2x WAN and 2x OpenVPN

Started by dev, August 28, 2025, 09:12:23 AM

Previous topic - Next topic
Hi everyone,
I'm running an OPNsense firewall with two separate WAN interfaces, each connected to a different ISP. Both WAN interfaces receive dynamic IP addresses via DHCP from the providers. I'd like to set up two independent OpenVPN servers, one on each WAN interface, both using UDP port 1194.
Is this possible, and if so, how can I configure it properly?

Here's some context about my setup:
WAN1: Dynamic IP via DHCP
WAN2: Dynamic IP via DHCP
Goal: Run one OpenVPN server on WAN1 (UDP 1194) and another on WAN2 (UDP 1194), each serving different clients or networks.

My questions: Is it feasible to run two OpenVPN instances on the same port (UDP 1194) when they are bound to different WAN interfaces?
How should I handle the dynamic IPs? As i understand you can set OpenVPN instances only to IP-addresses and not interfaces.
Would setting up Dynamic DNS (DDNS) for each WAN interface be sufficient, or are there other considerations?
Are there specific firewall or NAT rules I need to configure to avoid conflicts and ensure proper routing?
Any potential pitfalls or performance issues I should be aware of?

I'd appreciate any step-by-step guidance or pointers to relevant documentation. If anyone has a similar setup working, I'd love to hear about your configuration!
Thanks in advance for your help!


Quote from: dev on August 28, 2025, 09:12:23 AMMy questions: Is it feasible to run two OpenVPN instances on the same port (UDP 1194) when they are bound to different WAN interfaces?
How should I handle the dynamic IPs? As i understand you can set OpenVPN instances only to IP-addresses and not interfaces
Don't know, if you can bind the OpenVPN servers to a dynamic address. But anyway you can bind them to different local addresses or different ports and forward port 1194 from both WANs to it.

Quote from: dev on August 28, 2025, 09:12:23 AMWould setting up Dynamic DNS (DDNS) for each WAN interface be sufficient, or are there other considerations?
This only ensures the name resolution from public networks.