PC on LAN cannot see other same LAN PCs if connected to VPN

antoxa70

I have a 192.168.3.1/24 LAN with several devices connected including my laptop and NAS.
The moment I connect my Laptop to Express VPN, I cannot see my other LAN devices anymore. Cannot connect to NAS for example.
Same with NAS, if I connect NAS to Express VPN as a client, it disappears from the LAN network.

Is there a way to keep devices available in LAN while connected to VPN?

I had an EdgeRouterX before and never experienced such problems. So I assume it is related to pfsense settings.

Thanks for you help.

johnpoz

Why would you not connect the vpn via pfsense, and then policy route you want out the vpn. If your going to connect client to vpn, you need to make sure it does split tunneling, ie not send traffic that is meant to be local - 192.168.3.x to go out the vpn..

antoxa70

This is what I will end up doing most likely, but I would really like to understand why I had no problem with EdgeRouterX (and other routers) but it seems to be an issue with pfsense.

So do you suggest that when I connect my laptop to VPN all traffic including local goes through this tunnel and to keep local traffic in LAN I need to add routing to pfsense NAT? Does it also mean that EdgeRouter and other consumer grade stuff does it automatically for me?

22v10

I use a softiether VPN in a similar way ,t see the Drobo5n on the vpn I had to use a "Bridge " software setting. YMMV. Originally when I would connect to the Main office's VPN & LAN
I could see them and they could only see my machine but none of my Local LAN devices ie, Drobo5n file server shares or printers etc. Now with the Bridge its all there. HTH

I'm using it (softeither VPN) with the PFsence Firewall and just getting rolling.

Does your VPN give you a different IP Address after you connect?
22v10

johnpoz

@antoxa70 said in PC on LAN cannot see other same LAN PCs if connected to VPN:

why I had no problem with EdgeRouterX (and other routers) but it seems to be an issue with pfsense.

Because you had different vpn settings... Sorry but the router has ZERO to do with what a vpn client on a device does... There is no possible way the router could see traffic in your vpn tunnel to some outside server and say hey that traffic is local and send it back inside.

If you were sending traffic for 192.168.3.x down the tunnel - router has no idea about that, nor can it do anything about it. So why it worked before is your vpn client didn't send the local traffic down the vpn - period!!

antoxa70

Yeah, sounds reasonable, but I changed nothing on VPN client side (it is just an app on my laptop that connects to VPN, and it is not just my laptop, NAS experienced the same problem). So I suspect that somehow previous router had rules to route local traffic back into LAN (maybe it has been set up using wizard without me knowing/discovering it).

Anyway, I have set up a VPN on pfsense, so now I have the following:

3 subnets assigned to 3 physical interfaces sharing 192.168.3.1/24 range and combined into "LANs" group.
Traffic from several PCs is routed into VPN tunnel and tagged as "vpn-traffic". Sort of a "kill switch" floating rule that blocks "vpn-traffic" tagged packets attempting to go via WAN.
DNS Resolver configured to use Quad9 DNS over TLS routed via VPN tunnel. pfBlockerNG added.

I really like the DNS part, combination of VPN and TLS. This mean that DNS provider can associate my domains with VPN IP only. VPN provider cannot see DNS names. And ISP cannot see DNS names at all, even for non VPN traffic required for streaming/games/etc.

Hope I do not miss anything :)

johnpoz

@antoxa70 said in PC on LAN cannot see other same LAN PCs if connected to VPN:

So I suspect that somehow previous router had rules to route local traffic back into LAN

Can not and does not work that way!!! The client either sends the traffic out its local interface, or it sends it down the ENCRYPTED tunnel... The router, can not see traffic in the tunnel... So how would it do anything with it??

Does your client have more than 1 interface in the network? Or did your previous setup?

antoxa70

@johnpoz said

Can not and does not work that way!!! The client either sends the traffic out its local interface, or it sends it down the ENCRYPTED tunnel... The router, can not see traffic in the tunnel... So how would it do anything with it??

Yeah, stupid me, it seems like I was trying to connect to local wired NAS from wifi laptop, that were on different local subnets. VPN client still allows me to connect local IPs but it knows nothing about separate subnet obviously :)

Thank you @johnpoz, now I know a tiny bit more about routing and VPNs!