Difference between Interface subnet and 192.168.2.0/24

panz · Sep 3, 2013, 1:01 AM

Testing 2 firewall rules: the first one has for source the OPT3 subnet (net for OPT3 is 192.168.2.0/24) and DOESN'T work.

The second one - source 192.168.2.0/24 - is ok.

Why?

doktornotor · Sep 3, 2013, 1:06 AM

What's OPT3? Some OpeVPN? Why's it even assigned as interface? Not enough information here, and "doesn't work" is never a useful description of a problem.

kejianshi · Sep 3, 2013, 1:10 AM

They should both work (or not work) the same, as far as I know if the OPT3 subnet is 192.168.2.0/24.

But yeah - I don't get the reference to OpenVPN in the description either…

panz · Sep 3, 2013, 1:10 AM

@doktornotor:

What's OPT3? Some OpeVPN? Why's it even assigned as interface? Not enough information here, and "doesn't work" is never a useful description of a problem.

OPT3 is a VPN. The client has (been) assigned IP 192.168.2.6. "doesn't work" means that the first rule doesn't allow traffic through OPT3 interface, the second one allows it. But I can't understand why!

doktornotor · Sep 3, 2013, 1:13 AM

With pfS being the openvpn server? Then again, why's this even assigned as interface? Please describe exactly what you are doing and how things are set up, waste of time so far.

kejianshi · Sep 3, 2013, 1:16 AM

Hmmmm - Thats odd.

Not to beat a dead horse, but describe the VPN that is on OPT3?

Is it a separate piece of hardware?

(I might have an answer for why those rules behave differently. I notice to the left, there is a purple "i" meaning there is some advanced setting. Perhaps those are not the same on both rules?)

panz · Sep 3, 2013, 1:19 AM

OPT3 OpenVPN is a roadwarrior VPN. I use it to tunnel my laptop traffic to pfsense, then out to the Internet with a VPN provider.

I've assigned it an Interface to filter and NAT that connection.

It works flawlessly only with the second rule… :(

kejianshi · Sep 3, 2013, 1:29 AM

I'm not sure why this would work at all. I've never seen anyone do this.
My immediate thought is that you should not be doing this.

I would like to be able to have multiple instances of pfsense produce multiple firewall tabs that I could manipulate seperately, but I've not seen that ever happen and I have never seen anyone do what you are doing either.

I think that if I had additional rules to add, I'd be adding them under the OpenVPN Firewall Tab, not a seperate tab.
How did that tab even get there? is that a physical interface?

panz · Sep 3, 2013, 1:29 AM

@kejianshi:

I'm not sure why this would work at all. I've never seen anyone do this.
My immediate thought is that you should not be doing this.

Why?

My scheme is:

first OpenVPN is pfsense as client to AirVPN. This allows me to tunnel all the traffic leaving pfsense (LAN, etc.) through a VPN provider.
second OpenVPN is a roadwarrior VPN with pfsense acting as server. It assigns 192.168.2.0/24 addresses and tunnels all the traffic generated by my laptop through the VPN server and then outside pfsense to the Internet through AirVPN client.

What am I doing wrong??? ::)

doktornotor · Sep 3, 2013, 1:30 AM

@panz:

It works flawlessly only with the second rule… :(

If you check the "Topology" checkbox, do both work?

kejianshi · Sep 3, 2013, 1:32 AM

doktornotor - Currently I'm lost…

I'd probably need a drawing of this to know what is going on.

doktornotor · Sep 3, 2013, 1:35 AM

@kejianshi:

doktornotor - Currently I'm lost…
I'd probably need a drawing of this to know what is going on.

Basically something like this. But with client connected not from LAN, but via OVPN.

kejianshi · Sep 3, 2013, 1:38 AM

I'll just watch and see how this goes… Thanks.

panz · Sep 3, 2013, 1:49 AM

@kejianshi:

doktornotor - Currently I'm lost…

I'd probably need a drawing of this to know what is going on.

WAN (ISP) –-- pfsense ---- LAN

So, pfsense has 2 physical interfaces: LAN & WAN. WAN has a public IP; LAN is 192.168.1.0/24 (pfsense is 192.168.1.1).

Then I setup pfsense as client to AirVPN (a VPN service provider) so all my traffic is sent via VPN. Here's my NAT scheme:

Then, I want to use my laptop with maximum security, so I setup a roadwarrior conf with pfsense acting as an OpenVPN server (tunnel is 192.168.2.0/24).

Then, to prevent DNS leaks and LAN clients using Internet when AirVPN is down, I setup 2 floating rules:

where MY_DNS_ADDRESSES is an alias to my favorite DNS servers (OpenNIC).

Now I'm experimenting with firewall rules because, as far as I know, now my "exposed" interface is OpenVPN (because all my Internet traffic comes from there).

doktornotor · Sep 3, 2013, 1:50 AM

Wasn't my question. Let me ask again:

If you check the "Topology" checkbox, do both work (i.e., OPT3 subnet being the same as /24)?

panz · Sep 3, 2013, 1:52 AM

@doktornotor:

Wasn't my question. Let me ask again:

If you check the "Topology" checkbox, do both work (i.e., OPT3 subnet being the same as /24)?

There's only 1 (roadwarrior) client and it has 192.168.2.6 address.

doktornotor · Sep 3, 2013, 1:55 AM

The question still remains the same. See the OpenVPN docs on net30 for the reason I'm asking.

panz · Sep 3, 2013, 1:57 AM

Yes, now checking that, the first rule works… so... why?

doktornotor · Sep 3, 2013, 1:59 AM

Well, because /30 is not /24 :P

net30 – Use a point-to-point topology, by allocating one /30 subnet per client.
subnet -- Use a subnet rather than a point-to-point topology by configuring the tun interface with a local IP address and subnet mask

Documentation. Also comparing the ifconfig output for both modes should be pretty much enlightening.

kejianshi · Sep 3, 2013, 2:02 AM

OK - So, your pfsense is a client to a vpn service and then your pfsense is also running an openvpn server to which your laptop/computer is a client while inside your own LAN? Do I have this wrong?