5

So I'm using a pfsense openvpn to bridge my LAN segment so VPN users can access the servers.

The problem I'm having now is that I can establish a connection, I can ping the LAN server from the VPN, but as soon as I ping the client from the LAN server, there is no connectivity anymore between both parties.

So:

  • connect from the VPN client to the LAN => works
  • ping the LAN from the VPN client => works
  • access server from the VPN (ssh, ftp,...) => works
  • ping client from server => doesn't work
  • ping LAN from the VPN client => doesn't work anymore

My bridge has em1 and ovpns1 bridged. I noted with tcpdump that ICMP is reaching the bridge between LAN and the VPN segment. But it's not put onto the em1 interface for some reason.

My pfsense is running on an ESXi host with th vSwitch port enabled in promiscious mode. Firewall rules allow in and outbound traffic regardless origin or destination.

Improve this question

2 Answers 2

Reset to default
5

Turns out there was an implicit rule in the firewall defined on the bridge which dropped fragmented packets. This is not shown in the normal firewall overview.

I ended up turning off this 'feature' in the system ->advanced -> firewall/NAT section.

Improve this answer
-1

vSwitch->Promiscuous-Mode->Accept volia

Improve this answer
1
  • plus "forged transmits" (allow it to send frames other than it's own)
    – Ricky
    Apr 6, 2015 at 20:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.