Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Outbound openvpn to Expressvpn and route voIP traffic through it only - Bid $

    Scheduled Pinned Locked Moved Expired/Withdrawn Bounties
    36 Posts 3 Posters 23.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • X
      xbipin
      last edited by

      i managed to get it up and routing properly

      enabled AON
      in rules edited the default lan to any rule and set it to wan gateway
      created a new rule under lan for lan to sip server ip and set it to vpn gateway

      this did it for me but some other issues came up

      under floating i have 2 rules for lan to sip server and sip server to lan without any gateway specified but given the voip queue so traffic shaper can prioritize that, but after setting this vpn up, i only see the qVoIP on LAN getting pupulated and the the uplaod goes to the default qp2p instead of the qVoIP on WAN, any fix for that so this voip over vpn goes to the proper up and down qVoIP queue?

      1 Reply Last reply Reply Quote 0
      • stephenw10S
        stephenw10 Netgate Administrator
        last edited by

        Reading through this:
        http://openvpn.net/index.php/open-source/documentation/howto.html#redirect
        and then this:
        http://openvpn.net/index.php/open-source/documentation/manuals/65-openvpn-20x-manpage.html

        It would appear that the reason your routing table is being overwritten is due to the advanced command in the openvpn client setup: redirect-gateway def1
        Assuming you copied this from the StrongVPN guide.

        First check that your routing table is being changed as I outlined in my previous post. Then try removing this command and recheck.
        If this successfully prevents your default route changing then you can remove the gateway settings from the 'lan to any' rule.

        Steve

        1 Reply Last reply Reply Quote 0
        • X
          xbipin
          last edited by

          well i didnt, i use the below commands only

          fast-io;route-delay 2;verb 5;tun-mtu 1500;mssfix 1450;fragment 1300;persist-key;

          expressvpn gave me a ovpn file with the below contents so could u recommend what commands should i use out of them

          dev tun
          fast-io
          #proto tcp-client
          persist-key
          persist-tun
          replay-persist cur-replay-protection.cache
          nobind
          remote canada-cluster.expressnetwork.net 1194
          remote canada-cluster2.expressnetwork.net 1194
          remote canada-cluster3.expressnetwork.net 1194
          remote canada-cluster4.expressnetwork.net 1194
          remote-random
          pull
          # Use compression
          comp-lzo
          # Strong encryption
          tls-client
          tls-remote server
          ns-cert-type server
          tls-auth ssl/ta.key 1
          verb 3
          cert ssl/client.crt
          key ssl/client.key
          ca ssl/ca.crt
          
          route-method exe
          route-delay 2
          
          tun-mtu 1500
          fragment 1300
          mssfix 1450
          
          
          1 Reply Last reply Reply Quote 0
          • stephenw10S
            stephenw10 Netgate Administrator
            last edited by

            We have reached the limits of my own experience with this, anything further is experimental!  ::)
            However since something apparently is causing you default route to change I think you first need to confirm this is happening when you connect the OpenVPN tunnel by comparing your routing table before and after.

            Steve

            1 Reply Last reply Reply Quote 0
            • X
              xbipin
              last edited by

              i dont think the default gateway is being changed

              screenshot attached for before vpn and after vpn

              CropperCapture[2].jpg
              CropperCapture[2].jpg_thumb
              CropperCapture[1].jpg
              CropperCapture[1].jpg_thumb

              1 Reply Last reply Reply Quote 0
              • stephenw10S
                stephenw10 Netgate Administrator
                last edited by

                No but it is pushing a route, 0.0.0.0/1, which includes the entire internet! It never has to use the default route any more because it has a route to everywhere.

                This is the expected behaviour if the server is pushing the redirect-gateway def1 command:

                Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway.

                You could prevent this by using the 'route-nopull' option in the client config but that will probably prevent any routing information being sent making the vpn connection useless. Might be worth a try though.  :-\

                Steve

                Edit: You can add routes back manually to the config file:
                route yourvoipserverIP;

                1 Reply Last reply Reply Quote 0
                • X
                  xbipin
                  last edited by

                  after i added route-nopull i get the below routing table which seems correct now

                  CropperCapture[3].jpg
                  CropperCapture[3].jpg_thumb

                  1 Reply Last reply Reply Quote 0
                  • X
                    xbipin
                    last edited by

                    if i added the 'route-nopull' then went to AON and switched it back to Auto and under rules in lan to any removed the gateway which was as wan, all traffic goes out the default wan conenction which earlier wasnting working at all untill i specified wan as gateway so i guess that got solved.

                    according to this thread http://forum.pfsense.org/index.php/topic,7361.0.html its not possible to shape traffic that goes inside a tunnel so the whole tunnel traffic needs to be sent to a single queue so i just want to route the voip so i added 2 rules under floating tab one with direction out and selected source as any and destination as vpn subnet and other as traffic in, source vpn subnet and destination any and assigned the qvoip to both but only the in traffic goes to qvoip and the out still goes to qp2p. both the rules r set as queues

                    1 Reply Last reply Reply Quote 0
                    • X
                      xbipin
                      last edited by

                      i guess i spoke too soon, AON needs to be left on but the default lan to any doesnt need a gateway atleast

                      1 Reply Last reply Reply Quote 0
                      • stephenw10S
                        stephenw10 Netgate Administrator
                        last edited by

                        You will always need AON enabled due to changes in openvpn setup detailed by ermal.

                        That's a good result though. Did you have to add a route back in the client config?

                        Steve

                        1 Reply Last reply Reply Quote 0
                        • X
                          xbipin
                          last edited by

                          no i didnt add any client config, all i did is add ur recommended command under advanced configuration in the client openvpn section which looks like this now

                          fast-io;route-delay 2;route-nopull;verb 5;tun-mtu 1500;mssfix 1450;fragment 1300;persist-key;

                          1 Reply Last reply Reply Quote 0
                          • stephenw10S
                            stephenw10 Netgate Administrator
                            last edited by

                            @xbipin:

                            according to this thread http://forum.pfsense.org/index.php/topic,7361.0.html its not possible to shape traffic that goes inside a tunnel so the whole tunnel traffic needs to be sent to a single queue

                            That's only true for traffic in tunnel going through the pfSense box. Since the traffic destined for the VPN enters pfSense unencrypted it should be possible to shape it. Though I'm not sure quite how!

                            @xbipin:

                            i just want to route the voip so i added 2 rules under floating tab one with direction out and selected source as any and destination as vpn subnet and other as traffic in, source vpn subnet and destination any and assigned the qvoip to both but only the in traffic goes to qvoip and the out still goes to qp2p. both the rules r set as queues

                            Probably the out rule is not catching traffic because the VOIP server is not in the VPN subnet. Though the IN rule is catching traffic.  :-\

                            Steve

                            1 Reply Last reply Reply Quote 0
                            • X
                              xbipin
                              last edited by

                              but if u see, the rule under lan that says lan to sip server should go through vpn gateway, pfsense catches that and send it to the proper gateway so basically its able to detect upload traffic so then y cant it just assign the proper queue.

                              any1 else have any idea on how to send vpn traffic to the proper queue as all i would be sending through the tunnel is voip only so might as well send all vpn to the voip quene entirely

                              1 Reply Last reply Reply Quote 0
                              • stephenw10S
                                stephenw10 Netgate Administrator
                                last edited by

                                Can you give some screen shots of your queue rules, firewall rules etc?

                                Steve

                                1 Reply Last reply Reply Quote 0
                                • X
                                  xbipin
                                  last edited by

                                  the rules on the floating tab are just queues

                                  CropperCapture[1].jpg
                                  CropperCapture[1].jpg_thumb
                                  CropperCapture[2].jpg
                                  CropperCapture[2].jpg_thumb
                                  CropperCapture[3].jpg
                                  CropperCapture[3].jpg_thumb
                                  CropperCapture[4].jpg
                                  CropperCapture[4].jpg_thumb
                                  CropperCapture[5].jpg
                                  CropperCapture[5].jpg_thumb
                                  CropperCapture[6].jpg
                                  CropperCapture[6].jpg_thumb

                                  1 Reply Last reply Reply Quote 0
                                  • X
                                    xbipin
                                    last edited by

                                    few more screenshots

                                    CropperCapture[7].jpg
                                    CropperCapture[7].jpg_thumb
                                    CropperCapture[8].jpg
                                    CropperCapture[8].jpg_thumb

                                    1 Reply Last reply Reply Quote 0
                                    • X
                                      xbipin
                                      last edited by

                                      the 2 rules on floating tab that say * to mysip and mysip to * were originally created when i wasnt using vpn and voip used to work directly through wan. after vpn, the only additional rule i created was under lan for UDP * to mysip using gateway expressvpn

                                      1 Reply Last reply Reply Quote 0
                                      • stephenw10S
                                        stephenw10 Netgate Administrator
                                        last edited by

                                        Well this is definitely outside my experience now.  ;)
                                        However I think you need to disable the * to mysip rules on floating in order to make sure it's not them that are catching the inbound traffic and sending it to qvoip.

                                        Also I can't see how outbound traffic can possibly end up in qp2p when the only reference to it is for port 28183.  :-\

                                        Steve

                                        1 Reply Last reply Reply Quote 0
                                        • X
                                          xbipin
                                          last edited by

                                          well the 2 rules for mysip were made so traffic goes to qvoip, if i remove that then wont both up and down goto qp2p, we r trying here to send traffic tot he qvoip

                                          1 Reply Last reply Reply Quote 0
                                          • stephenw10S
                                            stephenw10 Netgate Administrator
                                            last edited by

                                            It may well but at least that would tell us which rule is sending traffic to qvoip, mysip to * or VPN to *.

                                            I still don't understand why any of that traffic would go to qp2p, is there a rule I'm missing?

                                            Busily reading the chapter 16 of the definitive guide…..

                                            Steve

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.