Skip to content

VPN

pfSense terminates two distinct VPN types, for two distinct purposes.

OpenVPN — remote access

Road-warrior style remote access into the lab for management from outside the home network (laptop, phone). Client configs and CA are managed on pfSense; certs are issued per-user/device.

IPsec — site-to-site to Azure

A persistent site-to-site IPsec tunnel from pfSense (WAN bridge mode) to an Azure Virtual Network Gateway in the hub resource group. This is the backbone that makes the hybrid parts of the architecture work at all:

  • Lab hosts can reach Azure Arc's connectivity endpoints, the private AKS API server, and ACR — all privately, no public exposure.
  • Azure's Hub DNS Resolver can reach back into the lab's DNS Resolver for split-horizon lookups (see DNS).
  • An Azure DevOps self-hosted agent pool runs from a container on-prem (truenas-dr) specifically so pipelines can reach lab-only resources (TrueNAS, vCenter, ESXi hosts) that Microsoft-hosted agents never could — see Self-Hosted Azure DevOps Agent.

See Architecture Overview for where this tunnel sits in the overall topology.