Topics

I have a hub-and-spoke model in Azure (as shown below)


opnsense:
LAN interface:10.1.1.250
WAN interface:10.1.0.250

Spoke1 is peered to hub vnet where opnsense lives.
Spoke3 is peered to hub vnet where opnsense lives.

For spoke1 to talk to spoke3, the traffic is routed through opnsese LAN interface in the hub.
Also for spoke3 to talk to spoke1, the traffic is routed through opnsese LAN interface in the hub.

I have added specific firewall rules on opnsense to allow the traffic from spoke1 to spoke3 and vice versa. However when I try to reach from spoke1 to spoke3 but I can't. I don't see any traffic on spoke3 at all from spoke1. Looking at opnsense firewall logs. I see the traffic is hitting my rule, but then the traffic is let out from firewall through WAN interface as shown in the following snippet:



Why this is happening? What do I need to do to get the traffic from spoke1 to reach to spoke3 and vice versa?

any help is appreciated.

I am testing opnsese on two VMs on Azure both live in two different virtual network and each has a single public ip address and a since nic as shown the below diagram.

I managed to get the S2S tunnel up but there is no traffic between the two opnsense servers.

I tried to ping a vm (or even the other opnsense) from opnsense1 server, but I get this message:

Code Select Expand

root@OPNsense:~ # ping 10.2.1.4
PING 10.2.1.4 (10.2.1.4): 56 data bytes
ping: sendto: Permission denied
ping: sendto: Permission denied

Same error I get when I try to ssh into the vm on the other side:

Code Select Expand

root@OPNsense:~ # ssh 10.2.1.4
ssh: connect to host 10.2.1.4 port 22: Permission denied

Any help is really appreciated.