Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    OpenVPN killswitch

    Scheduled Pinned Locked Moved OpenVPN
    20 Posts 5 Posters 2.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • N
      NasKar
      last edited by

      I've been playing with the settings and can use some clarification.
      I have 2 VPN clients. Client A and B and a VPN server to dial into my network remotely.  I have 2 rules on my LAN interface,
      Client A source alias for computers on VPN A, Source Port any, Destination any, Destination port any,  Gateway for VPN A.
      Client B soucre alias for computers on VPN B, Source Port any, Destination any, Destination port any, Gateway for VPN B and Tag NO_WAN_EGRESS
      The floating rule is quick check, WAN interface, direction out, address family IPv4, Protocol any, source any, destination any, Tag NO_WAN_EGRESS

      When remotely on the VPN server I can't go to web sites unless I turn off the floating rule.  I thought the floating rule would only affect VPNs with the TAG NO_WAN_EGRESS?
      With the floating rule on if I turn off VPN B computers on VPN A (no TAG) can't access the internet.

      Intel(R) Core(TM)2 Duo CPU E7500 @ 2.93GHz
      2 CPUs: 1 package(s) x 2 core(s)
      AES-NI CPU Crypto: No
      2 Gigs Ram
      SSD with ver 2.4.0
      IBM Intel Pro PCI-E Quad Port 10/100/1000 Server Adapter 39Y6138 (K210320)

      1 Reply Last reply Reply Quote 0
      • R
        Ryu945
        last edited by

        On your router:

        1)  Disable the LAN firewall rule that allows regular internet communication.

        1. Have your VPN rules set up.

        3)  Below those rules, make a rule that stops all ip4 and ip6 traffic.

        When the VPNs fail, the stop rules take over.

        1 Reply Last reply Reply Quote 0
        • N
          NasKar
          last edited by

          Ryu945 
          Does that involve using a checkbox in System->Advanced->Miscellaneous:Skip rules when gateway is down?

          Intel(R) Core(TM)2 Duo CPU E7500 @ 2.93GHz
          2 CPUs: 1 package(s) x 2 core(s)
          AES-NI CPU Crypto: No
          2 Gigs Ram
          SSD with ver 2.4.0
          IBM Intel Pro PCI-E Quad Port 10/100/1000 Server Adapter 39Y6138 (K210320)

          1 Reply Last reply Reply Quote 0
          • R
            Ryu945
            last edited by

            I never noticed that option before.  Even not touching that setting appears to work correctly.  When VPNs are down, there is no internet.

            1 Reply Last reply Reply Quote 0
            • DerelictD
              Derelict LAYER 8 Netgate
              last edited by

              Client B soucre alias for computers on VPN B, Source Port any, Destination any, Destination port any, Gateway for VPN B and Tag NO_WAN_EGRESS

              You set the tag there using the Tag: NO_WAN_EGRESS field on the rule.

              The floating rule is quick check, WAN interface, direction out, address family IPv4, Protocol any, source any, destination any, Tag NO_WAN_EGRESS

              You match the tag there using the Tagged: NO_WAN_EGRESS field on the rule.

              Different rule settings: Tag and Tagged.

              Chattanooga, Tennessee, USA
              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
              Do Not Chat For Help! NO_WAN_EGRESS(TM)

              1 Reply Last reply Reply Quote 0
              • N
                NasKar
                last edited by

                It seemed to work but when I tried a 2nd time turning off the VPN Client B, my computer still worked with the IP from VPN Client A. even though it's assigned to VPN Client B thru an alias.  I want to have VPN Client A work even if the VPN goes down and VPN Client B to not work at all when the VPN goes down.

                Intel(R) Core(TM)2 Duo CPU E7500 @ 2.93GHz
                2 CPUs: 1 package(s) x 2 core(s)
                AES-NI CPU Crypto: No
                2 Gigs Ram
                SSD with ver 2.4.0
                IBM Intel Pro PCI-E Quad Port 10/100/1000 Server Adapter 39Y6138 (K210320)

                1 Reply Last reply Reply Quote 0
                • DerelictD
                  Derelict LAYER 8 Netgate
                  last edited by

                  So make it do that.

                  That reject floating rule will not match unless the NO_WAN_EGRESS tag is present in the traffic. If you don't want it blocked, don't set the tag on the rule that policy routes it out the VPN.

                  Chattanooga, Tennessee, USA
                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                  1 Reply Last reply Reply Quote 0
                  • N
                    NasKar
                    last edited by

                    @Derelict:

                    So make it do that.

                    That reject floating rule will not match unless the NO_WAN_EGRESS tag is present in the traffic. If you don't want it blocked, don't set the tag on the rule that policy routes it out the VPN.

                    Thats how I have it setup per https://forum.pfsense.org/index.php?topic=144408.msg786896#msg786896
                    VPN Client A has no tag and VPN Client B has the NO_WAN_EGRESS tag.

                    I tried a 3rd time and it is working as it is supposed to.  No sure why it doesn't work all the time.  Do I need to reset the state table after I make a change?  I also notice on ipleak.net that sometimes my DNS is leaking but not all the time, could that have something to do with the intermittent issue?

                    Intel(R) Core(TM)2 Duo CPU E7500 @ 2.93GHz
                    2 CPUs: 1 package(s) x 2 core(s)
                    AES-NI CPU Crypto: No
                    2 Gigs Ram
                    SSD with ver 2.4.0
                    IBM Intel Pro PCI-E Quad Port 10/100/1000 Server Adapter 39Y6138 (K210320)

                    1 Reply Last reply Reply Quote 0
                    • K
                      kpa
                      last edited by

                      Everytime you do major changes to your ruleset you're supposed to reset states to eliminate any dangling states that might allow traffic that you don't want to pass after the changes.

                      1 Reply Last reply Reply Quote 0
                      • N
                        NasKar
                        last edited by

                        Thanks to Derelict and kpa for your help.  Everyting seems to be working as expected.

                        Intel(R) Core(TM)2 Duo CPU E7500 @ 2.93GHz
                        2 CPUs: 1 package(s) x 2 core(s)
                        AES-NI CPU Crypto: No
                        2 Gigs Ram
                        SSD with ver 2.4.0
                        IBM Intel Pro PCI-E Quad Port 10/100/1000 Server Adapter 39Y6138 (K210320)

                        1 Reply Last reply Reply Quote 0
                        • DerelictD
                          Derelict LAYER 8 Netgate
                          last edited by

                          I also notice on ipleak.net that sometimes my DNS is leaking but not all the time, could that have something to do with the intermittent issue?

                          That depends on how you configured the flow of your DNS.

                          Chattanooga, Tennessee, USA
                          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                          Do Not Chat For Help! NO_WAN_EGRESS(TM)

                          1 Reply Last reply Reply Quote 0
                          • N
                            NasKar
                            last edited by

                            @Derelict:

                            I also notice on ipleak.net that sometimes my DNS is leaking but not all the time, could that have something to do with the intermittent issue?

                            That depends on how you configured the flow of your DNS.

                            Could you expand on what u mean by flow of DNS

                            Intel(R) Core(TM)2 Duo CPU E7500 @ 2.93GHz
                            2 CPUs: 1 package(s) x 2 core(s)
                            AES-NI CPU Crypto: No
                            2 Gigs Ram
                            SSD with ver 2.4.0
                            IBM Intel Pro PCI-E Quad Port 10/100/1000 Server Adapter 39Y6138 (K210320)

                            1 Reply Last reply Reply Quote 0
                            • DerelictD
                              Derelict LAYER 8 Netgate
                              last edited by

                              What DNS servers are the clients configured to use?

                              If a DNS server you run, what is its configuration?

                              Chattanooga, Tennessee, USA
                              A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                              DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                              Do Not Chat For Help! NO_WAN_EGRESS(TM)

                              1 Reply Last reply Reply Quote 0
                              • N
                                NasKar
                                last edited by

                                @Derelict:

                                What DNS servers are the clients configured to use?

                                If a DNS server you run, what is its configuration?

                                in VPN/OPENVPN/Clients/edit  I don't see an option for DNS servers, my System/General Setup is open DNS 208.67.222.222 and 208.67.220.220 and my DNS resolver is set to All network interfaces and All outgoing Network Interfaces

                                Intel(R) Core(TM)2 Duo CPU E7500 @ 2.93GHz
                                2 CPUs: 1 package(s) x 2 core(s)
                                AES-NI CPU Crypto: No
                                2 Gigs Ram
                                SSD with ver 2.4.0
                                IBM Intel Pro PCI-E Quad Port 10/100/1000 Server Adapter 39Y6138 (K210320)

                                1 Reply Last reply Reply Quote 0
                                • DerelictD
                                  Derelict LAYER 8 Netgate
                                  last edited by

                                  Right but what are the actual hosts that are asking that names be resolved using as DNS servers?

                                  That would be either statically set on the client or in the DHCP server.

                                  It all matters and all has to be set correctly to get the results you are looking for.

                                  Chattanooga, Tennessee, USA
                                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                  1 Reply Last reply Reply Quote 0
                                  • N
                                    NasKar
                                    last edited by

                                    @Derelict:

                                    Right but what are the actual hosts that are asking that names be resolved using as DNS servers?

                                    That would be either statically set on the client or in the DHCP server.

                                    It all matters and all has to be set correctly to get the results you are looking for.

                                    Did some research
                                    Would this work?
                                    System/General Setup/DNS Servers blank, DNS Server Override checked
                                    Services/DNS resolver/General settings/Outgoing Network Interfaces/ VPN B (interface that I want my DNS to use with no leakage)
                                    Services/DHCP Server/LAN/Add DNS to static mapping that I want those static IP to use (ie not the VPN DNS)

                                    Intel(R) Core(TM)2 Duo CPU E7500 @ 2.93GHz
                                    2 CPUs: 1 package(s) x 2 core(s)
                                    AES-NI CPU Crypto: No
                                    2 Gigs Ram
                                    SSD with ver 2.4.0
                                    IBM Intel Pro PCI-E Quad Port 10/100/1000 Server Adapter 39Y6138 (K210320)

                                    1 Reply Last reply Reply Quote 0
                                    • DerelictD
                                      Derelict LAYER 8 Netgate
                                      last edited by

                                      I would:

                                      Set the VPN hosts I want to route only over the VPN to use free, outside name servers (google, quad-9, level3, etc) using DHCP or Static or whatever.

                                      Policy route the DNS queries out the VPN with all the other internet traffic.

                                      And you're done.

                                      Everything you just described is fine until the VPN is down and all of your DNS breaks for everything.

                                      Chattanooga, Tennessee, USA
                                      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                      1 Reply Last reply Reply Quote 0
                                      • First post
                                        Last post
                                      Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.