PfSense VPN to local services ?

srytryagn

I have many local services on my network that I access by their local IPs, like portainer, cockpit, proxmox etc...

Can I use pfsense vpn to connect to those services remotely from outside of my lab ?
How do I do this securely ?

Sorry for newb question, but I am just starting out with vpns...Thanks for your help

johnpoz

@srytryagn yes if you setup a vpn you can access your local resources - that is the whole point of vpn to be honest.

You could use either openvpn, tailscale, wireguard or ipsec.

here is documentation for openvpn setup.. its pretty much follow the bouncing ball using the wizard

https://docs.netgate.com/pfsense/en/latest/recipes/openvpn-ra.html

srytryagn

@johnpoz Tried tailscale setup. When entering local IPs from a rmote machine I was unable to access the services I need.
I read that if we do not have fixed public IPs tailscale is really the option to use.
I am open to openvpn, but is a fixed public ip a must for that to work ?
How do I get started and which way is the most secure ?
(Thanks for helping !)

johnpoz

@srytryagn anyone or anything that tells you need a fixed public IP to make something work doesn't have a clue.. Ok running a mail server, is going to be problematic if your IP changes..

Keep in mind just because you get your IP from dhcp from your ISP doesn't mean it changes ever 15 minutes.. I have had my current IP for like 2 years or something, last time it changed was when the ISP went through a merger and redid their ip space..

If your ip changes every 15 minutes or something your going to have a hard time.. But normally you just setup dynamic dns to register your public IP with some fqdn.. There are many free options..

Then use this fqdn to connect to your vpn..

As to accessing your services.. Many users always forget local firewalls on the boxes they want to access while via a vpn.. Said firewall prob not going to like the IP your vpn client is connecting from..

stephenw10

OpenVPN is probably easiest to setup for this from pfSense but Tailscale should work.

Yes, it's probably a missing firewall rule somewhere.