Possible to traceroute from pfSense across VPN connection?
-
I have a NordVPN connection (use with policy routing) established and would like to perform a traceroute across that connection. Is that possible from pfSense, GUI or command?
edit: I want to force the traceroute to go over the VPN connection.
-
Sure, just select the VPN interface as the source address:
-
@stephenw10 Oddly, when I've done that before asking, and again today, what I see as the first hop is the monitor IP of my WAN connection (that IP is set as the monitor IP on WAN gateway). This tells me the traceroute is going out WAN.
Are firewall rules applied during traceroute? -
Outbound rules would be. Routing also applies.
What are you tracerouting to?
-
@stephenw10 I was testing wp.pl and gazeta.pl. I can't glance anything out of my FW rules to indicate the issue could be there, but I did disable some "probable" rules and tested, but still the same 96.x.x.29 is the first hop IP.
-
You have any static routes for those that would apply via WAN?
What pfSense version are you running?
-
I do not have any static routes. I'm on 22.05 SG-2440.
-
@bartkowski said in Possible to traceroute from pfSense across VPN connection?:
I have a NordVPN connection (use with policy routing) established and would like to perform a traceroute across that connection. Is that possible from pfSense, GUI or command?
No. The policy routing is applied to incoming traffic on the interface you've defined the rule. But pfSense itself doesn't obey it.
You can only trace the route from a device connected to this interface. -
You may not have added them as static routes but they might be there for other reasons such as DNS servers or VPN endpoints. Check Diag > Routes to be sure.
Steve
-
@stephenw10 I think I may have found my issue, an Outbound NAT mapping which I put in to fix some other issue (NTP if I recall correctly).
-
In automatic mode it ignores any manually entered rules. Also that rule would only apply to traffic leaving the WAN and not the VPN.
-
@stephenw10 If I disable the Outbound NAT rule and do my traceroute, the first hop is on IP from VPN provider, 10.8.2.1. With the rule active, it goes out my WAN via 96.x.x.29.
-
That rule shown in your screenshot? With Outbound NAT set to automatic mode?
-
@stephenw10 Yes, but it is set to Hybrid.
edit: and yes, this rule is to fix NTP, without, NTP does not work.
-
Ah, well try changing that rule to destination port 123 so it only catches NTP traffic.
-
@stephenw10 That did it, thank you.
Here is the relevant thread and note from JimP about this rule. ( I cannot post hyperlinks)
