Topics

I run an OpenVPN server instance, can connect and access both the local LAN and internet trough the VPN.

In the LAN I run an Nginx proxy server where certain services are limited to the local LAN. When connecting to the LAN via OpenVPN I can however not connect to the services that are limited to the local LAN (403 forbidden error) as it sees the remote internet IP instead of the VPN IP (I have set the VPN IP range set as allowed in Nginx proxy manager). The Nginx proxy manager logs show the remote internet IP.

Connecting directly to the IP:port of the proxied services does work as the VPN is functional. The services that are exposed to the internet can be accessed trough the proxy server as usual.

Is there a specific setting in OpenVPN to make it report the VPN IP?

My logs get flooded with following message:

<171>1 2023-10-18T20:43:20+02:00 OPNsense.home.arpa suricata 70341 - [meta sequenceId="34716810"] [101173] <Error> -- [ERRCODE: SC_ERR_NETMAP_READ(264)] - Error reading netmap data via polling from iface 'pppoe1': (55u) No buffer space available

Google search delivers some results that OPNsense or actually freeBSD cannot cope with the pppoe interface of my provider (Dutch KPN). So I switched the interface from WAN to LAN but still the same messages. Switching off IPS also continues to give the same messages (in both cases the messages are still about the pppoe interface). The message above is actually with Suricata set to look at the LAN interface with IPS off.

Even when I untick enabled (in the Services - Intrusion detection - Administration menu) Suricata continues to produce these messages. Hence I think the settings are not actually being picked up. I also cannot disable the service from the dashboard.

I tried several VPN options (OpenVPN, Wireguard and Tailscale). For all of them I manage to get connected to my LAN machines and connect to services using their IP address. So far so good.

When The traffic hits my Nginx Proxy Manager I get denied access even though the VPN IP ranges are in the access list for that subdomain. Checking the logs I find the WAN IP of the client is reported instead of the VPN IP.

Is there a way to change this such that the VPN IP is reported? I tried about every setting I could find in the OPNsense interface for the different VPN types.

I am new to OPNsense and Zenarmor. Installation was really smooth (what a difference in layout of the web interface to pfsense, thanks for that). After installing Zenarmor I noticed that my own domain (which I just use for private purposes) is marked as potentially dangerous or empty. Quite understandable as it will be new in the Zenarmor database.

I whitelisted the domain (just the top level domain as wildcards are auto-included) expecting it to disappear from the list but it still gets added to the dangerous or empty sites. Is there a way to keep it from spamming the threat report?