OpenVPN Server and Client at the same time

chulio

Thanks a lot for your answer.
Now I understand what dynamic means in terms of address "settings".

VPN Servers, I'm not sure if I understood your question. Maybe this answers (Status Interfaces):

The VPN Servers network address range is different to the LAN address range.
The VPN Servers' IPv4 tunnel networks set are also correctly mapped in System->Routing.
Yes, I want to redirect via the OpenVPN Servers all corresponding VPN clients to the internet, as well as get acces to the LAN network.

It's good to know that in fact I don't want anybody from ExpressVPN to access my network :)
Should (can) I remove the rule completely or should I change from source=any to destination=any to something more useful ?

I'm also confused, that the OpenVPN Servers don't work correctly anymore after having installed the ExpressVPN Client. The FW Rule for the OpenVPN tab seems to be key in order that the ExpressVPN Client works, i.e. where I set to Gateway=ExpressVPN. This rule seems to mess up the OpenVPN Servers ?
Therefore I'm looking for a better solution to make the OpenVPN Servers work again as they did before :(

Many thanks in advance !

viragomann

Hi,

above you mentioned that you can access some hosts over VPN but not all. This could be an indication that your server side LAN overlaps the client side LAN. So you should check if this is the case here.

If you don't want to grant access from the ExpressVPN subnet you do not need any firewall rule at this tab.
Also you should delete all rule on OpenVPN tab, since you have now the rules on the appropriate interface.

Basically in pfSense firewall rules have to be added to that interface where the traffic comes in. So for instance if you want your LAN users to go out to ExpressVPN you have to add rule allowing this to the LAN interface only.

Please post the interface settings of your OpenVPN servers from the interfaces menu. Maybe there is something wrong.

chulio

Hi viragomann,

At the moment I cannot access hosts over the VPN Servers. I tried once adding a rule and it did not work correctly.

I turned off all FW Rules in the OpenVPN tab. Now I cannot connect to the OpenVPN Servers from the internet.

Please find attached the OpenVPN TCP Server (OpenVPN UDP Server is identical) from the interface menu.
As well I attached the FW Rules for WAN, whereas the two OpenVPN rules at the lower end were created automatically from the OpenVPN Wizard. Maybe they're not needed anymore as we use OpenVPN Server Gateways now ?

Many thanks in advance !

Interfaces_OpenVPNTCPServer.png_thumb

FW_Rule_WAN.png_thumb

chulio

And here also the FW Rules for LAN, attached.
Without the third rule I get no internet access from the LAN.

FW_Rule_LAN.png_thumb

viragomann

@chulio:

Without the third rule I get no internet access from the LAN.

If you want to direct traffic from LAN over ExpressVPN you have to change the gateway here to ExpressVPNUDP_VPN4.

This matter gave me another input. You will get the default route pushed from the VPN provider. This has to be prevented in your case.
To do so go to the VPN client settings and check "Don't pull routes". This should solve the issue with the VPN servers.

chulio

Hi viragomann,

I'm using individual hosts in the "VPN Client UDP" alias,
i.e. specific IP addresses on the GOST net,
to go over ExpressVPN to the internet. (see attachment)
All other subnets are not allowed to use ExpressVPN, which I redirected to WAN ISP (see previous post with FW Rule LAN attachment).

On the other hand I need to access the LAN over the OpenVPN Servers when I'm not at home,
i.e. the LAN hosts shall not have access to the ExpressVPN Gateway.

I added the Don't pull routes to the OpenVPN Client (ExpressVPN) and now I can connect again to the OpenVPN Servers ! I can access again a few hosts on LAN ! Unfortunately not all and it's extremely slow (compared to what I was used to).
We're getting closer :) Thanks a lot !

I'm wondering what it could be which blocks a few hosts but others not and being at the same time very slow.

Many thanks in advance !

FW_Rule_GOST_ExpressVPN.png_thumb

chulio

Is it possible that pfBlockerNG is slowing down something ?

viragomann

No, pfBockerNG just sets filter rules which is the basically job of pfSense.

Why do you use TCP for VPN connection. UDP will be considerably faster.

Are the host you cant reach over VPN all in LAN subnet? Have allready asked this, but no answer.

chulio

Hi,

Ah ok thanks.

I use TCP 443 because it's typically not blocked, and UDP for streaming (faster as you said :) ).

Yes exactly all host I need to reach via OpenVPN Servers are in the LAN subnet, all other subnets such as GOST, VOIP or GAME are not of interest to be reached from the internet via the OpenVPN Servers intentionally.

As mentioned I can reach only a few hosts on LAN and pretty slow. Some other hosts on the LAN are not reachable at all, which confuses me. Something in my FW Rules or NAT is strange and may cause this strange behaviour. The CPU is an overkill, shouldn't be an issue (i5 quad core).

As you recommended I turned off the

FW Rule in ExpressVPNClient tab as well as
all FW Rules in the OpenVPN tab
I attached my current screenshots, I think I missed something you recommended me to set (in the NAT or Rules part?)…

Many thanks in advance.

System_Routing.png_thumb

FW_NAT_oVPNs1s2c1.png_thumb

FW_NAT_LAN_and_VLAN.png_thumb

FW_Rules_WAN.png_thumb

FW_Rules_ExpressVPNClient.png_thumb

FW_Rules_oVPNs1.png_thumb

FW_Rules_OpenVPN.png_thumb

chulio

How about the FW traffic shaper which I set up prior setting up all the VPN Servers and Client.
Is it possible that this causes some "blocking" ?

Many thanks in advance!

chulio

Hi viragomann,

Thanks to your help everything is working now !
The screenshot I posted actually work.

I found an issue with some LAN hosts … which had nothing to do with pfSense, I had changed something in their firewalls... shame on me !
And it seems that mobile providers started closing some ports.

Many thanks for your help :) :) :)

Now I have a last question :)
I read about DNS leaks while using VPN providers, I'm not doing anything illegal, but I was wondering if this can be set to work correctly.
Do these occur with pfSense or could we avoid or minimize DNS leaks when attributing specific DNS servers to the VPN client ?
(And if yes, how can we do this in pfSense without altering the DNS servers used for the WAN ISP?)

Many thanks in advance !

viragomann

Fine that it's working.

To avoid DNS leaks set your VPN clients to use an external DNS. So the request will be directed over the VPN and gets your ExpressVPN address.

chulio

Hi viragomann,

Thanks for your reply.

It works, there are no DNS leaks anymore :) !