Pfsense hangs when trying to update static routes



  • I am trying to update my static routes but pfsense just seems to hang and then abandon the attempt. Is there any way to look into this?


  • LAYER 8 Global Moderator

    Some more info going to be need here, have no issues adding routes.



  • what kind of info do you need?


  • LAYER 8 Global Moderator

    Like how exactly your trying to add them, the gui right? And pointing them to where? And what version of pfsense your running.. I assume current 2.4.4p3?

    You have a gateway that your pointing the route too, etc.

    Your saying no errors are thrown in the log?

    Here as test just added this - no issues
    justadded.png



  • so the instructions I'm following are as follows:

    1. create an alias in pfsense called netflix or anything you want. Import all the netflix ip you can find or pm me and I'll post a list of the ones I have.

    2. Go to firewall >>>rules>>>LAN and edit the default Lan to any rule and change the gateway to your vpn

    3. Still under LAN create a new rule ACTION>>Pass INTERFACE>> LAN ADDRESS FAMILY>>IPV4 PROTOCOL>>TCP SOURCE>> LanNet DESINATION>>Netflix (this is the alias and all netflix ip's you have) DESTINATION PORT RANGE>> ANY DESTINATION OS>> ANY scroll down to gateway and select WAN save it.

    4. Move this rule above the default LAN to any rule

    5. Go to SYSTEM>>ROUTING>>STATIC ROUTES click on add and add this new route to your system

    NETWORK>>Netflix or (whatever you named the alias) GATEWAY>> WAN_DHCP-192.168.1.1 INTERFACE>>>WAN DESCRIPTION>>>netflix bypass or whatever description you like.

    1. After all your devices contact netflix and is working place the Lan rule you created below the the default lan to any rule so that it does not leak your isp public ip assigned to you.

    However, when the alias rules are too long (for domains - not ip addresses) I run into an issue where static rules hang when I try to apply them. The number of subdomains being added is around 8k

    Here is the sub domain listing I'm using: https://pastebin.com/THeAThxt


  • LAYER 8 Global Moderator

    That is just moronic.. You want pfsense to every 5 minutes resolve 8K some fqdn? And then add routes for those?



  • How should I be doing this then?


  • LAYER 8 Global Moderator

    Just policy route the traffic out the vpn..

    Where did you get those instructions?

    After all your devices contact netflix and is working place the Lan rule you created below the the default lan to any rule so that it does not leak your isp public ip assigned to you.

    That is just idiotic as well..



  • https://www.privateinternetaccess.com/forum/discussion/21421/pia-vpn-neftlix-bypass-for-pfsense

    Can you explain or point me where to read on using policy routes to traffic out of the vpn?


  • LAYER 8 Global Moderator

    That is just nonsense.. But you will notice he is using static range of IPs..

    And you wouldn't need to add routes, you would just policy route it out a dest out your wan.

    When you policy route, you don't grab routes from your vpn service.

    Simpler thing would be to do is just route your device doing netflix out your wan via its source IP. Or better yet send only the stuff you need/want out your vpn out the vpn vs everything expect some service that is hosted of CDNs

    Also that thread is dated from 2016.. I can pretty much promise you those IPs are no longer viable.



  • I'm not using those IP addresses I was trying to use the same concept for sub domains. But thanks for letting me know this is a bad path to follow, I'm reading up on policy routing now.


  • LAYER 8 Global Moderator

    BTW doing something like
    54-240-196-102.amazon.com
    54-240-196-172.amazon.com
    54-240-196-221.amazon.com

    Make no sense, why would you resolve those? Do you think they would resolve to some different IP then what their fqdn is?

    $ dig 54-240-196-102.amazon.com +short
    54.240.196.102

    So why resolve it at all, just use the IP.. And those all going to fall into a network, so why would not just route the /network vs the specific IP?

    Also when trying to do what your doing you would just use the ASNs which would contain all the networks and create an alias with those, etc.. pfblocker can do that for you automatically.

    The simple solution would be to just say your roku/tv/firestick is on IP 192.168.1.42, just create a policy route above where you force traffic out your vpn, to say that source IP just goes out your wan.. There you go netflix works, amazon prime works, hulu works, etc. etc. etc..



  • Haha thanks for the very useful information! I'm still pretty new to all of this. I'm going to look into pfblocker now. Thanks!!!

    The problem with your last suggestion is that the same computers that I use for streaming I also use for other activities. I have stuff like firestick but I thought it would just be simpler to go this route (guess not).



  • So I see how to enter a domain into the whitelist but how do I route the traffic meant for the VPN to WAN if it hits one of these domains? This appears to just allow the traffic on the vpn.


  • LAYER 8 Global Moderator

    With a policy route to the alias.

    Something like this.
    policyroute.png

    Anything with dest to what is in alias goes out wan..

    Anything that is not to that alias would hit the last allow rule and go out the vpn.



  • thanks!


  • LAYER 8 Global Moderator

    When you setup your vpn service, make sure you do not allow it to grab/set routes or it will set your default route to out the vpn..



  • I did as you said but the traffic is not being routed to wan. Is this where the static route stuff comes in? I thought I was supposed to avoid that? How is what the guys instructions were not policy routing?


  • LAYER 8 Global Moderator

    Does your alias actually populate? Lets see your rules.

    Do a traceroute for some IP that is in your alias.

    edit: Here I just forced traffic going to 8.8.8.8 out a vpn..

    outvpn.png

    Here is normal

    normal.png

    Did you setup your outbound nat? Did you change your vpn to not be default, ie don't pull routes or let it set routes?

    keep in mind if you had existing states they would have to be flushed..


Log in to reply