Help debugging a multi-VPN setup
-
First, I don't think you need floating rules (most people don't) so I would get rid of those for now as they can certainly cause issues. I have 5 OpenVPN clients and an ovpn server set up on my pfSense at home, with some pretty detailed policy routes + outbound NAT, and no floating rules needed.
Netflix blocks most VPNs nowadays and it's whack-a-mole. I don't know exactly what the latest advice is on that because I use Netflix without VPN and it works fine but you may need to find a different VPN provider to make that work if you absolutely must route Netflix via VPN. That isn't a pfSense issue.
It sounds like you've done the right things for the most part, the alias, the policy-based routing rules etc. Aside from Netflix, what exactly is not working? If you need the devices in the "SECURE" IP alias group to also talk to your parents house, then you probably need the rule that sends traffic there to be ABOVE whatever generic VPN routing rule you have.
-
You have two basic choices:
Enable Don't Pull Routes on the client connection and policy route certain traffic out the VPN.
Leave Don't Pull Routes checked and policy route the exceptional traffic (like your Roku devices) out the WAN_GW directly.
-
First, thank you to both of you. I had given up hope of getting a reply and thus hadn't checked.
@luckman212, my goal is NOT to use the secure VPN for Roku. Ideally my traffic all goes out the normal WAN. The exceptions are that traffic to and from SECURE goes out ONLY on the secure VPN and traffic that is not SECURE but tries to go to the parent's LAN goes out that VPN. The fact that Netflix is giving me problems means I'm sending traffic out the wrong way, I just don't know how to fix it or where to start. :( Currently I have removed all of the SECURE VPN stuff and things are working as expected. How do I add my SECURE VPN back in without breaking everything?
@Derelict, I'm afraid I don't follow. Could you elaborate some?
Thank you both!
-
First look at this:
https://www.infotechwerx.com/blog/Creating-pfSense-Connection-VPNBook
-
@Derelict, that's extremely similar to what I did with my privacy VPN connection. After that, I created an interface for that connection and I tried to route all SECURE traffic through it.
-
And what?
-
Take a look at this document. It describes almost exactly what you want.
https://www.techhelpguides.com/2017/06/12/ultimate-pfsense-openvpn-guide/
-
I just perused that. It looks pretty solid. I like tag/match instead of Skip Rules when Gateway is Down but other than that…
-
Give a newbie a hand please :) Tag/match should be done by floating rules in this context I suppose ?
-
It is all here:
https://www.infotechwerx.com/blog/Creating-pfSense-Connection-VPNBook
-
Sty make sure you don't have "redirect-gateway def1" in your advanced configuration for the PIA VPN. That will override all of your policy based routing and send all traffic through the VPN by setting your default gateway to the VPN.
