Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    OpenVPN Server, OpenVPN Client and NAT

    NAT
    2
    2
    1372
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • A
      alext
      last edited by

      Hi all!

      I have a router with pfSence 2.1-RELEASE (amd64) installed; one WAN and LAN interface. I also have set up an OpenVPN client to the partner site and an OpenVPN server for road warriors.

      OpenVPN server: ovpns2, IP: 192.168.4.1, 192.168.4.2…11/24 for road warriors.
      OpenVPN client: ovpnc1, receives a dynamic IP (192.168.10.x) and a route to a network at the partner site.

      I have to set up NAT on ovpnc1 so that the partner site doesn't need to know of our IPs, it knows just 192.168.10.x IP address that was given to our OpenVPN client. So, the Manual Outbound NAT rule was added:

      Interface: OpenVPN
      Source: 192.168.2.0/24 (our LAN)
      Translation Address: Interface address

      It has generated the following rule (from pfctl -sn)
      nat on openvpn inet from 192.168.2.0/24 to any -> (openvpn) port 1024:65535 round-robin

      And that is the problem: one half of my outbound connections to the partner site via ovpnc1 interface has source IP address translated to ovpnc1 IP address (that is correct), and the other half has source IP address translated to ovpns2 IP address (192.168.4.1), that is incorrect.

      How do I configure pfSense to use only OpenVPN client address in NAT?

      Thanks.

      1 Reply Last reply Reply Quote 0
      • P
        phil.davis
        last edited by

        You could try assigning an actual interface to the OpenVPN client - then it will become OPTn. Then you can put the manual outbound NAT rule/s specifically on this OPTn interface and it should then apply only to the OpenVPN client link, and not be mixed up with the Road Warrior server.

        As the Greek philosopher Isosceles used to say, "There are 3 sides to every triangle."
        If I helped you, then help someone else - buy someone a gift from the INF catalog http://secure.inf.org/gifts/usd/

        1 Reply Last reply Reply Quote 0
        • First post
          Last post