Multiple OpenVPN mapped to different WiFi SSID (Unifi)

[Antonio76]

Hello all ,

My first post and new to PfSense . So far I'm very happy .
What I'm trying to achieve in my home LAB, create multiple OpenVPN connections to different countries (2) using a VPN provider, to be mapped to different Unifi SSID . Each SSID will be named with the country where the OpenVPN connection is configured . In all OPenVPN connection cases, I would like to leverage PFblocker unbound configuration .
I have a switch capable of VLAN , eventually do all using the same cable will be best solution in my LAB .
If this is possible, thanks to pointing me on the right direction .

Antonio

[johnpoz]

Yeah you just need AP capable of doing vlan and bing bang zoom, easy peasy lemon squezy ;)

if your AP can not do vlans, then you would need different AP for each ssid.

Good price point AP would be say the unifi AC-Lite model... Retails like $80 USD

[Antonio76]

@johnpoz Thanks ,

I will dig in this direction . Maybe the switch can do VLAN and just the Unifi AP understand the tag .

Will search this option .

Cheers,

[johnpoz]

If you have unifi AP your golden.. They do valns just fine.

If you don't monitor the uplink you can set them for 8 SSID per band, all could be different vlans.. With doing that per band, so 2.4/5 you could in theory do 16 different SSID all on different vlans.

Not really good idea from performance standpoint to run that many SSIDs... But if you need many many vlans on wifi you could also do dynamic assigned vlans via radius, etc.

But if all you want/need is 2 - yeah clicky clicky!

[Antonio76]

@johnpoz said in Multiple OpenVPN mapped to different WiFi SSID (Unifi):

dynamic assigned vlans via radius

dynamic assigned vlans via radius is a world to discover for me :) . I know Radius on Windows server for SSL VPN appliances. For my LAB case I have to dig in since sound a bit too advanced but I like the idea .

[johnpoz]

Yeah it works if your current on your AP and controller... I got it working via PSK ssid even, and then assigned vlan based on mac.. Using the freerad in pfsense.. While it could be useful.. I was thinking cutting down my SSID to only 1, and then having my iot devices assigned to their particular vlans based on their mac address..

And I still might go that route at some point.. I validated it "could" be done - but then never had the drive to actually implement it across the board ;)

There is something said to KISS, and since only currently have need of 4 different wireless networks.. Just doing it the old fashion way ;)

[Antonio76]

@johnpoz Hhhhee I like how you think. I'm also trying to to make it rationale and use as less as possible wired and simplify topology .

I'm now setting up now Open VPN. Vlan already created and mapped to my LAN NIC igb1 . Let'see. .

[Antonio76]

Ok got the tunnel up . Cyberghost VPN is pain to setup and no really docs about it.
VLAN created, dhcp , subnet and range added to this VLAN , VLAN tagged in Unifi . NAT rule created to allow from this VLAN to WAN
No IP offered on this new VLAN . Maybe because I have created on Unifi a rule that block LAN traffic (Internet only like a guest) . I will further troubleshoot . Also becasue when this tunnel is up , normal LAN has no internet.
I only have a question about the GW to be assigned to this VLAN. In Pfsense I got this option uncheked. Not sure if in this case should be checked .
Use non-local GW: This will allow use of a gateway outside of this interface's subnet. This is usually indicative of a configuration error, but is required for some scenarios.

[johnpoz]

When creating new "lan" side networks there would be no gateway assigned.. You just give the interface an IP.. say 192.168.2.1/24 if your lan is 192.168.1 for example.

You can route your different networks or even just specific devices out a vpn connection via policy routing - ie select the vpn as gateway in your firewall rule.

You almost never want to pull routes from some vpn service - they like you send everything through them... Which normally you would want to policy route.

[Antonio76]

That's a bit nasty on Unifi side . Each time they upgrade the controller , they remove features . Such as VLAN only network, now is mandatory an Unifi switch .
As result the DHCP on the new Pfsense VLAN can't hand over an IP to the new SSID , therefore I got a bogus IP assigned by Unifi .
Will still try to find solutions , otherwise I will use an old DDWRT AP to test

[johnpoz]

What? Dude I run unifi AP I have vlans tagged and untagged... Not sure what your talking about? I am running 5.11.26 on controller and 4.0.43 firmware...

What would unifi be handing out IPs for??

You set your vlan ID as tagged on our switch connected to the AP... Set your SSID with vlan ID to match and there you go.

[Antonio76]

@johnpoz do you have AP only ? in my case yes .
I have created a new SSID , tagged on the Pfsense VLAN .
Now if I want to create in Unifi a new network (VLAN only), different from LAN , require an Unifi switch .
On the Pfsense VLAN, the firewall rule is pretty straight forward

[johnpoz]

dude you do not need to do that... You only need to do that if you have a switch..

Let me log in and will post screenshot.

You set the vlan ID on your wifi network

That network tab on the controller has nothing to do with it.

[Antonio76]

@johnpoz I guess I got your point. And indeed this is how I have configured it that struggles to work . I'm running a Docker version of the controller (does not really matter, is bridged to LAN)

[johnpoz]

If your client is not getting an IP from that vlan ID... Then you have a problem on your switch, or your vlan setup on pfsense or your not running dhcp...

All there is to do is set the vlan ID on your wireless network, and tag that to the AP..

[Antonio76]

@johnpoz There is no switch in between . Unifi AP straight forward in Pfsense LAN igb1 . DHCP server is running on that VLAN

[johnpoz]

So how exactly are you provisioning the AP? Its IP is also on vlan 49?

The AP talks to the controller normally via untagged... Where is your controller if you have the AP directly connected to your pfsense?

[Antonio76]

@johnpoz nope. AP is on the default LAN /24 . Works fine in that LAN.

[johnpoz]

And where is your controller? If you have the AP directly connected to your lan interface on pfsense? With no switch?

Draw up how you have everything connected...

[Antonio76]

@johnpoz Controller is running on Docker on a bridged LAN . Same main LAN subnet 192.168.1.0/24 . Just on it's own port 8443.

WAIT : I just remeber that I got a Tomato as bridge in between . Let me create a VLAN 49 there on the br0

[NogBadTheBad]

Try a packet capture on VLAN49.

[johnpoz]

Well yeah is that bridge you setup going to pass the tags? Or anything... How do you have this all connected... Why would you be bridging on your tomato box?? And does it even support vlan tags... Dude get a SWITCH!!!

How do you have a "lab" and not have a switch that does vlan tags?

[Antonio76]

@johnpoz I got a switch . I have to connect it . Mostly is all virtual but I will get this switch up and test again .

[johnpoz]

This is pretty simple/basic stuff here... You tag the vlan, that is what is on the wifi ssid with that tag.. Been using these AP since 2014 ;) I just had to look that up for another thread... Got an old square uap-ac back then.. tagging ssid worked the same as it does now..

If its not working your loosing your tag somewhere, didn't set it up, etc. etc.

[Antonio76]

@johnpoz Indeed . upgrading this netgear firmware(with PoE) and I will put it in the game .
Forgot I had this tomato device in bridge plugged somewhere . Sorry about.

[Antonio76]

@johnpoz all is working as intended. Again thanks for the help .
Last thing to solve is within the OpenVPN connection , is how to use my Pfsense / Pfblocker as DNS in the tunnel . Not sure where to look in this regard .
After that , I can export this config and us it in private LAN .

Thanks again

[johnpoz]

You want unbound to use your vpn connection for it lookups?

[Antonio76]

@johnpoz correct. I'm playing with settings and rule but seems that I got no luck . In DNS resolver (over TLS) , all the network are selected and outgoing network interfaces are selected. No VPN providers DNS are set in the general config . I do not allow clients to override Pfsense DNS default DNS via FW rule

[Antonio76]

Should be pretty much this :/

[johnpoz]

If your going to forward through a tunnel... Why would you want that to go through another tunnel? I don't get the point other than you want it ever freaking slower?

[mcarson75]

@Antonio76 I have a similar situation, with different VPNs to different countries on different VLANs. The way that Unbound works is that it will send queries out to all the outgoing interfaces, and the way I understand it, it will use the first reply.

This is an issue if you want to go to multiple countries. If I am on my local network, I want replies from local DNS servers, and if I'm on my VPN to the US I want replies from DNS in the US. If you have a single unbound resolver. the server farther away will never win (my VPN to the US has about 250 ms ping time from here).

What you want is queries from a particular VLAN to only be sent out via that VLAN's gateway (i.e. routed over that VPN) but as near as I can tell you can't do that with a single instance of unbound. My solution was to run a separate DNS server (in a VM in my case) on each VLAN to ensure that queries are only sent through the proper gateway. You can also run multiple DNS servers on pfsense if you enable both the forwarder (dnsmasq) and resolver (unbound). You could also install bind to get a third. You would need to run each on a separate port of course.

I've never played with bind, but it's possible that with the multiple views you might be able to route it correctly with a single server. I just don't have any experience with it.

[johnpoz]

If your wanting a client to use dns from vpn X... Then have the client ASK for dns he is doing down the tunnel.. Not sure how you expect unbound to know which interface to use for which client.

Set your dns on the CLIENT!! Simple via dhcp or actually set it on the client.

Or you could set it up with views on unbound.. Its had view support for awhile, then yes specific forwarders for each view.. But your not going to be able to do that in the qui, and just way simpler to set the dns on the client. I have some threads about here setting up views.. Simple enough to do.. If that the route you want to go - but why?? Just set it on the client.. And let your unbound resolve for your normal clients that are actually using your wan.

This is specific SSID for clients to use vpn X, then on your dhcp server for this vlan - just hand out the any dns you want your clients to ask.. Not Pfsense IP, and that query will go down the vpn tunnel.

[mcarson75]

@johnpoz I think you misunderstood what I said, but if there's a simpler way to do it I'm willing to learn.

I have three subnets - 192.168.2.0/24 is my local ISP, 192.168.3.0/24 is a VPN to a VPS I have in the US, and 192.168.4.0/24 is a VPN to my parents' house, also in the US.

I set up three separate VMs running unbound, one on each of those subnets - 192.168.2.5, 192.168.3.5, 192.168.4.5. Clients on 192.168.2.0/24 get 192.168.2.5 from DHCP for instance.

My local one is set up as a recursive resolver, while my VPS-VPN one goes to Cloudflare (otherwise multiple queries at 250 ms each to recurse) and the one for my parents' queries their pfsense box's unbound on the other end.

This way I ensure that DNS queries on my VPN network only go through the VPN gateway.

Is there a way to do all that using just unbound in my pfsense instead? And also using pfBlockerNG? (I currently also have PiHole running on each VM)

[Antonio76]

@johnpoz your point make sense . I just forced the client to use PFsense as only dns . A FW rule is preventing to look up different DNS .
I set up my Pfsense to do not override DNS settings too on a client side . Sure I can revert but what is the point security wise ?
BTW I have investigated the DHCP part but got not internet if enabled explictly in the DHCP server .

[Antonio76]

@mcarson75 Indeed I have installed BIND yesterday. Now I'm going to play around it .
Local DNS should is faster than VPN provider latency wise . I could dockerize a DNS server but goal is to let Pfsense handle this without mantaininng multiple componets. Actually I can dockerize a Pi-Hole too . Done already in past and works fine

[Antonio76]

@mcarson75 no joy enabling BIND on the VLAN . OpenVPN won't start

[johnpoz]

Again unbound can do this for you via views, and sure bind can do it - and while bind package has as a views section.. Your still going to have to do the config by hand..

How many clients are you going to have on this special ssid vlan? You do understand clients normally cache their own dns.. Are the clients on this vlan iot type devices that do not have a local cache of their own..

My take is you want these special vpn ssids so you can circumvent specific geo restrictions.. Keep in mind that both unbound and bind are going to be using a common cache..

So you have client look up host.domain.tld from country A, now when you have client ask pfsense for host.domain.tld but you want the answer to be the IP for country B - its just going to get the cache from country A, etc. etc..

Your going to be better off just letting the clients ask some public dns via your vpn connection... Your doing a lot of extra work for what a couple of ms of query time for what exactly... I don't think these clients you have on this country based vpns are going to be doing a lot of "user" internet browsing where cache helps, etc.

[Antonio76]

Is not a Ms gain, is the DNSBL feature that I need . I can sacrifice time for resolve but keep the privacy and security is what concern me the most .

About the shared cache you are right

About DHCP:
Local DNS flush is not the issue . SSID displayed as connect, no internet

[mcarson75]

@Antonio76 It looks like you are blocking LAN in your firewall rules, but your DNS server is on your LAN. You should push 192.168.49.1 as your DNS server instead of 192.168.1.1. It should be running on all interfaces.

Alternatively you could add a firewall rule to allow access on port 53 only to 192.168.1.1.

[Antonio76]

@mcarson75 got it fixed via DNS forwarder (enabled) on that VLAN 49 . (I had it disabled)

Still debugging because beside click and click , I need to understand the Pfsense logic behind