real address sometimes shows
-
Well your only sending TCP out your PIA... Maybe its using UDP.. Again!!!! If you do not want this .71 box to go out your wan then BLOCK below your PIA rule. this .71 source..
You do understand that google can use UDP right via QUIC for its web pages.. And dns is via UDP... If you want this .71 box using your PIA then your PIA rules should be ANY.. Or yeah anything other than TCP would use your normal wan.
-
Here I fired up chrome - do you use chrome on this .71 box... And bam to google its creating quic which is over UDP
Change your PIA rule to ANY, kill all your existing states.. What do you see now for your IP?
here is sniff on pfsense showing the 443 UDP connections
05:56:39.543573 IP 192.168.9.100.63533 > 216.58.192.196.443: UDP, length 1350 05:56:39.543837 IP 192.168.9.100.63533 > 216.58.192.196.443: UDP, length 621 05:56:39.564956 IP 192.168.9.100.63533 > 216.58.192.196.443: UDP, length 1350 05:56:39.568775 IP 216.58.192.196.443 > 192.168.9.100.63533: UDP, length 1350 05:56:39.568992 IP 216.58.192.196.443 > 192.168.9.100.63533: UDP, length 31 05:56:39.569728 IP 192.168.9.100.63533 > 216.58.192.196.443: UDP, length 41 05:56:39.569903 IP 192.168.9.100.63533 > 216.58.192.196.443: UDP, length 38 05:56:39.585723 IP 216.58.192.196.443 > 192.168.9.100.63533: UDP, length 25 05:56:39.764571 IP 192.168.9.100.63533 > 216.58.192.196.443: UDP, length 39Happy to help you track this down - because if the ninja's get you we are all in trouble ;)
-
ah great that looks to be working now, I cannot believe I missed that :-) thanks very much really appreciate your help!
-
No problem... So do you use chrome?
-
I was using chrome and thought it may have been webrtc so installed the plugin and it stopped showing the ip on some sites,
I then tried firefox and disabled webrtc and that seemed better but its been a bit of a mixed result :-)
-
Are you ok with this box using wan if your vpn is down? If not I really would suggest putting a block rule for your alias below the PIA policy rule.. That way your sure that box can not go outbound unless the vpn is up.
-
Thanks would I just use the same as this rule but change the pass to block? Thanks again!
-
yeah just below, use your same alias as source but destination would be any.
-
I may be mistaken, but I think for that block rule to work you may also need to enable the "Skip rules when gateway is down" setting in System > Advanced > Micellaneous? The description for the setting is "By default, when a rule has a gateway specified and this gateway is down, the rule is created omitting the gateway. This option overrides that behavior by omitting the entire rule instead." And you'd want the entire rule omitted in this case, so that rule processing would continue on to the next rule (the block rule). Another kill switch option is packet tagging/matching:
https://www.reddit.com/r/PFSENSE/comments/6edsav/how_to_proper_partial_network_vpn_with_kill_switch/ -
^ agreed... thanks for pointing that out. Sometimes I forget to mention stuff that to me seems obvious ;)
-
Thanks very much I will take a look at those!
