Can't access ESXi host from inside over OpenVPN on the virtual lan

This is a bit of a weird one and will take a bit of explaining so bear with me.

We have a VMWare ESXi host in the office. It runs half a dozen VMs that provide various business services.

The host's network is configured so that there's an internal network that all the VMs share. It is separate from the rest of the office outside of the host.

One of the VMs is a pfSense Router Distro. Basically, this VM provides the router and a NAT gateway that connects the internal virtual network to the outer office network.

The host has two management IP addresses - one for the outer office network, and one for the internal virtual network.

pfSense is running an OpenVPN Server, and staff connect to the internal virtual network from home over the internet using the OpenVPN client.

The staff who use the VPN are often NOT on the outer office network. They're usually at home working remotely.

------

Internal virtual network
         192.168.7.0/24
         pfSense router:   192.168.7.0
         ESXi management IP:    192.168.7.3

Outer office network:
         192.168.0.0/24
         ESXi management IP:    192.168.0.3

OpenVPN network:
         10.0.8.0/24
         OpenVPN gateway:   10.0.8.5

------

Here's the problem:

- When I connect to the network from the Internet via OpenVPN, I cannot ping or communicate with 192.168.7.3.
- I CAN communicate with everything else on the internal virtual network
-  Virtual machines on the internal virtual network CAN communicate with 192.168.7.3


I'm confident that OpenVPN is working properly... the firewall is completely opened up and everything else is accessible. There's nothing to specifically deny this one IP address.

I have also tested that pfSense CAN ping the ESXi host on 192.168.7.3.... when it pings using it's network adapter connected to the internal virtual network.

pfSense CANNOT ping the ESXi host on 192.168.7.3 when it pings from the OpenVPN network adapter. pfSense CAN ping everything else on the 192.168.7.0/24 subnet via the OpenVPN network adapter, though.

---------

So my conclusion from all of this, is that there appears to either be a problem with pfSense, or there's a problem with the network configuration on the ESXi host.

Perhaps the issue is that the ESXi host is rejecting connections that come from a separate subnet (the 10.0.8.0/24 subnet that OpenVPN assigns IPs on)? Is there some kind of firewall in ESXi that I don't know about?


Any help would  be greatly appreciated.
LVL 31
Frosty555Asked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Jon SnydermanCommented:
I know this is going to sound really silly, but have you checked the default gateway of the management network?  It should be the pfSense 192.168.7.x IP, right?  

~Jon

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Frosty555Author Commented:
*facepalm*

That was it - the default gateway for the management network was set to 192.168.0.1 and it needed to be set to 192.168.7.1 .

Thank you, Jon!
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
VMware

From novice to tech pro — start learning today.