PfSense and having the vpn clients having access to lan ressources

Networking & Firewalls
1

Hi !, I’m switching over from a sonicwall NSA 4600 to pfsense and thanks to the many videos on here I was ablt to get most of it running, the only issue I am having is getting openvpn clients to be able to get access to my lan ressources and people on my lan to be able to contact the open vpn clients

So far, i’m able to connect but not access the lan ressources

I’ve got it working if I add a gateway to my pfsense lan adress (using 10.1.1.1) which is my layer 3 nexus
as of this moment nothing is using 10.1.1.1 as their gateway

The way my network is setup is that

My pfsense server is 10.1.1.3/16

all my lan switches are in the 10.1.1.0 subnet with mask 255.255.0.0 and their gateway is pointing at 10.1.1.3

all my servers are in the 10.1.0.0 subnet and mask 255.255.0.0 and their gateway is pointing at 10.1.1.3

my printers are in the 10.1.4.0 subnet mask 255.255.0.0 and their gateway is pointing at 10.1.1.3

on the openvpn server settings

the ipv4 tunnel network is 10.1.5.0/24 I tried going 10.1.5.0/16 and it would fail to give me an ip adress from the openvpn server

my ipv4 local network(s) is 10.1.0.0/16 (which I think should give me access to all my subnets)

as i stated previously, if I don’t add a gateway on my pfsense lan adress (10.1.1.1) which is a layer 3 cisco switch I can’t connect to my lan ressources from the vpn

I also tried adding a static route for the 10.1.5.0/24 segment pointing to my pfsense server so my lan behind the fpsense could communicate to my openvpn

Anyone could nudge me in the right direction ?

2

The OpenVPN tunnel network should not overlap with the local networks or it will not be able to route. Make sure you have the rules to allow the OpenVPN clients to access the network in the firewall.

3

Thank you, I changed all my network equipment to /20, I know it’s still a bit overkill, but there’s some in house software that directly talks to ip’s in the 10.1.10.x range

I’ve changed the openvpn network to 10.1.20.x so it falls out of the /20 range, removed the gateway on my lan interface and obviously changed my pfsense lan interface mask for a /20 as well

boom, everything works great now

THANK YOU !!!

1 Like