Configuring a VPN endpoint behind another firewall
-
I currently have a ubiquity EdgeRouter Lite as my main firewall at home, and there are 3 openvpn tunnels running on it.
I'm going to be added a few more tunnels (~4) and was thinking that it might be better to use pfsense on a VM as a VPN endpoint behind the ERL. Then I could provide more RAM and CPU as needed to keep things flowing smoothly.
Is there a recommended setup for something like this? I won't be needing the firewalling, so I was planning to completely disable that, but there won't be two separate subnets for the interfaces, so should I be looking into some kind of one armed router config with virtual interfaces? I'm also not sure about openvpn vs. ipsec, but I figured that I could perform some testing to find out what's better on that front.
-
For a VPN router you only need one interface. The "wan" can exist on your current LAN. The edge router would forward in the VPN port(s) to pfSense, and the edge router would also have a static route pointing the VPN subnet(s) at pfSense. That's really all there is to it.
