set up pfSense as additional gateway into VPNs

viragomann

@sgw
As mentioned, client sites networks have to be specified once in the server settings at "remote networks" and again in the CSO.

If they are missed in the server settins pfSense doesn't add routes.

sgw

@viragomann

I don't see where to add that, and I didn't do that for the other clients.

VPN/ Server/ OpenVPN/ Servers/ Edit ?

used Search in Browser, not found ;-)

sgw

currently it seems to work after adding a NAT outbound rule on the client

OpenVPN 192.168.8.0/24 * 192.168.1.0/24

we test now

sgw

That outbound rule editing changed something, as if there was something changed under the hood.

Right now the admin there is able to access systems on the other side of the tunnel, as intended.

Nothing changed on the OpenVPN server, btw.

That NATing isn't fully correct still

What I'd like to have:

server side IP should be able to ping a PC on the client side
server side VM should be able to access a system on the client side, with a mapped IP in the client LAN

currently I have this, and rebooted for a check, the admin is able to access a server VM via RDP: GREAT, but not 100% yet ;-)

THANKS so far, I think I need some time afk now soon

viragomann

@sgw
Yeah, outbound NAT rules (masquerading) can be used to circumvent missing routes.
I'd rather set the routes properly, but depends on the use-case.

sgw

@viragomann I agree but I repeat: where to set these routes? See question above. Thanks.

viragomann

@sgw
The "Remote networks" field is only available in peer to peer server mode. But this is, what you should set up for your use case.

sgw

@viragomann Ah, that explains why it feels like barking up the wrong tree ;-)

I hope I can run that in parallel to the other openvpn-server? (separate port, sure).

Thanks so far, have a nice weekend!

viragomann

@sgw
Yes, of course you can run multiple OpenVPN servers for different purposes.

sgw

I set that up on the server site pfSense.

For the peer to peer VPN there is no Client Export, so I assume I have to set up a Server on the other site as well, also in Peer2Peer-Mode? For sure I browse the docs in a minute.

looking forward to solve this ;-)

EDIT: I see, seems I can follow this for example. So not a 2nd server but a specific client config. Will try monday or so.