OpenVPN Split tunnelling **screenshots**

lifespeed

I am also interested in this option, so rather than create a new thread I'll ask about a possible solution here. While I agree @johnpoz 's case for a remote P2P box may make sense for many users, I still think the OP has a valid question that wasn't answered. Let's say you have a truly high-speed connection to your home, both up and down.

Is it possible (this may be a Windows question as well) to assign an OpenVPN connection to one's VPN provider to a VLAN, and then make this VLAN a second network connection in Windows, alongside the network card LAN already in place? Most P2P software supports binding to a specific network connection. Details of implementation for less-than-expert pfSense users would be helpful.

johnpoz

Yes you can policy route a source IP, already went over this... What you can not do is policy route destinations you have no idea about... What are the destination IPs, what are the ports - you have no idea what ports will be used by the other p2p nodes you will be talking to. And your not going to use the same source port, so you can not even policy route on the source port.

But sure if you want to take an be it a standalone box, your application bound to a vip on your box.. A vm with its own IP, etc and then policy route that out your vpn service that is just clickity clickity sort of setup.

You don't need to create vlan or anything... Say your IP on your windows machine is 192.168.1.100, add a second IP - again very simple to do, say 192.168.1.101, then bind your p2p client to this .101 IP, now any traffic from .101 you policy route out your vpn connection you setup on pfsense.

lifespeed

I'm a believer that the simplest implementation is to be preferred. Not sure a VM is necessary, given the application in question can prefer a particular network connection.

How would one set up a VPN/VLAN to appear as a second network connection in Windows?

johnpoz

You DON"T need to do that!!! But if you run the vpn software on your machine directly it will automatically be another interface that you can bind your p2p client too.

As to setting up a vlan along with your normal connection. You would need a nic that supports multiple vlans on it.. windows doesn't make that easy like linux does.. Off the top the head I don't think in say normal windows 10 with direct support from the nic driver you can actually just create a vlan sub interface...

But again you do not need to, just add a secondary IP to your interface...

Here..

Ethernet adapter Local:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Realtek PCIe GbE Family Controller
   Physical Address. . . . . . . . . : 00-13-3B-2F-67-62
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   IPv4 Address. . . . . . . . . . . : 192.168.9.100(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 192.168.9.253
   DNS Servers . . . . . . . . . . . : 192.168.3.10
   NetBIOS over Tcpip. . . . . . . . : Enabled

Now I added a secondary IP..

Ethernet adapter Local:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Realtek PCIe GbE Family Controller
   Physical Address. . . . . . . . . : 00-13-3B-2F-67-62
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   IPv4 Address. . . . . . . . . . . : 192.168.9.100(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   IPv4 Address. . . . . . . . . . . : 192.168.9.33(Tentative)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 192.168.9.253
   DNS Servers . . . . . . . . . . . : 192.168.3.10
   NetBIOS over Tcpip. . . . . . . . : Enabled

Here is pfsense pinging that IP..

Now just bind your p2p app to that 2nd IP, and policy route it - clickity clickity!

lifespeed

Thanks, that was helpful!

lifespeed

Is there an IPv6 version of the above? I know where to find the network configuration in Windows, but wanting to do things correctly, there may be more to it than just typing in an IPv6 and changing the last 4 digits. The IPv6 the windows box gets now comes from prefix delegation from Comcast. Can I set up pfSense to hand out a second address to this machine? I'm getting "temporary" IPv6 addresses, but I doubt I want to use those as I believe they can change over time.

Thanks again for the help.

johnpoz

Your vpn supports IPv6? Unlikely..

lifespeed

@johnpoz said in OpenVPN Split tunnelling **screenshots**:

Your vpn supports IPv6? Unlikely..

Well, that wasn't an answer to the question at hand. I can choose a provider, some do support it, and as I've been working with pfsense I have found reasons to support IPv6.

johnpoz

How exactly are you going to route traffic out your vpn that support IPv6 from a client behind pfsense? On a different IPv6 address. You would have to NAT the ipv6 for that to work. The setup makes no sense..

If want to do it with ipv6, then you would run the vpn client on the client - you wouldn't be policy routing traffic out a vpn connected to pfsense.

lifespeed

@johnpoz said in OpenVPN Split tunnelling **screenshots**:

How exactly are you going to route traffic out your vpn that support IPv6 from a client behind pfsense? On a different IPv6 address. You would have to NAT the ipv6 for that to work. The setup makes no sense..

By binding the application requiring VPN to the 2nd network connection associated with an additional IPv6 address on the PC. pfSense would route traffic from that address to the VPN. Couldn't this be a firewall rule, not NAT? Agreed NAT and IPv6 don't make sense.

If want to do it with ipv6, then you would run the vpn client on the client - you wouldn't be policy routing traffic out a vpn connected to pfsense.

I don't want to run the VPN client on the server PC, I'm already doing that and it has several drawbacks, the main one is the VPN becomes the network connection for everything and screws with WAN server access.

johnpoz

For IPv6 vpn to work on pfsense, you would have to NAT to it... The vpn connection is not going to route your local IPv6 space..

lifespeed

@johnpoz said in OpenVPN Split tunnelling **screenshots**:

For IPv6 vpn to work on pfsense, you would have to NAT to it... The vpn connection is not going to route your local IPv6 space..

If you're referring to a link-local address, of course not. You're saying it won't route a SLAAC IPv6 that is globally routable?

johnpoz

@lifespeed said in OpenVPN Split tunnelling **screenshots**:

You're saying it won't route a SLAAC IPv6 that is globally routable?

NO it wont - why would you think that would work?? VPN services work by handing you an IP they route, and then natting it to some public IP... You can not just use as source IP space they don't route.. Now if they would hand you clients IPv6 space they are routing, then you could do it.

Kind of how HE ipv6 works, its a tunnel - is just not encrypted, its just a GRE tunnel... If you find an vpn service that does that, then sure you could do it.

lifespeed

@johnpoz said in OpenVPN Split tunnelling **screenshots**:

Kind of how HE ipv6 works, its a tunnel - is just not encrypted, its just a GRE tunnel... If you find an vpn service that does that, then sure you could do it.

Thanks again for the description, I'll look into what is actually offered by these IPv6 VPN services. As you mention, a key question is do they hand you a single /128 address or a /64 or /60? For IPv6, a single /128 is not normal nor really keeping with the whole point of IPv6.

You're also making me wonder if HE tunnel could be a replacement for some aspects of a VPN - the anonymizing aspect, not encryption obviously.

johnpoz

The prefix they hand the vpn client doesn't matter... and /128 is perfectly valid for a point to point connection like a vpn client to the vpn server... Work just fine when you run the vpn on the client.

When your doing it on the edge router, you have a problem for the other clients - you have to nat it to the IP given to the actual vpn client.. They are not routing a /64 prefix for you to use on all your clients - so if you want to use it you would have to nat to the IP they give the vpn client... Like what happens with IPv4.

Natting to IPv6 does work btw... if your interested in actually doing this.. But to be honest its just easier to spend your time/effort and money on just a box somewhere.. It's a much better solution across the board.

ekoo

@johnpoz
Hi John,

I have a 1gbe up/down fibre up and down and its the only source of "information" to the house and my rental tenants (eg: home phone, internet, even stream the local radio).
The said "linux ISO's" are my main entertainment thru a said "P-server"... which is hosted on the NAS and serves about 25 accounts of "families and friends".
Luckily, most of my p2p'ing is from a private tracker site. its the odd occasional public site i download.
I'm in Canada, where P2P is decently friendly, depends on the tracker.
ExpressVPN's pricing isn't bad at all, considering I need something reliable to climb the GFW whenever i travel to China.

I was hoping in someway i could narrow down just Transmission thru VPN and not the said "P-server" on the same NAS.
From your explanation, it sounds like it can only be done with IP.

DaMaGe21

@ekoo I am doing what your asking in your OP. But my setup is different. I have multiple Nics in my server and I can bind P2P to use one of those Nics. My router is pFSense with 8 ports to do whatever I want with.

So I setup pFSense to use Opt3(port3) to route all traffic through expressvpn, then on my server, I bind my P2P client to use Nic3 only.

I then set each nics index priority so that traffic is routed through nic1 first and so on. Only my P2P is traveling through VPN.