OpenVPN, with vyprvpn

[Tango]

Ok I am new to OpenVPN but I have been using pfsense for sometime, so forgive me if this is dead obvious.

My end goal is to have lan traffic on specific ports or to specific hosts route via OpenVPN.

So I read http://forum.pfsense.org/index.php?topic=35292.0 and the links in the forum

This has taken me to a point, according to the OpenVPN client screen

Name                     Status Connected Since                 Virtual Addr     Remote Host   Bytes Sent Bytes Received
vypr_vpn UDP:50011 up Tue May 10 21:06:23 2011 xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx 597746 480295

The last log entries show
May 11 11:58:52 openvpn[14307]: MANAGEMENT: Client disconnected
May 11 11:58:52 openvpn[14307]: MANAGEMENT: CMD 'status 2'
May 11 11:58:52 openvpn[14307]: MANAGEMENT: CMD 'state 1'
May 11 11:58:52 openvpn[14307]: MANAGEMENT: Client connected from /var/etc/openvpn/client1.sock

Nothing I seem to do in the firewall rules will make traffic route via OpenVPN, but I am not sure if it is just me not getting the rule correct or is related to those messages in the logs.

TIA

[GruensFroeschli]

Could you show a screenshot of the firewall rules you use to redirect traffic to the OpenVPN tunnel?

Did you assign the OpenVPN interface?
Did you create outbound NAT rules for the assigned OpenVPN interface?

[Tango]

Ok here is what I have so far.

http://www.tangerine-army.co.uk/vpn_int.jpg
http://www.tangerine-army.co.uk/gateway.jpg
http://www.tangerine-army.co.uk/pf_rules.jpg
http://www.tangerine-army.co.uk/int_sum.jpg

[GruensFroeschli]

I suppose you don't control the other side of the tunnel?
If you do, you have to add routes on the other side for the subnet on your local side.

If you don't:
You need to enable outbound NAT (firewall –> NAT --> outbound --> manual rule generation)
and create a rule with as interface the OpenVPN interface, source: wherever you're connecting from, destination: where you're connecting to (216.196.109.144).

[Tango]

I tried the your suggestion, initially nothing seemed to change, a restart of the OpenVPN service and boom there is now a IP address on the VPN Interface, something that it had never done before. However everything seems to be going via the VPN. Here is what I have set so far
http://www.tangerine-army.co.uk/aon.jpg

[GruensFroeschli]

This refers to "redirecting" traffic.
You are just NATing from interface to another.
The new rule looks right.

How do you determine that traffic is leaving via WAN?
Is the tunnel actually comming up correctly?
Can you ping from the pfSense itself the other side of the tunnel?

[Tango]

If I try to access www.bbc.co.uk it gives me the International version of the page, and not the localised version to the UK, also newsgroups run at full speed, which they would not do as my ISP throttles that traffic from 5pm onwards. So I can be fairly sure the tunnel is up and routing traffic ok.

Traceroute output:

1  10.9.0.1 (10.9.0.1)  70.076 ms  28.298 ms  27.524 ms
2  192.168.32.1 (192.168.32.1)  37.156 ms  29.530 ms  28.034 ms
3  vl307.gw1.ams.giganews.com (216.196.108.242)  28.278 ms  61.420 ms  45.326 ms
4  rt-amsix.tcams.bbc.co.uk (195.69.144.169)  29.823 ms  49.721 ms  29.445 ms
5  rt1.thdo.bbc.co.uk (212.58.239.45)  40.390 ms  36.354 ms  57.183 ms
6  212.58.238.38 (212.58.238.38)  54.758 ms  36.759 ms  69.710 ms
7  212.58.239.62 (212.58.239.62)  36.860 ms  42.856 ms  37.561 ms
8  212.58.251.44 (212.58.251.44)  63.978 ms  36.006 ms  56.095 ms
9  bbc-vip116.telhc.bbc.co.uk (212.58.244.71)  43.593 ms  40.037 ms  36.375 ms

As for the traffic leaving via the WAN, the install of pfsense was just out of the box, I had not done anything aside from a few port forwards.

[Tango]

Still not much further forward, I am guessing I need rules to send traffic to the WAN rather than the VPN but as to the specifics of such rules I am not quite sure.