How to let ONLY ONE interface use VPN?


  • Banned

    My pfsense router has been using only one interface that routes all traffic through a VPN.

    As more and more sites block VPN IP's, I need to be able to easily and routinely bypass my VPN.

    I got another WiFi AP and turned on my other Interface. Everything is setup but this interface is still using the VPN. I used https://forum.pfsense.org/index.php?topic=76015.0 to configure my router for PIA VPN.

    My first guess is that my outbound NAT rules are still forcing traffic through the VPN? So I changed the manual rules to switch the interface from the VPN to the WAN ( I use the hybrid manual+automatic outbound NAT option). This simply killed the internet, I also tried simply disabling those manual rules hoping that the automatic NAT rules would just work, but still no internet.

    So how can I keep my main interface routing all traffic through my VPN while adding an additional interface that does not use the VPN at all?


  • LAYER 8 Netgate

    Outbound NAT does not route traffic. Policy routing and the routing table (default gateway, static routes).

    All outbound NAT does is determine what happens to the source address/port when certain traffic is sent out an interface by policy routing/routing table.


  • Banned

    How can I change that to get my other interface to not use the VPN at all?


  • LAYER 8 Netgate

    Don't set up gateway groups and policy route one interface to the VPN.


  • Banned

    Could you tell me specifically how to do that? I don't know what I'm doing.

    Under System>Routing>Gateway Groups, I don't have anything configured.

    I don't know what you mean by policy route one interface to the VPN? What does this mean and how do I do it?


  • LAYER 8 Netgate

    Try using those as search terms first. Really not in the mood to explain it again.


  • Banned

    I have and from what I gather under my firewall rules I open the advanced options and select a specific gateway. I've selected WAN as the gateway for the firewall rules that I want to bypass the VPN, but it doesn't work, as soon as I do this the internet no longer works on that interface. When I change the Gateway back to default then it works again.

    I've also read to select "Don't Pull Routes" in my OpenVPN client configuration, but this also kills my internet.

    Is this what you were suggesting? If not I'm at a loss. If so… I'm still at a loss as it doesn't seem to work, any other suggestions or am I simply doing it wrong?


  • LAYER 8 Netgate

    Post what you have done. Far easier than trying to guess.


  • Banned

    Also, under Outbound NAT rules, if I disable my manual rules "PIAVPN - 192.168.16.0/24 - * - * - (* & 500) - PIAVPN address - *" or change the interface to WAN (Auto rules already include it under WAN interface) then it kills the internet on that interface. If I re-enable those rules then the interface works (provided I'm still routing traffic through the VPN).

    I don't know if this is helpful but those outbound NAT rules are definitely affecting my connection and are only working when configured for the VPN interface.


  • LAYER 8 Netgate

    If you disable outbound NAT on an interface you disable outbound NAT on an interface. If you need outbound NAT on that interface that breaks it. Why is this surprising?


  • Banned

    @Derelict:

    Post what you have done. Far easier than trying to guess.

    As my configuration is now, I have an OpenVPN client configured per the link in the original post.

    I have hybrid outbound NAT rules (manual rules configured for VPN interface).

    My firewall rules on the interface do not currently specify a gateway as it was not working when I specified WAN gateway.

    I have no gateway groups configured and do not have "don't pull routes" selected.

    In this configuration all interfaces work but all interfaces also route all traffic through the VPN.


  • LAYER 8 Netgate

    Screen shots. Real data. Not interested in what you think you have done. Interested in what you have done.

    Get your stuff into a mode where you THINK it should be working and post it.

    Oh, and this: https://forum.pfsense.org/index.php?topic=120295.0


  • Banned

    @Derelict:

    If you disable outbound NAT on an interface you disable outbound NAT on an interface. If you need outbound NAT on that interface that breaks it. Why is this surprising?

    Well this is all new to me but it surprised me because the automatic outbound NAT rules still included the subnet on the WAN interface, all I was doing was disabling the outbound NAT rule for the VPN interface (since I don't want that subnet to use the VPN). So I thought that by doing that it would simply use the WAN and skip the VPN.

    I posted a picture as to what I'm talking about. I blacked out everything but the rules for the subnet I'm trying to bypass the VPN with. The top rules under mappings are the ones I was disabling. I thought that since the subnet was included under the bottom automatic rules that it would still NAT over the WAN interface?



  • LAYER 8 Netgate

    It DOES NOT MATTER what subnets are included in outbound NAT rules. They only have an effect when traffic IS ROUTED OUT THAT INTERFACE by policy routing or the routing table. They DO NOT have ANY bearing on what traffic goes where. Only what NAT is performed when traffic flows that way.


  • Banned

    @Derelict:

    Screen shots. Real data. Not interested in what you think you have done. Interested in what you have done.

    Get your stuff into a mode where you THINK it should be working and post it.

    Oh, and this: https://forum.pfsense.org/index.php?topic=120295.0

    Here are some more screens of what I have. The Outbound NAT rules in the top mappings section of the other screenshot I posted are currently disabled.

    This is what I thought would work, but no internet routes on the interface that I want to bypass the VPN in this configuration. I get a "this site took too long to respond error".







  • Banned

    @Derelict:

    It DOES NOT MATTER what subnets are included in outbound NAT rules. They only have an effect when traffic IS ROUTED OUT THAT INTERFACE by policy routing or the routing table. They DO NOT have ANY bearing on what traffic goes where. Only what NAT is performed when traffic flows that way.

    So woul this mean that I can disable those manual outbound NAT rules safely (as they aren't ever going to do anything that I want). And then policy route all traffic on the interface I wan to bypass the VPN to my WAN interface (and the automatic outbound NAT rules would handle the NAT through WAN)?

    If I understood that correctly then it sounds like my issue is that I'm not correctly doing policy routing? I've tried adding my WAN interface as the gateway on all of my rules on my "GUEST" interface (the one I want to bypass VPN), but then the internet simply doesn't work.


  • LAYER 8 Netgate

    Your pass rule passing traffic to NETWAN is TCP-only. That is almost certainly not what you want. Try protocol any there.

    I see nothing that policy routes traffic out PIAVPN_GW. What traffic do you expect to be routed that way?

    Traffic to your Outgoing Ports will go out the default gateway, not the VPN.


  • Banned

    @Derelict:

    Your pass rule passing traffic to NETWAN is TCP-only. That is almost certainly not what you want. Try protocol any there.

    I see nothing that policy routes traffic out PIAVPN_GW. What traffic do you expect to be routed that way?

    Traffic to your Outgoing Ports will go out the default gateway, not the VPN.

    I rearranged it like this applied and reset state tables but am still getting the same error?



  • Banned

    @Derelict:

    I see nothing that policy routes traffic out PIAVPN_GW. What traffic do you expect to be routed that way?

    I don't want anything on this interface to go through the PIAVPN gateway, I want everything on this interface to completely bypass the VPN.

    Currently everything goes through PIAVPN Gateway (or doesn't work at all). I haven't needed to use any policy routing for it to work that way, everything just goes through the VPN.


  • LAYER 8 Netgate

    Be more specific. What error? Exactly what are you trying to connect to from where?

    It matters what DNS servers your clients are being told to use.

    Enable DON'T PULL ROUTES in the OpenVPN Client Config.

    It is usually better to route the traffic you want to go over the VPN over the VPN, not route the traffic you don't the other way.


  • Banned

    @Derelict:

    Be more specific. What error? Exactly what are you trying to connect to from where?

    It matters what DNS servers your clients are being told to use.

    Enable DON'T PULL ROUTES in the OpenVPN Client Config.

    It is usually better to route the traffic you want to go over the VPN over the VPN, not route the traffic you don't the other way.

    I tried enabling don't pull routes. That kills the internet on both of my interfaces. It gives an identical "too long to respond" error on both interfaces.

    I attached pictures of the error and the DNS server settings.





  • Banned

    @Derelict:

    It is usually better to route the traffic you want to go over the VPN over the VPN, not route the traffic you don't the other way.

    I would prefer that as well. The guide that I used to configure my VPN on pfsense just routes everything through the VPN.


  • Banned

    @Derelict:

    Be more specific. What error? Exactly what are you trying to connect to from where?

    On the "networkGUEST" interface there is a Wifi AP. I'm just testing connectivity using a laptop connected to that wifi network by going to websites and checking to see if programs are able to use the internet (i.e. cloud programs, AV, etc.).


  • LAYER 8 Netgate

    I tried enabling don't pull routes. That kills the internet on both of my interfaces. It gives an identical "too long to respond" error on both interfaces.

    No idea what you've done then. Your WAN_GW should be marked as the default gateway. Disabling redirect gateway on the VPN client should not impact WAN at all.

    Love these internet walkthroughs.

    Learn how to troubleshoot exactly what is broken using ping, dig/drill, telnet, etc. If you can identify exactly what is failing, maybe there's a chance at getting some forum help.

    https://doc.pfsense.org/index.php/Connectivity_Troubleshooting

    Oh, and again, there's a hangout on Connectivity Troubleshooting too: https://portal.pfsense.org/webcasts/index.php?video=172174964

    Wired, wireless, doesn't matter. Those aren't specifics.


  • Banned

    WAN Gateway is marked as default.

    I don't have a membership for that video.


  • LAYER 8 Netgate

    Maybe that should be remedied. They really do cover everything you're trying to do.


  • Banned

    I have posted a Bounty for this https://forum.pfsense.org/index.php?topic=120371.msg665710#msg665710, so I'm willing to pay for the solution. But would prefer to pay someone that can remedy my problem specifically, instead of paying for access to a video that may or may not help solve my specific problem.

    If you're willing let me know what you feel a reasonable price is and I would be happy to open up a TeamViewer screenshare for you or provide you screenshots of whatever you like to solve the problem (if I can afford you).


  • Banned

    Any takers?


  • Banned

    I've now got policy based routing kind of working.

    I turned on don't pull routes and put a pass any rule at the top of my rules on LAN that selects the VPN interface, that successfully has the internet working and using the VPN IP, but now my DNS is leaking. Not really a big deal to me but I don't know why? I've entered my VPN providers DNS Servers both in general setup for the VPN Interface and under the DHCP servers. But now dnsleaktest shows my ISP DNS, why?

    But my other interface (Guest interface) that I don't want to access the VPN still doesn't work. Regardless of whether I set an allow any rule at the top of the rules for default gateway (WAN) or explicitly set it as WAN.
    Changing the LAN rule to use the WAN gateway also breaks the internet on that interface.

    Both gateways are showing UP.

    What's going on, again I'm willing to pay a reasonable bounty for this. I just want it fixed and not be dealing with it anymore.

    Can open up a TeamViewer screenshare to make it quick and easy for you.


  • Banned

    I tried forcing the PIA DNS that my configuration was using without policy based routing by specifying those servers in the DHCP static configuration for a client computer per this thread https://forum.pfsense.org/index.php?topic=92981.0, but that just doesn't resolve at all anymore.


  • Banned

    I went through all of the checks listed on the suggested connectivity troubleshooting page https://doc.pfsense.org/index.php/Connectivity_Troubleshooting, both with policy routing and without. Everything works either way, but I still can't pull up any websites on the Guest interface.


  • Banned

    Fixed it, I had an old firewall rule from something I was experimenting with that was messing it all up. Works great as you suggested I configure it, thank you!

    If anyone's interested I was able to figure out the DNS leak issue and patch it by reading this thread: https://forum.pfsense.org/index.php?topic=66305.15


Log in to reply