Cleanly separate WiFi and LAN using OpenVPN

[chudak]

Hello

I want to separate LAN and WiFi subnets.
Here is what I have:

LAN interface 
  Subnet 192.168.90.0 (with DHCP)
WIFI interface
  Subnet 192.168.70.0 (with DHCP)

Alias
  Private_IPv4 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 Private IPv4 ranges

Rules
  https://snag.gy/6cJnO1.jpg

At this point everything seems to work, WiFi clients can use internet but have no access to LAN hosts.

Now I want to use OpenVPN to enable WiFi clients be able to access LAN hosts.  And with the current rule, of cause, I can't connect to my OpenVPN server.

What would be good way to accomplish this?

Thx

[johnpoz]

Put a rule above your ! private IPv4 alias that allows access to your vpn port on pfsense wifi net interface IP.

Rules are evaluated top down, inbound into that interface from that network, first rule to trigger wins, no other rules are evaluated.

[chudak]

Thanks for quick reply !

I must be missing something, this did not work so far https://snag.gy/XwS5WE.jpg

[johnpoz]

that rule is set for TCP.. 1194 on openvpn is the default UDP port - so not going to work no, don't even see any hits to it the 0/0

[chudak]

Stupid me  :(

Corrected, but still no love
https://snag.gy/KXsxWl.jpg

[johnpoz]

what rules do you have above that rule?  Is openvpn listening on that interface, what are you pointing your client to - name or IP, etc.

I see hits to that rule.. So seems maybe you have pfsense not listening on interface your hitting, or you using some name that is not resolving correctly to the correct IP, etc.

If you hit your openvpn are you allowing access to your lan, etc.

[chudak]

Here is what I know (maybe not all what you are asking)
My OpenVPN server is on port 1194

https://snag.gy/JF4Hbc.jpg

it's using DDNS not IP

When I use rules like !LAN net (https://snag.gy/gcnU5z.jpg) it seems working fine, restricting access to LAN and allows to connect to OpenVPN server

However, when I enable rules like this https://snag.gy/RumEDX.jpg, I can connect from other WiFi's and connect to OpenVPN, but from my WiFi i have not internet access and no OpenVPN connect.

[johnpoz]

What interface is that openvpn running on?

In your client config what are you pointing them too in your export of the config?

If you want your wifi clients to use the vpn, then it should be listening on your wifi interface of pfsense, and NOT your wan..