• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Using a GRE Tunnel to route VMs network and IP to external network.

Scheduled Pinned Locked Moved General pfSense Questions
36 Posts 2 Posters 4.7k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • X
    Xuap @Xuap
    last edited by Xuap Oct 3, 2022, 6:58 PM Oct 3, 2022, 6:45 PM

    @xuap So, I used the gateway 185.113.141.1 on the VM and the IP 192.168.1.139, on the local pfsense I get this

    c16f6871-5429-427c-b455-2b27636aeb93-image.png
    and on the remote I get this

    5c469311-9e59-48b8-bbec-de15a412ce02-image.png

    Also, I have this NAT rules c1496df2-9c32-482d-8c65-01d84c56e725-image.png

    but I don't have internet access on the VM.

    1 Reply Last reply Reply Quote 0
    • S
      stephenw10 Netgate Administrator
      last edited by Oct 3, 2022, 7:07 PM

      If you are 1:1 NATing, as you initially said, then you should not have any public IPs at the local site.

      The only place the public IPs would be defined would be as VIPs at the remote site.

      In the other thread they were given a routed subnet and so could use the public IPs directly on hosts at the local end. In that situation you don't need to NAT anything and instead can route the subnet across the tunnel at the remote site. Then use the subnet directly on an interface at the local end. The pfSense VLAN interface would still not be the .1 address though, that would imply they gave you the full /24 subnet which is very unlikely. It would be the first usable IP in the subnet they routed to you.

      Steve

      X 1 Reply Last reply Oct 3, 2022, 7:31 PM Reply Quote 0
      • X
        Xuap @stephenw10
        last edited by Oct 3, 2022, 7:31 PM

        @stephenw10 Unfortunately, they didn't allow us to have a routed subnet, so I have to stick with the 1:1.

        Virtual IPs on the remote site:
        e3a9a2bc-2b44-4a38-9fd0-9ca309901877-image.png

        Virtual IPs on the local site:
        3e2ea529-0435-4594-8560-fa7712b48cf2-image.png

        I only have Virtual IPs on the remote which is one additional IP I got that the hosting provider gave me.

        So, in my case do I need to change the gateway 185.113.141.1 to anything else or do I need to make some firewall rules to give the VM internet access or something? Because if I change to my router's gateway and the bridge to the main bridge of pfsense (WAN) the network starts working but I don't get any data on pfsense stats nor the public IP is correct..

        X 1 Reply Last reply Oct 3, 2022, 8:49 PM Reply Quote 0
        • X
          Xuap @Xuap
          last edited by Oct 3, 2022, 8:49 PM

          If I ping something like 1.1.1.1, on the console I get
          6c3d5da9-efd4-437e-8d84-c760fdefcd79-image.png
          without any output, but I do get the states on both ends
          LOCAL:
          221211db-5d97-46a3-872a-04dd3fd77c61-image.png

          REMOTE:
          42dc6e6d-0437-443f-9b5f-ff785494b7b9-image.png

          also referring that it's showing the ip 185.113.141.132 when the IP I want to use is the 185.113.141.139.

          1 Reply Last reply Reply Quote 0
          • S
            stephenw10 Netgate Administrator
            last edited by Oct 4, 2022, 12:03 AM

            Ok, so what's the 1:1 NAT rule at the remote side? It looks like it's not catching the traffic there on the way out and it's using the auto outbound rule instead.
            Also the 1:1 NAT rule would not change the source port (icmp ID here) like is shown there.

            However it does look to be working as expected apart from that. There is two way traffic shown on all 4 interfaces involved. But the ping fails?

            Steve

            X 1 Reply Last reply Oct 4, 2022, 5:41 PM Reply Quote 0
            • X
              Xuap @stephenw10
              last edited by Oct 4, 2022, 5:41 PM

              @stephenw10 The NAT rules on the remote site are like this:

              1:1
              475677e5-4214-4e4e-b611-55973f5b02f6-image.png

              Outbound
              5a5b6fb3-7c54-4697-b61a-3499629693bb-image.png

              Yeah, basically it just doesn't have internet access, nor even access to the pfsense or tunnel ping.. I can't ping the tunnel through the VM even tho the ping arrives there.

              1 Reply Last reply Reply Quote 0
              • S
                stephenw10 Netgate Administrator
                last edited by Oct 4, 2022, 5:52 PM

                Ok the 1:1 NAT rule should be on WAN with the external IP being the public IP VIP and the internal IP being the private IP of the server.

                X 1 Reply Last reply Oct 4, 2022, 5:55 PM Reply Quote 0
                • X
                  Xuap @stephenw10
                  last edited by Oct 4, 2022, 5:55 PM

                  @stephenw10 So, like this?
                  c6187a6d-ca16-44d6-a4e3-28daa7645360-image.png

                  And on the VM, like this?
                  489184d9-f0b5-4787-b6f7-3734c69eb06f-image.png

                  1 Reply Last reply Reply Quote 0
                  • S
                    stephenw10 Netgate Administrator
                    last edited by Oct 4, 2022, 5:57 PM

                    No the external IP should be the public IP. The internal IP should be the server IP in 192.168.1.0/24.

                    The VM gateway needs to be in the subnet so it should be the local pfSense VLAN interface IP. Probably 192.168.1.1

                    X 1 Reply Last reply Oct 4, 2022, 6:41 PM Reply Quote 0
                    • X
                      Xuap @stephenw10
                      last edited by Oct 4, 2022, 6:41 PM

                      @stephenw10 So, my networks on local pfsense are like this:

                      7167937f-2f66-45c0-834b-a080d152ce26-image.png

                      My WAN is the 192.168.1.10 which is on the main gateway of the router 192.168.1.254

                      I use the VLAN as a bridge for the VMs, but should I use something else both on pfsense or on the VMs?

                      X 1 Reply Last reply Oct 4, 2022, 6:49 PM Reply Quote 0
                      • S
                        stephenw10 Netgate Administrator
                        last edited by Oct 4, 2022, 6:47 PM

                        Hmm, where is the VM at 192.168.1.86 then?

                        I expect all the VMs to be in the VLAN subnet and all the routing the NAT setup to be to and from the VLAN subnet.

                        Steve

                        X 1 Reply Last reply Oct 4, 2022, 6:51 PM Reply Quote 0
                        • X
                          Xuap @Xuap
                          last edited by Oct 4, 2022, 6:49 PM

                          I also did a pcap on both the GRE and VLAN of the local pfsense

                          GRE:
                          d14dbcf6-36b0-4e74-bf2d-eb48e440fa4e-image.png

                          VLAN:
                          f19055c3-ebf6-4091-b462-8ac72173b942-image.png

                          So, as I understood it is sending the ping to the 1.1.1.1 but it is not receiving any traffic..

                          S 1 Reply Last reply Oct 4, 2022, 6:51 PM Reply Quote 0
                          • S
                            stephenw10 Netgate Administrator @Xuap
                            last edited by Oct 4, 2022, 6:51 PM

                            Right, well it won't if traffic from 192.168.1.86 is coming in on the wrong interface!

                            If you run a pcap on WAN you will see all the replies going back that way because that's where the 192.168.1.0/24 subnet is.

                            How exactly is the VM connected?

                            X 1 Reply Last reply Oct 4, 2022, 6:55 PM Reply Quote 0
                            • X
                              Xuap @stephenw10
                              last edited by Oct 4, 2022, 6:51 PM

                              @stephenw10 The VM is in the proxmox with the IP on 192.168.1.86 and gateway 192.168.2.1 like I showed above

                              The VM is with the bridge of the VLAN (192.168.2.1) which is the Linux Bridge 1 on proxmox (vmbr1) that will (supposedly) be attached to all VMs so it can tunnel the traffic to the remote pfsense

                              1 Reply Last reply Reply Quote 0
                              • X
                                Xuap @stephenw10
                                last edited by Oct 4, 2022, 6:55 PM

                                @stephenw10 16249c88-5c5c-499c-8067-7e1321555bac-image.png

                                This is the only 1.1.1.1 ping I have on the WAN of the local pfsense

                                1 Reply Last reply Reply Quote 0
                                • S
                                  stephenw10 Netgate Administrator
                                  last edited by Oct 4, 2022, 7:02 PM

                                  There is an ARP request for 192.168.1.86 though because it's trying to find it on the WAN. And failing.

                                  The VMs should be in the VLAN subnet, 192.168.2.0/24.

                                  The static route at the remote end should be for that subnet.

                                  The 1:1 NAT rules at the remote side should also be for host in that subnet.

                                  Steve

                                  X 1 Reply Last reply Oct 4, 2022, 7:14 PM Reply Quote 0
                                  • X
                                    Xuap @stephenw10
                                    last edited by Oct 4, 2022, 7:14 PM

                                    @stephenw10 So, like this?

                                    8d412b2e-cc2e-4ae2-af56-207db7d0cc09-image.png
                                    2e9705b1-00cb-4abb-825d-211ac6e37fa8-image.png
                                    9a1a6a0a-5063-4887-9df4-4ba4b4ead7ce-image.png

                                    X 1 Reply Last reply Oct 4, 2022, 7:24 PM Reply Quote 0
                                    • X
                                      Xuap @Xuap
                                      last edited by Oct 4, 2022, 7:24 PM

                                      Ok, so It looks like I was using a 192.168.1.86 on a .2 subnet, I changed it to 192.168.2.86 and it now pings 1.1.1.1 and 8.8.8.8 and the tunnel, but doesn't have internet access to like ifconfig.me or google.com. I'll do a bit more testing, but it's closer than never to work out.

                                      1 Reply Last reply Reply Quote 0
                                      • S
                                        stephenw10 Netgate Administrator
                                        last edited by Oct 4, 2022, 7:40 PM

                                        Yeah you need to be using 192.168.2.X everywhere.

                                        You are probably seeing pings work but no other traffic because there is some asymmetry somewhere. Once all the rules and routes are changed to the VLAN subnet it should work.

                                        X 1 Reply Last reply Oct 4, 2022, 7:49 PM Reply Quote 0
                                        • X
                                          Xuap @stephenw10
                                          last edited by Oct 4, 2022, 7:49 PM

                                          @stephenw10 Ok, it is pinging now. I can ping everything on IP addresses, except domains. Like, If I ping my Home Public IP address, I get a ping of 20ms or something, when the tunnel's ping is about 9ms.

                                          But is it normal the ping state is 0:0 on both ends?

                                          Local:
                                          1cb08819-1b8b-4ac5-a45b-dfbe311348f1-image.png

                                          Remote:
                                          80fcbc34-bdfe-4b60-b3d2-91adf9b2b878-image.png

                                          Also the only NAT rules I have are on the remote pfsense, which are:
                                          ff35e59a-2ab5-4dfb-a6b2-81dc147ac867-image.png

                                          On the local pfsense I have the NAT disabled.

                                          What rules should I change/add?

                                          X S 2 Replies Last reply Oct 4, 2022, 7:52 PM Reply Quote 0
                                          25 out of 36
                                          • First post
                                            25/36
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                            This community forum collects and processes your personal information.
                                            consent.not_received