Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Openvpn client nat problem

    Scheduled Pinned Locked Moved OpenVPN
    5 Posts 2 Posters 3.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • X Offline
      xxprowler
      last edited by

      hi,

      i've setup openvpn on my pfsense and expoerted it with the client export utility.
      now when trying to ping my LAN from the remote client(windows 2008 machine) i see the ping request on the pinged host(with wireshark) but the problem is that i see it coming from the tunnel subnet so it is obvious the ping will never return to the client machine.
      my question is, why doesnt the vpn server NATing the pings from the client so the host on the LAN sees them as if they are coming from the FW ?
      am i doing something wrong ? should i do a manual NAT ?

      thanks.

      1 Reply Last reply Reply Quote 0
      • jimpJ Offline
        jimp Rebel Alliance Developer Netgate
        last edited by

        By default, OpenVPN simply routes, it does not do NAT. If the firewall is the default gateway for things on the LAN, it will work fine the way you have it.

        If the firewall is not the default gateway for the LAN or the system on LAN has no gateway, then you have to setup manual outbound NAT to NAT out the LAN interface for a source network of the OpenVPN tunnel network. That isn't what most people want, so it is not the default.

        Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

        Need help fast? Netgate Global Support!

        Do not Chat/PM for help!

        1 Reply Last reply Reply Quote 0
        • X Offline
          xxprowler
          last edited by

          hi,

          you were right that this is not the default gateway of my LAN network as it is just a test right now before it becomes active.
          the problem is that I've seen this problem with wireshark on the destination LAN machine and tried to do a NAT rule for the LAN interface like this:
          LAN  10.72.68.0/24 * 192.168.123.0/24 * * * NO

          10.72.68.0/24 is the tunnel subnet in the openvpn config
          192.168.123.0/24 is the LAN subnet for this vpn server

          the NAT still doesn't work for me as i see the pings go back as the tunnel network IP and not with the IP of the vpn server's LAN IP.

          thanks.

          1 Reply Last reply Reply Quote 0
          • jimpJ Offline
            jimp Rebel Alliance Developer Netgate
            last edited by

            The NAT rule looks right.

            If you had a constant ping going when you added the rule, it may not have updated by just adding the NAT. You'll need to stop the ping and wait for the state to clear, or clear the state manually from Diagnostics > States, then try again.

            Remember: Upvote with the 👍 button for any user/post you find to be helpful, informative, or deserving of recognition!

            Need help fast? Netgate Global Support!

            Do not Chat/PM for help!

            1 Reply Last reply Reply Quote 0
            • X Offline
              xxprowler
              last edited by

              great !
              this fixed the problem.

              thanks for all your help :)

              1 Reply Last reply Reply Quote 0
              • First post
                Last post
              Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.