Navigation

    Netgate Discussion Forum
    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search

    Route traffic from LAN to OpenVPN Client network

    OpenVPN
    2
    6
    2461
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      mvrk last edited by

      Hi,

      I've configured my pfsense as an openvpn client in order to access the 172.21.0.0/16 network, the connection is ok and it pushes the route to 172.21.0.0/16 network and from pfsense i can ping ips from 172.21.0.0/16 network.

      But now i want to access the 172.21.0.0/16 network from my LAN network, i've configured this rule on pfsense:

      ID Proto Source Port Destination Port Gateway Queue Schedule
      IPv4 * LAN net * 172.21.0.0/16 * *         none

      But still no luck, do i need anything else to make it work?

      1 Reply Last reply Reply Quote 0
      • johnpoz
        johnpoz LAYER 8 Global Moderator last edited by

        why would you need that rule - isnt there already a lan rule that say lan net to anything allowed?  This is the default lan rule.

        the routes should already be in there.  What is pfsense route table look like?  If pfsense can ping clients in 172.21/16 then clients on its lan should be as well from the rules.  What is most likely is the problem is your outbound nat.

        How does the remote network know to talk to your lan clients IP?  What are you lan clients network?  Are you natting your clients to pfsense vpn connection IP?

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 22.05 | Lab VMs CE 2.6, 2.7

        1 Reply Last reply Reply Quote 0
        • M
          mvrk last edited by

          @johnpoz:

          why would you need that rule - isnt there already a lan rule that say lan net to anything allowed?  This is the default lan rule.

          the routes should already be in there.  What is pfsense route table look like?  If pfsense can ping clients in 172.21/16 then clients on its lan should be as well from the rules.  What is most likely is the problem is your outbound nat.

          How does the remote network know to talk to your lan clients IP?  What are you lan clients network?  Are you natting your clients to pfsense vpn connection IP?

          My rules are to block everything unless i allow it first.

          My LAN is 192.168.2.0/24, and on the remote side there is also a lot of 192.168.X.X networks, so they are natting all 192.168.0.0/16 to 172.21.0.0/16.

          I think the problem is that i'm not natting my LAN clients to pfsense vpn connection.

          On the remote server they see messages on their openvpn logs like:

          MULTI: bad source address from client [192.168.2.10], packet dropped.

          1 Reply Last reply Reply Quote 0
          • johnpoz
            johnpoz LAYER 8 Global Moderator last edited by

            Well you shouldn't have to nat if you don't want to..  They just need a route back..  But using 192.168/16 means they overlap your network - is that a typo?

            Your not going to want to have the same networks on both sides of your vpn connection.  Either change your network to something other 192.168 or why and the hell are you using /16's for vpn and do they really have so many machines they need a /16 – all in 1 broadcast domain? ;)

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 22.05 | Lab VMs CE 2.6, 2.7

            1 Reply Last reply Reply Quote 0
            • M
              mvrk last edited by

              @johnpoz:

              Well you shouldn't have to nat if you don't want to..  They just need a route back..  But using 192.168/16 means they overlap your network - is that a typo?

              Your not going to want to have the same networks on both sides of your vpn connection.  Either change your network to something other 192.168 or why and the hell are you using /16's for vpn and do they really have so many machines they need a /16 – all in 1 broadcast domain? ;)

              They have 192.168.2.0/24, 192.168.200.0/24, 192.168.201.0/24, 192.168.10.0/24, 192.168.5.0/24, 192.168.20.0/24.

              On my side i also have 192.168.2.0/24 and 192.168.10.0/24, so these two overlap.

              1 Reply Last reply Reply Quote 0
              • M
                mvrk last edited by

                I've configured an oubound NAT to nat my LAN clients accessing 172.21.0.0/16 to the OpenVPN connection IP, and it fixes my problem.

                1 Reply Last reply Reply Quote 0
                • First post
                  Last post