Allow OpenVPN Server to access Pfsense Subnets

Owen82

Hi All,

I have pfsense openvpn client connection to a VPS running openvpn server. Everything is working well - I can access SSH on the VPS through the openvpn connection from my local subnets.

But I would like the VPS to access the local subnets. How can I do that?

I have a firewall rule on the LAN interface that allows any traffic from the OpenVPN server network. Do I need a NAT rule also?

Any help appreciated! :)

rcoleman-netgate

@owen82 Two things are needed:

The local networks need to exist on the remote OVPN server as remote networks and
The OpenVPN interface needs to allow passing of the traffic.

Have you tested it?
Did you see anything in your Firewall logs? https://docs.netgate.com/pfsense/en/latest/monitoring/logs/firewall.html

Owen82

@rcoleman-netgate thank you and sorry for the slow reply- I see that the auto added OVPN ANY/ANY rule is there (and passing a bit of traffic).

I also added static route on the VPS for 192.168.0.0 255.255.255.0(LAN Net) via 10.8.0.1 (VPS OVPN Int), but still no dice.

I do not see anything in the firewall logs for 10.8.0.1 or 10.8.0.2.

viragomann

@owen82 said in Allow OpenVPN Server to access Pfsense Subnets:

I also added static route on the VPS for 192.168.0.0 255.255.255.0(LAN Net) via 10.8.0.1 (VPS OVPN Int),

That's the servers IP. You have to point it to the client, which might have 10.8.0.2.
However, this should better be done in OpenVPN Wirth the Route Option. Conider that this requires a /30 tunnel network, otherwise you need a host override with iroute.

Owen82

@viragomann It's working!

I had tried the static route on the VPN to the client side IP but it wasn't working, so I tried the server side. I ended up deleting the static route I made and going with your recommendation of letting OVPN do that. The pfsense client was already set to the /30 network.

For anyone else in a similar scenario, read this: OpenVPN: Including multiple machines on the client side when using a routed VPN (dev tun).

And I missed an "i" on the "iroute 192.168.0.0 255.255.255.0" in the client file in the CCD folder on the server. #Facepalm.

Big thank you to @viragomann and @rcoleman-netgate !