Outgoing data being routed to OpenVPN Client Connection
-
I just added an OpenVPN connection, along with creating a new interface for this connection. Then specified my LAN subnet access to send data out over this interface, but did not add LAN rules to have any host do so. Basically, just a connection to my OpenVPN server, but no assigned usage on my LAN.
I cannot decipher what you're talking about here.
What is "specified my LAN subnet access to send data out over this interface?"
Post shots of what you've done instead of telling us what you think you've done.
-
I just added an OpenVPN connection, along with creating a new interface for this connection. Then specified my LAN subnet access to send data out over this interface, but did not add LAN rules to have any host do so. Basically, just a connection to my OpenVPN server, but no assigned usage on my LAN.
I cannot decipher what you're talking about here.
What is "specified my LAN subnet access to send data out over this interface?"
Post shots of what you've done instead of telling us what you think you've done.
-
How is ATTGW defined?
Any floating rules?
The rules on your VPN1 are wrong. They apply to connections coming INTO pfSense FROM OpenVPN. You don't need any rules there to make outbound connections to that tunnel.
https://doc.pfsense.org/index.php/Firewall_Rule_Troubleshooting
-
How is ATTGW defined?
Any floating rules?
The rules on your VPN1 are wrong. They apply to connections coming INTO pfSense FROM OpenVPN. You don't need any rules there to make outbound connections to that tunnel.
https://doc.pfsense.org/index.php/Firewall_Rule_Troubleshooting
I made the change to the VPN1 ruleset, but it was my understanding that I needed to explicitly allow my LAN traffic or individual host to leave through the VPN1 interface if I wanted to further control access.
Here are the settings now…
Traffic is still leaving on VPN1 instead of WAN.
-
Yeah that's strange.
Does checking your egress IP address at wimi.com or something confirm the traffic is actually going out the VPN?
What happens if you change the LAN rule back to Gateway: default ??
Disable the VPN1 NAT rule?
I just tried it on my Xen stack and it works exactly as expected.
-
Duh. You are probably getting a default route from your VPN provider. Add route-nopull; to the advanced settings of the VPN client and bounce it.
-
Yeah that's strange.
Does checking your egress IP address at wimi.com or something confirm the traffic is actually going out the VPN?
What happens if you change the LAN rule back to Gateway: default ??
Disable the VPN1 NAT rule?
I just tried it on my Xen stack and it works exactly as expected.
Yeah all my devices on my 'LAN' are on my WAN IP according to WIMI and Google search 'IP'.
Looking at pfInfo, all my outgoing packets are being logged under the ovpnc2 interface.
I also started a packet capture on VPN1, and nothing other than a few random packets were captured. Not the heavy activity that is being shown in pfInfo.
-
Duh. You are probably getting a default route from your VPN provider. Add route-nopull; to the advanced settings of the VPN client and bounce it.
Ok, that did it.
But its really weird that the previous packet capture wasnt actually seeing the data that pfInfo said was passing across it.
-
Yeah. Sorry. I should have caught route-nopull; first thing instead of asking you to jump through all those screenshots.
-
Yeah. Sorry. I should have caught route-nopull; first thing instead of asking you to jump through all those screenshots.
No problem man! Thanks for all the help!
-
Just learned: Note that if you're on 2.2 there's now a checkbox "Don't Pull Routes" that adds route-nopull for you.
Ignore the description on 2.2 - the descriptions for those two similar options are flipped. Fixed in 2.2.1. https://redmine.pfsense.org/issues/4273
