# How manage my VPN tunnel with shorewall?

## periko

Hi people.

  I'm using gentoo as firewall with shorewall, vpn with OpenVPN, proxy auth. vs ldap, is working very well.

  This fw protect 2 networks linked by a P2P link(Frame Relay), we got 2 routers between both points, LOC-A 192.168.1.0/24 and LOC-B 192.168.2.0/24. At LOC-A we have the mail+Internet access, I need to help this link, because most of the traffic between both links is the mail, www, etc. At LOC-B we have  a DSL service that we would like to use as extra link between both locations, I can create a VPN with OpenVPN and pfsense and connect to LOC-A the fw, I do this from home.

  My big doubt is this:

1; The DSL is at LOC-B, the VPN is inside one of the networks, can shorewall use the VPN created at LOC-B and used as load-balance? The issue I see here is that the fw doesn't have the control of the dsl just the tunnel created.

Do I need to get another ISP at LOC-A to make this LOAD-BALANCE thing or I can do it with my current links?

Is better to make this with IPSEC, or I will have the same technical issue?

  Thanks for your time   :Question: 

----------

## gerdesj

Really sorry but I'm having trouble understanding your problem. A simple picture may help.  For example this is my home to work connection:

```

Home                                         Office

                                                  |- Draytek1 -| 

192.168.200.0/24 ----- Gentoo ----- Internet -----|- Draytek2 -|-----pfSense ----- 192.168.100.0/24

                                                  |- Draytek3 -|

```

I too use OpenVPN and pfSense.  The three Drayteks are ADSL routers.  My client OVPN has all three external IPs of the routers set as the end point and the client picks one at random.  OVPN cannot load balance, it is only very, very good at getting through and connecting to the other end.

I appreciate that you have two sites to get to but I cant work out the exact topology from your post.  Also I can't really get at your exact problem.

If you can get the problem across though, I think I should be able to help because I use both Gentoo and pfSense big time!

Cheers

Jon

----------

## periko

Hi gerdesj.

  Here I go:

  Current Network

```

 Internet<--->Gentoo fw<--->LAN-A(192.168.1.0/24)<--->router<--->Private Line<--->router<--->LAN-B(192.168.2.0/24)

                       

```

  My goal is to add a extra link in LAN-B and use pfsense to make a VPN between LOC-A and LOC-B.

pfsense 192.168.2.2 dsl line.

router-a 192.168.1.1

router-b 192.168.2.1

   First, u can see that our current network is not very complex.

   Each network have his own router, they are connected over a private line, if I want to access from LAN-A to LAN-B I need cross over the private line and done, we just have 2 gw.

   My new network, have a extra link using pfsense. The DSL is in LOC-B the fw is in LOC-A, we have a extra route to each location.

  How can our fw use the VPN to cross data, I mean I want to help my current private line and move some data over the VPN, like a load-balance, the thing here is that the fw doesn't have the DSL control just the OpenVPN tunnel.

  Other thing, normally went u setup a vpn example with openvpn, the networks u connect must not be the same, in this case the pfsense box is inside the network. This could generate some issues? Because how can our fw knows went to send data over the VPN or the private line?

  Is possible to make this thing to work?

  Hope be clear, thanks for your time.

----------

