Add a public ip to pfsense over a VPN connection?

VPN
1

Hi,

Maybe this is a weird thing to want to try, but have anyone tried using a VPN connection to get an additional public IP address?

I have been trying to figuring out how to make a VPN connection to a VPS with a static IP, where I want to use this as an additional public ip to my pfsense router

Have anyone tried to figuring out something similar?

2

It’s your goal to have an additional public IP for outbound traffic? One being your straight ISP provided IP, the other being your VPN connections IP? Because that is totally doable.

This is what I do. I have two WAN connections. One is provided for my ISP, the other is provided by my VPN provider (which is technically tunnelled over my WAN interface). From a PFSense point of view, it appears as if I had two WAN connections. I route certain subnets over the VPN, and the rest to the normal WAN. But you could route it off anything you want. Prior to me having multiple subnets, I routed a specific LAN IP.

3

take a look on this.
it’s not with a vpn, but with a gre tunnel.
the tut is written in German language.

https://administrator.de/tutorial/feste-ips-zuhause-pfsense-tunnel-567618.html

with this you can use the vps public IP as wan IP in your homelab.

4

Don’t understand anybody is concerned about this.

For outbound easy:

  • VPS is act as VPN server and has static IP for username configured. Authorization done over private key generated by own CA.
  • pfsense act as VPN client (white public ip not required!)
  • enable hybrid outbound nat mode in pfsense
  • configure outbound nat rules to route lan to vpn for specific resources

For inbound first part working in same way but need play with inbound nat & firewall on VPS and point it to pfsense ip inside VPN.

I saw people use ceap VPS to route mail (inbound and outbound) in both directions and used VPS to Nat also clients connections ports to home mail server. Their home even not had any public ips through but they still host their mail server just right to their bad :sweat_smile:

If you just want to extend your ips count maybe better stick with ipv6?:winking_face_with_tongue:

If your provider not support it yet you can configure tunnelbroker.net as 6rd to get all benefits of ipv6 incapsulated in ipv4 if you have white public ip (dynamic public ip also possible, but you will need to handle ddns to update your ip on change at he.net, this easy).

The only issue I was faced is that some services (there is 0.0001%of such on web) not allowing icmp package to big and this break connection for people behind vpn or tunnel. I workaround this by stripping aaaa record from resolving from such services. But you can lower mtu in lan to 1480 and this will fix any possible issues, but I not like to do this.

5

So the pfsense is acting as a VPN client connected to the VPN gateway from you provider?

Is it a OpenVPN tunnel, or?

6

I have been trying to do the wireguard version in this link and am really struggling as the write-up seems to skip & gloss over many things. Is there a better step-by-step available?

7

Your VPS should be the VPN client. You are basically tunneling through you pfsense. From the internet, you have 2 public IPs. One from the ISP, the other is for VPN provider. This is typically when you want to by pass the pfsense.
You should actually explain the goal. What is it you are trying to do?

8

sorry this is the only one I’ve found. did it with this tutorial an it worked very well for me.