Can I use one of my 6 physical network ports to be a vpn port?
-
@johnpoz I have tried using the ip of my interface for igb3 which is the port I want for PIA and although I can connect to the port, windows says there is internet but there actually isn't? I cannot see the outside world?
-
Your gateway is right there, its called PIAVPN - that is what you would select for the policy route, under advanced on the rule pick that as the gateway... Not the IP..
It pulls that IP from the vpn server it connects too.
Also did you switch to manual outbound nat? Yeah that is going to be problematic - you should leave it as auto, and just create a hybrid outbound nat for your vpn connection... And the tunnel network used by the vpn can not overlap any network your actually using locally.
Don't pay attention to that hybrid lan nat, that is a source nat so I can get to a box without a gateway... Has nothing to do with policy routing.
-
@johnpoz said in Can I use one of my 6 physical network ports to be a vpn port?:
Also did you switch to manual outbound nat? Yeah that is going to be problematic - you should leave it as auto, and just create a hybrid outbound nat for your vpn connection
I followed the privateinternetaccess pfsense guide mentioned in post #12, here is an excerpt from it.
So, here is what my screens look like now
I have tried setting the ip of the source network to 192.168.2.1 as this is the ip of the interface but it automatically changes it back to 192.168.2.0
As things stand the OpenVPN PIA Service is running and connected but nothing on the LAN is running through that.
If I connect to the igb3 port on pfsense (PIAVPN) I can ping anything on the LAN but cannot connect to anything (unraid, ip cameras etc) I also cannot connect to the outside world from this port.
I think that if the instructions from pia to change to manual outbound nat is incorrect then there is probably more mis-information in that guide. Is there an alternative guide you are aware of or am I still missing something?
Many thanks for your time and patience so far, it is really appreciated!
-
@mbc0 said in Can I use one of my 6 physical network ports to be a vpn port?:
I have tried setting the ip of the source network to 192.168.2.1
Why are you trying to set an IP... You would NOT set an ip on a vpn client connect to some vpn service..
Their guides are written by idiots for their idiot users.. Sorry but that is my personal opinion of these nonsense service..
Point to me in their guide where it says to set an IP on your interface???
Lets say you where required to set a static on the interface - you still can not have the same network locally as your tunnel network.. You can not use 192.168.2/24 on one of your networks, and 192.168.2/24 as your tunnel to the vpn service..
Where is your gateway??? You manually created that gateway pointing to your own local interface on 192.168.2.1??
So you didn't follow there guide at all!! Is what your saying - your just saying you did... Because no where in there does it say to do that...
What I would suggest is just remove ALL the settings for any vpn anything... Switch to normal automatic and then get this new network working... Then setup your vpn!
-
Hi,
Firstly, I understand your frustration and I totally get it! I am an engineer of 30 years and find it very frustrating explaining things to people that just cannot understand what I am explaining. Please remember I am a complete novice trying my best to understand and follow what I thought was an official guide from PIA which has in it's defence worked for all my interfaces but I need it to work for just one interface, the guide does not cover that.
> Why are you trying to set an IP... You would NOT set an ip on a vpn client connect to some vpn service..]
I was doing this as unless I specified an IP it just stays at dynamic and does not show an IP
> Their guides are written by idiots for their idiot users.. Sorry but that is my personal opinion of these nonsense service..]
I understand your opinion :-)
> Point to me in their guide where it says to set an IP on your interface???
It does not say this anywhere in the guide as their guide is only to put all interfaces behind the vpn which as I previously stated works, I cannot find any guide or understand any way to do this for just one interface.
> Lets say you where required to set a static on the interface - you still can not have the same network locally as your tunnel network.. You can not use 192.168.2/24 on one of your networks, and 192.168.2/24 as your tunnel to the vpn service..
I am so sorry I am not fully understanding this, I have 4 interfaces in use
wan
lan - I set an IP of 192.168.0.10
Unifi - I set an IP of 192.168.1.5
PIAVPN - I set an IP of 192.168.2.1> Where is your gateway??? You manually created that gateway pointing to your own local interface on 192.168.2.1??
So you didn't follow there guide at all!! Is what your saying - your just saying you did... Because no where in there does it say to do that...
Yes I did follow the guide completely and it worked perfectly but for all interfaces, I need this to be on just one interface.
What I would suggest is just remove ALL the settings for any vpn anything... Switch to normal automatic and then get this new network working... Then setup your vpn!
I have had this interface working fine the whole time and have been using it for some months before trying to get OpenVPN working.
In a nutshell
All interfaces have been working fine for some time now.
I followed the PIA Guide and all worked great for all interfaces then the problem is trying to get it to work just on one interface.Again, I really am genuinly sorry as I know how frustrating this must be.
Thanks
-
Dude... You can do this with 1 interface, 100 interfaces... Doesn't matter its a simple policy route... You have gateway that is the vpn connection... creat a rule that sends who you want when they want go X out the gateway... its that freaking simple..
All that is required for you to do this, is follow their stupid guide and don't pull the routes. Then nobody will be using the vpn
Other than their nonsense about deleting your wan outbound nats as their kill switch.. OMG!!!
Now create a rule that points either the whole network or a specific IP out the gateway...
That is ALL there is too it... Have you read the policy routing documentation?
https://docs.netgate.com/pfsense/en/latest/routing/directing-traffic-with-policy-routing.html
edit: Here... I just created a firewall rule to point my client out the vpn.. Its as simple as changing the gateway from default to the vpn.. That is all there is too it... When you pull the routes, they change your DEFAULT to use the vpn... For anything to no use the vpn you would have to force it out your wan gateway..
Reason the other site for IP is different, is I didn't want to flush my states, so I went somewhere different (not google) to create a new state on the firewall and use the vpn connection, vs the previous states that were using my wan.
-
Thank you, I can see now I was on the wrong path and overthinking.
I believe I am understanding this (mostly) now and have been through what you said and the Policy Routing Configuration many times, I have mostly started again but cannot get my vpn gateway to register an IP.
I cannot get anything other than dynamic to show for my Gateway
Do I need a rule for this interface?
I have been over and over and feel I have things setup right now, I just cannot see why the gateway is stuck on dynamic? -
AHA!
A Break Through!!!
I now have an IP!
In the firewall rules I had the vpn interface selected instead of the physical interface!
All I have to do now is work out how to get any devices on the interface to the correct gateway as there is no internet on the physical port (IPCONFIG shows the gateway as 192.168.2.1 which is the address of the physical port) but this is so close now :-)
Thank you SOOO much for your help and I hope I never caused you to lose too much hair :-D
-
@mbc0 said in Can I use one of my 6 physical network ports to be a vpn port?:
(IPCONFIG shows the gateway as 192.168.2.1 which is the address of the physical port) but this is so close now :-)
Huh?? When you create a new network on pfsense there would be NO GATEWAY set.. When you do that it becomes a WAN..
So in pfsense you would have an interface
192.168.2.1/24 for example.. NO GATEWAY!!! NONE!!!
Here is one of my network..
Clients on this network, say your box you want to use your vpn would use pfsense IP as "their" gateway 192.168.2.1 for example if that is what you set pfsense to be, or example mine is 192.168.4.253..
What I suggest you get this network working going out your normal wan - than Policy route it out your vpn!!!
-
-
Now with your nat set to auto any clients on this network should work.. You created a any any rule on this interface right?
-
hmmm with nat set to auto, Windows changes from no internet shown on the connection to showing internet is now available but there is no response to the outside world, the other LAN & UNIFI interfaces are working fine
-
I have a Windows 10 Laptop solely connected to the vpn interface FYI
And yes I do have an any rule
-
I removed the gateway from the interface but still the same, no internet
-
well how is internet going to work with just TCP... dns is UDP... to lookup www.internet.com you need to be able to talk UDP.
-
A schoolboy error.. no idea how that happened!
I have just put everything back and its working!! I am so relieved! and yes it is so bloody easy now I know how it all comes together, you must have been pulling your hair out! I am going to do this again on another server just to prove to myself how easy it is :-)
All I have now is a dns leak but have seen plenty of info on how to resolve that!
Thanks so so much!
-
One think I have noticed though, although everything is working (apart from the DNS Leak)
The VPN Gateway is showing as offline?
-
What version are you running? That is not current version..
Oh your in the status section.. Thats why it looks different.. Restart the vpn instance.
Really dude your hiding a 10 address?
-
haha, yes, I did hide the 10 address but not intentionally! :-D
-
That is not current.. current is
2.4.4-RELEASE-p3 (amd64)
built on Thu May 16 06:01:19 EDT 2019
FreeBSD 11.2-RELEASE-p10Well now 2.4.5 is, it just dropped..
Version 2.4.5 is available.
Version information updated at Thu Mar 26 11:19:06 CDT -
hmmm ok...
I run pfsense (for nearly 2 years now) as a vm on a HP Microserver running unraid, I wonder why it doesn't update automatically? I will look to see how to update now, are there any pitfalls I should be aware of jumping from 2.4.3 to 2.45?
Thank you
-
Well 2.4.5 just dropped like maybe an hour a ago.. at best... So prob wouldn't update just yet... Oh but your on a VM... Oh then just take a snapshot and click the button... Use to do that all the time when running on vm.. Even daily snapshots I would run - because could just rollback to the snapshot took before I clicked upgrade..
-
ok, I wonder why 2.4.4 or 2.4.5 are not showing as availble for me?
-
Because your system is hosed ;)
https://docs.netgate.com/pfsense/en/latest/install/upgrade-troubleshooting.html
pkg-static clean -ay; pkg-static install -fy pkg pfSense-repo pfSense-upgrade
-
perhaps you are right! this doesn't look good!
Shell Output - pkg-static clean -ay; pkg-static install -fy pkg pfSense-repo pfSense-upgrade
The following package files will be deleted:
/var/cache/pkg/sqlite3-3.22.0_1-3c0de3fc74.txz
/var/cache/pkg/iprange-1.0.3-65464f6717.txz
/var/cache/pkg/sqlite3-3.22.0_1.txz
/var/cache/pkg/pfSense-rc-2.4.3_1-abfbca5302.txz
/var/cache/pkg/pfSense-rc-2.4.3_1.txz
/var/cache/pkg/pfSense-kernel-pfSense-2.4.3_1-bde115e399.txz
/var/cache/pkg/pfSense-base-2.4.3_1-bd208e4cff.txz
/var/cache/pkg/pfSense-kernel-pfSense-2.4.3_1.txz
/var/cache/pkg/pfSense-default-config-2.4.3_1-01f7a2a04f.txz
/var/cache/pkg/pfSense-default-config-2.4.3_1.txz
/var/cache/pkg/pfSense-base-2.4.3_1.txz
/var/cache/pkg/libnghttp2-1.31.1.txz
/var/cache/pkg/pfSense-pkg-pfBlockerNG-devel-2.2.5_10.txz
/var/cache/pkg/perl5-5.24.4-89340f9371.txz
/var/cache/pkg/perl5-5.24.4.txz
/var/cache/pkg/libnghttp2-1.31.1-24a10b90b7.txz
/var/cache/pkg/pfSense-pkg-pfBlockerNG-2.1.4_8-d9071a3c1b.txz
/var/cache/pkg/lighttpd-1.4.48_1-26b547d114.txz
/var/cache/pkg/pfSense-pkg-pfBlockerNG-2.1.4_8.txz
/var/cache/pkg/lua52-5.2.4-34ceb7a41c.txz
/var/cache/pkg/lighttpd-1.4.48_1.txz
/var/cache/pkg/whois-5.2.17.txz
/var/cache/pkg/lua52-5.2.4.txz
/var/cache/pkg/whois-5.2.17-3e6f851a29.txz
/var/cache/pkg/GeoIP-1.6.11-3a55b74664.txz
/var/cache/pkg/pecl-intl-3.0.0_11.txz
/var/cache/pkg/GeoIP-1.6.11.txz
/var/cache/pkg/grepcidr-2.0-cec890eb71.txz
/var/cache/pkg/grepcidr-2.0.txz
/var/cache/pkg/aggregate-1.6_1-c1ea4bf1a7.txz
/var/cache/pkg/aggregate-1.6_1.txz
/var/cache/pkg/pecl-intl-3.0.0_11-7e63ad3a02.txz
/var/cache/pkg/icu-60.2_1,1-66aa5ec8d3.txz
/var/cache/pkg/iprange-1.0.3.txz
/var/cache/pkg/icu-60.2_1,1.txz
/var/cache/pkg/pfSense-pkg-pfBlockerNG-devel-2.2.5_10-5af9141812.txz
/var/cache/pkg/pfSense-repo-2.4.3_3-97fc8a3f69.txz
/var/cache/pkg/pfSense-repo-2.4.3_3.txz
/var/cache/pkg/pfSense-upgrade-0.52-239e1a78fc.txz
/var/cache/pkg/pfSense-upgrade-0.52.txz
/var/cache/pkg/pfSense-repo-2.4.3_4-c159ba5343.txz
/var/cache/pkg/pfSense-repo-2.4.3_4.txz
/var/cache/pkg/pfSense-upgrade-0.53-7baf5452be.txz
/var/cache/pkg/pfSense-upgrade-0.53.txz
The cleanup will free 78 MiB
Deleting files: .......... done
All done
Updating pfSense-core repository catalogue...
pfSense-core repository is up to date.
Updating pfSense repository catalogue...
pfSense repository is up to date.
All repositories are up to date.
The following 3 package(s) will be affected (of 0 checked):Installed packages to be UPGRADED:
pfSense-repo: 2.4.3_3 -> 2.4.3_4 [pfSense]
pfSense-upgrade: 0.52 -> 0.53 [pfSense]Installed packages to be REINSTALLED:
pkg-1.10.3_1 [pfSense]Number of packages to be upgraded: 2
Number of packages to be reinstalled: 13 MiB to be downloaded.
[1/3] Fetching pkg-1.10.3_1.txz: .......... done
[2/3] Fetching pfSense-repo-2.4.3_4.txz: . done
[3/3] Fetching pfSense-upgrade-0.53.txz: .. done
Checking integrity...Assertion failed: (strcmp(uid, p->uid) != 0), function pkg_conflicts_check_local_path, file pkg_jobs_conflicts.c, line 386.
Child process pid=52858 terminated abnormally: Abort trap -
I just pulled the trigger to 2.4.5.. And I really still have like hour of so more work to do... But I was pretty confident.. Had my media, and my backup (just in case)..
Took a bit longer than I thought - but I'm up on new 2.4.5... Have to check that all packages are working, etc.. But clearly the internet is working ;)
-
Glad it worked for you!
Mine is defo looking hozed!
Shell Output - pfSense-upgrade -d -c
Updating repositories metadata...
Updating pfSense-core repository catalogue...
pfSense-core repository is up to date.
Updating pfSense repository catalogue...
pfSense repository is up to date.
All repositories are up to date.
Upgrading pfSense-repo...
Updating pfSense-core repository catalogue...
pfSense-core repository is up to date.
Updating pfSense repository catalogue...
pfSense repository is up to date.
All repositories are up to date.
Checking integrity...Assertion failed: (strcmp(uid, p->uid) != 0), function pkg_conflicts_check_local_path, file pkg_jobs_conflicts.c, line 386.
Child process pid=10408 terminated abnormally: Abort trap -
Well do a clean install of 2.4.5 would be my suggestion... You can load in your backup config file..
-
-
So when you get back - just curious question.. Did you really think that 2.4.3_1 was current? That they hadn't updated in like 2 years.. And you were just ok with that?
-
@johnpoz said in Can I use one of my 6 physical network ports to be a vpn port?:
So when you get back - just curious question.. Did you really think that 2.4.3_1 was current? That they hadn't updated in like 2 years.. And you were just ok with that?
Hi, back!
Created a fresh VM but had a few issues with it not detecting my 4port nic (well it detected it but only used the 1st port) after alot of xml editing and tweaking it is working and now running on 2.4.5 :-)
To be honest with you, I rarely logged into the web admin of pfsense, only if I wanted to tweak or check something I would log in. I would always look to check for updates (I love an update!) and it would always say it was up to date in green so I just presumed it was updating itself and thought no more of it. It was only when you mentioned it I saw how old it was!
So, I am on 2.4.5 and still have this gateway down issue? the gateway must be up though as pia is active and running fine!
I also have dns leak and you made it quite clear that you did not approve of their method for resolving it not their killswitch method, would you mind pointing me in the way of the correct method? I have read about floating rules for a killswitch?
Many thanks :-)
-
How do you think you going to use normal wan and resolver not have a dns leak?
Did you hand your client on your vpn network a different dns? If you have him ask pfsense then yeah your going to show a "leak" But your resolving, your not forwarding.. So your not handing all your dns to anyway anyway..
that kill switch method they used was if you send ALL traffic to them! And if they down, then all traffic stops... That is not what your doing, your policy routing.. If you set gateway down rules don't
This is what normally would be your kill switch
But this is also what is prob preventing you from working... If your gateway is down, then you shouldn't have access.
Did you put any rules on your vpn interface you created?
Also when you say trouble recognizing your 4 port nic.. Your doing passthru of the nic to pfsense? Its easier to just let esxi do the nics, and give pfsense virtual nics. vmx3 or e1000
if you have no rules - then yeah you will show offline
-
@johnpoz said in Can I use one of my 6 physical network ports to be a vpn port?:
How do you think you going to use normal wan and resolver not have a dns leak?
Did you hand your client on your vpn network a different dns? If you have him ask pfsense then yeah your going to show a "leak" But your resolving, your not forwarding.. So your not handing all your dns to anyway anyway..
Yes I have given the vpn network a different dns
that kill switch method they used was if you send ALL traffic to them! And if they down, then all traffic stops... That is not what your doing, your policy routing.. If you set gateway down rules don't
This is what normally would be your kill switch
But this is also what is prob preventing you from working... If your gateway is down, then you shouldn't have access.
I Do have access even though my gateway is showing as offline, gateway monitoring is active but I cannot find that screenshot above on my system?
Did you put any rules on your vpn interface you created?
Yes I have this rule on my interface
Also when you say trouble recognizing your 4 port nic.. Your doing passthru of the nic to pfsense? Its easier to just let esxi do the nics, and give pfsense virtual nics. vmx3 or e1000
The reason I was having issues was when setting up the VM, if I used the latest Q35-4.2 machine type I would only get 1 port of my 4 port nic so I reverted back to Q35-2.11 to get this working properly
if you have no rules - then yeah you will show offline
I do have this rule
-
Why do you have a gateway set on your interface - to itself???
Where did it say to set a gateway on the interface you created for your vpn connection?
Which is which here?? You have the interface to your vpn... And then you have your own local network interface you created that you want to route out the vpn..
You need a rule on the interface that is vpn connection to allow monitoring to work..
What rules do you have on the PIA_VPN interface???
And NO is not how you would setup dns... All that says hey pfsense if your talking to those dns servers, use this gateway.. If your wanting client on this vpn connection your setting up to use those - then hand him those via dhcp!! Don't even let him ask pfsense..
if I used the latest Q35-4.2 machine type I would only get 1 port of my 4 port nic so I reverted back to Q35-2.11 to get this working properly
again that has ZERO to do with anything.. If you let the host handle the nics, and just give your VM virtual interfaces tied to virtual switches that esxi handles the connections too..
A vm doesn't know anything about how many ports on a nic.. It has a virtual interface, be it e1000 or vmx3 - so you are passing the hardware onto the VM... There is no point in doing this to be honest.. And now you prevent yourself from using those physical interfaces for any other VMs you might want to leverage, etc..
-
@johnpoz said in Can I use one of my 6 physical network ports to be a vpn port?:
Why do you have a gateway set on your interface - to itself???
Where are you seeing this?
As there is no guide for what I am trying to achieve I am finding information from you and information the web, it is obvious I am out of my depth, I am not denying that but what I am finding is advice from you is contradicting guides/information on the web so this is incredibly hard for me as I do not fully understand all the terminology nor the science behind everything, I find information that says do X and then it is shot down by you, the problem is I do not know any better I am just trying to get this interface working
Where did it say to set a gateway on the interface you created for your vpn connection?
As above, this would have been something I have found on the net.
Which is which here?? You have the interface to your vpn... And then you have your own local network interface you created that you want to route out the vpn..
PIA_INTERFACE is the physical interface and PIA_VPN was created automatically during the guide setup?
You need a rule on the interface that is vpn connection to allow monitoring to work..
Unfortunately when you say I need a rule, I have no idea what type of rule? this kind of advice although appreciated means little to me so I go and research and make my best assumption normally to find it is wrong :-(
What rules do you have on the PIA_VPN interface???
And NO is not how you would setup dns... All that says hey pfsense if your talking to those dns servers, use this gateway.. If your wanting client on this vpn connection your setting up to use those - then hand him those via dhcp!! Don't even let him ask pfsense..
if I used the latest Q35-4.2 machine type I would only get 1 port of my 4 port nic so I reverted back to Q35-2.11 to get this working properly
again that has ZERO to do with anything.. If you let the host handle the nics, and just give your VM virtual interfaces tied to virtual switches that esxi handles the connections too..
A vm doesn't know anything about how many ports on a nic.. It has a virtual interface, be it e1000 or vmx3 - so you are passing the hardware onto the VM... There is no point in doing this to be honest.. And now you prevent yourself from using those physical interfaces for any other VMs you might want to leverage, etc..
This turned out to be a common issue, when spaceinvader one made the video guide on how to install pfsense in 2018 he used Q35.211 as the machine type. That has since progressed to Q35-4.2 which results in pfsense only detecting one port of the four port nic. This has affected quite a few people I was not alone.
I have pfsense installed as a VM on unraid using a seperate HP Microserver. This is seperate to my main server and only runs pfsense, homeassistant and blue iris cctv, that is all it does.
Again, I really appreciate you trying to help me but and it must be tough for you but I assure I am trying as hard as I can to understand and progress. Thank you
-
So how are you going to ping.. You need a rule on that PIA_VPN interface - I showed you this already!!
Please do not reply like that - its makes it almost impossible to read... Just answer the question there is zero reason to quote every line of my post... It right above yours if I have to reread it to understand what your answering..
There is one thing to quote a specific item to point it out specifically - or if your 3 pages later in a thread..
But its becoming dreadful trying to read what your doing with you doing that.. Please stop!!
Put rules on your interface.. Does it now show that is up - there is really nothing your gong to be able to do if you don't get it to show that the gateway is up..
Q35-4.2 which results in pfsense only detecting one port of the four port nic
Again ZERO reason to do that - just let the VM host handle the hardware... The whole freaking point to running a VM.. There is ZERO reason to hand off direct hardware to just run pfsense... Are you saying when the VM is using e1000 or vmx3 virtual nics its not fast enough? You can not push enough pps?? That would be the only reason to do such a thing.
-
Thank you for your time, I will address this at a later date, it is just too beyond me. I have restored my backup to before I attempted this.