PfSense + PIA VPN + DDNS + Servers to WAN (not VPN) best practices?
-
So I finally decided to get serious about my internet traffic and privacy setup, I got PIA VPN setup. My issue is that some devices/services don't work well or at all with the VPN (gaming, Plex), some hotel websites.
Everything I care about specific routing has a static address assigned in the DHCP reservation table. I initially followed a guide that had me go into General > Setup and force the PIA DNS servers to prevent leakage, and that works fine.
Am I better off using Outbound NAT rules or Firewall rules to control what devices get to use the VPN and which go to my ISP assigned IP (which is where my DDNS points)?
My primary issue is I'm trying out Plex, but can't get it to be seen for external sharing (something I'd like to do). Oddly enough, I can get Emby to work, but it doesn't phone home and just works with the DDNS name/port. The biggest problem is despite blocking the Plex server (unRAID with a docker) from going to the VPN, or using the VPN gateway, it still pulls the VPN external IP and not the WAN.
Or would I be better served just running the PIA client on my PC and letting everything else just work?
-
How you control what uses the vpn client you setup in pfsense is normally done through policy routing. You just create firewall rules for what to go out your vpn and what you want to go out your normal internet connection.
-
So would that be Firewall Rules > WAN, VPN, or LAN?
The previous guide I used did it through the NAT > Outbound table.
Sadly, my previous experience was just with DD-WRT and Tomato which have a slightly less professional and more consumer orientation to them.
-
its done on the interface the traffic would first hit pfsense.. So if devices on your lan, that is where you would put the rule pointing it to the gateway on the requirements you want to use to send it down the vpn.
As to outbound nat, yes that is a requirement of setting up a client connection you have to tell pfsense how to nat the traffic going out the vpn. But that is not where you control what goes down the vpn.
-
So, this is my LAN firewall rules and these are my Outbound NAT rules. I set DNS servers for each gateway under System>General settings.
However, when I put them in place and disable the default LAN to all rules I get no connectivity on both the file server (101) and my PC which should fall under the next rule, correct?
