1 WAN interface, 3 LAN interfaces, OpenVPN allow communication to all networks

[jg8000]

I am new to pfsense, and need some help

I have a WAN connection, an OpenVPN server setup (192.168.1.50.0/24), and 3 LAN physical interfaces:

192.168.1.0/24
192.168.2.0/24
192.168.3.0/24

I want the VPN clients to access all addresses/protocols on all LANs.

I setup the interfaces with a static IP and a /24 network

I setup the firewall rules for each interface for any source to any destination.

I am unable to communicate with a VPN client to the LAN networks, any advice on how to troubleshoot this and if I set things up correctly? I can connect to the VPN and get to the pfsense admin page on each LAN ( the .1 on each interface) but not to any other ips on any LAN.

Thanks

[viragomann]

@jg8000
In pfSense you have to define filter rules on the incoming interface.
So if you want the VPN client to access any IP you need to add a rule to the OpenVPN tab to allow any destination address.

However, I rather suspect, that your LAN devices block access from outside of their subnet. To verify just try to access one from another LAN subnet.
If it blocks the access you might have to configure its firewall accordingly to allow it.

[stephenw10]

@jg8000 said in 1 WAN interface, 3 LAN interfaces, OpenVPN allow communication to all networks:

an OpenVPN server setup (192.168.1.50.0/24)

Is that not in pfSense then? Any reason you are not just using the OpenVPN server in pfSense?

Doing so makes this much easier.

[Gblenn]

@jg8000 Can it be the VPN client where you need to include all three networks in the "allowed IP's" list??

[jg8000]

@stephenw10

I am using the built in OpenVPN server, I’m just using a different subnet for VPN connections. Does that just complicate things?

[jg8000]

@Gblenn

I entered all 3 LAN subnets in the vpn server local networks, is that what you mean?

[jg8000]

@viragomann

On each interface, I added a rule to for any protocol and for any source and any destination, just as a basic rule to get things going. I also tried using the interface network as the source.

[viragomann]

@jg8000
As I wrote above, I don't really believe, that it's pfSense, which is prohibiting you from accessing the devices.

[stephenw10]

@jg8000 said in 1 WAN interface, 3 LAN interfaces, OpenVPN allow communication to all networks:

I am using the built in OpenVPN server, I’m just using a different subnet for VPN connections.

That's fine and would be required. But in your first post you showed the VPN subnet conflicting with one of the LANs. Re-reading that though I think it's a typo? 192.168.1.50.0/24

Is that in fact 192.168.50.0/24? Which would be fine.

[stephenw10]

Yes it could well just be the hosts rejecting traffic from outside their subnet.

Can you ping the interface address (.1) from each subnet from the VPN clients?

[jg8000]

@stephenw10

Yes, I can ping .1 on each subnet

[stephenw10]

Ok so try to ping something on of the other subnets you think should respond; leave the ping running.

Check the state table in Diag > States. Filter it by that ping target and make sure you see the expected two states. One on the VPN and one on the internal interface.

Steve

[jg8000]

@stephenw10

thanks, I tried that for 2 subnets. State is 0:0 and packet number grows on the VPN client side but not on the other, for both. I allow any so icmp should get through.

Maybe the issue is elsewhere, I'll try and get a console up on the machine that I expect to be up.

[stephenw10]

Can you grab a screenshot of that?

[jg8000]

@stephenw10

Sure

[stephenw10]

Ok, so in both cases that ping is coming in the VPN and leaving the internal interface correctly but no replies come back.

So either the target devices are not replying or the replies are not coming back to pfSense. More likely they just don't reply to pings from outside their own subnet because of local firewall restrictions.

What are those target devices?

[jg8000]

@stephenw10

Thank you for your help.

I have duplicated the issue on a separate setup.

I have 3 interfaces setup:

WAN

LAN: set to static 192.168.1.1/24

OPT1 - set to static 192.168.2.1/24

I enabled DHCP for both, and setup a windows client on each LAN. I don't have OpenVPN on this setup but I think the problem is similar.

The machines can't ping each other. They both get DHCP addresses, I can ping the statically assigned interface IP, access the pfsense admin .1 address from each client. I can even get to the other interface .1 pfsense login from each client.

But I can't get them to ping each other.

I don't understand what I'm doing wrong.

[jg8000]

@stephenw10

Ok, you are correct. It was the local firewall restricting the response. I turned off the local firewall and I can now ping. I did not try other services yet.

The real world scenario is access the LAN via ssh from the VPN Net, and to access the IMPI/iLO also.

Right now it's not working, can't access ssh or ping, it's Rocky 8/9 so a firewall could be the issue. Not sure about iLO, it should be accessible via https but that isn't working either.

[stephenw10]

You can work around it with an outbound NAT rule so traffic appears to be sourced from the pfSense interface address.

But a cleaner solution is to add rules on the targets to allow the access.

[jg8000]

@stephenw10

Thank you, so if I wanted to add an Outbound NAT rule to make it seem like the traffic is originating on the same subnet, how can I set this up?

If I come in via VPN on 192.168.50.0/24 and want to connect to 192.168.3.1/24 how is the rule configured?

This is my attempt on my test bench trying to get to an IPMI device on 192.168.3.101 (OPT2) from 192.168.1.5 (LAN). I can get to IPMI only if I configure the network port to be on the 192.168.3.1/24 (OPT2) interface