set up pfSense as additional gateway into VPNs

[sgw]

Greetings, I could need your help here:

For a customer I configure pfSense-appliances (small 1100s) which are rented to their customers.
They want hw appliances so that the paying customers "see what they get" ;-)

The boxes should be plugged between the existing LAN and the PCs, pull an IP and act as DHCP and OpenVPN client, calling "home":

a tunnel is established, and via CSO they now can reach one single VM in the server LAN at my customers site

So we have the following "features":

• pull WAN-IP per DHCP
• provide DHCP to the PCs behind its LAN-NIC
• act as VPN client, route traffic to one server VM
• optionally provide access from the server VM to stuff like payment terminals or printers at the client side (via NAT portforwardings)

So far this works, we run around 20 of them

For sure the concept has flaws: double NAT, sometimes issues accessing existing Wifi (which is in the original subnet) etc / AND the pfSense is a SPOF now

So we want to come up with better solutions:

• I'd like to place the 1100 as an additional gateway routing to the servers
• no more DHCP-server on it
• PCs keep their def gw, and get a route added ("to reach server X, send packets to pfSense-IP")

What I don't get yet:

• WAN and LAN of the pfSense would be in the same subnet: can't work
• can I set that up using one NIC only somehow?

The appliances should be as much "plug and play" as possible

I appreciate any help here, so far I am a bit lost ... thanks

ps: I see that this would be a use-case for something like tailscale etc ...

[viragomann]

@sgw said in set up pfSense as additional gateway into VPNs:

can I set that up using one NIC only somehow?

A router on a stick design? For sure, you can set this up.

pfSense only needs a single IP in this case.

On the internet router you have to forward the OpenVPN traffic of course.

The appliances should be as much "plug and play" as possible

You need to set a static route on each client, which needs to access the remote site, as you already mentioned. But this can be done via DHCP.
You can also consider to forward traffic on pfSense to the server, in case that there is no need to access a LAN device from the remote site.

If you connect the WAN interface to the network, ensure the remove the "block private networks" in the interface settings. But you can as well attach the LAN to their network.

Aside from this and proper firewall rules, there is nothing special to concern with this setup, what come into my mind.

[sgw]

@viragomann thanks for your reply

I will look into this concept, so far I don't understand:

• the pfSense would need an upstream gateway (the existing router there): so the one NIC used would have to be type WAN?
• or set up a LAN interface and manually add routes?

[viragomann]

@sgw
Yes, you have to state the router as upstream gateway. But you can use either interface. The upstream gateway must not be necessarily defined on the WAN.

If you connect the LAN to the router you can as well define the gateway in the LAN interface settings.
And if the router provides a DHCP server the gateway will be configured automatically, however, you probably want a static mapping to forward the VPN traffic to the proper IP.

[sgw]

@viragomann As far as I know as soon as you define a gateway "on the interface" it gets a WAN-interface. Doesn't hurt, I assume, I don't know if that enables NAT etc

[viragomann]

@sgw
What WAN is depends on your setup.

But yes, good point, stating an upstream gateway in the interface setting, leads pfSense to create automatic outbound NAT rules.
However, for your use case, outbound NAT is not needed for internal networks. In fact, the rules will have no impact, since you don't route any traffic from the LAN out on the upstream interface. Only rules for pfSense itself accessing the internet are needed.

[sgw]

@viragomann I still don't fully get it, but maybe I have to take an existing box and start adjusting it to learn that step by step.

So I would only set up a single NIC, add a gateway in "Routing" ... set up an OpenVPN-client with the correct subnets etc and ... done?

googled for router on a stick with pfSense, found mostly setups using 2 VLANs on one NIC. That's beyond what I need, I think.

[viragomann]

@sgw said in set up pfSense as additional gateway into VPNs:

googled for router on a stick with pfSense, found mostly setups using 2 VLANs on one NIC.

You have two network segments on two interfaces as well in fact. With at least two, a router makes sense. But only one of them has an outside NIC.
This one you connect the existing LAN subnet and the other one is the VPN subnet, which has a virtual interface inside pfSense.
On the VPN you have a route to the remote site. On the LAN you have the default route.

As mentioned, you can use either interface for this, but if it's the WAN, ensure the remove the "block private networks" check in the interface and in both cases enter the gateway directly there. This sets the default route automatically and add outbound NAT rules, so that pfSense is able to search for updates.