Policy routing and OpenVPN
-
I have a an OpenVPN client tunnel to AirVPN that i'm routing almost all my interfaces via policy routing; meaning I have pass rules that match my entire subnet on each interface and routes it to the OpenVPN interface via the advanced section in the pass rule. I also have associated manual outbound rules for this as well. This has worked great with one big exception:
I have no clue as how to route things that are hosted on the actual router such as an OpenVPN server, webGUI access, ssh to the router, web updater (this was a bid one for me) etc. So mainly outbound things like the web updater, and package updater and secondly port forwarding inbound services and how they would get back out that very interface, the AirVPN OpenVPN interface.
How would i do this? Floating rules?
Also, feel free to let me know if this is not the right way to do it what I'm doing. Some suggested making the OpenVPN client interface as the new default GW, but there's like half the internet that says not to do this, and the other half says to do it the way I'm doing via policy.
Anyhow, the main part of the question is the most important: how do I policy route to internal router services.
-
You can't policy route services running on the firewall. Policy routing happens when traffic enters an interface. Traffic sourced from the firewall never does that.
If you have ports forwarded into OpenVPN with an assigned interface, AND the incoming connections match the firewall rules on that assigned interface and NOT the OpenVPN group tab, the reply traffic will go the right way thanks to reply-to.
-
You can't policy route services running on the firewall. Policy routing happens when traffic enters an interface. Traffic sourced from the firewall never does that.
If you have ports forwarded into OpenVPN with an assigned interface, AND the incoming connections match the firewall rules on that assigned interface and NOT the OpenVPN group tab, the reply traffic will go the right way thanks to reply-to.
So there's no way to make sure that package update routes through a particular tunnel vs. the main WAN interface?
I will have to brush up on reply-to. I've seen it in my peripheral vision, but never used it.
-
pfSense Updates follow the routing table, not policy routing.
