Netgate SG-1000 microFirewall

Author Topic: Strange routing issue site-site with openvpn (works fine in ipsec though).  (Read 251 times)

0 Members and 1 Guest are viewing this topic.

Offline diablo266

  • Jr. Member
  • **
  • Posts: 87
  • Karma: +0/-0
    • View Profile
I have a site-site VPN between the following subnets:


Long story short: Using either openvpn or ipsec i'm able to ping every machine on either side of the vpn tunnel just fine, however I can only ping from but I cannot access any of its services (ssh/smaba etc) over openvpn. Everything works fine over ipsec. This problem only affects this one host, Every other device is completely accessible via openvpn (in this case everything else is a VM hosted on proxmox host

I have no firewall rules blocking access to, I only have an allow all ipv4 rule on both sides for now.

Details: is a proxmox host, pfsense is virtualized on this host with access to the vmbr0 (WAN) and vmbr1 (internal vm LAN) interfaces.

ifconfig from

Code: [Select]
auto lo
iface lo inet loopback

iface eth0 inet manual

auto vmbr0
iface vmbr0 inet static
        bridge_ports eth0
        bridge_stp off
        bridge_fd 0

auto vmbr1
iface vmbr1 inet static
        bridge_ports none
        bridge_stp off
        bridge_fd 0
        post-up ip route add dev vmbr1 src table rt2
        post-up ip route add default via dev vmbr1 table rt2
        post-up ip rule add from table rt2
        post-up ip rule add to table rt2

Without the additional route rules for the vmbr1 interface none of the VM's hosted on were able to access services on (ping worked though). At first I suspected this may have something to do with my problem, but if it does how come ipsec is unaffected?

traceroute from to
Code: [Select]
traceroute to (, 30 hops max, 60 byte packets
 1 (  0.770 ms  0.824 ms  0.913 ms

It doesn't seem to be taking the correct route, and I figure I need another static route back to pfsense at but if I do, again, why does it work fine in ipsec without one? Unfortunately i'm out of my depth, i'm not sure how to add an additional default route, if it's even needed. Thanks for any help with my crazy problems!