So I'm using a pfsense openvpn to bridge my LAN segment so VPN users can access the servers.

The problem I'm having now is that I can establish a connection, I can ping the LAN server from the VPN, but as soon as I ping the client from the LAN server, there is no connectivity anymore between both parties.


  • connect from the VPN client to the LAN => works
  • ping the LAN from the VPN client => works
  • access server from the VPN (ssh, ftp,...) => works
  • ping client from server => doesn't work
  • ping LAN from the VPN client => doesn't work anymore

My bridge has em1 and ovpns1 bridged. I noted with tcpdump that ICMP is reaching the bridge between LAN and the VPN segment. But it's not put onto the em1 interface for some reason.

My pfsense is running on an ESXi host with th vSwitch port enabled in promiscious mode. Firewall rules allow in and outbound traffic regardless origin or destination.

2 Answers 2


It turned out to be the scrubbing was the culprit. To disable scrubbing:

System -> Advanced -> firewall/NAT -> disable scrubbing


You may have to allow IP forwarding rather than just changing firewall rules in ESX -- this bit us with pfSense under KVM, but I'm not sure what the analogous VMware option would be.

  • that example is using tunneling, I'm doing tap. It turned out to be a firewall rule silently added by pf-sense Nov 4, 2013 at 23:23
  • Ah, glad you got it sorted.
    – nedm
    Nov 4, 2013 at 23:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .