Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    OpenVPN killswitch

    Scheduled Pinned Locked Moved OpenVPN
    20 Posts 5 Posters 2.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • R
      Ryu945
      last edited by

      I never noticed that option before.  Even not touching that setting appears to work correctly.  When VPNs are down, there is no internet.

      1 Reply Last reply Reply Quote 0
      • DerelictD
        Derelict LAYER 8 Netgate
        last edited by

        Client B soucre alias for computers on VPN B, Source Port any, Destination any, Destination port any, Gateway for VPN B and Tag NO_WAN_EGRESS

        You set the tag there using the Tag: NO_WAN_EGRESS field on the rule.

        The floating rule is quick check, WAN interface, direction out, address family IPv4, Protocol any, source any, destination any, Tag NO_WAN_EGRESS

        You match the tag there using the Tagged: NO_WAN_EGRESS field on the rule.

        Different rule settings: Tag and Tagged.

        Chattanooga, Tennessee, USA
        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
        Do Not Chat For Help! NO_WAN_EGRESS(TM)

        1 Reply Last reply Reply Quote 0
        • N
          NasKar
          last edited by

          It seemed to work but when I tried a 2nd time turning off the VPN Client B, my computer still worked with the IP from VPN Client A. even though it's assigned to VPN Client B thru an alias.  I want to have VPN Client A work even if the VPN goes down and VPN Client B to not work at all when the VPN goes down.

          Intel(R) Core(TM)2 Duo CPU E7500 @ 2.93GHz
          2 CPUs: 1 package(s) x 2 core(s)
          AES-NI CPU Crypto: No
          2 Gigs Ram
          SSD with ver 2.4.0
          IBM Intel Pro PCI-E Quad Port 10/100/1000 Server Adapter 39Y6138 (K210320)

          1 Reply Last reply Reply Quote 0
          • DerelictD
            Derelict LAYER 8 Netgate
            last edited by

            So make it do that.

            That reject floating rule will not match unless the NO_WAN_EGRESS tag is present in the traffic. If you don't want it blocked, don't set the tag on the rule that policy routes it out the VPN.

            Chattanooga, Tennessee, USA
            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
            Do Not Chat For Help! NO_WAN_EGRESS(TM)

            1 Reply Last reply Reply Quote 0
            • N
              NasKar
              last edited by

              @Derelict:

              So make it do that.

              That reject floating rule will not match unless the NO_WAN_EGRESS tag is present in the traffic. If you don't want it blocked, don't set the tag on the rule that policy routes it out the VPN.

              Thats how I have it setup per https://forum.pfsense.org/index.php?topic=144408.msg786896#msg786896
              VPN Client A has no tag and VPN Client B has the NO_WAN_EGRESS tag.

              I tried a 3rd time and it is working as it is supposed to.  No sure why it doesn't work all the time.  Do I need to reset the state table after I make a change?  I also notice on ipleak.net that sometimes my DNS is leaking but not all the time, could that have something to do with the intermittent issue?

              Intel(R) Core(TM)2 Duo CPU E7500 @ 2.93GHz
              2 CPUs: 1 package(s) x 2 core(s)
              AES-NI CPU Crypto: No
              2 Gigs Ram
              SSD with ver 2.4.0
              IBM Intel Pro PCI-E Quad Port 10/100/1000 Server Adapter 39Y6138 (K210320)

              1 Reply Last reply Reply Quote 0
              • K
                kpa
                last edited by

                Everytime you do major changes to your ruleset you're supposed to reset states to eliminate any dangling states that might allow traffic that you don't want to pass after the changes.

                1 Reply Last reply Reply Quote 0
                • N
                  NasKar
                  last edited by

                  Thanks to Derelict and kpa for your help.  Everyting seems to be working as expected.

                  Intel(R) Core(TM)2 Duo CPU E7500 @ 2.93GHz
                  2 CPUs: 1 package(s) x 2 core(s)
                  AES-NI CPU Crypto: No
                  2 Gigs Ram
                  SSD with ver 2.4.0
                  IBM Intel Pro PCI-E Quad Port 10/100/1000 Server Adapter 39Y6138 (K210320)

                  1 Reply Last reply Reply Quote 0
                  • DerelictD
                    Derelict LAYER 8 Netgate
                    last edited by

                    I also notice on ipleak.net that sometimes my DNS is leaking but not all the time, could that have something to do with the intermittent issue?

                    That depends on how you configured the flow of your DNS.

                    Chattanooga, Tennessee, USA
                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                    1 Reply Last reply Reply Quote 0
                    • N
                      NasKar
                      last edited by

                      @Derelict:

                      I also notice on ipleak.net that sometimes my DNS is leaking but not all the time, could that have something to do with the intermittent issue?

                      That depends on how you configured the flow of your DNS.

                      Could you expand on what u mean by flow of DNS

                      Intel(R) Core(TM)2 Duo CPU E7500 @ 2.93GHz
                      2 CPUs: 1 package(s) x 2 core(s)
                      AES-NI CPU Crypto: No
                      2 Gigs Ram
                      SSD with ver 2.4.0
                      IBM Intel Pro PCI-E Quad Port 10/100/1000 Server Adapter 39Y6138 (K210320)

                      1 Reply Last reply Reply Quote 0
                      • DerelictD
                        Derelict LAYER 8 Netgate
                        last edited by

                        What DNS servers are the clients configured to use?

                        If a DNS server you run, what is its configuration?

                        Chattanooga, Tennessee, USA
                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                        1 Reply Last reply Reply Quote 0
                        • N
                          NasKar
                          last edited by

                          @Derelict:

                          What DNS servers are the clients configured to use?

                          If a DNS server you run, what is its configuration?

                          in VPN/OPENVPN/Clients/edit  I don't see an option for DNS servers, my System/General Setup is open DNS 208.67.222.222 and 208.67.220.220 and my DNS resolver is set to All network interfaces and All outgoing Network Interfaces

                          Intel(R) Core(TM)2 Duo CPU E7500 @ 2.93GHz
                          2 CPUs: 1 package(s) x 2 core(s)
                          AES-NI CPU Crypto: No
                          2 Gigs Ram
                          SSD with ver 2.4.0
                          IBM Intel Pro PCI-E Quad Port 10/100/1000 Server Adapter 39Y6138 (K210320)

                          1 Reply Last reply Reply Quote 0
                          • DerelictD
                            Derelict LAYER 8 Netgate
                            last edited by

                            Right but what are the actual hosts that are asking that names be resolved using as DNS servers?

                            That would be either statically set on the client or in the DHCP server.

                            It all matters and all has to be set correctly to get the results you are looking for.

                            Chattanooga, Tennessee, USA
                            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                            Do Not Chat For Help! NO_WAN_EGRESS(TM)

                            1 Reply Last reply Reply Quote 0
                            • N
                              NasKar
                              last edited by

                              @Derelict:

                              Right but what are the actual hosts that are asking that names be resolved using as DNS servers?

                              That would be either statically set on the client or in the DHCP server.

                              It all matters and all has to be set correctly to get the results you are looking for.

                              Did some research
                              Would this work?
                              System/General Setup/DNS Servers blank, DNS Server Override checked
                              Services/DNS resolver/General settings/Outgoing Network Interfaces/ VPN B (interface that I want my DNS to use with no leakage)
                              Services/DHCP Server/LAN/Add DNS to static mapping that I want those static IP to use (ie not the VPN DNS)

                              Intel(R) Core(TM)2 Duo CPU E7500 @ 2.93GHz
                              2 CPUs: 1 package(s) x 2 core(s)
                              AES-NI CPU Crypto: No
                              2 Gigs Ram
                              SSD with ver 2.4.0
                              IBM Intel Pro PCI-E Quad Port 10/100/1000 Server Adapter 39Y6138 (K210320)

                              1 Reply Last reply Reply Quote 0
                              • DerelictD
                                Derelict LAYER 8 Netgate
                                last edited by

                                I would:

                                Set the VPN hosts I want to route only over the VPN to use free, outside name servers (google, quad-9, level3, etc) using DHCP or Static or whatever.

                                Policy route the DNS queries out the VPN with all the other internet traffic.

                                And you're done.

                                Everything you just described is fine until the VPN is down and all of your DNS breaks for everything.

                                Chattanooga, Tennessee, USA
                                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                1 Reply Last reply Reply Quote 0
                                • First post
                                  Last post
                                Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.