Netgate SG-1000 microFirewall

Author Topic: CARP + OpenVPN - slave not reachable over VPN  (Read 158 times)

0 Members and 1 Guest are viewing this topic.

Offline Polderdijk

  • Newbie
  • *
  • Posts: 5
  • Karma: +0/-0
    • View Profile
CARP + OpenVPN - slave not reachable over VPN
« on: October 24, 2017, 08:54:59 am »
Hi,

I setup a nice CARP setup and OpenVPN on 2 pfSense boxes in a datacenter. Everything works as expected, but only a tiny problem I can't fix.

I can't access the slave pfSense box with the internal IP on the 'other side over VPN'.

Sure, this is expected because the OpenVPN is down on the slave, so I need to add some route/NAT to fix it.

I see a faq on https://doc.pfsense.org/index.php/CARP_Secondary_Unreachable_Over_VPN

But I can't figure out how to interpretate all words in the 'For example, add a manual outbound NAT rule on the LAN interface, source being the VPN subnet, destination being an alias that contains both the primary and secondary node LAN IPs. Translation would be Interface Address (NOT the CARP VIP!).'

I try every combination, without luck.

So I break it in pieces. Is i understand i need to add this to the 'datacenter side'?

- add a manual outbound NAT rule on the LAN interface
+ I got it! In Firewall / NAT / Outbound > Add > Interface == LAN :-)

- source being the VPN subnet:
+ Mmmm. The 'private' VPN subnet? As in VPN / OpenVPN / IPv4 Tunnel Network? Or the 'datacenter side' LAN subnet. I don't know!

- destination being an alias that contains both the primary and secondary node LAN IPs
+ Yehh, i add a new VIP: Firewall / Aliasses > add both LAN IP's (Interface > LAN > IPv4). I hope this is the way!

- Translation would be Interface Address (NOT the CARP VIP!).
+ I got Firewall / NAT / Outbound / Translation set to 'Interface Address'

Save but no luck :(



Offline viragomann

  • Hero Member
  • *****
  • Posts: 2502
  • Karma: +265/-1
    • View Profile
Re: CARP + OpenVPN - slave not reachable over VPN
« Reply #1 on: October 24, 2017, 09:14:48 am »
- source being the VPN subnet:
The VPN tunnel network.


- destination being an alias that contains both the primary and secondary node LAN IPs
+ Yehh, i add a new VIP: Firewall / Aliasses > add both LAN IP's (Interface > LAN > IPv4). I hope this is the way!
Ok.


- Translation would be Interface Address (NOT the CARP VIP!).
+ I got Firewall / NAT / Outbound / Translation set to 'Interface Address'
Ok.

Maybe you have to restart pfSense.

Offline Polderdijk

  • Newbie
  • *
  • Posts: 5
  • Karma: +0/-0
    • View Profile
Re: CARP + OpenVPN - slave not reachable over VPN
« Reply #2 on: October 24, 2017, 09:32:30 am »
Ahh, after re-read, re-read and re-read i found the solution!

With 'The VPN tunnel network' they mean the subnet from the 'remote side' of the VPN tunnel.

After change it works :)