Bypass VPN VLAN to external IP?
-
@viragomann Thanks for the tip about the ping, I did not know that. Now I've switched to a different test, there are 2 web interfaces on the Linux server, on port 80 and 8080. I figured I should be able to access those from "another place" as long as the other place can reach the server.
@viragomann said in Bypass VPN VLAN to external IP?:
Just add a pass rule to the VLAN 18 interface to allow it.
So would you say that I don't need to do anything with NAT though?
I didn't know for the gateway if I'm supposed to select default or the non-VPN gateway. I've tried both and it's not working yet. I also tried changing the order, that didn't help.
Then I also tried to do the same on the ovpnc1 interface (OPT8_VPN) and that didn't seem to help either.
Just to confirm that I have the right idea, the following is true?
This is probably not relevant but I am a bit confused by having 2 different VPN thingies under firewall rules:
I feel like with the 4 rules I've added that traffic for the server (...99.106) is allowed to come in through the VLAN18 and uses the non-VPN gateway. Since it's still not working I will try to do a outbound NAT but here too I'm not really sure what I'm doing and I've read a bunch of documentation but I still don't completely understand.
I'm struggling with stuff that is probably super basic. For instance, outbound NAT, I'm confused what I select as the interface. The description reads:
The interface on which traffic is matched as it exits the firewall. In most cases this is "WAN" or another externally-connected interface.This is most confusing to me. I thought the interface is the place that the traffic is coming in from. Doesn't outbound mean it's going out through the WAN, like in my case I'm trying to go in at VLAN18 and then out from the WAN port. I don't know why it says for the outbound NAT that the interface is usually the WAN port. It's also slightly confusing to me "as it exits the firewall". I know that all the firewall rules apply to incoming traffic only. So I guess it looks like this: interface (VLAN18) -> firewall rule (matches with a pass) -> traffic now exits the firewall and enters the outbound NAT. Is that right?
The interface I selected is the VLAN18 and I think that is the right one. I have a little bit of confusion regarding the other 2 VPN interfaces. I think that OPT8_VPN is like a virtual WAN port that goes to the VPN and I don't know what OpenVPN is under rules but I imagine it's something similar. Neither of those have any rules defined and my understanding is that rules for those 2 apply to incoming connections from the VPN side, so no rules is correct for those.My understanding regarding the rules for LAN is that because I only use VLANs that the LAN is just the physical interface and I can ignore it completely and add all my rules to WAN and VLANs instead. The LAN interface only comes into play if there is untagged traffic coming in, which there isn't.
Anyway, back to the outbound NAT, I select VLAN18 as the interface and I put the linux server (192.168.99.106) as the destination (I believe this is important so that all other traffic continues to go through the VPN). Under translation for address I put WAN interface. I believe this means the traffic going to the Linux server will end up looking like it's coming from 192.168.99.200. I don't think that even matters, my understanding is that it would be fine if the traffic looks like it's coming from 192.168.18.30 (the Win PC) which is why I'm not even sure that I need outbound NAT. So now it looks like this:
I also tried specifying the ports:
It still doesn't work and as you can tell from all of my noob questions I'm basically completely lost and at the same time aware that what I'm trying to achieve is probably a very simple task.
-
Because the destination is in the WAN subnet directly you should not set a gateway on that pass rule. That traffic has to go directly to the target not via the WAN gateway device.
Steve
-
@SubSeven said in Bypass VPN VLAN to external IP?:
So would you say that I don't need to do anything with NAT though?
Presumed, you have a gateway stated in the WAN interface settings and with outbound NAT in hybrid mode, pfSense nats traffic leaving the WAN to the WAN address automatically. So no further settings needed.
Automatically created outbound NAT rules are listed below the manual rules.
-
@stephenw10 Ok, thanks. I took out the firewall rule that had called for the WAN gateway, so it just looks like this now but still doesn't work:
@viragomann I kind of thought that, I took out the outbound NAT entry again. So now it looks like this but still doesn't work and I assume the portion in the yellow square is what you were referring to:
-
Check the state table in Diag > States while you're pinging.
-
Btw. I don't know if this means anything but under diagnostics/routes, I don't see 192.168.99.106 listed and I also don't see it under diagnostics/states or diagnostics/states summary.
I played around in diagnostics and found this port test and it succeeded, so at least that part works.
The ping also worked.
-
@stephenw10 Ok, I did that and something did show up:
-
@stephenw10 I don't know if this helps, but below is the same thing with ping happening, and trying to access web interface on port 80 and on port 8080:
I also tried turning off the firewall on the server:
sudo ufw disable
Firewall stopped and disabled on system startup -
Ok so that is the incoming state. There should be an outgoing state on WAN too.
If it's not going out of the WAN there may be firewall rules preventing it. Or there may be no route.
You said you don't see a route but the WAN should be in that subnet. What do you see in the routing table?
-
@stephenw10 I really appreciate you helping me btw.
For the WAN rules there are these:
All the tables seem to be pretty empty, unless I'm looking at the wrong thing:
-
Diag > Routes is where the routing table is.
The rules that might block that would be outgoing so on the floating tab. Unlikely there are any.
If you have an IPSec VPNs defined that might be grabbing the traffic.
-
@stephenw10 my bad!
The floating rules are empty yes.
This is what is under routes for IPv4 and 192.168.99.106 is not on the list:
-
@stephenw10 I don't know if this helps but here are all the rules:
-
Hmm, well it correctly shows the 192.168.99.0/24 subnet on the igc0 interface directly so it should send that traffic to it.
Something must be blocking it. I'd check IPSec tunnels.
-
Try pinging it from the firewall but setting the source to the OPT9 address then check the states.
-
@stephenw10 Those look empty. I'm going to restart pfSense to see if that does anything and I'll also restart the Win PC and the Linux server.
-
@stephenw10 I powered all 3 down, started pfSense back up, then Linux server, and then the Win 10 PC but the good old "restart your computer" trick didn't help :)
I tried the ping and that seems to work:
At the same time I was doing that I checked the states again and saw an entry for ...99.106:
-
Ok, so that is translating as expected.
One thing I see is that pfSense has two IP addresses in that subnet, 192.168.99.99 and 192.168.99.200. Which of those is the WAN address?
-
@stephenw10 192.168.99.99 is the gateway of the parent router, it is part of my old / original network which I want to eventually get rid of. That one is running OpnSense.
I access it from what I labeled as test PC (...99.111):
To get to the pfSense PC we've been talking about, I would go to 192.168.99.200 so that tells me that is the WAN IP.
-
@stephenw10 I also wanted to share the details of the outbound NAT that is used for the VPN in case there is something in there.
