VPN client
-
@antibiotic Traffic from LAN should not arrive on the OpenVPN tunnel interface.
See https://docs.netgate.com/pfsense/en/latest/vpn/openvpn/firewall-rules.html#allowing-traffic-over-openvpn-tunnels -
@steveits
I'm saw this guide and follow but result zero. I'm also tried to another guides with manual outbound rules, the same result. Could some1 step by step explain what to do ( I'm newbie). -
@antibiotic
Which VPN client are you running? A client on pfSense itself or a device behind?What is the "VPN client interface"?
-
@viragomann VPN client on pfsense, sir. Vpn interface name: ovpnc1
-
@antibiotic
And whats the purpose of the "VPN client interface"?What's the purpose of the client?
Some infos regarding your intention would be helpful.
-
@viragomann The purpose to make all home network going over this client. All PC's in LAN network to use this VPN client on pfsense before touch internet.
-
@antibiotic
So I assume, you connect to a VPN provider.
There is no special VPN gateway for this if the provider normally pushes default route to you, which is default behavior. Anyway, if it's already configured, you can leave it.But did you set the outbound NAT into the hybrid mode add a rule to the OpenVPN interface?
-
@viragomann Negative sir, any tutorial? I see in NAT hybrid mode but what kind of rule should add? Should I'm transfer to hybrid mode and save it?
-
@antibiotic check out https://docs.netgate.com/pfsense/en/latest/recipes/openvpn-s2s-route-internet-traffic.html I think itβs closer to what youβre looking for.
-
@antibiotic said in VPN client:
Negative sir, any tutorial?
You should ask this you VPN provider. Normally he should provide set up tutorials for certain clients.
Yes, an outbound NAT is needed. If you want to get details here, please come with your related settings first.
-
@viragomann My settings here but not working :
π Log in to view π Log in to view π Log in to view -
@antibiotic
This outbound NAT rule covers only access from pfSense itself. You need also one for your local network.So copy it by clicking the button at the right and change the source in the new rule to your LAN network 192.168.10.0/24.
-
@viragomann did but not workingπ Log in to view
-
@antibiotic said in VPN client:
did but not working
What does this mean?
No access to the internet?
Wrong WAN IP?Please give details!
-
@viragomann I have internet but , IP checking show me my real IP address not a VPN address.π Log in to view
-
@antibiotic
Please post Status > Gateways.
You may hide your WAN gw. -
-
@antibiotic
Well, the VPN gateway is not the default gateway. I assume, the connection is established, so there must be something wrong in the VPN client settings.
Can you post the "Tunnel Settings" section, please? -
-
@antibiotic
Remove the check at "Don't pull routes". It prohibits that the client can set the default route to the VPN provider. -
@viragomann Ops now start working))) Thanks you for assistance. But default gateway still my ISP provider( Status gateway), is it normally? Second question can I use squid proxy with VPN client for caching web or will not any profit or will not work? Should I remove in firewall LAN settings rule (Default allow LAN IPv4 to any rule)
-
@antibiotic said in VPN client:
But default gateway still my ISP provider( Status gateway), is it normally?
I think so. As far as I know, the default route is splited into two parts from OpenVPN, 0.0.0.0/1 and 128.0.0.0/1. So it's not determined as default route by pfSense.
See Diagnostic > routes
Second question can I use squid proxy with VPN client for caching web or will not any profit or will not work?
I don't use squid, so don't know. But I think, why not, it should be doable.
-
@viragomann Should I remove in firewall LAN settings rule (Default allow LAN IPv4 to any rule)
-
@antibiotic
Don't know, whats the suppose of your "local subnets" alias.
At the moment the default allow rule would pass any traffic with different source than "local subnets".A different source could be the case if you have a router within your local network like a VPN endpoint, which passes traffic trough.
But where will it get to? Since you obviously have a single LAN subnet, which might be included in the local subnets alias, the traffic could be go to the WAN or VPN at its best, but would fail then, since it is not natted (Outbound NAT source).