Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We use PFSense firewalls at three installations with the following LAN networks:

1.) Datacenter #1: 2.) Datacenter #2: 3.) HQ:

All of these locations are linked via an IPSEC tunnel that works properly. Hosts in any of the above networks can communicate with hosts in any other of the above networks.

Now, for our laptops etc. we established a road warrior network and have implemented OpenVPN to link the laptops etc. to Datacenter #1. This works great too, so our laptops can connect and communicate with any host in Datacenter #1 (anything on

The problem is the laptops can't communicate with any hosts that Datacenter #1 can reach by its IPSEC tunnel to Datacenter #2 (and/or the HQ for that matter).

Does anyone know what to do configuration wise on the PFSense box in Datacenter #1 to configure to route packets received on the OpenVPN tunnel to Datacenter #2 over the IPSEC tunnel? It could be a setting on the OpenVPN or some sort of static route or some such.

Any ideas?

share|improve this question

Traffic must match your SPD local and remote subnets to go across IPsec. Easiest is put your OpenVPN subnet within the IPseec local subnet of the site where the OpenVPN server resides. Also need to push appropriate routes to the OpenVPN client. That's all covered in detail in

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.