For a client I am building a network solution that enables them expanding their available online presence.

I am running into a problem with port forwarding to an IP which is routed over an OpenVPN L3 site-to-site VPN.

On site A I have public IP which is running the openVPN server. is the openVPN tunnel IP.

On site B I have public IP which is running as openvpn Client. is the openVPN tunnel IP. Site B is running an apache server on port 80 with IP address

RfC1918 is routed to, making all possible IPs reachable from site A, proven by ping and reaching port 80 on a server within one of the server vlans at site B from the pfsense console (telnet).

On site A I configured a port forward with destination, forwarding it to Here starts the confusion. I try to reach from an external IP (so no weird NAT reflection or so), the connection fails. When I do a tcpdump on said server, I see the packets coming in and getting responded to, but the response packets never reach the firewall on site A. When I set a static route on site B with the IP address of the external source to site A, the connection works.

pfTop on site A&B shows this.

  pfTop: Up State 1-2/2 (22), View: default, Order: bytes
PR        DIR SRC                           DEST                                   STATE                AGE       EXP     PKTS    BYTES
tcp       In                         CLOSED:SYN_SENT     00:00:03  00:00:30        3      180
tcp       Out                       SYN_SENT:CLOSED       00:00:03  00:00:30        3      180

I tried setting as a gateway for on site B and a outbound mapping on site A to the WAN, but this did not help.

It feels like asymmetric routing, but as it is session based routing it should work.

  • You really shouldn't be running an OpenVPN client on site B but a server for site-to-site.
    – Zac67
    Commented Apr 30, 2023 at 7:05
  • I made site B the openvpn client as I would be unable to configure a gateway on the interface when it's a server. Commented Apr 30, 2023 at 9:30
  • 1
    NAT is not a substitute for routing. NAT should only be used for private<->public or overlapping addressing, but it should only be a temporary solution for overlapping addressing while one or both sides are readdressed to fix the conflict.
    – Ron Maupin
    Commented Apr 30, 2023 at 15:46
  • @RonMaupin it is private<->public, as is mapped to Commented Apr 30, 2023 at 15:57
  • 1
    The tunnel should be private<->private inside the tunnel. The routers running the tunnel have the public address, so you do not need NAT for the outer tunnel. Also, you do not own, so you should not be using that.
    – Ron Maupin
    Commented Apr 30, 2023 at 16:04


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.