Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    VPN up Gateway up - No Internet

    Scheduled Pinned Locked Moved OpenVPN
    43 Posts 5 Posters 7.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • A
      Apsis-IM @vMAC
      last edited by

      @vmac may try seeing how this plays out?

      https://forum.netgate.com/topic/160257/lan-connection-drops-when-openvpn-client-connected/4

      There are several apparently informed individuals helping this person out. The problem seems similar to yours.

      V 1 Reply Last reply Reply Quote 0
      • V
        vMAC @Apsis-IM
        last edited by

        @johnpoz @viragomann
        Can either of you help here?

        V 1 Reply Last reply Reply Quote 0
        • V
          viragomann @vMAC
          last edited by

          @vmac
          I don't know, how you've configured the DNS on the affected machines, but since your LAN rules don't allow DNS requests to internal servers, they can only access external ones, but must be configured to do so or you do some forwarding to an external server.
          So check if you can resolve hostnames on a computer which belongs to the VPN_devices alias.

          V 1 Reply Last reply Reply Quote 1
          • V
            vMAC @viragomann
            last edited by

            @viragomann I'm confused what you are stating here.
            Here is a copy of my current LAN rules. Doesn't the last rule allow access from any device on my LAN vLAN to any device?

            6cc92fa1-4fc9-4346-8900-533ef057b4c7-image.png

            Are you stating that I need to add another rule to allow DNS traffic?

            V 1 Reply Last reply Reply Quote 0
            • V
              viragomann @vMAC
              last edited by

              @vmac
              Yes, it does. But this rule will never be applied, since that one above matches to any traffic and directs it to the vpn gateway.

              Rules are processed from the top downwards. If one matches it is applied and other rules are ignored.

              Still don’t know, how you do DNS resolution. But assumed it“s done by pfSense, add a pass rule to the top of the rule set for TCP/UDP, dest. „This Firewall“, port DNS. So this ruhe only is applied for DNS access to pfSense, all other traffic is still directed to the vpn.

              1 Reply Last reply Reply Quote 0
              • V
                vMAC
                last edited by vMAC

                @viragomann
                I'm confused as to what you mean about the order. since VPN devices would only match specific devices. However, I made the change and still can't get any Internet when VPN connected:

                a254157f-f7af-42f2-97d6-2a6b69959d04-image.png

                To answer your other question, I have my pfSense resolving all DNS queries:

                9ce69d46-055f-4b03-a710-0a27e2a522a3-image.png

                V 1 Reply Last reply Reply Quote 0
                • V
                  vMAC
                  last edited by

                  I'm starting to wonder if it has something to do with the Automatic Outbound NAT not working.
                  When I check the OpenVPN logs I see this noted:
                  5123c7f4-7fd8-487a-90b2-d928a49fc0a7-image.png

                  When I go to Outbound NAT I don't see this interface in the "automatic" generated outbound.

                  3d033646-3cf9-43b9-9f71-646a87a5bd9e-image.png

                  Could this be the issue?

                  1 Reply Last reply Reply Quote 0
                  • V
                    viragomann @vMAC
                    last edited by

                    @vmac said in VPN up Gateway up - No Internet:

                    I'm confused as to what you mean about the order. since VPN devices would only match specific devices. However, I made the change and still can't get any Internet when VPN connected:

                    To answer your other question, I have my pfSense resolving all DNS queries:

                    The question is if your VPN devices are configured to resolve host names. If they are set to use pfSense you need this rule, otherwise DNS requests are directed to the VPN provider, while the destination address is pfSense and resolution fails.
                    Since the rule shows some matches I assume the devices are set to use pfSense for DNS resolution.

                    @vmac said in VPN up Gateway up - No Internet:

                    I'm starting to wonder if it has something to do with the Automatic Outbound NAT not working.
                    When I check the OpenVPN logs I see this noted:

                    When I go to Outbound NAT I don't see this interface in the "automatic" generated outbound.

                    I cannot find what's really wrong there. The virtual interface port is ovpnc3. This one you should have assigned to NordVPN in interfaces > assignments.

                    The only weird thing in the outbound NAT is in the automatically generated rules: 192.168.3.1/26 and 192.168.3.0/26. No idea where the .1 is from.

                    Your VPN devices may be in 192.168.1.0/24 and 192.168.3.0/24? However, the latter may not really be defined on your system, since it isn't shown in automatic rules.

                    V 1 Reply Last reply Reply Quote 0
                    • V
                      vMAC @viragomann
                      last edited by

                      @viragomann
                      Well I'm at a loss.

                      Yes the devices are set to use pfSense for DNS.
                      That is correct ovpnc3 is assigned to NORDVPN.

                      855d0fd0-146c-495c-b6d0-6ef714fcb4d9-image.png

                      I'm assuming this is where the 192.168.3.1 comes from Interfaces->IoT:
                      70069222-b455-4b82-a34e-437d08c5f275-image.png

                      Yes I have some devices that I want to use the VPN that are in my IoT vLAN, and I have ones that are regular LAN vLAN that I want to use the VPN. The device that I'm testing right now is on the LAN vLAN and still can't hit the VPN. I just tried the IoT vLAN and same issue.

                      The really weird thing is nothing has been changed except me adding a traffic shaper. Before my config has worked for literally 2-3 years.

                      V 1 Reply Last reply Reply Quote 0
                      • S
                        senseCanuck
                        last edited by

                        I just updated to 2.5.0 RC and have the same problem.

                        NordVPN used to work perfect, now I don't get internet through it. The interface comes up with an IP but when I look at the traffic graph I only see outgoing traffic (no incoming).

                        It was a straight upgrade, I made no changes to the pfSense config.

                        V D 2 Replies Last reply Reply Quote 0
                        • V
                          vMAC @senseCanuck
                          last edited by

                          @sensecanuck could that be the problem? I've been using 2.5 beta since June/July due to an issue with miniupnp and my ps4s. Maybe something that was changed in November/December changed something?

                          S 1 Reply Last reply Reply Quote 0
                          • S
                            senseCanuck @vMAC
                            last edited by senseCanuck

                            @vmac could be.
                            This is the 3rd time I've tried upgrading to 2.5.0 and have always had this VPN issue. I just assumed it was on the to-be-fixed list but apparently it's something else since we're now into RCs.

                            All three of my 2.5.0 attempts have been December or later.

                            1 Reply Last reply Reply Quote 0
                            • V
                              viragomann @vMAC
                              last edited by

                              @vmac said in VPN up Gateway up - No Internet:

                              I'm assuming this is where the 192.168.3.1 comes from Interfaces->IoT:

                              What I wanted to point out is that the outbound NAT shows these entries among other: 192.168.3.1/26, 192.168.3.0/26. But normally it only shows network address, 192.168.3.1/26 is none, but it's part of 192.168.3.0/26.
                              Post your routing table to get closer.

                              Do a packet capture on the NortVPN interface, while you try to access something from a concerned device, to see if the packets are natted well.

                              V 1 Reply Last reply Reply Quote 0
                              • S
                                senseCanuck
                                last edited by senseCanuck

                                My setup is almost identical to @vMAC (select VPN based on a IP alias group). The only difference I have is I don't use the DNS resolver (to avoid DNS leaks) - I forward all VPN alias group DNS traffic to the VPN's DNS server.

                                But same problem - was working perfect until the move to 2.5.0.

                                Noticed though my gateway shows as offline. I switched the monitor to 1.1.1.1 but no difference.

                                99aab776-1e81-4652-8fa0-b452e6511c2a-image.png

                                A 1 Reply Last reply Reply Quote 0
                                • A
                                  Apsis-IM @senseCanuck
                                  last edited by

                                  @sensecanuck I thought it typical to block and forward all dns traffic to the pfsense dns resolver to avoid dns leaks...

                                  S 1 Reply Last reply Reply Quote 0
                                  • S
                                    senseCanuck @Apsis-IM
                                    last edited by

                                    @apsis-im

                                    I didn't want to use the VPN DNS for all LAN clients, just the few selected to use VPN. So I manually forward all port 53 traffic on those clients to the VPN provider's DNS server.

                                    A 1 Reply Last reply Reply Quote 1
                                    • A
                                      Apsis-IM @senseCanuck
                                      last edited by

                                      @sensecanuck gotcha!

                                      1 Reply Last reply Reply Quote 0
                                      • D
                                        Dilligaf @senseCanuck
                                        last edited by

                                        @sensecanuck I'm also feeling your pain.
                                        Whether I upgrade or rebuild from scratch its the same result. Tried on 2 boxes (one a vlan setup and the other multiple nics).
                                        Also made several attempts at this. I can get the gateway up but I can't get traffic to flow through it. It seemed to me like the firewall wouldn't direct traffic into it - though I haven't looked into it very deeply.
                                        Watching this thread closely to see if anyone can shed light.

                                        S 1 Reply Last reply Reply Quote 0
                                        • S
                                          senseCanuck @Dilligaf
                                          last edited by senseCanuck

                                          @dilligaf You seem to be a step above me. My gateway won't even show up. I've changed every rule I can find, changed the monitor address to 1.1.1.1, no luck. I'm so fed up with this I'm about to try out an OPNsense install.

                                          D 1 Reply Last reply Reply Quote 0
                                          • D
                                            Dilligaf @senseCanuck
                                            last edited by Dilligaf

                                            @sensecanuck I've have a very similar setup by the sounds and like you use cloudflare dns. And like you changed everything I could think of.

                                            All sorts of different issues: I've had it running but only at about 120mb/s (I'm expecting 400+). I thought at that point it was just hardware acceleration. Backed up that config but when I restored it no traffic.

                                            And had the gateway up but no traffic like you. I was mucking about with it late last night and can't repeat anything.

                                            I'm looking to overhaul my network as a suitable and more powerful NUC type box has come into my possession. There's an issue there with 2.5 I don't understand and want to use PFSense on it as everything generally just works, but don't really want to put the effort in on 2.4.5.

                                            And like you I'm testing OpnSense. Not getting the same VPN performance though. Generally 15-20% less. Beware of the NordVPN guide - do not follow the guide for dns prefetch suppork and prefetch dns key. It doesn't work!

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.