• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

1 WAN interface, 3 LAN interfaces, OpenVPN allow communication to all networks

Scheduled Pinned Locked Moved General pfSense Questions
44 Posts 4 Posters 3.2k Views 4 Watching
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • J Offline
    jg8000 @stephenw10
    last edited by jg8000 May 24, 2024, 3:09 AM May 24, 2024, 2:52 AM

    @stephenw10

    The IPMI has a default route, I set it to 192.168.3.1. The 192.168.1.5 interface has no gateway.

    No layer 3 switch, IPMI cable to cheap netgear switch, and cable from same switch to windows client. I can't have the windows test client 192.168.1.5 have a gateway because it's dual homed with a WAN interface and the WAN needs it.

    1 Reply Last reply Reply Quote 0
    • J Offline
      jg8000 @stephenw10
      last edited by jg8000 May 24, 2024, 3:58 AM May 24, 2024, 3:25 AM

      @stephenw10

      On the real server setup, I am able to see the states when going to the 192.168.3.0/24 from the VPN net 192.168.50.0/24. I'm not sure what to make of it.

      Although it doesn't seem to matter if the target http address is real or not, but I guess that doesn't matter, looks like it's making an attempt?

      af1fd218-4385-4985-88cb-d829fc28bf81-image.png

      1 Reply Last reply Reply Quote 0
      • S Offline
        stephenw10 Netgate Administrator
        last edited by May 24, 2024, 11:29 AM

        The states are correct but there is no translation. Did you add an appropriate OBN rule there too?

        J 1 Reply Last reply May 24, 2024, 2:36 PM Reply Quote 0
        • J Offline
          jg8000 @stephenw10
          last edited by May 24, 2024, 2:36 PM

          @stephenw10

          I see those states no matter if the OBN is there or not.

          1 Reply Last reply Reply Quote 0
          • S Offline
            stephenw10 Netgate Administrator
            last edited by May 24, 2024, 2:57 PM

            What OBN rule are you setting there?

            J 1 Reply Last reply May 24, 2024, 3:44 PM Reply Quote 0
            • J Offline
              jg8000 @stephenw10
              last edited by May 24, 2024, 3:44 PM

              @stephenw10 Screenshot 2024-05-24 at 8.36.46 AM.png

              1 Reply Last reply Reply Quote 0
              • S Offline
                stephenw10 Netgate Administrator
                last edited by May 24, 2024, 3:47 PM

                Is that destination the address or subnet? It needs to be the OPT2 subnet there to match.

                J 1 Reply Last reply May 24, 2024, 3:53 PM Reply Quote 0
                • J Offline
                  jg8000 @stephenw10
                  last edited by May 24, 2024, 3:53 PM

                  @stephenw10

                  It's the subnet. Does I need this Outbound rule when setting the OPT2 (192.168.3.0/24) as local networks in the OpenVPN config?

                  Screenshot 2024-05-24 at 8.50.02 AM.png .

                  1 Reply Last reply Reply Quote 0
                  • S Offline
                    stephenw10 Netgate Administrator
                    last edited by May 24, 2024, 4:34 PM

                    Yes you still need the rule because hosts in the OPT2 subnet will block access from the VPN subnet directly.

                    That rule should match if the subnets are correct.

                    J 1 Reply Last reply May 24, 2024, 4:36 PM Reply Quote 0
                    • J Offline
                      jg8000 @stephenw10
                      last edited by May 24, 2024, 4:36 PM

                      @stephenw10

                      Is there a way to just have the vpn clients land on the OPT2 subnet? Would that solve the problem?

                      1 Reply Last reply Reply Quote 0
                      • S Offline
                        stephenw10 Netgate Administrator
                        last edited by May 24, 2024, 4:43 PM

                        Yes, you can setup the VPN as TAP and bridge the interfaces. But that will only work for one interface and you have 3. And it introduces a bunch of other things you don't want so I wouldn't recommend it.

                        Adding an OBN rule that matches will allow this to work. The best solution is to just allow it on the hosts though.

                        Make sure the rules are actually loading in Status > Filter Reload. Make sure it returns without errors.

                        J 1 Reply Last reply May 24, 2024, 5:35 PM Reply Quote 0
                        • J Offline
                          jg8000 @stephenw10
                          last edited by May 24, 2024, 5:35 PM

                          @stephenw10

                          Ok, I'm confused now.

                          Looks as if rules are being loaded without error.

                          This is my Outbound rule

                          Screenshot 2024-05-24 at 10.34.42 AM.png

                          1 Reply Last reply Reply Quote 0
                          • S Offline
                            stephenw10 Netgate Administrator
                            last edited by May 24, 2024, 11:27 PM

                            Yet you still see the states with no NAT applied?

                            J 1 Reply Last reply May 24, 2024, 11:35 PM Reply Quote 0
                            • J Offline
                              jg8000 @stephenw10
                              last edited by May 24, 2024, 11:35 PM

                              @stephenw10

                              I still can’t get it to work on my test setup, but I was able to solve the production issue.

                              It was the Cisco switches breaking comms between the devices and the firewall. No fix yet, other than to use a dumb switch. The traffic flowed just fine right away, I was able to provision the nodes with no issue.

                              I’m still seeing some weird timeouts with the VPN, could be a timeout issue, not sure

                              Thanks so much for all of your help

                              1 Reply Last reply Reply Quote 0
                              • S Offline
                                stephenw10 Netgate Administrator
                                last edited by May 25, 2024, 12:38 PM

                                Ah, well that's a much better solution. Adding NAT in there is always a workaround.

                                That NAT looks like it should match and be applied though.

                                1 Reply Last reply Reply Quote 0
                                44 out of 44
                                • First post
                                  44/44
                                  Last post
                                Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                  This community forum collects and processes your personal information.
                                  consent.not_received