Adding OpenVPN Interface in Interface Assignments

dabbelju007

Hi all,

I did set up an OpenVPN Server on pfSense 2.4.5 and it works like a charm.

When I did start adding FW rules I missed something like "OpenVPN NET" in the source list. I found an articel which describes how to add the Interface as OPT Interface, which works also.

But now I have two Tabs in the firewall rules.

OpenVPN: This is the one which was added when I did configure the openVPN Server
OpenVPNOPT: thats the one I added in Interface Assignments.

The pfsense is using the OPT one.

Is there a way to get rid of the OpenVPN tab in Firewall rules cause it is confusing?

Thanks in advance!

Dabbelju

Rico

@dabbelju007 said in Adding OpenVPN Interface in Interface Assignments:

Is there a way to get rid of the OpenVPN tab in Firewall rules cause it is confusing?

No, this is the expected behavior.
Take care of the Rule Processing Order: https://docs.netgate.com/pfsense/en/latest/interfaces/groups.html

-Rico

dabbelju007

@rico

Thanks for your reply.

I did review the article you mentioned but I do not understand your hint.

For me cuerrently only Rules defined under the "OPTOPENVPNTAB" are hit. The "originale" openVPN Tab is there but does nothing.

Thanks
Dabbelju

viragomann

@dabbelju007
The OpenVPN is an implicit interface group including all OpenVPN instances running on pfSense, either servers or clients. It's present when at least one is set up and cannot be deletet.

So the OpenVPN interface group also includes your server.
Fireall rules on interface groups are prefered against rules on interface tabs. Look here for details: https://pfsense-docs.readthedocs.io/en/latest/firewall/firewall-rule-processing-order.html

dabbelju007

@viragomann
Thanks - understood it a bit better. It is for sure not the most important discussion but I would like to use the chance to dig a bit deeper, if it is ok with you.

And even if I make a fool of myself: It seems to work for me in a different way.

With regard to openVPN I now have two tabs in the FW rules.

One is called "OpenVPN" and was added after configuring the openVPN Server. When I got it right it is an implicit interface group.
The other is called "OpenVPNOPT" and it was added after I did configure it assigned interface.

The order according to the link you showed me is:

Floating tab (I do not have one)
Interface Group (also implicit?)
interface

Traffic from my OpenVPN network is hitting the "OpenVPNOPT" interface, not as I would expect the OPENVPN.

I did setup the assigned interface as described in this articel:
https://docs.netgate.com/pfsense/en/latest/vpn/openvpn/assign.html

viragomann

@dabbelju007 said in Adding OpenVPN Interface in Interface Assignments:

Traffic from my OpenVPN network is hitting the "OpenVPNOPT" interface, not as I would expect the OPENVPN.

Without knowing your firewall rules I cannot estimate.
However, it behaves like stated in the link. The OpenVPN is an interface group is mentioned.

For testing you can add a block any protocol, source, destionation rule to the top of the OpenVPN tab. Consider to flush the states on that interface before trying to access something.