next »

[hshh]

ipfw enable in-kernel nat, kernel conf:
options LIBALIAS
options IPFIREWALL_NAT
or load module, kldload libalias; kldload ipfw_nat


pf rules:
no nat on $ext_if proto gre from any to any

ipfw rules:
ipfw nat 1 config if $ext_if same_ports reset unreg_only
ipfw add 1000 nat 1 gre from any to any

now, outbound pptp can be simultaneous.

[newfirewallman]

So are you saying you may have fixed the PPTP outbound limitation?

[hshh]

So are you saying you may have fixed the PPTP outbound limitation?

yes, just bypass gre nat on pf

[newfirewallman]

Ok you have me excited, how? The above commands mean nothing to me can you simplify for dummies?

[hshh]

Just post tips, maybe pfsense developer team to do it.
I am using pure freebsd system not pfsense.

[cmb]

Interesting work around. It'd be hard to make work correctly in every possible scenario for every user though. It's something to consider at least.

[dhatz]

Could this also be used to do "NAT before IPsec" ? (I haven't used ipfw's NAT)

[pbo808]

What are the issues with this solution?  Any chance this is an option for 2.2?

[alber_rm]

If there was a stable and good solution the pfSense team would have implemented it... In the meanwhile I have deployed a second firewall (clearos) between my lan and wan. A static route "route -p add VPNServerIP ..." tells every computer to connect through clearos (which can nat gre protocol) for the vpn servers people use more often. I know this is not by far the best solution but It allows me to keep using pfsense in my company... I hope this helps someone...