Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Prevent Certain LAN ips from accessing WAN when OpenVPN goes down

    Scheduled Pinned Locked Moved OpenVPN
    52 Posts 11 Posters 25.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • K
      kejianshi
      last edited by

      In that case, not sure…  I'll be reading along and thinking about it a while.

      1 Reply Last reply Reply Quote 0
      • K
        kejianshi
        last edited by

        You posted a screen shot above.  I cant see the whole page.  Can you repost the screen shot to include the interface tabs etc?

        1 Reply Last reply Reply Quote 0
        • M
          m3ki
          last edited by

          Here you go

          ![Screen Shot 2013-08-09 at 7.12.12 PM.png](/public/imported_attachments/1/Screen Shot 2013-08-09 at 7.12.12 PM.png)
          ![Screen Shot 2013-08-09 at 7.12.12 PM.png_thumb](/public/imported_attachments/1/Screen Shot 2013-08-09 at 7.12.12 PM.png_thumb)

          1 Reply Last reply Reply Quote 0
          • M
            m3ki
            last edited by

            This can easily be done using iptables I just don't know how to do it here.

            Idea is mark packets to go to either one routing table or another. then if packet still arrives to unwanted interface drop it. I have my iptables rules in earlier  posts.

            1 Reply Last reply Reply Quote 0
            • K
              kejianshi
              last edited by

              The rules, as they are now, pass everything.  For sure.  First you pass 192.168.1.5, and then you pass everything that isn't 192.168.1.5.
              So, that everything.

              For the first one, shouldn’t you specify a destination gateway?

              1 Reply Last reply Reply Quote 0
              • M
                m3ki
                last edited by

                Yeah sorry I was doing some other tests to see here are the rules as they are now. OpenVPN gateway is down and I can still ping outside from 192.168.1.5

                ![Screen Shot 2013-08-09 at 7.20.11 PM.png](/public/imported_attachments/1/Screen Shot 2013-08-09 at 7.20.11 PM.png)
                ![Screen Shot 2013-08-09 at 7.20.11 PM.png_thumb](/public/imported_attachments/1/Screen Shot 2013-08-09 at 7.20.11 PM.png_thumb)

                1 Reply Last reply Reply Quote 0
                • K
                  kejianshi
                  last edited by

                  So, if you put in a rule immediately after the pass 192.168.1.5 to olive rule and you made it a block 192.168.1.5 to anywhere rule, I wonder what that would do?

                  Second what is the subnet the VPN is using?  I have 1 last question after this…

                  1 Reply Last reply Reply Quote 0
                  • M
                    m3ki
                    last edited by

                    Like so ?
                    Still lets traffic go though ISP.

                    ![Screen Shot 2013-08-09 at 7.40.15 PM.png](/public/imported_attachments/1/Screen Shot 2013-08-09 at 7.40.15 PM.png)
                    ![Screen Shot 2013-08-09 at 7.40.15 PM.png_thumb](/public/imported_attachments/1/Screen Shot 2013-08-09 at 7.40.15 PM.png_thumb)

                    1 Reply Last reply Reply Quote 0
                    • K
                      kejianshi
                      last edited by

                      If none of this works, I'm thinking this.

                      Traffic should go from 192.168.1.5 > some VPN subnet > WAN > VPN

                      (my understanding could be bad)

                      But, if you put a rule on the WAN to block any traffic that is source 192.168.1.5 and destination * that should block 192.168.1.5 when its not using VPN for sure.  Not sure if it will also block it when inside VPN also.  Never tried it.  Its easy to do, try and undo if needed.  Maybe try it.

                      If blocking 192.168.1.5 at the wan doesn't work or if it completely breaks 192.168.1.5 then I'm fresh out of unique and amazing ideas.

                      1 Reply Last reply Reply Quote 0
                      • M
                        m3ki
                        last edited by

                        Like so?
                        You would think this would work ;) So did I, I think this was the first think i tried.

                        anyway tried it again same thing.

                        ![Screen Shot 2013-08-09 at 7.49.51 PM.png](/public/imported_attachments/1/Screen Shot 2013-08-09 at 7.49.51 PM.png)
                        ![Screen Shot 2013-08-09 at 7.49.51 PM.png_thumb](/public/imported_attachments/1/Screen Shot 2013-08-09 at 7.49.51 PM.png_thumb)

                        1 Reply Last reply Reply Quote 0
                        • K
                          kejianshi
                          last edited by

                          Just an idle question?  Do you have a floating rule that says pass anything to anything because this is getting strange?
                          And are you sure the computer in question's IP is actually 192.168.1.5?

                          1 Reply Last reply Reply Quote 0
                          • M
                            m3ki
                            last edited by

                            hehe..
                            no but I have block source 192.168.1.5 to anywhere. Doesnt work either.

                            1 Reply Last reply Reply Quote 0
                            • K
                              kejianshi
                              last edited by

                              So, its going to the VPN as a gateway and then that gateway is sending to the openweb when the vpn fails.

                              Maybe make a rule on the WAN that blocks anything from source interface BOLEVPN that isn't on that one port that openvpn needs.

                              This isn't multi-public-IP system right?  Just 1 WAN?

                              1 Reply Last reply Reply Quote 0
                              • M
                                m3ki
                                last edited by

                                I really hoped that would work but no :(
                                It seems the rules are being bypassed and traffic just jumps to VPN gateway.

                                1 Reply Last reply Reply Quote 0
                                • K
                                  kejianshi
                                  last edited by

                                  Did you apply some rules to the firewall outside the gui using command line?

                                  1 Reply Last reply Reply Quote 0
                                  • M
                                    m3ki
                                    last edited by

                                    No I don't. I haven't gotten that desperate yet :D I am hoping someone who made pfSense would be able to shed some light on this.

                                    1 Reply Last reply Reply Quote 0
                                    • M
                                      m3ki
                                      last edited by

                                      What does this mean: (from the docs)
                                      Policy Route Negation
                                      When a firewall rule directs traffic into the gateway, it bypasses the firewall's normal routing table. Policy route negation is just a rule that passes traffic to other local or VPN-connected networks that does not have a gateway set. By not setting a gateway on that rule it will bypass the gateway group and use the firewall's routing table. These rules should be at the top of the ruleset – or at least above any rules using gateways.

                                      1 Reply Last reply Reply Quote 0
                                      • K
                                        kejianshi
                                        last edited by

                                        It just means that when you send LAN traffic to VPN as gateway it does an end run around the rest of pfsense rules and that if no gateway is stipulated it will use a default gateway.  Also says these rules belong at the top, which is where you have them.

                                        Doesn't explain to me how to get a down VPN to cease and desist passing traffic.

                                        BLOCK TRAFFIC WHEN VPN IS DOWN would be a great option to add to client VPN settings…

                                        1 Reply Last reply Reply Quote 0
                                        • M
                                          m3ki
                                          last edited by

                                          Well I specified option in vpn client not to route traffic by default. Because by default it would add a rule to force stuff into vpn. That's why policy based routing works. I can throw stuff at vpn as needed.

                                          Is there another way to mark packets to go to that gateway?

                                          1 Reply Last reply Reply Quote 0
                                          • K
                                            kejianshi
                                            last edited by

                                            I don't know that that would fix your problems.  No matter how the traffic arrives at the VPN gateway it seems it might get to the WEB unless the VPN blocks traffic when down.  An easy fix would be to run those devices off a second small device that acts as a VPN client, like a small DD-WRT router instead of using pfsense as VPN client.  Then you could easily block any traffic not on a VPN port.  Short of that, I guess we have to wait for answer from ubber genius more than us…

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.