Everything going out via VPN client - I don't know why

[randombits]

I've given up Googling for an answer and searching the forums.
I've setup a VPN client (Proton) and assumed setting the default gateway to WAN would, by default, push out all data over the WAN gateway, but it doesn't. The LAN rules with any (*) as the gateway goes out via the VPN rather than the default gateway setting of WAN. Do I have to change all my LAN gateway rules from ANY to WAN ?.

[viragomann]

@randombits
I presume the server pushes the default route. To avoid it is set by the client, check "Don't pull routes".

[randombits]

@viragomann Ah thanks, That seemed to get things working as I expected, I followed the instructions here with some adaptation. After resetting passwords half a dozen times after 'your account might have been hacked please change your password' when things went over the VPN I didn't want to. I'll continue testing to make sure it's working as it should.

[viragomann]

@randombits
Yes, most peoples intention ist to direct the whole traffic over the VPN. So vpn providers simply pushes the default route and it's done.
However, if you only want to direct partial traffic to the vpn provider, you have to set "don't pull routes" and use policy routing rules for directing the traffic over the vpn.

[johnpoz]

@viragomann said in Everything going out via VPN client - I don't know why:

Yes, most peoples intention ist to direct the whole traffic over the VPN

Let me correct that for you ;)

Yes the intention of pretty much all VPN services is for you to send ALL DATA through them.. Or they might miss out on some crucial information they can use to monetize your info ;)

I have never seen a vpn service guide - even ones specific to setting up pfsense make any mention of how you don't have to send them everything.. And that you can policy route traffic to them if you so desire.. Not ONE!! And I have looked at many - trying to figure out what users are doing wrong when they say they follow guide xyz.

[viragomann]

@johnpoz said in Everything going out via VPN client - I don't know why:

Let me correct that for you ;)

To be honest, I don't use any vpn service. :-)

[johnpoz]

You couldn't pay me too ;)

I have my own vps(es) that I can route traffic through and show users how to policy route with, or setup connections, etc.

[randombits]

My intention is just to send torrents over the VPN with everything else going direct. But https://ipleak.net/ shows some 'interesting' results with Policy Routing I'm just using the free ProtonVPN - for non torrent traffic for testing before I pay anybody.

[johnpoz]

keep in mind when you change something like a policy route, that existing states could still send traffic out old way.

Good idea to kill any existing states before testing a change in policy routing.

[viragomann]

@randombits
You will also have to direct DNS traffic from the related machine over the VPN to avoid leaking.

[johnpoz]

Yeah depending on what the client on your network is doing for dns - if pointing to pfsense, that could show a "leak" - what is the symbol for air quotes ;)

[randombits]

@johnpoz Good point, I have rebooted once or twice if the results I get seem off, killing states would be quicker - thanks for the reminder. But When I get the ProtonVPN IP in ipleak.net and loads of DNS servers doesn't seem right to me...

[johnpoz]

Users have a hard time understanding leak test to be honest.

For example if you point to google you might get all kinds of different IPs, not the 8.8.8.8 you are pointing to.

If you point to some vpn DNS, a dns leak would show you the resolver IPs that its pointing too.. And not the specific IP your pointing too..

All a dns leak test does is have your client look up some unique fqdn.. And then what IP actually came and asked for that specific fqdn.