Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Vlan, LAN and Openvpn

    Scheduled Pinned Locked Moved NAT
    11 Posts 2 Posters 1.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • J
      jonna99
      last edited by

      Hi!
      I wonder if somone could guide me. Going crazy.
      I want to be able to reach LAN when connected to any external Openvpn-server. Windows openvpn client => VLAN =>LAN and WAN

      Connection from VLAN to LAN and/or WAN works fine…until I connect Openvpn from my windows client. Then I can only reach internet,WAN.

      My configuration;
      Interfaces WAN, LAN, OPT1
      One VLAN (OPT1) from wireless accesspoint.

      Thanks in advance for any help.
      Jonna
      Pfsense 2.26

      1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator
        last edited by

        so your running the vpn on windows itself, most likely that is setting your gateway to vpn, and forces all traffic out your vpn.  If you want to at the same time talk to stuff on your network then you need to alter the configuration so local traffic uses your local connection and not the vpn.

        Why don't you just run a client on pfsense, and then you can use policy based routing to have any device on your network use the vpn, or not, etc..

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        1 Reply Last reply Reply Quote 0
        • J
          jonna99
          last edited by

          Hi
          Thanks for quick answer!

          I do have an Openvpnclient on the firewall itself also. Some of the stuff is always connected to a vpn server through that.
          But it´s nice to be able to sometimes use the laptop (that mostly is connected directly to WAN) and connect quickly to a vpnserver without losing the possibility to reach LAN.

          So what you wrote in your answer is exactly what I want to do….without success...

          Jonna

          1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator
            last edited by

            what do you mean your laptop is directly connected to wan??  So this laptop is not behind pfsense, and you want to connect to stuff behind pfsense?

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            1 Reply Last reply Reply Quote 0
            • J
              jonna99
              last edited by

              Oh sorry my mistake!
              Of course I dont connect direct to WAN.
              Everything goes through Pfsense.

              Jonna

              1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator
                last edited by

                So you want to go through a different vpn out on the public internet, that you run on on your windows client and this traffic goes through pfsense.  But is not policy based routed to the other vpn?  Your not going to try to nest vpn connections are you?  That is not going to be very good performance wise.

                Is this other network your trying to access on your opt1 network and not the network your laptop is connected too?

                So I have multiple segments.. lan 192.168.9.0/24 but I also have stuff on my 192.168.2.0/24 segment, and etc…  If I connect to a vpn from this windows machine - I can still access stuff that is on the 192.168.9.0/24 but without creating a route to 192.168.2.0/24 then sure that would be broken..

                Here is my windows machine route table.  See how I have routes to 192.168.2.0/24 3.0/24 and 4.0/24, so even when my default route points to a vpn I still know how to connect to those other local networks.

                When I get home I can show you my route table when connected to my vpn how the default route changes out the vpn.

                windowsroutes.png
                windowsroutes.png_thumb

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                1 Reply Last reply Reply Quote 0
                • J
                  jonna99
                  last edited by

                  I appreciate your help.
                  I think I have soon tried all possible firewallcombinations there is…no maybe not.... but I´ve certainly tried very many.Changing settings in NAT and the firewall. After a while I start making more mistakes and have to revert to a saved config file time after time..

                  Befor I started to use VLAN there was no problem since everything went trough the LAN.

                  Thanks
                  Jonna

                  1 Reply Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator
                    last edited by

                    why are you messing with firewall rules?

                    Can your client get to your other network(s) when its not using the its own vpn client?  If so then your firewall rules are fine, and you need to to have routes on this client so it knows not to send traffic for your other networks out its vpn connection.

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    1 Reply Last reply Reply Quote 0
                    • J
                      jonna99
                      last edited by

                      Ok
                      yes, when i`m not using the vpnclient I can connect to everything….so I guess you are right..I need to fix the routes on the client pc. But how, do you know?

                      thanks
                      Jonna

                      1 Reply Last reply Reply Quote 0
                      • johnpozJ
                        johnpoz LAYER 8 Global Moderator
                        last edited by

                        yes what is your other network(s)..

                        Lets say your lan network is 192.168.1.0/24 with pfsense having an IP of 192.168.1.1, your other network off pfsense lets call it 192.168.2.0/24 with pfsense having an IP of 192.168.2.1 in this network.

                        So if your on 192.168.1.100 say for your client that uses the vpn, and you want to got to say something on 192.168.2.14 on the vpn client box just create a route.

                        from an elevated cmd prompt

                        route add 192.168.2.0 mask 255.255.255.0 192.168.1.1

                        Then look in your route table with route print

                        Now you should be able to get to stuff on 192.168.2.0/24 even when you have vpn client connected on that 192.168.1.100 box.

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                        1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator
                          last edited by

                          I saw your pm, but could not post pictures..

                          Here see how I can access my printer on different segment, even when I connect to my vpn - because I have a route!

                          Se my public IP is now showing vpn IP.

                          printeraftervpn.png
                          printeraftervpn.png_thumb
                          publicviapvpn.png
                          publicviapvpn.png_thumb

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          1 Reply Last reply Reply Quote 0
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.