NAT help for VPN tunnel to VPS

  • Hello,

    I have a VPS server that is hosting a samba share (Windows share) that I'm connecting to via a VPN connect. My pfsense box is the client and the VPS server has a static IP of See the picture for the current setup.

    I can connect to the VPS through the VPN connection and according to the VPN Status page, everything up and working normally. I obtain a 10.8.0.X IP and doing ping tests from PfSense always works. I experience intermittent issues connecting to the shared drive and also pinging the VPS's internal IP of from any of my LAN network devices, all on network.

    From a laptop,

    Tracing route to over a maximum of 30 hops

    1    <1 ms    <1 ms    <1 ms  pfsense.internal.mydomain.local []
      2    49 ms    49 ms    49 ms

    Is there something that I'm missing in regards to NAT'ing?

  • Sorry, but I'm not sure why you need the NAT at all.

    Normally I'd expect your VPN setup to handle the assignment of routing through the tunnel.

    What are you using for your VPN, IPSec, OpenVPN?

  • I'm using OpenVPN.

    If I don't use any NAT rules then only the pfsense box itself can reach as all other devices on the network don't know how to reach the and get sent out onto the internet.

    The other people sharing the samba share on the VPS are all using tomato on their routers and in their OpenVPN settings, it's a checkbox for "Create NAT on tunnel" which I'm trying to create manually on pfsense.

    I read through a few how-to's for configuring pfsense with an OpenVPN VPS but they are all for browsing the Internet through the VPN. I don't want to browse the internet, only access the samba share hosted on the VPS.

  • This sounds more like an OpenVPN problem than a NAT issue.

    Normally you just add the remote subnet you want access to via the tunnel and the pfSense box sets up the routes automatically.

    What does your pfSense OpenVPN client setup look like?

    What version of pfSense are you running?

  • Attached is a OpenVPN client configuration page.

    I'm running the latest pfsense, 2.2.4-RELEASE (amd64).

    I didn't configure any remote subnet in the OpenVPN page, I think I'll give that a shot also. Thanks for the tip.

  • One thing that jumps out at me in your setup is the lack of an entry in "IPv4 Tunnel Network"

    Usually that's the tunnel subnet set by the OpenVPN server (your VPS provider in this case).

    I'm not sure how this is working if OpenVPN doesn't have a tunnel subnet to use to establish your connection.

    Does the VPS provider supply a cheat sheet/howto for setting up OpenVPN with their service?

    Edit: I'm going to suggest this thread be moved to the "OpenVPN" section

  • I have requested this thread be moved to the OpenVPN forum.

    Without any tunnel subnet or remove network specific, these routes are created by default when I start the OpenVPN client connection.

    Destination Gateway Flags Use Mtu Netif Expire UGS 4 1500 ovpnc3 link#13 UH 0 1500 ovpnc3 link#13 UHS 0 16384 lo0

    As for the VPS, we've installed the OS and configured OpenVPN ourselves. I'm the only person having issues, everyone else is using the tomato firmware on their routers and using a checkbox for "Create NAT on tunnel". That's why I was under the impression I needed to create NAT rules myself.

  • Well if you've created the server side of OpenVPN, that means you have full control which is very good.

    Without any tunnel subnet or remove network specific, these routes are created by default when I start the OpenVPN client connection.

    Just looked through the current and look at that, the tunnel specification is not a requirement. I always add it in mainly because it was a requirement in some past (10+ years ago) incarnations of OpenVPN I used and it part of my "checklist" (I'll have to revisit that….)

    Can you post the config file from the server's OpenVPN setup?

    That should show us what OpenVPN thinks it's supposed to do for you.  This shouldn't be too tough to setup at all if you have full control of both ends.

    BTW what is the LAN subnet on the VPS side?

  • On our VPS server,

    eth0 The public WAN IP
    tun0 inet addr:  P-t-P:  Mask:

    Here is the OpenVPN server's config:

    /etc/openvpn$ cat server.conf
    port 5060
    proto udp
    dev tun
    ca ca.crt
    cert server.crt
    key server.key  
    dh dh2048.pem
    ifconfig-pool-persist ipp.txt
    keepalive 10 120
    auth none
    cipher BF-CBC        # Blowfish (default)
    user nobody
    group nogroup
    status openvpn-status.log
    log         openvpn.log
    verb 3
    mute 20

    The part that's confusing me the most is that I'm the only one with issues.

  • So things are a little clearer to me now (I think).

    You don't have separate LAN and Tunnel subnets in this case as the VPS is hosting both the  Samba shares and the OpenVPN server on the same box.

    It's not a setup I've had to configure myself but I would add the OpenVPN tunnel subnet to your pfSense client:

    Add to the "IPv4 Tunnel Network" config box.

    I'm thinking that this will create a "Route command" within pfSense that can be given to the devices on your LAN so they can find your Samba server.

  • Correct, everything is hosted on the same server.

    I've added the route (OpenVPN creates the route for automatically).

    The strange issue that persists is the intermittent ping/availability of the samba share). I can try to ping a few times in a row and sometime it will work and other times it wont. When it does work, I can leave that ping command go for a long time (I stopped it after 10 minutes) and it works the whole time yet if I retry right after stopping a working ping doesn't mean it will work again a few seconds after.

    I have this rule under Firewall: Rules, OpenVPN tab AND the first image showing the NAT rule.
    Proto Source Port Destination Port Gateway Queue Schedule Description
    IPv4 * *      * *                 * *         none           OpenVPN OpenVPN wizard

    Also, according the the OpenVPN logs and the Uptime indicated from the OpenVPN Status page, the OpenVPN tunnel is always up even when the ping command or the samba shares are temporarily not working

  • remove the nat

  • Does OpenVPN automatically do the NAT'ing in the background?

    Without the NAT rule, the pfsense box can talk to on the VPS server however the server won't know how to reply to all other devices on my192.168.1.0/24 home network.

    Please correct me if I'm wrong here but my understanding of the NAT is it allows the to go out under whatever 10.8.0.X IP the OpenVPN server give me so the OpenVPN server thinks it's only talking to an 10.8.0.X IP and have no idea how to reach my internal network.

  • You mentioned:

    I'm the only person having issues, everyone else is using the tomato firmware on their routers

    How many people are connecting simultaneously?

    Any chance one (or more) of them has a LAN with a subnet?

    If two or more people connect via OpenVPN with the same external subnets, how does your VPS know which connection to use when routing a response to (for example) ""?

    It may be some work on your side, but can you try and change your LAN subnet to something other than (say,

    Normally OpenVPN setups are pretty simple and reliable, the fact that you're getting intermittent traffic makes me suspicious there's a fundamental conflict going on.

  • We are 4 people connected simultaneously.

    I've talked to two other people and we do have the same LAN with a subnet.

    The VPS doesn't know about any of our LAN networks. When we connect through OpenVPN, we are each assigned a separate 10.8.0.X IP. For example, I currently have

    I have been running the same pfsense server for a few years now always just doing upgrades and I've tried out a few configs in the past. I'm starting to wonder if there may be some NATing options that should be checked/unchecked from the Advanced Settings menu option within PfSense. I'm going to setup a few install of PfSense in a VM and compare with my current settings. I'm strongly leaning towards a NAT issue only because any test I do straight from the PfSense box always works but it always has it's own 10.8.0.X IP and not needing any NATing.

  • @jbiss_ca:

    Does OpenVPN automatically do the NAT'ing in the background?

    it does, once you assign an interface to the openvpn instance (interface-type = none)

  • Just to do a quick recap, I'm not trying to access the Internet through the VPN on the VPS server. We have a VPS server running OpenVPN server and I want to have access to that samba shares hosted on that same server.

    I've configured as I think heper meant. I don't see any automatically created NAT rules in the GUI though.

    My pfsense machine can still ping the VPS at however any of my other machines can't as shown in the picture. I tried to provide as much information as I thought would be usefull

  • Everything is now working, thank you very much divsys and heper for all the pointers.

    For those looking for a similar setup, here's what I needed to do.

    I needed to assign the OpenVPN client connection sto an interface, ex: OPT1 and set the Interface Type to none

    Under Firewall: Rules -> OPT1 tab, add the appropriate. ex: pass all traffic

    Under Firewall: NAT -> Outbound tab, select the interface used for the OpenVPN connection (ex: OPT1) and add the destination network (ex:

Log in to reply