<![CDATA[OpenVPN - Network Segment - Firewall Rule]]>I watched several postings on how to setup basic OpenVPN client access.

I installed client export. Made reference to correct WAN DDNS target.. All seems good. Client connect and they show DNS from LAN, Route tables denoting the dedicated network within the environment, as well as routing to the Production LAN. But the clients are NOT able to communicate.

I do see resolution of MAC to router "VPN" interface, so L2 is definatly working, and route tables / DNS is correct. My guess then is firewall rule. But, in various videos, I did not see any examples where the VPN LAN segment needs to be set to allow ingress to the various Intranet VLANs. Examples below

Production LAN: VLAN 100 172.16.100.0/24 GW (router) .1
DNS: 172.16.100.22
VPN VLAN / Network: 172.16.104.0/24 GW (router) .1

VPN: IP leased to client 172.16.104.2/24
Route:
172.16.104.0/24 172.16.104.2
172.16.100.0/24 172.16.104.1

So all that looks normal.

Firewall rule: Only one for VPN for ingress on WAN 1194, destination any.

So that look kocher.

I don't think I have to create route logic within PFSense to forward.. but .. maybe I missed that part of the walk throughs.

]]>https://forum.netgate.com/topic/172507/openvpn-network-segment-firewall-ruleRSS for NodeSun, 19 Jul 2026 03:40:38 GMTSun, 29 May 2022 02:19:54 GMT60<![CDATA[Reply to OpenVPN - Network Segment - Firewall Rule on Sun, 29 May 2022 13:47:21 GMT]]>You need a firewall rule to pass traffic from VPN clients coming in over the tunnel. That either has to be on the OpenVPN tab on the firewall rules page or the assigned interface tave if you have assigned the OpenVPN server as an interface. Be aware that the OpenVPN tab acts as an interface group that includes all OpenVPN servers and clients. If you have assigned an OpenVPN interface you usually want the rules on the assigned interface tab and not on the group openvpn tab.

Steve

]]>https://forum.netgate.com/post/1044345https://forum.netgate.com/post/1044345Sun, 29 May 2022 13:47:21 GMT<![CDATA[Reply to OpenVPN - Network Segment - Firewall Rule on Sun, 29 May 2022 02:41:33 GMT]]>@penguinpages said in OpenVPN - Network Segment - Firewall Rule:

examples where the VPN LAN segment needs to be set to allow ingress

Take a look at: https://docs.netgate.com/pfsense/en/latest/vpn/openvpn/firewall-rules.html#allowing-traffic-over-openvpn-tunnels

]]>https://forum.netgate.com/post/1044312https://forum.netgate.com/post/1044312Sun, 29 May 2022 02:41:33 GMT