Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    How to build NAT rule for OpenVPN network on pfSense with single interface

    Scheduled Pinned Locked Moved NAT
    2 Posts 1 Posters 1.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • B
      bruceus
      last edited by

      Hello to all.
      We have firewall publicly available (public IP). I am trying to build pfSense device behind this firewall and use it as a VPN concentrator. I would like to use it only with one interface. So public firewall will translate requests to UDP port 1194 to pfSense device. The servers which should be presented to the VPN users are on the same subnet as the pfSense single interface.

      (INTERNET) –--> (public firewall) ----> (pfSense)

      So far I managed the OpenVPN to work. The user is connected to the pfSense with OpenVPN but could not ping any of the local IP addresses.

      pfSense 1st interface: WAN - 10.1.8.242/27
      pfSense 2nd interface: LAN - disabled
      OpenVPN network: 10.44.44.0/24
      Example server to ping: 10.1.8.237

      I need to translate all traffic from the network 10.44.44.0/24 to the IP 10.1.8.242. How can I achieve this?

      The help would be appreciated.

      Michal

      1 Reply Last reply Reply Quote 0
      • B
        bruceus
        last edited by

        I've helped myself.
        Obviously I had to restore outbound NAT rules. I don't know if I deleted NAT rules while playing or the NAT rules couldn't be built if the LAN interface is disabled.

        Resolution:
        I reinstalled pfSense with 2 interfaces. I've setup everything including OpenVPN.
        Then I switched outbound NAT rules from "Automatic outbound NAT rule generation" to "Manual Outbound NAT rule generation" and then changed Source addresses from LAN subnet to the subnet where the WAN interface resides. Also NAT Address has to have value "WAN address". The final step was to disable LAN interface. Now if I create OpenVPN tunnel I am able to access servers which are in the same LAN as the WAN interface.

        ![Firewall_ NAT_ Outbound.png](/public/imported_attachments/1/Firewall_ NAT_ Outbound.png)
        ![Firewall_ NAT_ Outbound.png_thumb](/public/imported_attachments/1/Firewall_ NAT_ Outbound.png_thumb)

        1 Reply Last reply Reply Quote 0
        • First post
          Last post
        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.