Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    OpenVPN killswitch

    Scheduled Pinned Locked Moved OpenVPN
    20 Posts 5 Posters 2.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • N
      NasKar
      last edited by

      I'm trying to create an openVPN killswitch and read numerous thread on the subject the one that I would like to enact is https://forum.pfsense.org/index.php?topic=84463.msg463226#msg463226 by Derelict.
      I have created a Openvpn client that is up and a gateway using the interface attached to the openvpn client.  I create the LAN rule for the computer to use the openvpn client gateway and add the the no_wan_egress tab in the adv section.  As soon as I create the floating rule see below my computer is not able to access the internet.  Not sure what I'm doing wrong.
      Killswitch-03.jpg
      Killswitch-03.jpg_thumb
      Killswitch-04.jpg
      Killswitch-04.jpg_thumb

      Intel(R) Core(TM)2 Duo CPU E7500 @ 2.93GHz
      2 CPUs: 1 package(s) x 2 core(s)
      AES-NI CPU Crypto: No
      2 Gigs Ram
      SSD with ver 2.4.0
      IBM Intel Pro PCI-E Quad Port 10/100/1000 Server Adapter 39Y6138 (K210320)

      1 Reply Last reply Reply Quote 0
      • V
        Velcro
        last edited by

        On the floating rule did you designate the traffic direction as "Out"?

        https://www.infotechwerx.com/blog/Prevent-Any-Traffic-VPN-Hosts-Egressing-WAN

        1 Reply Last reply Reply Quote 0
        • N
          NasKar
          last edited by

          @V3lcr0:

          On the floating rule did you designate the traffic direction as "Out"?

          https://www.infotechwerx.com/blog/Prevent-Any-Traffic-VPN-Hosts-Egressing-WAN

          Yes traffic direction is out

          Intel(R) Core(TM)2 Duo CPU E7500 @ 2.93GHz
          2 CPUs: 1 package(s) x 2 core(s)
          AES-NI CPU Crypto: No
          2 Gigs Ram
          SSD with ver 2.4.0
          IBM Intel Pro PCI-E Quad Port 10/100/1000 Server Adapter 39Y6138 (K210320)

          1 Reply Last reply Reply Quote 0
          • N
            NasKar
            last edited by

            I've been playing with the settings and can use some clarification.
            I have 2 VPN clients. Client A and B and a VPN server to dial into my network remotely.  I have 2 rules on my LAN interface,
            Client A source alias for computers on VPN A, Source Port any, Destination any, Destination port any,  Gateway for VPN A.
            Client B soucre alias for computers on VPN B, Source Port any, Destination any, Destination port any, Gateway for VPN B and Tag NO_WAN_EGRESS
            The floating rule is quick check, WAN interface, direction out, address family IPv4, Protocol any, source any, destination any, Tag NO_WAN_EGRESS

            When remotely on the VPN server I can't go to web sites unless I turn off the floating rule.  I thought the floating rule would only affect VPNs with the TAG NO_WAN_EGRESS?
            With the floating rule on if I turn off VPN B computers on VPN A (no TAG) can't access the internet.

            Intel(R) Core(TM)2 Duo CPU E7500 @ 2.93GHz
            2 CPUs: 1 package(s) x 2 core(s)
            AES-NI CPU Crypto: No
            2 Gigs Ram
            SSD with ver 2.4.0
            IBM Intel Pro PCI-E Quad Port 10/100/1000 Server Adapter 39Y6138 (K210320)

            1 Reply Last reply Reply Quote 0
            • R
              Ryu945
              last edited by

              On your router:

              1)  Disable the LAN firewall rule that allows regular internet communication.

              1. Have your VPN rules set up.

              3)  Below those rules, make a rule that stops all ip4 and ip6 traffic.

              When the VPNs fail, the stop rules take over.

              1 Reply Last reply Reply Quote 0
              • N
                NasKar
                last edited by

                Ryu945 
                Does that involve using a checkbox in System->Advanced->Miscellaneous:Skip rules when gateway is down?

                Intel(R) Core(TM)2 Duo CPU E7500 @ 2.93GHz
                2 CPUs: 1 package(s) x 2 core(s)
                AES-NI CPU Crypto: No
                2 Gigs Ram
                SSD with ver 2.4.0
                IBM Intel Pro PCI-E Quad Port 10/100/1000 Server Adapter 39Y6138 (K210320)

                1 Reply Last reply Reply Quote 0
                • R
                  Ryu945
                  last edited by

                  I never noticed that option before.  Even not touching that setting appears to work correctly.  When VPNs are down, there is no internet.

                  1 Reply Last reply Reply Quote 0
                  • DerelictD
                    Derelict LAYER 8 Netgate
                    last edited by

                    Client B soucre alias for computers on VPN B, Source Port any, Destination any, Destination port any, Gateway for VPN B and Tag NO_WAN_EGRESS

                    You set the tag there using the Tag: NO_WAN_EGRESS field on the rule.

                    The floating rule is quick check, WAN interface, direction out, address family IPv4, Protocol any, source any, destination any, Tag NO_WAN_EGRESS

                    You match the tag there using the Tagged: NO_WAN_EGRESS field on the rule.

                    Different rule settings: Tag and Tagged.

                    Chattanooga, Tennessee, USA
                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                    1 Reply Last reply Reply Quote 0
                    • N
                      NasKar
                      last edited by

                      It seemed to work but when I tried a 2nd time turning off the VPN Client B, my computer still worked with the IP from VPN Client A. even though it's assigned to VPN Client B thru an alias.  I want to have VPN Client A work even if the VPN goes down and VPN Client B to not work at all when the VPN goes down.

                      Intel(R) Core(TM)2 Duo CPU E7500 @ 2.93GHz
                      2 CPUs: 1 package(s) x 2 core(s)
                      AES-NI CPU Crypto: No
                      2 Gigs Ram
                      SSD with ver 2.4.0
                      IBM Intel Pro PCI-E Quad Port 10/100/1000 Server Adapter 39Y6138 (K210320)

                      1 Reply Last reply Reply Quote 0
                      • DerelictD
                        Derelict LAYER 8 Netgate
                        last edited by

                        So make it do that.

                        That reject floating rule will not match unless the NO_WAN_EGRESS tag is present in the traffic. If you don't want it blocked, don't set the tag on the rule that policy routes it out the VPN.

                        Chattanooga, Tennessee, USA
                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                        1 Reply Last reply Reply Quote 0
                        • N
                          NasKar
                          last edited by

                          @Derelict:

                          So make it do that.

                          That reject floating rule will not match unless the NO_WAN_EGRESS tag is present in the traffic. If you don't want it blocked, don't set the tag on the rule that policy routes it out the VPN.

                          Thats how I have it setup per https://forum.pfsense.org/index.php?topic=144408.msg786896#msg786896
                          VPN Client A has no tag and VPN Client B has the NO_WAN_EGRESS tag.

                          I tried a 3rd time and it is working as it is supposed to.  No sure why it doesn't work all the time.  Do I need to reset the state table after I make a change?  I also notice on ipleak.net that sometimes my DNS is leaking but not all the time, could that have something to do with the intermittent issue?

                          Intel(R) Core(TM)2 Duo CPU E7500 @ 2.93GHz
                          2 CPUs: 1 package(s) x 2 core(s)
                          AES-NI CPU Crypto: No
                          2 Gigs Ram
                          SSD with ver 2.4.0
                          IBM Intel Pro PCI-E Quad Port 10/100/1000 Server Adapter 39Y6138 (K210320)

                          1 Reply Last reply Reply Quote 0
                          • K
                            kpa
                            last edited by

                            Everytime you do major changes to your ruleset you're supposed to reset states to eliminate any dangling states that might allow traffic that you don't want to pass after the changes.

                            1 Reply Last reply Reply Quote 0
                            • N
                              NasKar
                              last edited by

                              Thanks to Derelict and kpa for your help.  Everyting seems to be working as expected.

                              Intel(R) Core(TM)2 Duo CPU E7500 @ 2.93GHz
                              2 CPUs: 1 package(s) x 2 core(s)
                              AES-NI CPU Crypto: No
                              2 Gigs Ram
                              SSD with ver 2.4.0
                              IBM Intel Pro PCI-E Quad Port 10/100/1000 Server Adapter 39Y6138 (K210320)

                              1 Reply Last reply Reply Quote 0
                              • DerelictD
                                Derelict LAYER 8 Netgate
                                last edited by

                                I also notice on ipleak.net that sometimes my DNS is leaking but not all the time, could that have something to do with the intermittent issue?

                                That depends on how you configured the flow of your DNS.

                                Chattanooga, Tennessee, USA
                                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                1 Reply Last reply Reply Quote 0
                                • N
                                  NasKar
                                  last edited by

                                  @Derelict:

                                  I also notice on ipleak.net that sometimes my DNS is leaking but not all the time, could that have something to do with the intermittent issue?

                                  That depends on how you configured the flow of your DNS.

                                  Could you expand on what u mean by flow of DNS

                                  Intel(R) Core(TM)2 Duo CPU E7500 @ 2.93GHz
                                  2 CPUs: 1 package(s) x 2 core(s)
                                  AES-NI CPU Crypto: No
                                  2 Gigs Ram
                                  SSD with ver 2.4.0
                                  IBM Intel Pro PCI-E Quad Port 10/100/1000 Server Adapter 39Y6138 (K210320)

                                  1 Reply Last reply Reply Quote 0
                                  • DerelictD
                                    Derelict LAYER 8 Netgate
                                    last edited by

                                    What DNS servers are the clients configured to use?

                                    If a DNS server you run, what is its configuration?

                                    Chattanooga, Tennessee, USA
                                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                    1 Reply Last reply Reply Quote 0
                                    • N
                                      NasKar
                                      last edited by

                                      @Derelict:

                                      What DNS servers are the clients configured to use?

                                      If a DNS server you run, what is its configuration?

                                      in VPN/OPENVPN/Clients/edit  I don't see an option for DNS servers, my System/General Setup is open DNS 208.67.222.222 and 208.67.220.220 and my DNS resolver is set to All network interfaces and All outgoing Network Interfaces

                                      Intel(R) Core(TM)2 Duo CPU E7500 @ 2.93GHz
                                      2 CPUs: 1 package(s) x 2 core(s)
                                      AES-NI CPU Crypto: No
                                      2 Gigs Ram
                                      SSD with ver 2.4.0
                                      IBM Intel Pro PCI-E Quad Port 10/100/1000 Server Adapter 39Y6138 (K210320)

                                      1 Reply Last reply Reply Quote 0
                                      • DerelictD
                                        Derelict LAYER 8 Netgate
                                        last edited by

                                        Right but what are the actual hosts that are asking that names be resolved using as DNS servers?

                                        That would be either statically set on the client or in the DHCP server.

                                        It all matters and all has to be set correctly to get the results you are looking for.

                                        Chattanooga, Tennessee, USA
                                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                        1 Reply Last reply Reply Quote 0
                                        • N
                                          NasKar
                                          last edited by

                                          @Derelict:

                                          Right but what are the actual hosts that are asking that names be resolved using as DNS servers?

                                          That would be either statically set on the client or in the DHCP server.

                                          It all matters and all has to be set correctly to get the results you are looking for.

                                          Did some research
                                          Would this work?
                                          System/General Setup/DNS Servers blank, DNS Server Override checked
                                          Services/DNS resolver/General settings/Outgoing Network Interfaces/ VPN B (interface that I want my DNS to use with no leakage)
                                          Services/DHCP Server/LAN/Add DNS to static mapping that I want those static IP to use (ie not the VPN DNS)

                                          Intel(R) Core(TM)2 Duo CPU E7500 @ 2.93GHz
                                          2 CPUs: 1 package(s) x 2 core(s)
                                          AES-NI CPU Crypto: No
                                          2 Gigs Ram
                                          SSD with ver 2.4.0
                                          IBM Intel Pro PCI-E Quad Port 10/100/1000 Server Adapter 39Y6138 (K210320)

                                          1 Reply Last reply Reply Quote 0
                                          • DerelictD
                                            Derelict LAYER 8 Netgate
                                            last edited by

                                            I would:

                                            Set the VPN hosts I want to route only over the VPN to use free, outside name servers (google, quad-9, level3, etc) using DHCP or Static or whatever.

                                            Policy route the DNS queries out the VPN with all the other internet traffic.

                                            And you're done.

                                            Everything you just described is fine until the VPN is down and all of your DNS breaks for everything.

                                            Chattanooga, Tennessee, USA
                                            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                            Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.