to start, I have very little knowledge on routes, iptables, etc. That said, here's what I'm trying to accomplish and where I think I'm stumped:

Problem: We have an external website which we recently firewalled so it only accepts traffic from our office IP addresses. This works well at the office, but doesn't work for remote access through VPN as we don't route all traffic through OpenVPN. I would rather avoid forcing everyone to route all traffic through just to accommodate this one site.

Environment: Main router box is running pfSense. Em0 is internal IP, Em1 is external. Internal net is 10.23.x and VPN is

I believe what I need to do is add a route to the VPN server config to send all traffic to that IP over the VPN tunnel. I think that part's working, but I don't get a response back, so I'm assuming that I need some NAT config on the VPN server to route the response back over the tunnel?

What I've found so far is to try the following, but since this is a pfSense box on FreeBSD, I can't run iptables, etc.

Make sure ip forwarding is enabled: echo 1 > /proc/sys/net/ipv4/ip_forward

Setup NAT back out: iptables -t nat -A POSTROUTING -s -o em0 -j MASQUERADE

Am I on the right path, and if so how do I accomplish this through pfSense UI or FreeBSD CLI? Thanks!

  • Thank you DennisQ ! This was helpful because I did the same steps as you before coming here so it should be right, and it did not solved my problem. In my case I have a dual wan setup, so I had to add a rule in the OpenVPN section to redirect traffic to a specific wan and restart OpenVPN. – user95489 Sep 21 '11 at 21:46

Got it! A coworker and I stumbled through onto success (for now).

XXX.XXX.XXX.XXX = IP of the specific site we wanted routed over the VPN


  1. VPN > OpenVPN > Server > Edit > Custom Options: push "routeXXX.XXX.XXX.XXX";
  2. Firewall > NAT > Outbound >
    • Select Manual Outbound NAT (AON)
    • Add 2 routes below:
      • Interface Source SrcPort Destination DestPort NATAddr NATPort StaticPort
      • WAN * * * * * NO
      • WAN * XXX.XXX.XXX.XXX/32 * * * NO
  3. Profit ;-)

Step 3 is optional.


Glad you solved it! Another method is to have the external server be part of the VPN. Then just set the domain/s to the servers new VPN IP instead of the public IP. This way all administrative access to the external server travels over the VPN as well. Plus no special routes or NAT rules.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.