Can I use one of my 6 physical network ports to be a vpn port?



  • Hi,

    As the title suggests I would like to know if it is possible to use one of my 6 physical ports to be a VPN port so everything connected to it automatically goes through my PIA account with a killswitch or would I be better off creating a VLAN? I do not fully understand each possibility (if indeed they are possibilities) but looking for the best way to acheive an rj45 connection that is secure.

    Many Thanks!


  • LAYER 8 Global Moderator

    Sure you can put a network on any of your interfaces and policy route the traffic out a vpn service.. Just like you can with a vlan.. The only difference between a native network on an interface vs a vlan, is vlans would be tagged..

    What exactly are you going to connect to this port? A different switch, an AP.. Keep in mind that if you connect native network to a switch that your using for other interfaces you would not have isolation unless the switch supports vlans and your running vlans on this switch.



  • Thank you so much for your detailed reply!

    I do have a managed switch (TPLink TL-SG108PE) I could use for vlans but I have to be honest it was not very intuitive and did not respond how I expected to the settings resulting in quite a mess with two ip ranges spreading throughout my large(ish) network. I thought it would make more sense to use one of the spare ports on my pfsense machine (HP Microserver running unraid and pfsense VM)

    The objective is to create a VPN network that I can use in another unraid server that certain VM's & Dockers can use to connect. My thinking was that I could use a pfsense PIA VPN physical port to a spare port on my other unraid server so I can route certain dockers to that port.

    just to clarify I have two machines

    HP Microserver running unraid, pfsense & Ubiqity Unifi (VPN Not Required On This Machine)

    Another rackmount running unraid with VM's & Dockers I would like to go through a VPN Network.

    Thank you!


  • LAYER 8 Global Moderator

    @mbc0 said in Can I use one of my 6 physical network ports to be a vpn port?:

    TPLink TL-SG108PE

    Not sure would call those managed or smart... They have had huge issues with vlan leakage, since some firmware doesn't allow you to remove vlan 1 from ports you want to put in a different vlan.

    If your going to connect this physical port to a server, then sure everything on that network could be policy routed out your vpn connection you setup in pfsense.



  • lol ok, I actually only bought it for it's POE conections so it is no loss but also after what you said and some googling it is not a very good/smart switch. I would prefer to create a physical port on pfsense to acheive what I am looking to do.

    I am struggling with the correct terminology to find a good guide to follow, can you please recommend anything?

    I did watch a video yesterday regarding policy routing the vpn connection so will check/double check and run dns leak tests!

    You have been so helpful, thank you so much for your time.



  • @mbc0 said in Can I use one of my 6 physical network ports to be a vpn port?:

    (TPLink TL-SG108PE)

    Some TP-Link gear doesn't handle VLANs correctly. Best to avoid them, if you're planning on using VLANs.



  • Many thanks for chipping in, can I ask what is generally recommended for VLAN switches for future use please?



  • @mbc0

    Pretty much anything other than TP-Link. I haven't heard of problems with other brands. They also have similar problems with some WiFi access points.



  • ah, ok thank you! I have a couple of standard gigabit switches which have never caused me an issue, a wireless ap which needed rebooting every day (went in the bin) so in future will avoid TP-Link, thank you


  • LAYER 8 Global Moderator

    if your just going to use it as a dumb switch - then they should be fine... But doesn't seem like they actually understand how vlans are suppose to work ;) There are many a thread about here discussing them... I have one, which I got to test with because I couldn't believe what users were saying ;) heheheh

    But they were correct - they leak vlans, they don't actually allow you to remove... Now they finally after almost a year came out with a firmware update for v3 of hardware, and recently found out (there is a thread about) where you can put the v3 firmware on the v2 hardware - and it seems to work ;)

    What version (hardware) and firmware do you have of this tplink switch?

    I have both the netgear and dlink low end ones as well (testing) I run cisco sg300s.. And they work fine from all the testing I have done on them.. But they just don't do all the features I want... But they are on shelf if need a switch for something - you never know ;)



  • Sadly mine is a V1.0 so I think it will just remain a dumb switch with POE :-)

    I am going to attempt to see if I can work out how to get a port on my pfsense to be a VPN connection only so should be ok and not need a vlan (for now) ;-)

    Thank you for taking the time to respond :-)



  • I am just following this guide from PIA

    https://www.privateinternetaccess.com/forum/discussion/29231/tutorial-pia-on-pfsense-2-4

    There is a section that says if you have an AES-NI it is advised to select BSD cryptodev engine but I can only see Intel RDRAND Engine? I have an i5-3470T which I bought because it has AES-NI

    Thanks!



  • @mbc0 said in Can I use one of my 6 physical network ports to be a vpn port?:

    Sadly mine is a V1.0 so I think it will just remain a dumb switch with POE :-)

    You could do what I did with mine, I made it into a [data tap].(https://en.wikipedia.org/wiki/Network_tap)



  • @JKnott said in Can I use one of my 6 physical network ports to be a vpn port?:

    @mbc0 said in Can I use one of my 6 physical network ports to be a vpn port?:

    Sadly mine is a V1.0 so I think it will just remain a dumb switch with POE :-)

    You could do what I did with mine, I made it into a [data tap].(https://en.wikipedia.org/wiki/Network_tap)

    That looks like an interesting read! :-) Thank you!



  • Hi!

    I have made good progress but have 2 questions! :-)

    I have followed these instructions

    https://www.privateinternetaccess.com/forum/discussion/29231/tutorial-pia-on-pfsense-2-4

    and now, my all 4 used interface ports are behind the vpn which is great that it is working but I now need to remove 3 of them so just a single port is behind the vpn in my case PIAVPN (igb3)

    d342de8c-b57a-4d05-8544-11252242ce11-image.png

    I see I had to create a new rule for each interface in Outbound nat (as per the guide) is that where I have gone wrong?

    Any pointers greatly appreciated!!

    Thank you

    784b1367-0b99-4612-a04c-825933a1a84b-image.png



  • Well, I have googled the hell out of this and saw one guy on the forums get stroppy about it (now banned) , another that had spent 2 weeks trying to find a way but that is it? I am very sorry if this is such an easy thing to you but to someone like me it is incredibly hard to learn quickly, there is so much terminology to learn as well as understanding complex settings. If anyone has any time to just point me in the right direction of what I should be searching for or doing to resolve this I would really appreciate it!

    If I go to Status/OpenVPN and start the service all interfaces then go through the VPN which is expected but I would only like 1 interface to go through the vpn (igb3)

    abe439be-e836-4340-8855-09c242437b79-image.png
    Many Thanks :-)


  • LAYER 8 Global Moderator

    @mbc0 said in Can I use one of my 6 physical network ports to be a vpn port?:

    start the service all interfaces then go through the VPN which

    Most likely because you pulled routes when when you setup the vpn client in pfsense.. So yeah!

    If you want to policy route, you can not pull routes from your vpn service because they will set your default route to go through them..

    So do not pull routes! Here example setup in my vpn client setup on pfsense..

    pullroutes.jpg

    Then setup your firewall rules to go out that gateway.. example..

    policyroute.jpg



  • @johnpoz

    Thanks so much for this!

    I think I must be really close now but I do not understand where you get the ip for System/Routing/Gateways?

    783d7441-09fd-41a3-9ac1-a51e1390b988-image.png



  • @johnpoz I have tried using the ip of my interface for igb3 which is the port I want for PIA and although I can connect to the port, windows says there is internet but there actually isn't? I cannot see the outside world?

    9faaeae3-8e08-40ea-bfe6-e8a3f82ecca7-image.png

    36e0b9f2-9f69-4df4-8087-b21b9c8a5b99-image.png

    9b22fcae-3a20-49dd-af65-557fc5c479fd-image.png


  • LAYER 8 Global Moderator

    Your gateway is right there, its called PIAVPN - that is what you would select for the policy route, under advanced on the rule pick that as the gateway... Not the IP..

    It pulls that IP from the vpn server it connects too.

    Also did you switch to manual outbound nat? Yeah that is going to be problematic - you should leave it as auto, and just create a hybrid outbound nat for your vpn connection... And the tunnel network used by the vpn can not overlap any network your actually using locally.

    hybridoutboundnat.jpg

    Don't pay attention to that hybrid lan nat, that is a source nat so I can get to a box without a gateway... Has nothing to do with policy routing.



  • @johnpoz said in Can I use one of my 6 physical network ports to be a vpn port?:

    Also did you switch to manual outbound nat? Yeah that is going to be problematic - you should leave it as auto, and just create a hybrid outbound nat for your vpn connection

    I followed the privateinternetaccess pfsense guide mentioned in post #12, here is an excerpt from it.

    301ee0fa-7eab-46df-8f1a-f97bd06ff4a5-image.png

    So, here is what my screens look like now

    3b53bdd2-2a3d-49cd-a8ee-4f039d58bc3c-image.png

    30fdb644-5858-4efc-a028-a2dea4872429-image.png

    b2273875-d31b-4877-8d15-0f8fc879922d-image.png

    I have tried setting the ip of the source network to 192.168.2.1 as this is the ip of the interface but it automatically changes it back to 192.168.2.0

    As things stand the OpenVPN PIA Service is running and connected but nothing on the LAN is running through that.

    If I connect to the igb3 port on pfsense (PIAVPN) I can ping anything on the LAN but cannot connect to anything (unraid, ip cameras etc) I also cannot connect to the outside world from this port.

    I think that if the instructions from pia to change to manual outbound nat is incorrect then there is probably more mis-information in that guide. Is there an alternative guide you are aware of or am I still missing something?

    Many thanks for your time and patience so far, it is really appreciated!


  • LAYER 8 Global Moderator

    @mbc0 said in Can I use one of my 6 physical network ports to be a vpn port?:

    I have tried setting the ip of the source network to 192.168.2.1

    Why are you trying to set an IP... You would NOT set an ip on a vpn client connect to some vpn service..

    Their guides are written by idiots for their idiot users.. Sorry but that is my personal opinion of these nonsense service..

    Point to me in their guide where it says to set an IP on your interface???

    Lets say you where required to set a static on the interface - you still can not have the same network locally as your tunnel network.. You can not use 192.168.2/24 on one of your networks, and 192.168.2/24 as your tunnel to the vpn service..

    Where is your gateway??? You manually created that gateway pointing to your own local interface on 192.168.2.1??

    So you didn't follow there guide at all!! Is what your saying - your just saying you did... Because no where in there does it say to do that...

    What I would suggest is just remove ALL the settings for any vpn anything... Switch to normal automatic and then get this new network working... Then setup your vpn!



  • Hi,

    Firstly, I understand your frustration and I totally get it! I am an engineer of 30 years and find it very frustrating explaining things to people that just cannot understand what I am explaining. Please remember I am a complete novice trying my best to understand and follow what I thought was an official guide from PIA which has in it's defence worked for all my interfaces but I need it to work for just one interface, the guide does not cover that.

    > Why are you trying to set an IP... You would NOT set an ip on a vpn client connect to some vpn service..]

    I was doing this as unless I specified an IP it just stays at dynamic and does not show an IP
    a2fe0028-cdf6-4ae5-bc9e-75bc8e27d7c3-image.png

    > Their guides are written by idiots for their idiot users.. Sorry but that is my personal opinion of these nonsense service..]

    I understand your opinion :-)

    > Point to me in their guide where it says to set an IP on your interface???

    It does not say this anywhere in the guide as their guide is only to put all interfaces behind the vpn which as I previously stated works, I cannot find any guide or understand any way to do this for just one interface.

    > Lets say you where required to set a static on the interface - you still can not have the same network locally as your tunnel network.. You can not use 192.168.2/24 on one of your networks, and 192.168.2/24 as your tunnel to the vpn service..

    I am so sorry I am not fully understanding this, I have 4 interfaces in use
    wan
    lan - I set an IP of 192.168.0.10
    Unifi - I set an IP of 192.168.1.5
    PIAVPN - I set an IP of 192.168.2.1

    > Where is your gateway??? You manually created that gateway pointing to your own local interface on 192.168.2.1??

    0fa0e06f-196c-4ea4-aec6-dd2ee41875bf-image.png

    So you didn't follow there guide at all!! Is what your saying - your just saying you did... Because no where in there does it say to do that...

    Yes I did follow the guide completely and it worked perfectly but for all interfaces, I need this to be on just one interface.

    What I would suggest is just remove ALL the settings for any vpn anything... Switch to normal automatic and then get this new network working... Then setup your vpn!

    I have had this interface working fine the whole time and have been using it for some months before trying to get OpenVPN working.

    In a nutshell
    All interfaces have been working fine for some time now.
    I followed the PIA Guide and all worked great for all interfaces then the problem is trying to get it to work just on one interface.

    Again, I really am genuinly sorry as I know how frustrating this must be.

    Thanks


  • LAYER 8 Global Moderator

    Dude... You can do this with 1 interface, 100 interfaces... Doesn't matter its a simple policy route... You have gateway that is the vpn connection... creat a rule that sends who you want when they want go X out the gateway... its that freaking simple..

    All that is required for you to do this, is follow their stupid guide and don't pull the routes. Then nobody will be using the vpn

    Other than their nonsense about deleting your wan outbound nats as their kill switch.. OMG!!!

    Now create a rule that points either the whole network or a specific IP out the gateway...

    That is ALL there is too it... Have you read the policy routing documentation?

    https://docs.netgate.com/pfsense/en/latest/routing/directing-traffic-with-policy-routing.html

    edit: Here... I just created a firewall rule to point my client out the vpn.. Its as simple as changing the gateway from default to the vpn.. That is all there is too it... When you pull the routes, they change your DEFAULT to use the vpn... For anything to no use the vpn you would have to force it out your wan gateway..

    policyroute.jpg

    Reason the other site for IP is different, is I didn't want to flush my states, so I went somewhere different (not google) to create a new state on the firewall and use the vpn connection, vs the previous states that were using my wan.



  • Thank you, I can see now I was on the wrong path and overthinking.

    I believe I am understanding this (mostly) now and have been through what you said and the Policy Routing Configuration many times, I have mostly started again but cannot get my vpn gateway to register an IP.

    803a1c93-006f-4bba-b2f0-f7ad9a443a09-image.png

    I cannot get anything other than dynamic to show for my Gateway

    3fbd7be5-6897-48ce-886e-9a342f35fe6a-image.png

    ba9653b1-7cb0-4393-a8a9-3d8a646ff562-image.png

    e15578c6-2d32-43b8-a30d-1a50938cdd86-image.png
    Do I need a rule for this interface?

    08b286b6-5ad4-40cb-a68a-cd68c09391a9-image.png

    b8a45e86-440d-4223-b7e2-e95dc33b9970-image.png
    I have been over and over and feel I have things setup right now, I just cannot see why the gateway is stuck on dynamic?



  • AHA!

    A Break Through!!!

    I now have an IP!

    In the firewall rules I had the vpn interface selected instead of the physical interface!

    All I have to do now is work out how to get any devices on the interface to the correct gateway as there is no internet on the physical port (IPCONFIG shows the gateway as 192.168.2.1 which is the address of the physical port) but this is so close now :-)

    Thank you SOOO much for your help and I hope I never caused you to lose too much hair :-D

    d0a9ab33-4294-4da4-b78c-f675714469e3-image.png


  • LAYER 8 Global Moderator

    @mbc0 said in Can I use one of my 6 physical network ports to be a vpn port?:

    (IPCONFIG shows the gateway as 192.168.2.1 which is the address of the physical port) but this is so close now :-)

    Huh?? When you create a new network on pfsense there would be NO GATEWAY set.. When you do that it becomes a WAN..

    So in pfsense you would have an interface

    192.168.2.1/24 for example.. NO GATEWAY!!! NONE!!!

    Here is one of my network..

    none.jpg

    Clients on this network, say your box you want to use your vpn would use pfsense IP as "their" gateway 192.168.2.1 for example if that is what you set pfsense to be, or example mine is 192.168.4.253..

    What I suggest you get this network working going out your normal wan - than Policy route it out your vpn!!!



  • @johnpoz

    edffe15a-fef1-43ba-9a4e-a78e0b8540f6-image.png

    Mine is the same,

    yes I will get it working on the normal wan first,

    Thank you :-)


  • LAYER 8 Global Moderator

    Now with your nat set to auto any clients on this network should work.. You created a any any rule on this interface right?



  • hmmm with nat set to auto, Windows changes from no internet shown on the connection to showing internet is now available but there is no response to the outside world, the other LAN & UNIFI interfaces are working fine



  • I have a Windows 10 Laptop solely connected to the vpn interface FYI

    And yes I do have an any rule

    aa52c507-0b72-43c7-9cae-f7351f74bc20-image.png



  • I removed the gateway from the interface but still the same, no internet

    f6d0a753-4401-4d66-809a-fa5d570d1631-image.png


  • LAYER 8 Global Moderator

    well how is internet going to work with just TCP... dns is UDP... to lookup www.internet.com you need to be able to talk UDP.



  • @johnpoz

    A schoolboy error.. no idea how that happened!

    I have just put everything back and its working!! I am so relieved! and yes it is so bloody easy now I know how it all comes together, you must have been pulling your hair out! I am going to do this again on another server just to prove to myself how easy it is :-)

    All I have now is a dns leak but have seen plenty of info on how to resolve that!

    Thanks so so much!



  • One think I have noticed though, although everything is working (apart from the DNS Leak)

    The VPN Gateway is showing as offline?

    e010ec7c-4f1e-4adb-8b41-e33df1a69a7e-image.png

    34ba950f-ce23-4d24-ab04-865813715f41-image.png


  • LAYER 8 Global Moderator

    What version are you running? That is not current version..

    Oh your in the status section.. Thats why it looks different.. Restart the vpn instance.

    Really dude your hiding a 10 address?



  • haha, yes, I did hide the 10 address but not intentionally! :-D

    519c11a5-895d-4562-a137-26c81487a9aa-image.png

    f8fd5bb1-e822-4f21-a400-29f4e4d397f5-image.png


  • LAYER 8 Global Moderator

    That is not current.. current is
    2.4.4-RELEASE-p3 (amd64)
    built on Thu May 16 06:01:19 EDT 2019
    FreeBSD 11.2-RELEASE-p10

    Well now 2.4.5 is, it just dropped..

    Version 2.4.5 is available.
    Version information updated at Thu Mar 26 11:19:06 CDT



  • hmmm ok...

    I run pfsense (for nearly 2 years now) as a vm on a HP Microserver running unraid, I wonder why it doesn't update automatically? I will look to see how to update now, are there any pitfalls I should be aware of jumping from 2.4.3 to 2.45?

    Thank you


  • LAYER 8 Global Moderator

    Well 2.4.5 just dropped like maybe an hour a ago.. at best... So prob wouldn't update just yet... Oh but your on a VM... Oh then just take a snapshot and click the button... Use to do that all the time when running on vm.. Even daily snapshots I would run - because could just rollback to the snapshot took before I clicked upgrade..


Log in to reply