Two servers, want one to have no LAN access
-
The networks I mentioned were only an example to explain the needed settings, since you didn't offer your settings. So that you can differ the clients in firewalll rules.
@viragomann:The OpenVPN interface was also a mystery to me
Which OpenVPN interface? The OpenVPN tab in the firewall rules? Or have you added additional interfaces? Assigning interfaces to the OpenVPN instances should not be necessary for your purposes.
Since your clients on both servers have already access to all, you only need a firewall rule on the OpenVPN tab to block that group that should not get access to LAN.
which interface: My mistake. The firewall/rules/openvpn tab was what I was referencing. Still, until your post, the purpose was unclear and is still a little unclear since the WAN tab allows opens the OpenVPN ports in use.
I understand the overall meaning of your post and will apply my configuration to it when I have time to test it.
Since I assume my problem is a common one it would be nice if it were posted somewhere official and easy to find. pfSense is one of the few routers that support multiple OpenVPN instances. And, off point, pfBlockerNG makes it unique in that no other router allows black list management like it.
-
The OpenVPN tab is for connections coming into the firewall via OpenVPN from sites across the tunnel(s).
The rule on the WAN tab is for establishment of the OpenVPN tunnel itself.
-
The OpenVPN tab is for connections coming into the firewall via OpenVPN from sites across the tunnel(s).
The rule on the WAN tab is for establishment of the OpenVPN tunnel itself.
Thanks. I was beginning to suspect something like this, but an explicit definition is great.
FYI: I want to have one server, the pass through one, for use by people who only need remote private internet access without the odd questions that sometimes appear when an IP address comes from a commercial VPN, such as with Amazon when making a purchase. No local LAN access needed. I can use an auto connect file for that without worries. The separate user certificate for each server allows me to lock it off if a device is lost or stolen.
The other server is for full access, such as windows remote desktop via LAN only or a remote file server via LAN only.
I'm at the level that the OpenVPN wizard is needed and appreciated, short of detailed accurate instructions. Using OpenVPN is a useful tool, not my life's work.
This must, or should be, a common problem. I was surprised to find out it was not clearly defined as such. I originally thought using the local lan box on the server config handled this, but it didn't. Even creating a fictitious LAN for that box permitted local LAN access.
Some kind of formalized instruction would be useful by lots of people, especially if it were geared towards the intermediate user - someone who can look things up providing they know/are told what to look up and providing an answer is actually available somewhere. Better than that would be fantastic.
-
I would:
Assign interfaces to both OpenVPN servers
Place rules that reject the traffic you want rejected (to LAN, to this firewall, etc) on the tab for the server you want to limit
Place a rule that passes any after that (any = the internet)Do the same for the rules for the other VPN server but pass/reject the traffic you want passedrejected from those clients.
Remove all rules from the OpenVPN tab
-
"some pfSense documentation is great and some is lacking a bit"
I would suggest you buy the book, or get gold so you have access to the html and pdf, epub and mobi version of the book.. Gold also gives you access to the hangouts which go over lots of different subjects and gold gives you access to all the previous hangouts.
Keep in mind the some of the docs are really put together by other users - its a wiki.. My understanding is it not meant to be "official" documentation.. I have access and previous you could request access and put up doc's on subjects you felt needed help and if passed peer review would stay, etc.. I am not sure if they are currently allowing new wiki author access?
if you would like clarification on some aspect of how pfsense works in a specific manner - post up your question and many helpful people here to clarify how something works in relation to your context, etc.
-
I would:
Assign interfaces to both OpenVPN servers
Place rules that reject the traffic you want rejected (to LAN, to this firewall, etc) on the tab for the server you want to limit
Place a rule that passes any after that (any = the internet)Do the same for the rules for the other VPN server but pass/reject the traffic you want passedrejected from those clients.
Remove all rules from the OpenVPN tab
Thanks. I tried this and got lost along the way.
Using the OpenVPN rules tab as described further above worked great. I just tested it and it worked well. It was a 1 line entry.
-
"I would suggest you buy the book,"
Went looking for it. Without digging a lot, the only reference to a book for the current pfSense required a gold subscription, at $99/year.
I would consider buying a book, but not buy access to a book for $99/yr. Ridiculous.
-
You get more than just the book for the gold.. But the html version is $24.70
https://portal.pfsense.org/members/signup/html-book
Shoot Derelict has a link to it in his sig ;)
A google for pfsense book, first hit is https://www.netgate.com/blog/pfsense-book-now-available-for-purchase.html
Which links to the gold way to get it or the html (standalone)..
-
You get more than just the book for the gold.. But the html version is $24.70
https://portal.pfsense.org/members/signup/html-book
Shoot Derelict has a link to it in his sig ;)
A google for pfsense book, first hit is https://www.netgate.com/blog/pfsense-book-now-available-for-purchase.html
Which links to the gold way to get it or the html (standalone)..
You're right. I tool a 2nd look at the link and saw the stand alone version available via HTML and if you sign in to read it. Thanks.
-
https://www.netgate.com/our-services/gold-membership.html
