Cant communicate with slave/backup pfsense instance via OpenVPN

[jedblack]

Hi all,

I have a weird problem…

I got to 2x Pfsense 2.0R instances running (192.168.1.9/10), :LAN segment is 192.168.1.0, :openvpn segment is 170.32.10.0/24

When I VPN into 192.168.1.9(via WAN interface) I can ping the GW (192.168.1.9) and I can ping anything on my LAN segement.  However, I CANNOT ping/access the slave/backup Pfsense instance(192.168.1.10), but if I remote desktop into a windows instance (192.168.1.112) I can ping/access(80) the instance(192.168.1.10)

Any ideas.... i'm tapped out

Thanks guys/gals.

[jimp]

That's normal, due to the routing involved.

Could probably work around it with some outbound nat trickery on the LAN (nat from openvpn clients to the lan ip if they try to access the other box's IP).

[jedblack]

Hi Jimp,

Could you elaborate a little bit more?

I wouldnt' do a 1:1, but a 'outbound', and i would have to change it for automatic to manual correct?

[jimp]

well the easiest thing to do would be outbound NAT on the LAN interface, source of the openvpn subnet, translated to the LAN IP of the box.

Yes, you'd have to switch to manual.

You could do 1:1 NAT on LAN from an OpenVPN IP to a VIP (non-CARP!) in the LAN subnet, but that would only work for one client with a static IP.