Route single IP through Site-to-Site-VPN

This forum is for general conversation and user-user networking.

Moderators: TinCanTech, TinCanTech, TinCanTech, TinCanTech, TinCanTech, TinCanTech

Post Reply
dakapo
OpenVpn Newbie
Posts: 4
Joined: Wed May 03, 2023 9:52 am

Route single IP through Site-to-Site-VPN

Post by dakapo » Wed May 03, 2023 10:04 am

Hello everybody!

I have two locations (Home-Office, Main-Office) connected through a Site-to-Site-VPN between two pfSense-devices.

From my home-office I have several servers I want to connect to through the VPN and through the WAN-IP of the main-office.

It goes like this:
Home-Office (192.168.121.0/24) <---- OpenVPN (192.168.123.0/30) ----> Main-Office (192.168.122.0/24) <----> WAN

For building up the route to the different Destination-IPs (e.g. 1.1.1.1) I added the following command to my OpenVPN-Client on the pfSense in the Home-Office:

Code: Select all

route 1.1.1.1 255.255.255.255;
After that the packets are going out through the WAN of the pfSense in the Main-Office.
But no packets seem to come back to my client in my Home-Office.

I checked the Firewall and nothing seems to be blocked. I think I might have a routing-problem somewhere.

Normal connections between the two LANs of Home-Office and Main-Office are working fine.

Can anybody help me with this?

Thank you!
Daniel

dakapo
OpenVpn Newbie
Posts: 4
Joined: Wed May 03, 2023 9:52 am

Re: Route single IP through Site-to-Site-VPN

Post by dakapo » Wed May 03, 2023 12:28 pm

The routing-table of pfSense 1 (Home-Office, 192.168.121.1)

Code: Select all

Internet:
Destination        Gateway            Flags   Nhop#    Mtu      Netif Expire
default            109.205.200.1      UGS         7   1500        ix0
109.205.200.0/24   link#5             U           5   1500        ix0
109.205.200.1      link#5             UHS         4   1500        ix0
***.***.***.***    link#5             UHS         6  16384        lo0
127.0.0.1          link#9             UH          2  16384        lo0
192.168.120.0/24   192.168.120.2      UGS        10   1500     ovpns1
192.168.120.1      link#13            UHS         9  16384        lo0
192.168.120.2      link#13            UH          8   1500     ovpns1
192.168.121.0/24   link#1             U           1   1500       igc0
192.168.121.1      link#1             UHS         3  16384        lo0
192.168.122.0/24   192.168.123.1      UGS        13   1500     ovpnc3
192.168.123.1      link#14            UH         11   1500     ovpnc3
192.168.123.2      link#14            UHS        12  16384        lo0
1.1.1.1     192.168.123.1      UGHS       14   1500     ovpnc3
213.196.148.12     link#5             UHS         4   1500        ix0
213.196.149.12     link#5             UHS         4   1500        ix0

The routing-table of pfSense 2 (Main-Office, 192.168.122.1)

Code: Select all

Internet:
Destination        Gateway            Flags       Use    Mtu      Netif Expire
default            213.196.128.1      UGS    185021789   1500       igb0
127.0.0.1          link#5             UH      5659087  16384        lo0
192.168.121.0/24   192.168.123.2      UGS         842   1500     ovpns2
192.168.122.0/24   link#3             U      7353864632   1500       igb2
192.168.122.1      link#3             UHS           0  16384        lo0
192.168.123.1      link#8             UHS           0  16384        lo0
192.168.123.2      link#8             UH           16   1500     ovpns2
192.168.124.0/24   link#2             U             0   1500       igb1
192.168.124.1      link#2             UHS           0  16384        lo0
192.168.125.0/24   192.168.125.2      UGS     3276461   1500     ovpns1
192.168.125.1      link#9             UHS           0  16384        lo0
192.168.125.2      link#9             UH            0   1500     ovpns1
213.196.128.0/24   link#1             U             0   1500       igb0
213.196.128.1      **:**:**:**:**:**  UHS           0   1500       igb0
***.***.***.***      link#1             UHS           0  16384        lo0
213.196.148.12     **:**:**:**:**:**  UHS        3953   1500       igb0
213.196.149.11     **:**:**:**:**:**  UHS        3953   1500       igb0

dakapo
OpenVpn Newbie
Posts: 4
Joined: Wed May 03, 2023 9:52 am

Re: Route single IP through Site-to-Site-VPN

Post by dakapo » Wed May 03, 2023 2:37 pm

Okay. A first problem has been solved. A friend of mine found out that a Outbound-NAT-Rule was missing for the 192.168.123.0/30-Tunnel on the Firewall in the Main Office.

Now I can reach the IP-Adresses from the pfSense in the Home-Office.

What's still not working is reaching the IP-Adresses from the Clients in the LAN of Home-Office.

Code: Select all

> pfctl -s nat
no nat proto carp all
nat-anchor "natearly/*" all
nat-anchor "natrules/*" all
nat on igb0 inet from 192.168.122.0/24 to any -> ***.***.***.*** port 1024:65535
nat on igb0 inet from 192.168.125.0/24 to any -> ***.***.***.*** port 1024:65535
nat on igb0 inet from 192.168.123.0/30 to any -> ***.***.***.*** port 1024:65535
no rdr proto carp all
rdr-anchor "tftp-proxy/*" all
rdr-anchor "miniupnpd" all

dakapo
OpenVpn Newbie
Posts: 4
Joined: Wed May 03, 2023 9:52 am

Re: Route single IP through Site-to-Site-VPN

Post by dakapo » Thu May 04, 2023 6:50 am

I solved the last part of the problem too. I had to add another Outbound-NAT-Rule for the LAN-Subnet (192.168.121.0/24) of Home-Office to the pfSense in Main-Office.

Anasabdullah
OpenVpn Newbie
Posts: 11
Joined: Tue Apr 25, 2023 9:13 am

Re: Route single IP through Site-to-Site-VPN

Post by Anasabdullah » Thu May 11, 2023 6:14 am

You should be able to solve this problem by configuring a route on the pfSense in the Main-Office to the Home-Office. This route should tell the pfSense in the Main-Office to route any traffic from the Home-Office to the WAN.

To do this, you can use the following command:
CODE: SELECT ALL

route 192.168.121.0/24 192.168.123.2

Where 192.168.123.2 is the IP of the OpenVPN interface on the pfSense in the Home-Office.

Once you have set this routing rule in the Main-Office, your setup should be working as expected.

Post Reply