Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    HowTo: Route part of your LAN via TorGuard or PIA.

    Scheduled Pinned Locked Moved OpenVPN
    45 Posts 15 Posters 27.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • C
      chebyshev
      last edited by

      The "push block-outside-dns" seems to allow the client to start at least, but it didn't change anything in terms of the leak tests. You're right - they are showing my IP, not my ISP's DNS server. Strange and pretty much the opposite of what I'm looking for out of a VPN.

      1 Reply Last reply Reply Quote 0
      • DerelictD
        Derelict LAYER 8 Netgate
        last edited by

        @chebyshev On the host you are performing DNS leak tests what are the configured name servers? Precisely what firewall rules did you create (screen shot would be best).

        Chattanooga, Tennessee, USA
        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
        Do Not Chat For Help! NO_WAN_EGRESS(TM)

        1 Reply Last reply Reply Quote 0
        • C
          chebyshev
          last edited by

          The host doing the leak tests gets a static IP assigned via DHCP from the pfSense box - it is assigned the Google DNS servers (8.8.8.8 and 8.8.4.4). Those are the ones that show up if I do 'ipconfig /all'. It is running Windows 10.

          Screenshots of my firewall rules are attached.

          lan_rules.PNG
          lan_rules.PNG_thumb
          floating_rules.PNG
          floating_rules.PNG_thumb

          1 Reply Last reply Reply Quote 0
          • DerelictD
            Derelict LAYER 8 Netgate
            last edited by

            Do you have name servers set up in System > General Setup?? What are they?

            Chattanooga, Tennessee, USA
            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
            Do Not Chat For Help! NO_WAN_EGRESS(TM)

            1 Reply Last reply Reply Quote 0
            • morrealeM
              morreale
              last edited by

              @morreale:

              @chebyshev:

              I just tried that, but got the following in my OpenVPN log:

              May 6 20:54:13	openvpn	84233	SIGTERM[hard,] received, process exiting
May 6 20:54:13	openvpn	30195	Options error: Unrecognized option or missing parameter(s) in /var/etc/openvpn/client2.conf:31: block-outside-dns (2.3.9)
May 6 20:54:13	openvpn	30195	Use --help for more information.

              This seems weird to me because the documentation for OpenVPN 2.3.9 seems to indicate that the –block-outside-dns option is available.

              I had to use "push block-outside-dns" which someone recommended.  not sure if that is actually working or not.  don't see anything in the log.

              I am still having the issue where any of the leaktest sites are showing my DNS server as my IP from the ISP (not my ISPs DNS servers)

              I have done all the different rules for blocking DNS and forcing certain servers.  It just seems like it was working at first and now it always displays the ISP IP even when connected to VPN

              I am using DNS Resolver (no forwarding and no DNS servers configured on general setup…using 127.0.0.1)

              Here is my config at the moment…I have the DNS related rules disabled until I figure out the situation

              0.JPG
              0.JPG_thumb
              1.JPG
              1.JPG_thumb
              2.JPG
              2.JPG_thumb
              3.JPG
              3.JPG_thumb
              4.JPG
              4.JPG_thumb
              5.JPG
              5.JPG_thumb
              6.JPG
              6.JPG_thumb

              Release: pfSense 2.3.4 p1(amd64)
              M/B: Supermicro A1SRi-2758F-O
              SSD: 128GB
              RAM: 2x8Gb Kingston 1600MHz DDR3L PC3-12800 ECC
              AP: Cisco

              1 Reply Last reply Reply Quote 0
              • DerelictD
                Derelict LAYER 8 Netgate
                last edited by

                Don't know why you have all those rules duplicated. Only the first match is going to have any effect.

                Chattanooga, Tennessee, USA
                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                1 Reply Last reply Reply Quote 0
                • morrealeM
                  morreale
                  last edited by

                  @Derelict:

                  Don't know why you have all those rules duplicated. Only the first match is going to have any effect.

                  some of those are due to it being 2 separate images that i should have done a better job of editing before posting :)
                  the others are due to being autocreated and manually created.  duplicates remain disabled and were left in place only for testing

                  Release: pfSense 2.3.4 p1(amd64)
                  M/B: Supermicro A1SRi-2758F-O
                  SSD: 128GB
                  RAM: 2x8Gb Kingston 1600MHz DDR3L PC3-12800 ECC
                  AP: Cisco

                  1 Reply Last reply Reply Quote 0
                  • C
                    chebyshev
                    last edited by

                    @Derelict:

                    Do you have name servers set up in System > General Setup?? What are they?

                    I have the Google DNS servers in there: 8.8.8.8 and 8.8.4.4.

                    dns.png_thumb
                    dns.png

                    1 Reply Last reply Reply Quote 0
                    • DerelictD
                      Derelict LAYER 8 Netgate
                      last edited by

                      I think that might be the problem. Manually set your DNS server on that host to just 4.2.2.2 and run your DNS leak test again.

                      Chattanooga, Tennessee, USA
                      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                      1 Reply Last reply Reply Quote 0
                      • C
                        chebyshev
                        last edited by

                        Tried that - same result.

                        host_dns.PNG
                        host_dns.PNG_thumb

                        1 Reply Last reply Reply Quote 0
                        • DerelictD
                          Derelict LAYER 8 Netgate
                          last edited by

                          And what result is that?

                          Chattanooga, Tennessee, USA
                          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                          Do Not Chat For Help! NO_WAN_EGRESS(TM)

                          1 Reply Last reply Reply Quote 0
                          • C
                            chebyshev
                            last edited by

                            Sorry - my IP is showing up in the DNS leak test results.

                            1 Reply Last reply Reply Quote 0
                            • DerelictD
                              Derelict LAYER 8 Netgate
                              last edited by

                              Hmm. When I set mine to use google for DNS all dnsleaktest.com sees is google.

                              You positive you're working from a host that has all traffic forwarded to the VPN?

                              You sure that host has google and only google set as its DNS servers?

                              Chattanooga, Tennessee, USA
                              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                              Do Not Chat For Help! NO_WAN_EGRESS(TM)

                              1 Reply Last reply Reply Quote 0
                              • C
                                chebyshev
                                last edited by

                                I'm pretty sure on all counts. Is there a DNS leak test site I can use that doesn't require a browser? Like how I can just wget ipecho.net/plain. That way I could test it on my headless clients that are supposedly behind the VPN.

                                The only thing I wonder about is if IPV6 is somehow leaking my IPV4 info, but I don't know enough about IPV6 to know if that is possible.

                                1 Reply Last reply Reply Quote 0
                                • C
                                  chebyshev
                                  last edited by

                                  Update!

                                  It was in fact IPV6 somehow leaking IPV4 information. I turned off IPV6 in Interfaces/WAN and now all that shows up is Google's DNS information in the leak tests.

                                  So on to the next question: am I losing anything by not having IPV6 enabled and if so, how can I prevent the leak with it enabled?

                                  1 Reply Last reply Reply Quote 0
                                  • O
                                    op644
                                    last edited by

                                    After debugging, upon creating the floating rule matching the tag NO_WAN_EGRESS, my wan gateway goes offline or appears to be fully offline.

                                    Why would this be so?

                                    Is the alternative shown at the bottom of the single post at https://www.infotechwerx.com/blog/Prevent-Any-Traffic-VPN-Hosts-Egressing-WAN a viable alternative?

                                    My setup is as this article defines, allocating only a portion(s) of subnets to vpn clients. Otherwise, my setup is identical to the steps listed here and I intend to match this guide.

                                    1 Reply Last reply Reply Quote 0
                                    • DerelictD
                                      Derelict LAYER 8 Netgate
                                      last edited by

                                      It's something else. Traffic sourced from the firewall (dpinger gateway monitoring) will not be matched by the rule that marks traffic with the NO_WAN_EGRESS tag.

                                      Chattanooga, Tennessee, USA
                                      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                      1 Reply Last reply Reply Quote 0
                                      • O
                                        op644
                                        last edited by

                                        @Derelict:

                                        It's something else. Traffic sourced from the firewall (dpinger gateway monitoring) will not be matched by the rule that marks traffic with the NO_WAN_EGRESS tag.

                                        When I disable just that rule I get most of what the guide is set out to do to work. I'm guessing you can't have both this floating rule and the advanced setting to Skip rules when gateway is down (the alternative I mentioned in Advanced -> Misc -> Gateway Monitoring) to be active at the same time.

                                        I'm also surprised that it was by disabling only this floating rule that my router goes back to having a stable WAN gateway connection.

                                        Any ideas on where to look or what to check for?

                                        Also, each of the openvpn client gateways I defined show offline in Gateway status but are active in OpenVPN status and are actually working. Does this help and could this mean that the gateway monitoring service has something interfering?

                                        1 Reply Last reply Reply Quote 0
                                        • DerelictD
                                          Derelict LAYER 8 Netgate
                                          last edited by

                                          The rules and that checkbox can coexist I just don't know why you'd want to.  I hate to do it but instead of saying the rules are the same how about showing us what you actually have.

                                          Any packages (snort/squid) involved?

                                          Chattanooga, Tennessee, USA
                                          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                          Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                          1 Reply Last reply Reply Quote 0
                                          • O
                                            op644
                                            last edited by

                                            General audience:

                                            After resolving my previous issue I am now unable to get through with the BLOCK dns port 53 rule hierarchically ordered above the pass rules in the firewall rules. I have been checking every detail and now I have a new question.

                                            My router general DNS servers have both google public dns and another dns outside of my ISP's dns. Because of this, I did not specifically add DNS settings (to the same criteria) per static mapping.

                                            I'm not sure why when the OpenVPN clients use WAN so to work with blocking LAN requests from those client's assigned IP/range, yet it still prevents connection so somehow these OpenVPN clients are still using the LAN interface and the block is preventing successful connections.

                                            Derelict:

                                            The new pfsense interface had me put the tagged in tag instead, because I was going by the screen shots and now the web front end is slightly different with labels. So the floating rule is fixed.

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.