Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So I'm using a pfsense openvpn to bridge my LAN segment so VPN users can access the servers.

The problem I'm having now is that I can establish a connection, I can ping the LAN server from the VPN, but as soon as I ping the client from the LAN server, there is no connectivity anymore between both parties.


  • connect from the VPN client to the LAN => works
  • ping the LAN from the VPN client => works
  • access server from the VPN (ssh, ftp,...) => works
  • ping client from server => doesn't work
  • ping LAN from the VPN client => doesn't work anymore

My bridge has em1 and ovpns1 bridged. I noted with tcpdump that ICMP is reaching the bridge between LAN and the VPN segment. But it's not put onto the em1 interface for some reason.

My pfsense is running on an ESXi host with th vSwitch port enabled in promiscious mode. Firewall rules allow in and outbound traffic regardless origin or destination.

share|improve this question

It turned out to be the scrubbing was the culprit. To disable scrubbing:

System -> Advanced -> firewall/NAT -> disable scrubbing

share|improve this answer

You may have to allow IP forwarding rather than just changing firewall rules in ESX -- this bit us with pfSense under KVM, but I'm not sure what the analogous VMware option would be.

share|improve this answer
that example is using tunneling, I'm doing tap. It turned out to be a firewall rule silently added by pf-sense – Lucas Kauffman Nov 4 '13 at 23:23
Ah, glad you got it sorted. – nedm Nov 4 '13 at 23:53

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.