OpenVPN with Netgate connected directly to Starlink dish.

zompakto

So I've connected my Netgate pfsense firewall directly to my starlink dish (gen 1 router with round dish) successfully, and have WAN/LAN running smoothly. Port1WAN 192.168. I followed this video and other tutorials rebuilding the OpenVPN configurations multiple times but can't seem to get it. https://www.youtube.com/watch?v=gnJgbwZGB8M

I've tried pointing the OpenVPN Export at the WAN port IP, and the IP that resolves when I browse "what's my ip", and I've tried putting ddns..com and putting my Cloudflare API key into my firewall to see if I can get that to connect.

At this point I have no idea what is wrong.

I would appreciate any insight. Has anyone connected to a firewall using OpenVPN going through a Starlink connection?

johnpoz

@zompakto Pretty sure starlink is cgnat (carrier grade nat).. Ie you can not do unsolicited inbound into it..

Does your pfsense wan show a 100.64-127.x.x address?

DominikHoffmann

@zompakto: You may have a double-NATted WAN IP address. In other words, possibly the IP address of your WAN interface is not directly exposed to the internet. Instead—and I have increasingly seen this practice by ISPs—your WAN interface may get its IP address from the ISP’s internet gateway as part of a private subnet. The only way to get around that would be to subscribe to a static IP address. How much does Starlink charge for that?

DominikHoffmann

Check this out: Reddit post “double NAT fixed”.
And: Wikipedia article “Carrier-grade NAT”.

johnpoz

@DominikHoffmann said in OpenVPN with Netgate connected directly to Starlink dish.:

The only way to get around that would be to subscribe to a static IP address. How much does Starlink charge for that?

I don't think its even an option at any price.

But you can get a dynamic public IP

https://support.starlink.com/topic?category=10&category=46

How do I set my IP address to Public?

The ability to update the IP policy to a Public IP is only available with a Priority or Mobile Priority service plan:

Login to your account www.starlink.com/account
Select "Manage" in the Your Starlinks section
Select the "pencil" icon next to "IP Policy"
Select "Public IP" from the drop down menu
Save
Reboot your Starlink

But you would need priority plan..

They are suppose to be rolling out IPv6 - if you have that you could use that for an unsolicited inbound connection for you vpn. Or there are other ways to work around the cgnat issue, with creating the outbound connection. Something like tailscale or wireguard could work.

https://www.starlink.com/service-plans/all

Wonder if have public inbound data is metered.. That can get pretty expensive.

Not exactly how those priority tiers work.. But 20$ more a month isn't horrible for a public IP. But 250 a month for 1TB seems a bit high!