• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

Routing between OpenVPN and External Subnet

Scheduled Pinned Locked Moved OpenVPN
4 Posts 2 Posters 1.1k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • R
    rckalex
    last edited by Apr 22, 2015, 1:49 AM

    Current configuration
    pfsense @ 10.0.1.1 – 10.0.1.0/24

    OpenVPN server on pfsense (tunnel network 10.0.2.0/24)
      route 192.168.1.0 255.255.255.0
      push "route 192.168.1.0 255.255.255.0"

    pfsense Opt1 plugged into LAN port of different router @ 192.168.1.1 -- 192.168.1.0/24

    pfsense Opt1 has static IPv4 address of 192.168.1.254

    OpenVPN interface and Opt1 are bridged

    Outbound NAT rule on Interface Opt1 Source being 10.0.2.0/24 Destination being any NAT address is 192.168.1.0/24

    I would like to be able to access the 192.168.1.0/24 subnet when connected to the OpenVPN server -- is this possible? What would i need to change in my configuration

    1 Reply Last reply Reply Quote 0
    • P
      phil.davis
      last edited by Apr 22, 2015, 2:29 AM

      No bridging needed - get rid of that.

      On the pfSense OpenVPN server put all the local networks in the "Local Network/s" box, like:
      10.0.0.0/24,192.168.1.0/24

      There is no need to put anything in the advanced box (no "route" or "push…" statements needed - the code underneath does the needed stuff from what is in the Local Network/s box).

      Make sure the firewall rules on OpenVPN and OPT1 allow the traffic.

      Also, I strongly suggest you use some other subnet than 192.168.1.0/24 - that is so common out in home and cafe-land that you are sure to get conflicts when connecting in from somewhere.

      As the Greek philosopher Isosceles used to say, "There are 3 sides to every triangle."
      If I helped you, then help someone else - buy someone a gift from the INF catalog http://secure.inf.org/gifts/usd/

      1 Reply Last reply Reply Quote 0
      • R
        rckalex
        last edited by Apr 22, 2015, 7:05 PM

        I appreciate you taking the time to reply!

        I've removed the bridge.

        Firewall Rules are as follows:
        Opt1 PASS – IPv4 Source - any Port - any Destination - any Port - any Gateway - any

        OpenVPN Pass - IPv4 Source - any Port - any Destination - any Port - any Gateway - any

        Removed the statements from the advanced box and added 192.168.1.0/24 to "Local Network/s"

        Still unable to access devices on 192.168.1.0/24

        I'm thinking the Outbound NAT rules are incorrect or incomplete

        Is it correct to have an IP assigned in 192.168.1.0/24 subnet to OPT1? Should I have an upstream gateway configured for OPT1?

        Thanks for the suggestion. I was planning on moving the subnet and all devices on it once I get this configured.

        1 Reply Last reply Reply Quote 0
        • P
          phil.davis
          last edited by Apr 23, 2015, 2:11 AM

          Outbound NAT rule on Interface Opt1 Source being 10.0.2.0/24 Destination being any NAT address is 192.168.1.0/24

          I just noticed that. You should not need any Outbound NAT going to OPT1. And in any case you should be NATing that to "Interface Address" - forcing the NAT to 192.168.1.0 would break things because that is the base subnet address and likely will not work.

          OPT1 is an ordinary LAN-style interface here - do not put any upstream gateway.

          As the Greek philosopher Isosceles used to say, "There are 3 sides to every triangle."
          If I helped you, then help someone else - buy someone a gift from the INF catalog http://secure.inf.org/gifts/usd/

          1 Reply Last reply Reply Quote 0
          4 out of 4
          • First post
            4/4
            Last post
          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
            This community forum collects and processes your personal information.
            consent.not_received