Netgate SG-1000 microFirewall

Author Topic: VPN customer towards a host only ?  (Read 1325 times)

0 Members and 1 Guest are viewing this topic.

Offline jerem87

  • Newbie
  • *
  • Posts: 3
  • Karma: +0/-0
    • View Profile
VPN customer towards a host only ?
« on: May 12, 2009, 03:32:56 pm »
Good evening,

I am sorry for the translation in English, I am French.

Is it possible to indicate to PfSense a host rather than a distant address of network? Would I wish that the VPN customer simply allow to reach to a distant host and not a whole distant network?

Thank you very much.


Offline Cry Havok

  • Global Moderator
  • Hero Member
  • *****
  • Posts: 2818
  • Karma: +5/-0
  • Backup: n. What you should have done yesterday.
    • View Profile
Re: VPN customer towards a host only ?
« Reply #1 on: May 12, 2009, 05:22:55 pm »
Not in 1.2.  I believe that firewalling on OpenVPN doesn't come in until 2.0, which is still in Alpha.
If you're planning on PMing me to ask me to look at a thread, or for individual support, don't.

Offline jimp

  • Administrator
  • Hero Member
  • *****
  • Posts: 21619
  • Karma: +1484/-26
    • View Profile
Re: VPN customer towards a host only ?
« Reply #2 on: May 12, 2009, 06:56:51 pm »
There is some support for filtering OpenVPN in 1.2.3, but it's not very elegant.

You can add an OpenVPN tunnel, bring it up, then assign the resulting tunx (likely tun0) interface as an opt interface. You can then enable that opt interface, name it OpenVPN, give it a (bogus?) ip address, and you'll get a tab on the firewall rules where you can control access.

What I'm not so sure of is how reliable this is. In my testing, after making changes in OpenVPN which made tun0 leave and come back, I had to edit/save the rules again for things to work as expected. I may have misconfigured something along the way though.
Need help fast? Commercial Support!

Co-Author of pfSense: The Definitive Guide. - Check the Doc Wiki for FAQs.

Do not PM for help!