Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Selective routing via VPN interface

    Scheduled Pinned Locked Moved General pfSense Questions
    22 Posts 5 Posters 3.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • DerelictD
      Derelict LAYER 8 Netgate
      last edited by

      The NO_WAN_EGRESS tags must be blocked out WAN using a floating rule, so you are misreading, apparently.

      The gist is:

      If you route traffic for the VPN, tag it at the same time.

      Block anything tagged as such from egressing WAN.

      Chattanooga, Tennessee, USA
      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
      Do Not Chat For Help! NO_WAN_EGRESS(TM)

      1 Reply Last reply Reply Quote 0
      • I
        Inxsible
        last edited by

        Got it. Trying it out now…

        Thanks for sticking by me...

        1 Reply Last reply Reply Quote 0
        • I
          Inxsible
          last edited by

          I just can't get this going. Here's how I set this up :

          Firewall Rule 1 and Firewall Rule 2 are screenshots of how I set up the rule.

          Firewall Rule Setup indicates I have that rule above my default VPN rule that goes via the VPN interface.

          My alias – wan_devices -- is set up as a Hosts with 1 IP for my work laptop

          The minute I save the Firewall rule, my work laptop doesn't get any internet connection. This leads me to believe that the rule is catching the IP correctly. The only thing I can think of now is that the NordVPN tutorial probably set it in a way where nothing goes out of the WAN.

          If there is a way to just create a VPN interface and not follow anything in the NordVPN tutorial and simply do this via Firewall rules, then that would be best.

          What am I doing wrong ???

          ![Firewall Rule 1.png](/public/imported_attachments/1/Firewall Rule 1.png)
          ![Firewall Rule 1.png_thumb](/public/imported_attachments/1/Firewall Rule 1.png_thumb)
          ![Firewall Rule 2.png](/public/imported_attachments/1/Firewall Rule 2.png)
          ![Firewall Rule 2.png_thumb](/public/imported_attachments/1/Firewall Rule 2.png_thumb)
          ![Firewall Rule setup.png](/public/imported_attachments/1/Firewall Rule setup.png)
          ![Firewall Rule setup.png_thumb](/public/imported_attachments/1/Firewall Rule setup.png_thumb)

          1 Reply Last reply Reply Quote 0
          • luckman212L
            luckman212 LAYER 8
            last edited by

            The 2nd rule is definitely getting hit because it's showing 20 states. Is your Outbound NAT set to auto? Post screenshots of outbound NAT, issue might be there…

            1 Reply Last reply Reply Quote 0
            • I
              Inxsible
              last edited by

              Here's the outbound NAT:

              ![Outbound NAT.png](/public/imported_attachments/1/Outbound NAT.png)
              ![Outbound NAT.png_thumb](/public/imported_attachments/1/Outbound NAT.png_thumb)

              1 Reply Last reply Reply Quote 0
              • luckman212L
                luckman212 LAYER 8
                last edited by

                Yeah, that's not gonna work… You're NAT'ting everything out your NORDVPN interface. You need to change that to WAN and then add a more restrictive Outbound NAT rule that only rewrites the addresses for your VPN alias group to the NORDVPN address, or you can do it the other way around but the point is you need 2 rules there...

                1 Reply Last reply Reply Quote 0
                • I
                  Inxsible
                  last edited by

                  thanks luckman212,

                  The NAT'ting everything out the NORDVPN interface was done by the tutorial that I followed from NordVPN. I would rather do what is correct than trying to circumvent the NordVPN tutorial. What would be the recommended way?

                  • Do you think I should default everything out my WAN and create an Alias for all my VPN devices or

                  • default everything out my VPN and create an Alias for my WAN devices?

                  I want only 2 devices out my WAN, rest all via VPN. So option 2 would mean setting static IPs to only 2 devices vs the first option where I would have to set static IPs for almost all my devices.

                  Should I just "factory reset" my pfSense, in order to get rid of everything that the NordVPN tutorial did and start over in the right way ?

                  1 Reply Last reply Reply Quote 0
                  • luckman212L
                    luckman212 LAYER 8
                    last edited by

                    You are not "circumventing" anything. The tutorial just doesn't cover your particular case but there is nothing "wrong" about what I am suggesting here. Yes in your case I would go with option #2 - just define your alias for devices that you want to route normally (bypass VPN) and then set up outbound NAT based on that.

                    1 Reply Last reply Reply Quote 0
                    • I
                      Inxsible
                      last edited by

                      Thank you again luckman212. Creating a NAT rule for WAN helped me out. Now i have my work laptop showing me my ISP IP on whatsmyip and other devices on my network showing me my VPN IP.

                      Exactly what I wanted.

                      Just a quick question: If I add my TV's IP to my wan_devices alias, that should also allow it to go out via my ISP? At that point I don't have to do anything with NAT rules correct?

                      1 Reply Last reply Reply Quote 0
                      • luckman212L
                        luckman212 LAYER 8
                        last edited by

                        Correct  from this point on you can manage everything through your aliases as long as you do not add any additional network interfaces or VLANs. Glad you got things working!

                        1 Reply Last reply Reply Quote 0
                        • I
                          Inxsible
                          last edited by

                          Wonderful. Thank you again for sticking by a novice like me.

                          1 Reply Last reply Reply Quote 0
                          • V vMAC referenced this topic on
                          • First post
                            Last post
                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.