Firewall Rule to Allow LAN Transfers to Bypass VPN

jg2003

How do I create a firewall alias and rule to allow LAN transfers (static/private IP address to static/private IP address) to bypass the wireguard tunnel, but have the same IP addresses use the VPN gateway when accessing the internet?

I've seen several similar questions asked within this forum, but they seem to be focused on bypassing VPN traffic by IP for both LAN and WAN.

Thanks for your help.

johnpoz

@jg2003

https://docs.netgate.com/pfsense/en/latest/multiwan/policy-route.html

If you want to not use vpn for specific sorts of traffic the rule would go above the rule that sends traffic to your vpn.

This could be private or public destination IPs, or ports, protocols, etc.

jg2003

This is the FW Alias and Rule I created to :

Alias
Name: Non_VPN_LAN_Access
Type: Host(s)
IP of FQDN: 192.168.10.10 - Server LAN IP address (connected to BE9300 router by enternet cable)
IP of FQDN: 192.168.10.11 - Client LAN IP address (connected to BE9300 router by wifi)

Rule (LAN) (above the rule that sends traffic to the vpn)
Action: Pass
Interface: LAN
Address Family: IPv4
Protocol: TCP
Source: Address of Alias - Non_VPN_LAN_Access
Destination: Any
Gateway: Default

Something within these settings isn't correct. I haven't set a rule like this before so unsure what needs to be changed?

When the above rule is enabled, I can ping 1.1.1.1, but am unable to open a browser web page.

Besides needing help with the above Alias and Rule, I have some additional questions that I'm unsure of.

Is it even possible to have LAN transfers outside of the VPN, while at the same time doing a browser IP check and see my VPN server IP address?
How can I tell if LAN traffic is bypassing the VPN?

The main reason I'm trying to bypass the VPN for LAN traffic is that it's extremely slow, so trying to figure out a faster way to transfer files back and forth.

Any suggestions would be greatly appreciated.

btw, this is my network setup:

ISP Modem > pfSense Firewall > GL-iNet BE9300 Access Point > Ethernet and wifi devices

johnpoz

@jg2003 you understand lan traffic wouldn't even touch pfsense or vpn right.. Only time pfsense would come into play would be when you are routing between local networks or going out to the internet.

Your rule would not allow for ping, your bypass rule is tcp.

What about dns, etc. Could you post up a picture of your lan rules, and also do you have any rules in floating.

edit:
Also keep in mind many bad guides on the internet have you set your vpn as default.. You should make sure your default route is just out your wan, and then use a policy route to send traffic out your vpn.

When I get a chance will post up some example picture - got a work meeting in a few minutes.

But to get started here is example routing - where my normal wan is default, but there is a vpn gateway setup that I can route through via policy routing

johnpoz

@jg2003 So here I just created a rule to send traffic out my vpn - the wg_gateway

I have a rule above that which allows any traffic to rfc1918 network to not use the policy route out the vpn.

reserved4 is a built in table in newer pfsense that is all the rfc1918 space (10/8,192.168/16 and 172.16/12)

Any traffic you do not want to go out the vpn, create a rule above that rule that you want not go out the vpn above it., Be it based on source IP, destination IP, port or protocol..

You can see here my Public IP is now the IP of my vpn - my normal isp IP starts with 67. not the 209 you see. Also you can see on my rules there are states and traffic going through my local rule (above the vpn rule) and traffic and states using my vpn rule

Keep in mind that you might have to kill states to see your new traffic flow - because an existing state would use the existing connection it had before you put in the new policy route.

jg2003

@johnpoz said in Firewall Rule to Allow LAN Transfers to Bypass VPN:

@jg2003 you understand lan traffic wouldn't even touch pfsense or vpn right..
Yes this is a concern........

Your rule would not allow for ping, your bypass rule is tcp.
I haven't set up firewall rulles like this before so wasn't sure which settings to implement?

What about dns, etc. Could you post up a picture of your lan rules, and also do you have any rules in floating.
Using Proton DNS (which I believe is slowing my network down). No floating rules either.

edit:
You should make sure your default route is just out your wan, and then use a policy route to send traffic out your vpn.
I could definitely use help with the policy route for vpn traffic. Still learning my way around pfSense. However, I do prefer to use the vpn at all times for the encryption. Really just trying different scenarios to speed up pc to pc transfers as they are extremely slow.

jg2003

@johnpoz said in Firewall Rule to Allow LAN Transfers to Bypass VPN:

@jg2003 So here I just created a rule to send traffic out my vpn - the wg_gateway

I have a rule above that which allows any traffic to rfc1918 network to not use the policy route out the vpn.

reserved4 is a built in table in newer pfsense that is all the rfc1918 space (10/8,192.168/16 and 172.16/12)
I checked in Diagnostics/Tables but didn't see the reserved4 table you've mentioned. Was this just added in the latest update?

Any traffic you do not want to go out the vpn, create a rule above that rule that you want not go out the vpn above it., Be it based on source IP, destination IP, port or protocol..
Do you use an alias to define the IP's, are you using multiple IP's, or just using LAN subnets?

You can see here my Public IP is now the IP of my vpn - my normal isp IP starts with 67. not the 209 you see. Also you can see on my rules there are states and traffic going through my local rule (above the vpn rule) and traffic and states using my vpn rule
Are there security concerns with your local rule not being in the vpn tunnel?

Keep in mind that you might have to kill states to see your new traffic flow - because an existing state would use the existing connection it had before you put in the new policy route.
Are you referring to disabling and re-enabling the rules to kill the states?

johnpoz

@jg2003 not sure what your allows rules are suppose to be doing - they have never even triggered.

Clients almost never use dot (port 853).. They would use doh (443) if not just doing normal dns over 53. And ntp is never over tcp - it is always udp.

And your rule to allow internet without vpn isn't even enabled.

Where do your clients point to for dns - is it not just pfsense lan Ip normal dns (port 53). You browsers using doh (443)?

How does your rule to block internet but allow lan with what a single IP? Or is that a network - why would you not just use the built in lan subnets alias?

Why are you hiding rfc1918 addresses? Everyone uses them, they do not route on the internet... I use 192.168.9.0/24 for my lan - my pc is 192.168.9.100 - what could you do with that?

I can almost promise you when you setup your vpn they had you pull routes.. So now pfsense default route is out the vpn. I just looked at their guide - wg doesn't pull routes - but they have you set use non local gateway which forces all traffic out the vpn. And they have you set pfsense to use dns through the vpn.

Look at your pfsense routes - where is default pointing to?

This should be your isp gateway. Also they had you change your natting to manual.. Which only nats wg connection. So there is no way for you to just use a normal isp connection. Your outbound nat should be hybrid - with a rule to nat out your vpn for traffic going out your vpn.

What I would do is get your pfsense doing just normal traffic out your isp.. And then add your vpn to be used only for your policy routing. Your default route for pfsense should be out your normal isp, your clients should nat to your isp IP, etc. Then you can setup policy routing to send only the clients you want out the vpn.

Yes this is a concern........

How are local devices on your network talking to each other without talking to their gateway a concern? 192.168.0.100 talking to 192.168.0.101 would never route out your gateway or use any vpn setup on the gateway.

I normally don't route traffic out my vpn - the only reason I have it is for showing people how to do stuff.. As to reserved4 not sure if this was the current 26.07 or 2.9 that implemented that or before.. I normally just use my own alias for rfc1918 address space - but noticed it when setting up the policy routing to show you. You should keep your pfsense current.

As to killing states - no you don't need to disable or enable rules, just kill the states or all of them in the states table under diagnostics.

jg2003

@johnpoz said in Firewall Rule to Allow LAN Transfers to Bypass VPN:

@jg2003 not sure what your allows rules are suppose to be doing - they have never even triggered.
The 3 rules under 'Block Internet to Server' are from this Netgate post - https://forum.netgate.com/topic/200702/block-server-ip-address-but-allow-lan-access?_=1787920469445
I don't like leaving my server constantly exposed to the internet, so I wanted a way to use the server resources when needed, but block internet access to it. Overkill perhaps, but I got tired of pulling the ethernet cable out of the server often.

Clients almost never use dot (port 853).. They would use doh (443) if not just doing normal dns over 53. And ntp is never over tcp - it is always udp.
With the 3 rules enabled, I can access my server from within my network, but the server has no internet access and it works quite well. Are there better ways to accomplish this?

And your rule to allow internet without vpn isn't even enabled.
This rule wasn't configured correclty (wasn't working) so I disabled it until I could research how to implement it.

Where do your clients point to for dns - is it not just pfsense lan Ip normal dns (port 53). You browsers using doh (443)?
The pc I use is using nextdns, but what DNS should I be using in pfSense

How does your rule to block internet but allow lan with what a single IP? Or is that a network - why would you not just use the built in lan subnets alias?
I'm using a fw alias with 2 ip addresses in it. Per your recommendation, I can change it to lan subnets.

Why are you hiding rfc1918 addresses? Everyone uses them, they do not route on the internet... I use 192.168.9.0/24 for my lan - my pc is 192.168.9.100 - what could you do with that?
I'm don't have much experience in using pfSense. However, I'm figuring more out each day and want to get better at managing it. With that said, I didn't realize I was hiding rfc1918. Thanks for pointing this out and I will try to figure out how to correct this.

I can almost promise you when you setup your vpn they had you pull routes.. So now pfsense default route is out the vpn. I just looked at their guide - wg doesn't pull routes - but they have you set use non local gateway which forces all traffic out the vpn. And they have you set pfsense to use dns through the vpn.
Yes I did follow the proton wg guide. I prefer to keep all my network devices behind a vpn. Is there a better tutorial somewhere to set up a wg vpn for my internet traffic?

Look at your pfsense routes - where is default pointing to?
They are all over the place. No wonder I'm having issues.

This should be your isp gateway. Also they had you change your natting to manual.. Which only nats wg connection. So there is no way for you to just use a normal isp connection. Your outbound nat should be hybrid - with a rule to nat out your vpn for traffic going out your vpn.
I can change outbound to hybrid and work on the rules.

What I would do is get your pfsense doing just normal traffic out your isp.. And then add your vpn to be used only for your policy routing. Your default route for pfsense should be out your normal isp, your clients should nat to your isp IP, etc. Then you can setup policy routing to send only the clients you want out the vpn.
Thanks for this suggestion. I will go back to normal traffic, and run vpn on my individual devices until I can add the vpn to the policy routing as you've suggested.

How are local devices on your network talking to each other without talking to their gateway a concern? 192.168.0.100 talking to 192.168.0.101 would never route out your gateway or use any vpn setup on the gateway.

I normally don't route traffic out my vpn - the only reason I have it is for showing people how to do stuff.. As to reserved4 not sure if this was the current 26.07 or 2.9 that implemented that or before.. I normally just use my own alias for rfc1918 address space - but noticed it when setting up the policy routing to show you. You should keep your pfsense current.
I just updated to 2.9.0 and now see nat64reserved under tables.

As to killing states - no you don't need to disable or enable rules, just kill the states or all of them in the states table under diagnostics.
ok I understand, thanks

Although it will take me some time working through all your suggestions, they all make sense and I will work through it. Thanks for your recommendations.

johnpoz

@jg2003 said in Firewall Rule to Allow LAN Transfers to Bypass VPN:

are from this Netgate post - https://forum.netgate.com/topic/200702/block-server-ip-address-but-allow-lan-access?

Not really - clearly stated UDP for ntp - you have tcp.. Nowhere was DoT mentioned in that thread port 853. DNS on tcp/udp 53 mentioned.. etc..

I prefer to keep all my network devices behind a vpn.

Yet here you are asking how to bypass - And you still don't seem to understand that devices on the same network, ie your lan have zero use for a gateway (pfsense) and would never talk to the gateway to talk to a device on their same network - so how would your proton vpn ever come into play??

Pfsense is a router/firewall - it has zero to do with devices on the same network talking to each other.. So unless your also running the vpn client software on each device on your lan.. VPN has zero to do with 192.168.0.100/24 talking to 192.168.0.101/24

What it does do is ROUTE between networks - ie 192.168.0.0/24 and say 192.168.1.0/24, or 192.168.0.0/24 and say the internet.. It has nothing to do with devices on the same network talking to each other. And then apply firewall rules between these networks its routing between.

jg2003

You've been very helpful and I appreciate all you've suggested.

I will try to work through all of your recommendations.

I did find out why pc to pc transfers weren't working. I had enabled "Block private networks" with my protoninterface. Once I unchecked it, pc to pc file transfers are working well again.

As for my mistake of following the proton tutorial for setting up wireguard in pfsense, proton should have consulted with pfsense experts to come up with the best solution possible. I've seen a few posts within the netgate forum that have mentioned incorrect configurations with the proton wg instructions.

I will also read through the netgate wg overview and related documentation to help me understand it better.
https://docs.netgate.com/pfsense/en/latest/vpn/wireguard/index.html

At the moment, I do have some questions regarding the screenshot of your rfc 1918 lan fw rule.

This is how I have it setup:
Action: Pass
Interface: LAN
Address Family: IPv4
Protocol: Any
Source: LAN subnets
Destination: ?
Gateway: Default (which is WAN)

What is the private4 destination in your lan rule? Is it an fw alias with a protocol or ip address(es)? Could you please explain how this is set up?

Does the rest of my fw rule above look correct?

Also, what is the purpose of adding an underscore at the beginning/end (which is similar to the table nat64reserved)?

And in regards with switching from manual outbound nat to hybrid outbound nat, are there any changes that I need to be aware of?

Thanks again for helping me through this.

btw, I'm just an average computer user trying to learn pfsense and networking on my own through online tutorials and forums. I was surprised I even got pfsense working....

johnpoz

@jg2003 said in Firewall Rule to Allow LAN Transfers to Bypass VPN:

"Block private networks" with my protoninterface. Once I unchecked it, pc to pc file transfers are working well again.

So you are running proton on each pc? Not sure what your not uderstanding.. The proton running on pfsense only has to do with the internet traffic. Not when one1 device on your lan talks to another device on the lan

The pc I use is using nextdns

How would your pc then resolve the name of the other device on your lan?? Pretty sure nextdns has no clue to what the name of your pc resolves too. So you are accessing by IP?

For example my nas, who's fqdn is nas.home.arpa - how would nextdns resolve that to its local IP?

$ ping nas

Pinging nas.home.arpa [192.168.9.10] with 32 bytes of data:
Reply from 192.168.9.10: bytes=32 time<1ms TTL=64
Reply from 192.168.9.10: bytes=32 time<1ms TTL=64

This is search suffix at work, My client auto adds home.arpa - asks the dns on pfsense, hey what is the ip of nas.home.arpa and gets told 192.168.9.10 so my pc knows what IP to talk to.

yes reserved4 lists all the rfc1918 address space.

Ask pfsense why they use _ in the name - those are builtin aliases..

jg2003

Followed all of your suggestions and pfsense and my lan are working really well!

Thanks for your suggestion and sticking with me on this. It really helped me out!