Openvpn – Howto route VPN client traffic over a VPN tunnel with pfSense

Here's what may be an issue. Imagine you have following network:

address pool: 10.1.1.0/255.255.255.0
router: 10.1.1.1
internal interface on internal vpn server: 10.1.1.2
some external machine that VPNs to network: 10.2.2.2
some internal client machine: 10.1.1.90

When you trying to access SIC from external VPN box, then traffic route goes like this:

• 10.2.2.2
• vpn (internet)
• 10.1.1.2
• 10.1.1.90
• OK

Seems fine, HOWEVER, in order for traffic to flow, the 10.1.1.90 machine should be able to respond and that means that packets from it must be routable to 10.2.2.2 too. Internal client has obviously ip: 10.1.1.90, mask: 255.255.255.0 and router: 10.1.1.90. Therefore, packets would be routed like this:

• 10.1.1.90
• 10.1.1.1 (sine it is router, and 10.2.2.2 is not directly addressable)
• internet
• NOT FOUND

Basically, reply packets will not even reach VPN. What can you do? Obviously, what will work is to add route to internal client to route all packets to 10.2.2.2 not to VPN box instead of router, such as (Windows box):

route add 10.2.2.0 mask 255.255.255.0 10.1.1.2

this will resolve the problem on single-machine level. Reply packets will go:

• 10.1.1.90
• 10.1.1.2 (explicit route)
• vpn (internet)
• 10.2.2.2

To resolve issue on the network level, you must modify router in a same matter to redirect all traffic going to 10.2.2.0 to 10.1.1.2. This way reply packet will go:

• 10.1.1.90
• 10.1.1.1
• 10.1.1.2
• vpn (internet)
• 10.2.2.2

Another solution is: make your VPN box to NAT on 10.1.1.2 interface. This way for internal machines it will look as if all the traffic originates from 10.1.1.2, and replies will go to 10.1.1.2. I would advise to go through routing though, since NAT will require additional resources on VPN box for connection tracker

Got it! A coworker and I stumbled through onto success (for now).

XXX.XXX.XXX.XXX = IP of the specific site we wanted routed over the VPN

Solution:

1. VPN > OpenVPN > Server > Edit > Custom Options: push "routeXXX.XXX.XXX.XXX";
2. Firewall > NAT > Outbound >
   • Select Manual Outbound NAT (AON)
   • Add 2 routes below:
     • Interface Source SrcPort Destination DestPort NATAddr NATPort StaticPort
     • WAN 10.23.23.0/24 * * * * * NO
     • WAN 10.0.8.0/24 * XXX.XXX.XXX.XXX/32 * * * NO
3. Profit ;-)

Step 3 is optional.