NordVPN Client only for specific hosts



  • Hello all,

    I managed to install NordVPN in pfsense (2.4.5-DEVELOPMENT) following this tutorial: https://nordvpn.com/fr/tutorials/pfsense/pfsense-openvpn/

    My problem is all my network is passing trough the VPN, but I don't want that.
    I've create an Aliase with the hosts I want to be in the VPN connection.

    Can you help me please?

    Here my settings:
    0_1548763921872_b70552a2-44c3-41c2-b89e-16c3c30c6865-image.png

    0_1548763868158_3e3fd383-8a2b-4655-9fe2-7113f05143b9-image.png

    If you need something else please tell me.
    Thanks for your help.


  • Galactic Empire

    Why are you only policy based routing UDP ?

    Change the protocol to ANY.

    Also for testing use an IP address for the source, does it then work ?



  • Changed to Any in the rules and only the host ip, still the same, all my network is passing through the VPN.

    0_1548764917501_bd690ad5-bb03-4f92-8c1c-174f61e28ac0-image.png


  • Galactic Empire

    @luckyzor said in NordVPN Client only for specific hosts:

    I've create an Aliase with the hosts I want to be in the VPN connection.
    Can you help me please?
    Here my settings:

    Tried changing the gateway in the two rules below the NORD VPN rule to be the WAN gateway ?

    Is the state count going up on the two rules below the NORD VPN ?



  • Is the state count going up on the two rules below the NORD VPN ? - what do you mean with this?

    0_1548765681900_6a8463eb-6ba1-4c6d-a7e5-c47b526aecee-image.png

    Like that it worked. Should I change the gateway in another rule?

    I have this problem too:
    VPN host - I can't access my DMZ zone (I have one VM in there) when I try to ssh to this VM I got access denied.
    Other host, I can't access the VM and there is no internet (can't ping 8.8.8.8 for example)


  • Galactic Empire

    @luckyzor said in NordVPN Client only for specific hosts:

    Like that it worked. Should I change the gateway in another rule?

    You need to establish which firewall rules are being matched, add logging to the other two rules and then look in the logs.

    The rule at the bottom is IPv6, if you don't use IPv6 nothing will hit the rule.

    Maybe then do packet captures on the DMZ interface and see if traffic is even hitting the DMZ.



  • I'm struggling how to do it.
    Do you have any hint, how to do it?

    I turned on the log in the 2nd rule and why I tried to ssh to the VM in the DMZ and I can't find anything in the log, maybe i'm doing something wrong 😭


  • Galactic Empire

    @luckyzor said in NordVPN Client only for specific hosts:

    I'm struggling how to do it.
    Do you have any hint, how to do it?

    I turned on the log in the 2nd rule and why I tried to ssh to the VM in the DMZ and I can't find anything in the log, maybe i'm doing something wrong 😭

    The NordVPN rule or the rule below it ?

    I've never done this but as I said previously you need to figure out what rule it hits and then go from there.

    If you hold your mouse over the X or tick in Status System -> LogsFirewall -> Normal View you'll see the rule numbers, ditto over states in the firewall rules page.



  • Well, with logs I didn't find anything.

    With some testes I have this:

    Disabled OpenVPN client: VM in DMZ - OK (have internet ping 8.8.8.8 / I can SSH from LAN interface)

    Enable OpenVPN client: Can't ping 8.8.8.8 / but I can SSH if - NO specific gateway which means all my network is in the VPN :

    0_1548771465692_849d974b-34ac-4cd5-8de0-a44fdcd6c707-image.png

    If I put the gateway like this:
    0_1548771559471_b9365f98-ce20-4bdc-8d7e-84c5dc911dc1-image.png

    Only the host 10.0.0.3 have VPN (which is my intention) but I can no longer ssh my VM in DMZ / no internet in the VM DMZ.

    I'm lost, because I don't know what to do 😭

    edit: the WANGW is the IP of my ISP modem :/



  • The guide you followed does not allow for policy routing; it assumes you want all traffic to go through the VPN. If you want to use policy routing, go into your VPN client configuration and check the box for "Don't Pull Routes". When that box is checked, a static route is pulled that directs all your traffic through the VPN. You don't want that; you want no traffic to go through the VPN unless you have a firewall rule that directs it to.

    Also note that the guide directs all DNS requests through the VPN. Generally, that shouldn't be a problem. But you can override it for specific clients on your LAN using static DHCP mappings. For example, you could use a static mapping to ensure that a specific client always gets the IP 192.168.1.10 and always gets assigned Google's DNS servers (8.8.8.8 and 4.4.4.4) instead of being assigned the pfSense box itself (192.168.1.1) as its DNS server.



  • @thenarc WOW it's solved ;) thank you :D

    One last question, how can I have access to my DMZ VM with a host in the VPN?

    example:
    [root@vmservers ~]# ping 192.168.2.2
    PING 192.168.2.2 (192.168.2.2) 56(84) bytes of data.
    From 10.8.0.1 icmp_seq=1 Destination Port Unreachable
    From 10.8.0.1 icmp_seq=2 Destination Port Unreachable
    From 10.8.0.1 icmp_seq=3 Destination Port Unreachable

    10.8.0.1 is the ip of the VPN Client

    Thank you



  • Glad to hear that worked. I may be of less use with respect to a DMX though; I've never configured one on pfSense. But it's an OPT interface, right? Did you set up the appropriate policy routing firewall rules for it? How do you want it to behave?



  • yes the DMZ is an OPT interface.
    This are the rules in DMZ.

    0_1548777163862_871f6519-bf16-4fb9-95a4-dfa26aea38aa-image.png

    Rules in the VPN interface:
    0_1548777651667_1332cd9f-0104-4bf4-8a82-bce5a924d79d-image.png

    the problem is the connection between the hosts in the VPN and the DMZ. (diferent subnet) / I can't even ping my ISP modem with the host in the VPN.

    hosts in the VPN with hosts not in the VPN - OK (same subnet)

    thanks for your help :)



  • When you say "hosts in the VPN", do you mean hosts in the LAN for which you have the gateway set to your VPN using policy routing firewall rules? As you say, the DMZ and your LAN are two separate networks, and the block rule you made explicitly prohibits any hosts on the DMZ from communicating with hosts on the LAN. Typically, this is what you would want, I believe. Are you saying that it's not what you want? Or that you want hosts on the DMZ to also be routed through your VPN? I'm still not clear on the goal, but if the firewall rules are configured to allow DMZ hosts to communicate with LAN hosts, then I don't believe it would be a DMZ at all, right?



  • Yes, I want to be able to access all my subnet's (DMZ, ISP subnet ) with the hosts (in Lan interface) who have the gateway NordVPN
    For now, the hosts with the gateway NordVPN only have access to there subnet (10.0.0.0)

    The hosts in the DMZ will not have the NordVPN gateway and I don't want them to have access to anything else then WAN interface

    thanks for your help



  • These resources may be useful:

    https://www.slideshare.net/NetgateUSA/creating-a-dmz-pfsense-hangout-january-2016

    https://www.netgate.com/docs/pfsense/config/example-basic-configuration.html

    However, I believe that allowing access to the DMZ from the LAN is breaking the whole idea of the DMZ. As I said, I've never configured one myself, but I think generally the whole purpose is to have complete isolation from the LAN.



  • But the DMZ is isolated. The DMZ only have access to WAN, nothing more than that.

    I have access to DMZ from LAN, for example if I want to update my website, etc...


  • LAYER 8 Global Moderator

    @thenarc said in NordVPN Client only for specific hosts:

    However, I believe that allowing access to the DMZ from the LAN is breaking the whole idea of the DMZ.

    NO... So you allow the whole public internet to access a DMZ... But you think accessing it from the LAN would be bad?

    You can even allow access from DMZ into lan with specific pinholes and understanding, etc. Its best to not do that - but its done all the time.

    All of the guides from these sites want any and all traffic to go to them... This is NOT what normal people would want... So you DO NOT PULL routes, and then just policy route out the vpn what you want to use the vpn.



  • Okay, and you're saying your LAN-to-DMZ access is already working, or that's what you're trying to get working? Because if it's not working, I think you'll want to add a firewall rule on your LAN interface allowing access to the DMZ subnet via the default gateway.


  • LAYER 8 Global Moderator

    @thenarc said in NordVPN Client only for specific hosts:

    DMZ subnet via the default gateway.

    No you would not call out a gateway - this is where you run into problems.. You just allow the traffic you want and do not call out a gateway - since now your policy routing, and you wouldn't be going out your wan or vpn to get to another segment off pfsense.

    You just allow the rule above where you force out traffic via a policy route "setting gateway" in the rule.

    Rules are evaluated top down, first rule to trigger wins, no other rules are evaluated.



  • My LAN to DMZ is working, but only with hosts without the NordVPN gateway.

    I wanted to know if it's possible to connect to others subnets (DMZ, ISP modem subnet) with hosta who have NordVPN gateway.



  • @johnpoz You're correct, but in my defense the terminology on the firewall rule config is confusing:
    "Leave as 'default' to use the system routing table. Or choose a gateway to utilize policy based routing."

    So you set the Gateway setting to Default, but that doesn't mean it uses the default gateway.



  • @luckyzor You need to create a LAN firewall rule above your existing rule that routes hosts through the NordVPN gateway. Per johnpoz's post, that rule should have the source set to any (assuming you want any LAN host to be able to access the DMZ), the destination set to the DMZ subnet, and the Gateway setting left at Default.



  • So only have to pull down the nordvpn rule for that... If I'm understanding well.



  • @luckyzor You mean you have an existing LAN-to-DMZ allow rule but it's currently below your NordVPN rule? If so, then yes, simply re-ordering them may be all you need. If that doesn't work, post a screen shot of your LAN firewall rules.



  • I have this for now
    alt text



  • @luckyzor Okay so add a new rule at the top that looks like the "Default allow LAN to any rule" but instead of the Destination being set to any (*), set it to "DMZ Address", or more likely "OPT1 Address", whatever corresponds to your DMZ interface. I'd probably also move it below the Anti-Lockout Rule, but that's just for aesthetics; since they'll have mutually exclusive destinations they can't both match the same traffic anyway.


  • LAYER 8 Global Moderator

    @thenarc said in NordVPN Client only for specific hosts:

    So you set the Gateway setting to Default, but that doesn't mean it uses the default gateway.

    Huh? You leave the gateway at default - ie you don't touch it and then it uses routing.. Maybe its just me doing this stuff for 30+ years and using pfsense for 10 some years. But its pretty freaking clear..

    Here is what I will say - pretty much every guide I have seen out there for all these BS vpn services is either just WRONG or not how you should be doing it... I have yet to see one that was good or actually went into the detail that should be setup. But then again they are catering to the people that would use them in the first place.. So they have to want to go over the most basic info - click this and you will use us sort of setups.

    What I would suggest is understand how it works before attempting to route traffic out a vpn vs just clicking buttons on some "guide" you found from 3 versions back, etc.


  • LAYER 8 Netgate

    This guy knows what he is talking about 😉 :

    https://www.infotechwerx.com/blog/Creating-pfSense-Connection-VPNBook

    But even he hasn't found the time to update it to a current pfSense version. Still relevant though.



  • @johnpoz All I mean is that from this:
    0_1548822835762_FirewallRuleGatewaySetting.png
    It's not intuitively obvious to me whether "Default" means "use the default gateway." But your point about not needing to touch that setting at all is of course dead on.

    I enjoy contributing what I can to the forums, and I do my best not to misrepresent my level of knowledge or confidence. I never mind being corrected, and am willing to admit when I'm wrong. I've received and appreciated valuable assistance from you in the past, and I believe I have always deferred to your expertise. But sometimes the tone of responses is discouraging. If there's a concern that forum members below a certain level of expertise are routinely providing dangerous or misleading information, I can respect that. I can even accept if that's an opinion held of me, in which case I'll gladly stop attempting to provide answers and use the forums only when I have questions of my own. But a gentle correction suffices. I admittedly know less than you and many others on the forum, and enjoy learning more, but enthusiasm wanes when I'm made to feel stupid for trying to help others. That said, I may be more sensitive than others in that respect. And I pledge to try to better qualify any advice I give in the future with my relative level of confidence in its accuracy, or to not comment at all if my confidence is not relatively high. I promise that I don't want to give people bad advice just as much as you don't want me to give people bad advice.


  • LAYER 8 Netgate

    It says it right there. use the system routing table



  • @derelict Yeah so basically, if you select anything other than "Default" in that drop-down, you're overriding the system routing table and saying "use only this one specific gateway (or gateway group) that I specify" (i.e. policy routing), right? And when you select a default gateway (in System > Routing), you're selecting the gateway used for the default route in the system routing table. Just trying to get my terminology straight.


  • LAYER 8 Netgate