Configuring OpenVPN when NG Firewall is not at the network edge

Overview

If your NG Firewall is in bridge mode, it is not serving as the edge device in your network. This means that some additional configuration is necessary to use it as an OpenVPN host.

Configure NG Firewall's Public Address

Since your NG Firewall's external interface will have a private address, it can't be reached directly via the Internet. Go to Config > Network > Hostname and change the default setting to 'Use manually specified address'. Fill in the IP/Hostname field with the public IP address or hostname of the network's edge device.

If you have not changed the HTTPS Service Port setting, leave the Port field set to 443. If you have changed the Service Port, use the appropriate port in this field.

Download & deploy OpenVPN client config files

See this article for the complete process: Configure and deploy OpenVPN Clients for remote users. If you have deployed these client config files before, you must re-download them after making the above change to your public address.

Configure port forwarding on the upstream router

Finally, you will need to configure a port forward on the upstream device to forward UDP port 1194 to your NG Firewall's external interface IP, found in Config > Network > Interfaces.