I am stuck how to establish port forwarding between the Internet and an OpenVPN server behind two routers. I need the first router as an Internet DSL modem and VoIP phone access (both services from the same provider). The drawback is that this router/phone system does not offer the capability to set up a home network and a separate DMZ. For that purpose I have connected a second router with pfSense which does that. One of the its two LAN sockets connects to my office LAN, the other to the DMZ with the OpenVPN server. The WAN address of the second router is in the network of the first router.

Internet +-----------+                 +------------+ LAN2 / DMZ
---------{    R1     }-----------------{WAN     LAN2}--->------------+
  DSL    |  DSL/VoIP ||  pfSense   |                |
         |  router   |                 |        LAN1}---+      +-----+------+
         +-----------+                 +------------+   |      |  OpenVPN   |
           R1: port forward              R2: port fwd   V      |  server    |
               from Internet to          How???        LAN1    +------------+

The first port forward in router R1 sends UDP packets from the Internet to the pfSense WAN interface. A pfSense trace shows that the OpenVPN UDP packets arrive at the R2 router WAN interface with source IP=public IP and target IP= I am stuck now with the port forward rule in router R2. I tried a pfSense NAT rule in router R2 like this:

I/F:WAN src:any proto:UDP srcPort:443 dest:any destPort:443 NAT_IP NATport:443

but a pfSense trace does not show any activity on the LAN2 port. Any suggestions what I did wrong?

  • If your DNAT rule on R1 is right, the srcPort for all UDP packets arriving at R2 should not be 443 but any dynamic port. So, have you tried to set srcPort:any on R2 for DNAT to your OpenVPN server? – Markus Dec 4 '18 at 12:34
  • The DNAT rule on router R1 forwards UDP packets from publicIP:443 to Therefore I did not try to define srcPort=any in the DNAT rule on router R2. "If your DNAT rule on R1 is right ..." : Is is a dumb thought that the rule on R1 should perhaps forward to an IP address in that other network, i.e. to of which R1 has no knowledge? – H. Bre Dec 4 '18 at 13:32
  • 1. Please try srcPort:any in your port forwarding rule on R2. You could do a packet capture of incoming OpenVPN packets and you will see that srcPort is always dynamic. "PulicIP:443"/"" -> here, 443 is the destPort, not the srcPort. 2. You could only fwd from R1 to OpenVPN server directly, when R1 knows the path to over – Markus Dec 4 '18 at 13:56
  • 1
    Why are you running a double NAT? You only use NAT if you absolutely must. You can simply route on the pfSense router because you are not going from private to public addressing, nor are you using overlapping network addressing, so there is no reason to NAT inside your own network. Do not make the mistake of substituting NAT for routing. Port forwarding is only used for NAT, so if you are simply routing in your network, then you do not forward ports inside your own network. – Ron Maupin Dec 4 '18 at 14:57
  • Unfortunately, questions about home networking and consumer-grade devices are explicitly off-topic here. You could try to ask this question on Super User. – Ron Maupin Dec 4 '18 at 20:22

I'm with Ron Maupin. You should only be running NAT on your edge router. Then you can have that router forward directly to the OpenVPN server. If you are using consumer grade routers, you will have to either enable RIP or OSPF, or configure static routes between them. If you do enable RIP or OSPF, both routers must support them.

  • Thank you for the clarification about NOT using NAT in the private network! I have UP'ed the answer. – H. Bre Dec 9 '18 at 20:58

Not the answer you're looking for? Browse other questions tagged or ask your own question.