search

opnsense / core

OPNsense GUI, API and systems backend
https://opnsense.org/
BSD 2-Clause "Simplified" License
3.07k stars 700 forks source link

Asymmetric routing issues when using port-forwarding on two or more gateways #7531

Closed LZNetwork-Main closed 1 week ago

LZNetwork-Main commented 1 week ago

This could be a bug, but I am really not sure, so I am posting it here.

So basically, I have a wireguard VPN client setup on OPNsense with an IPv4 gateway assigned, I also have my native WAN with an IPv4 assigned. What I'm trying to do is port-forward a single port to both gateways - for example 10.0.0.5:8877 to both my native WAN and to the VPN gateway. This was possible in pfsense that I have used for about 4 years with this setup, however it seems to be impossible in OPNsense.

I have only migrated about 3 days ago and have asked on the forum as well as on reddit. We were able to isolate the issue to asymmetrtic routing - packets enter through the VPN gateway and leave through the default WAN gateway.

Is there any way to fix this? Thanks!

Monviech commented 1 week ago

In this guide is a note about DNAT with VPN Interfaces. Maybe it fixed your issues? Its probably a reply-to problem.

https://docs.opnsense.org/manual/how-tos/nat_reflection.html

Probably duplicate of: https://github.com/opnsense/core/issues/7448

LZNetwork-Main commented 1 week ago

Sorry for the late answer, this is exactly it. I am really sorry for bothering you, I somehow completely missed this section of the guide. This is stupidity on my side, again sorry and thank you very much for pointing this out!

fichtner commented 1 week ago

Hey, no worries at all! :)

Monviech commented 1 week ago

The guide is really long and its only a small detail. I especially added it there since a lot of forum posts happen because of this. So I just knew where to look right away. Glad it solved your issue. :)