Quad Lan.
                      CPUĀ  : Core i5 5250U, Ram : 8GB Kingston DDR3LV 1600
                      LANĀ  : 4 x Intel 211, DiskĀ  : 240G SAMSUNG MZ7L3240HCHQ SSD

                      C 1 Reply Last reply Reply Quote 0
                      • bingo600B
                        bingo600 @chrispazz
                        last edited by

                        @chrispazz said in offloading OpenVPN using external gateway:

                        I tried enabling logging on the rule and I can confirm it is using it.

                        Ok

                        Now try to do a packet trace on the pfSense WAN

                        Set host address to the Raspi IP

                        63beebf6-8231-43a9-965c-b3349295c4c7-image.png

                        And generate some traffic destined for VPN

                        If you find my answer useful - Please give the post a šŸ‘ - "thumbs up"

                        pfSense+ 23.05.1 (ZFS)

                        QOTOM-Q355G4 Quad Lan.
                        CPUĀ  : Core i5 5250U, Ram : 8GB Kingston DDR3LV 1600
                        LANĀ  : 4 x Intel 211, DiskĀ  : 240G SAMSUNG MZ7L3240HCHQ SSD

                        C 1 Reply Last reply Reply Quote 0
                        • C
                          chrispazz @bingo600
                          last edited by

                          @bingo600 oops....sorry. Inside IP of router is 192.168.5.254.

                          Pf sense has 192.168.5.1 on the WAN side...

                          1 Reply Last reply Reply Quote 0
                          • C
                            chrispazz @bingo600
                            last edited by

                            @bingo600

                            Activated packet capture on host 192.168.5.9 and opened a webpage with www.google.it:

                            16:58:57.410983 IP 192.168.5.1 > 192.168.5.9: ICMP echo request, id 43267, seq 8815, length 9
                            16:58:57.920985 IP 192.168.5.1 > 192.168.5.9: ICMP echo request, id 43267, seq 8816, length 9

                            bingo600B 1 Reply Last reply Reply Quote 0
                            • bingo600B
                              bingo600 @chrispazz
                              last edited by

                              @chrispazz said in offloading OpenVPN using external gateway:

                              @bingo600

                              Activated packet capture on host 192.168.5.9 and opened a webpage with www.google.it:

                              16:58:57.410983 IP 192.168.5.1 > 192.168.5.9: ICMP echo request, id 43267, seq 8815, length 9
                              16:58:57.920985 IP 192.168.5.1 > 192.168.5.9: ICMP echo request, id 43267, seq 8816, length 9

                              Where did 192.168.5.9 come from ??
                              did you mean 5.99

                              If you find my answer useful - Please give the post a šŸ‘ - "thumbs up"

                              pfSense+ 23.05.1 (ZFS)

                              QOTOM-Q355G4 Quad Lan.
                              CPUĀ  : Core i5 5250U, Ram : 8GB Kingston DDR3LV 1600
                              LANĀ  : 4 x Intel 211, DiskĀ  : 240G SAMSUNG MZ7L3240HCHQ SSD

                              C 1 Reply Last reply Reply Quote 0
                              • C
                                chrispazz @bingo600
                                last edited by chrispazz

                                @bingo600 yes is 5.99 :) don't hate me eheheh

                                bingo600B 1 Reply Last reply Reply Quote 0
                                • bingo600B
                                  bingo600 @chrispazz
                                  last edited by

                                  @chrispazz

                                  So we have confirmed that the ICMP (ping) packages are actually being "policy routed" from 5.1 (pfSense) to 5.99 (RasPI)

                                  We don't see any Echo reply ... The issue is probably on the RasPI

                                  If you find my answer useful - Please give the post a šŸ‘ - "thumbs up"

                                  pfSense+ 23.05.1 (ZFS)

                                  QOTOM-Q355G4 Quad Lan.
                                  CPUĀ  : Core i5 5250U, Ram : 8GB Kingston DDR3LV 1600
                                  LANĀ  : 4 x Intel 211, DiskĀ  : 240G SAMSUNG MZ7L3240HCHQ SSD

                                  C 1 Reply Last reply Reply Quote 1
                                  • bingo600B
                                    bingo600
                                    last edited by

                                    On the Raspi (as root)

                                    What does a : sudo iptables -L show ?

                                    And this one ?
                                    92d9b6a4-89e6-402d-aeb5-c359a7092195-image.png

                                    If you find my answer useful - Please give the post a šŸ‘ - "thumbs up"

                                    pfSense+ 23.05.1 (ZFS)

                                    QOTOM-Q355G4 Quad Lan.
                                    CPUĀ  : Core i5 5250U, Ram : 8GB Kingston DDR3LV 1600
                                    LANĀ  : 4 x Intel 211, DiskĀ  : 240G SAMSUNG MZ7L3240HCHQ SSD

                                    C 1 Reply Last reply Reply Quote 0
                                    • C
                                      chrispazz @bingo600
                                      last edited by

                                      This post is deleted!
                                      1 Reply Last reply Reply Quote 0
                                      • bingo600B
                                        bingo600
                                        last edited by

                                        Did you reboot the RasPI after enabling forwarding ?

                                        If you find my answer useful - Please give the post a šŸ‘ - "thumbs up"

                                        pfSense+ 23.05.1 (ZFS)

                                        QOTOM-Q355G4 Quad Lan.
                                        CPUĀ  : Core i5 5250U, Ram : 8GB Kingston DDR3LV 1600
                                        LANĀ  : 4 x Intel 211, DiskĀ  : 240G SAMSUNG MZ7L3240HCHQ SSD

                                        1 Reply Last reply Reply Quote 0
                                        • C
                                          chrispazz @bingo600
                                          last edited by chrispazz

                                          @bingo600 yes, forward is activated.

                                          Chain INPUT (policy DROP)
                                          target prot opt source destination
                                          ACCEPT all -- anywhere anywhere
                                          ACCEPT icmp -- anywhere anywhere
                                          ACCEPT tcp -- anywhere anywhere tcp dpt:ssh
                                          ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED

                                          Chain FORWARD (policy DROP)
                                          target prot opt source destination
                                          ACCEPT all -- anywhere anywhere
                                          ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED

                                          Chain OUTPUT (policy ACCEPT)
                                          target prot opt source destination

                                          and yes, I rebooted it a lot of times :)

                                          bingo600B 1 Reply Last reply Reply Quote 0
                                          • bingo600B
                                            bingo600 @chrispazz
                                            last edited by

                                            @chrispazz

                                            Does this one give the expected result , should be your (OpenVPN public ip) ?

                                            wget http://ipinfo.io/ip -qO -

                                            Can you ping the google.it from the RasPI ?

                                            /Bingo

                                            If you find my answer useful - Please give the post a šŸ‘ - "thumbs up"

                                            pfSense+ 23.05.1 (ZFS)

                                            QOTOM-Q355G4 Quad Lan.
                                            CPUĀ  : Core i5 5250U, Ram : 8GB Kingston DDR3LV 1600
                                            LANĀ  : 4 x Intel 211, DiskĀ  : 240G SAMSUNG MZ7L3240HCHQ SSD

                                            C 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.