Exclude a Subnet From OpenVPN

NOYB

Need to exclude a subnet (192.168.149.0) on Windows clients of pfSense OpenVPN.

Thinking there needs to be something added to the pfSense OpenVPN server custom options.

Need some guidance in right direction.

Thanks.

Derelict

I assume you are pushing a default gateway and want to make a local exclusion to another subnet other than the local subnet or something like that.

Perhaps something like:

push "route 192.168.149.0 255.255.255.0 net_gateway"

https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage

NOYB

Thanks for your suggestion. I was barking up the wrong tree though. The route table looked fine.

Turned out to be Windows OpenVPN client interface marked as "public" so Windows Firewall blocking stuff.

The fix was to run


Get-NetConnectionProfile

to get the interface index and then run


Set-NetConnectionProfile -InterfaceIndex {interface index} -NetworkCategory Private

to mark it as private.

Would be nice if it could somehow be pushed from the server though. Are there any settings the OpenVPN server can push that will cause the Windows OpenVPN client interface to be marked as private?

Hope that doesn't open security hole. I'm thinking it should be similar to being on the pfSense LAN with an interface marked as private. Please correct me, share insights etc.

Thanks.

P.S. Those are PowerShell commands run as administrator by the way.

Pippin

Try this in server:

push "route-metric 512" 
push "route 0.0.0.0 0.0.0.0"

NOYB

Still marked as "Public Network". It is no longer "unidentified" though.

From what I understand, public/private is determined per the default gateway. Though I'm not sure what criteria is used to make the determination.

NOYB

Think I may have it resolved. Time will tell for sure but looking good so far.

After adding the push route-metric and route, the interface network category was still set as "Public".
But then after setting the network category to "Private", using the "Set-NetConnectionProfile" command it seems to stick with future connections. So we'll see how well that holds up over time.

I consolidated the two push commands into a single command of:


push "route 0.0.0.0 0.0.0.0 vpn_gateway 9999"

Any gotchas lurking with the single command? OpenVPN doc does mention the "vpn_gateway" keyword may not be compatible with all OS's. But didn't mention any specifically.

Thanks to everyone for your help and getting me on the right path.