Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Sharing a Port with OpenVPN and a Web Server

    Scheduled Pinned Locked Moved OpenVPN
    16 Posts 3 Posters 1.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • F
      FrankZappa
      last edited by

      I'm hoping someone can help me with a firewall configuration issue. I use OpenVPN on my pfSense box. Using UDP 1194, no problem, everything connects. However, I also want to use TCP 443 as many WiFi hotspots only allow ports 80 and 443. To connect to my OpenVPN server, I would need to connect via TCP 443. I followed the direction on Netgate https://docs.netgate.com/pfsense/en/latest/vpn/openvpn/port-share.html

      I added the custom line to my server. However, I'm not clear what goes in the firewall rules i.e. "add a firewall rule to pass traffic to the WAN IP address or VIP used for OpenVPN on port 443" My box runs on 192.168.1.1. Can anyone suggest a configuration for my firewall? Thanks.

      V 1 Reply Last reply Reply Quote 0
      • V
        viragomann @FrankZappa
        last edited by viragomann

        @frankzappa said in Sharing a Port with OpenVPN and a Web Server:

        However, I'm not clear what goes in the firewall rules i.e. "add a firewall rule to pass traffic to the WAN IP address or VIP used for OpenVPN on port 443"

        You have to pass 443 to that IP the OpenVPN is listening on.
        If it's listening on WAN address allow access to WAN address, if it's listening on localhost using a NAT rule allow 443 access to 127.0.0.1.

        Ensure that you have no other port forwarding rule for 443 in place.

        @frankzappa said in Sharing a Port with OpenVPN and a Web Server:

        My box runs on 192.168.1.1.

        Since your pfSense is behind a router, you have to forward 443 on the router to pfSense.

        F 1 Reply Last reply Reply Quote 0
        • F
          FrankZappa @viragomann
          last edited by

          @viragomann
          Thanks viragomann. This is where I get confused. My pfSense box runs on 192.168.1.1 as does my OpenVPN server (as part of pfSense package). I want to be able to access my LAN from the WAN using TCP 443. Not sure what the configuration should look like on the firewall. Thanks

          johnpozJ 1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator @FrankZappa
            last edited by

            so you want openvpn to listen on both 1194 udp and 443 tcp - is that right. If so just fire up another instance of openvpn.

            The reason you would want to share ports, if is your already using 443 say as a forward to some https server behind pfsense.

            here.jpg

            if you want vpn on 443, and say web server behind pfsense - then yes you can use openvpn share point.. I found it better response to do this with haproxy for your 443 service behind pfsense.

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            1 Reply Last reply Reply Quote 0
            • F
              FrankZappa
              last edited by

              Thanks johnpoz. I'm not running a server behind pfsense. I do want openvpn to listen on both 1194 udp and 443 tcp. I don't know if I'm already using port 443 although I thought if I accessed the pfSense GUI via https, it uses tcp 443, correct?

              That said, I'm still having trouble accessing my LAN using UDP 1194 or TCP 443. I currently have two instances of OpenVPN running (1194 and 443).

              I can't figure out (from the WAN) how to access my LAN. What firewall settings do I need (as well as NAT)?

              johnpozJ 1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator @FrankZappa
                last edited by johnpoz

                What port openvpn listens on has nothing to do with accessing your lan devices. Your going to have to show what you did for your setup. Did you put in your lan as the local network?

                Keep in mind a common issue users run into is the device they are accessing own firewall, not allowing the tunnel network you are using..

                As to pfsense using 443? Did you use that for https.. Out of the box pfsense only listens on 80.. You would have to enable https, and it allows you to pick the port. I use 8443 for example.

                My box runs on 192.168.1.1

                That is the default lan IP of pfsense, your wan is public IP? Your actually making a connection? Can you ping 192.168.1.1, but not say 192.168.1.X a device on your lan?

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                F 1 Reply Last reply Reply Quote 0
                • F
                  FrankZappa
                  last edited by

                  5657e3b6-cfe7-46cd-ad16-2f5234a69a65-image.png

                  feb47b7b-d5fe-4eb5-b462-36f6e0ab42f3-image.png

                  f14900c0-6c01-4bdd-9dfa-e93bc128936d-image.png

                  1ed06398-6eaf-461c-816d-4ad880c2cced-image.png

                  3d4da720-3674-425c-ab4f-4a246dc40765-image.png

                  1 Reply Last reply Reply Quote 0
                  • F
                    FrankZappa @johnpoz
                    last edited by

                    @johnpoz said in Sharing a Port with OpenVPN and a Web Server:

                    Your actually making a connection? Can you ping 192.168.1.1, but not say 192.168.1.X a device on your lan?

                    Correct. I can ping 192.168.1.1 bit nothing else on my LAN e.g. 192.168.1.20

                    F 1 Reply Last reply Reply Quote 0
                    • F
                      FrankZappa @FrankZappa
                      last edited by

                      @frankzappa
                      Actually, disregard the previous post. From my LAN, connected to OpenVPN 443, I can now ping everything on LAN (from within LAN).

                      F 1 Reply Last reply Reply Quote 0
                      • F
                        FrankZappa @FrankZappa
                        last edited by

                        @frankzappa
                        I still can't access the internet, or my local LAN from the WAN using TCP 443. Not sure what I'm doing wrong.

                        johnpozJ 1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator @FrankZappa
                          last edited by johnpoz

                          @frankzappa You have not local network setup, nor are you redirecting all traffic through the vpn.. So no you wouldn't access anything through that tunnel..

                          You need to set the local network(s) up, or you need to route everything through the tunnel.

                          How would the remote client know to go down the tunnel to get anywhere?

                          route.jpg

                          And why do you have port share setup?? You do not want or need that..

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          F 2 Replies Last reply Reply Quote 0
                          • F
                            FrankZappa @johnpoz
                            last edited by

                            @johnpoz
                            Thanks. Not sure what you mean (or how to) "set the local network(s) up, or you need to route everything through the tunnel" How do I do that?

                            F 1 Reply Last reply Reply Quote 0
                            • F
                              FrankZappa @FrankZappa
                              last edited by

                              @frankzappa
                              Ok, I think I figured out setting up the local network. I added 192.168.1.0/24 in the window. However, my iPhone (wifi off/connected only to phone data) won't even connect to my OpenVPN server on TCP 443. However, UDP 1194 works fine. Something I'm missing?

                              1 Reply Last reply Reply Quote 0
                              • F
                                FrankZappa @johnpoz
                                last edited by

                                @johnpoz
                                Thanks again johnpoz. I'm almost there. I can connect from WAN to OpenVPN on TCP 443 and UDP 1194. Two remaining issues:

                                1. I can't connect to my local NAS. I can ping it, but can't connect via OpenVPN. Same for everything else on LAN.
                                2. When I run a security scan (Shields Up) It gives me the giant red "FAILED" as it shows port 443 wide open (saying it's unsafe to have this open).

                                Is there any way to prevent port scanners from showing TCP 443 wide open? It doesn't show UDP 1194 as open (and yet it is).

                                Thanks

                                johnpozJ 1 Reply Last reply Reply Quote 0
                                • johnpozJ
                                  johnpoz LAYER 8 Global Moderator @FrankZappa
                                  last edited by johnpoz

                                  The scanner doesn't scan udp that is why its not showing 1194.

                                  No there is no way to have the port closed, but yet people connect ;) Your vpn is pretty freaking secure.. And openvpn will just drop packets that are not vpn packets from your clients.. look into what tls key does.. "correct HMAC signature"

                                  To you nas.. Look to the nas firewall - I highly doubt it allows something other your lan network, ie your tunnel network (vpn client IP) to access its shares, etc.. it might allow ping.

                                  If you can ping it.. Then you have connectivity and issue is pretty much 99.9999 sure is local firewall of the device.. Unless on your openvpn interface rules you limited that to icmp? It defaults to any any..

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                                  F 1 Reply Last reply Reply Quote 0
                                  • F
                                    FrankZappa @johnpoz
                                    last edited by

                                    @johnpoz
                                    Thanks Again. I'll play around with NAS firewall to see if that's the issue.

                                    1 Reply Last reply Reply Quote 0
                                    • First post
                                      Last post
                                    Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.