Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Prevent Certain LAN ips from accessing WAN when OpenVPN goes down

    Scheduled Pinned Locked Moved OpenVPN
    52 Posts 11 Posters 27.9k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • P
      phil.davis
      last edited by

      The advice from cmb should work - http://forum.pfsense.org/index.php/topic,58694.msg315225.html#msg315225
      Post your "quick floating rule matching out on WAN" and we can try to sort out the detail of it.

      As the Greek philosopher Isosceles used to say, "There are 3 sides to every triangle."
      If I helped you, then help someone else - buy someone a gift from the INF catalog http://secure.inf.org/gifts/usd/

      1 Reply Last reply Reply Quote 0
      • M
        m3ki
        last edited by

        Hi Phil,

        Thank you for your reply!
        I am not at home at the moment.

        But the rule I used was…
        Anything on WAN interface, Direction OUT,coming from 192.168.1.5 - to Anywhere BLOCK <--- this didnt work.
        I also tried same as above going to WAN Subnet. that didnt work either.

        I tried packet capture and it seems that I only see my pings coming from 192.168.1.5 on LAN I am not sure if that helps.

        Is there a documentation/diagram anywhere displaying how packets are traversed and in which order rules are applied?

        Ig.

        1 Reply Last reply Reply Quote 0
        • GruensFroeschliG
          GruensFroeschli
          last edited by

          Firewall rules are always applied to to down.
          Firewall rules are always applied on the interface on which they come in (well, floating rules are an exception, but these are more complicated)
          .
          So to block traffic for your 192.168.1.5 on the LAN interface, you need to add the block rule on the LAN interface.

          Now i'm not sure but i suspect that since your VPN interface is down, the rule which redirects traffic for your client doesn't apply anymore (don't take my word on this, i'm really not sure).

          What i would do:

          • Create an alias containing all your "is only allowed via VPN" clients. (Firewall–>Aliases). Lets call it VPN_USERS
          • Change your redirect rule to: "source: VPN_USERS, gateway: VPN_gateway"
          • Change the default allow all rule to: "source: NOT VPN_USERS"

          In The end you would have 2 rules:
          1: rule to allow VPN_USERS to the VPN, which forces traffic directly to the VPN gateway
          2: rule to allow everyone except the VPN_USERS to wherever the routing table allows.

          We do what we must, because we can.

          Asking questions the smart way: http://www.catb.org/esr/faqs/smart-questions.html

          1 Reply Last reply Reply Quote 0
          • M
            m3ki
            last edited by

            Ahah ok that makes sense I guess it's possible I have to try that when I get home.

            I tried this last night and it didnt work.
            ALLOW source: 192.168.1.5, gateway: VPN_gateway <–- i assumed this would be skipped if vpn gateway is down.
            BLOCK source: 192.168.1.5, anywhere < --- and this would be triggered
            ALLOW source: lan, *

            Is there a way to see which rules which packet hits?

            1 Reply Last reply Reply Quote 0
            • P
              phil.davis
              last edited by

              On 2.1-RC1 the firewall log lets you display the rule number and description of the packets logged.
              (I suspect that is new to 2.1, so won't be in 2.0.n - it is quickly getting to the point where 2.1 needs to get released and everyone upgrade, then we can all forget about what features might or might not be in 2.0.n)

              As the Greek philosopher Isosceles used to say, "There are 3 sides to every triangle."
              If I helped you, then help someone else - buy someone a gift from the INF catalog http://secure.inf.org/gifts/usd/

              1 Reply Last reply Reply Quote 0
              • M
                m3ki
                last edited by

                Is there a way to definitively know that a rule gets skipped if  VPN_gateway is down?

                since this didnt work.
                IN LAN TAB
                ALLOW source: 192.168.1.5, gateway: VPN_gateway <–- i assumed this would be skipped if vpn gateway is down and would go to next rule.
                BLOCK source: 192.168.1.5, anywhere < --- and this would be triggered
                ALLOW source: lan, *

                1 Reply Last reply Reply Quote 0
                • M
                  m3ki
                  last edited by

                  Alright I tried rules below.
                  If 192.168.1.5 -> VPN is enabled and vpn gateway is down. Traffic from 192.168.1.5 still flows to ISP.
                  If the rule is disabled then 192.168.1.5 cannot ping anything.

                  So it seems that the moment the traffic is redirected to VPN gateway rest of the routing table is skipped.

                  Any ideas?

                  ![Screen Shot 2013-08-09 at 6.10.24 PM.png](/public/imported_attachments/1/Screen Shot 2013-08-09 at 6.10.24 PM.png)
                  ![Screen Shot 2013-08-09 at 6.10.24 PM.png_thumb](/public/imported_attachments/1/Screen Shot 2013-08-09 at 6.10.24 PM.png_thumb)

                  1 Reply Last reply Reply Quote 0
                  • K
                    kejianshi
                    last edited by

                    Well - What ports are needed for DNS, OpenVPN and little things like that?
                    You could close everything on LAN, and only allow from LAN subnet to pfsense LAN IP (lets call it 192.168.1.1 for simplicity)

                    That would kill all traffic to the NET.

                    Then you could allow only that 1 port that openvpn needs out from LAN 192.168.1.5 to *.

                    That should do it.  One would think.

                    (Is the vpn client on the computer 192.168.1.5, or is pfsense the client?)
                    This is easier to do if the computer in question is the client and not pfsense as client.

                    1 Reply Last reply Reply Quote 0
                    • M
                      m3ki
                      last edited by

                      That's the thing the moment traffic is redirected to VPN Gateway every other rule seems to be skipped.

                      I am trying to wrap my head around this:
                      Policy Route Negation
                      When a firewall rule directs traffic into the gateway, it bypasses the firewall's normal routing table. Policy route negation is just a rule that passes traffic to other local or VPN-connected networks that does not have a gateway set. By not setting a gateway on that rule it will bypass the gateway group and use the firewall's routing table. These rules should be at the top of the ruleset – or at least above any rules using gateways.

                      Am I supposed to create another rule somewhere ?

                      1 Reply Last reply Reply Quote 0
                      • K
                        kejianshi
                        last edited by

                        I'd just make the computer the client directly and that solves so many issues.
                        If its a windows machine or a MAC, this is really easy.  If its some server, maybe not as easy.

                        1 Reply Last reply Reply Quote 0
                        • M
                          m3ki
                          last edited by

                          Haha yeah… that would be simpler.

                          What I want is:

                          Have 3x machines -> ISP
                          TV -> flow to US VPN
                          NAS -> Some other VPN

                          If OpenVPN links go down BLOCK TV and NAS from accessing outside world.
                          I did this with DDWRT before but I have no idea how to do this with PFsense. I must be missing something simple.

                          1 Reply Last reply Reply Quote 0
                          • K
                            kejianshi
                            last edited by

                            OK - I want to be sure about this, so I'll list a list of conditions.  Tell me which are true or false for you.

                            Your distant VPN server uses a fixed IP?

                            If your VPN drops you want everything connected to pfsense to not be able to access internet?

                            1 Reply Last reply Reply Quote 0
                            • M
                              m3ki
                              last edited by

                              @kejianshi:

                              OK - I want to be sure about this, so I'll list a list of conditions.  Tell me which are true or false for you.

                              Your distant VPN server uses a fixed IP?
                              NO It's dynamic. Using OpenVPN Client in pfsense

                              If your VPN drops you want everything connected to pfsense to not be able to access internet?
                              No only machines forwarded to VPN Gateway

                              1 Reply Last reply Reply Quote 0
                              • K
                                kejianshi
                                last edited by

                                In that case, not sure…  I'll be reading along and thinking about it a while.

                                1 Reply Last reply Reply Quote 0
                                • K
                                  kejianshi
                                  last edited by

                                  You posted a screen shot above.  I cant see the whole page.  Can you repost the screen shot to include the interface tabs etc?

                                  1 Reply Last reply Reply Quote 0
                                  • M
                                    m3ki
                                    last edited by

                                    Here you go

                                    ![Screen Shot 2013-08-09 at 7.12.12 PM.png](/public/imported_attachments/1/Screen Shot 2013-08-09 at 7.12.12 PM.png)
                                    ![Screen Shot 2013-08-09 at 7.12.12 PM.png_thumb](/public/imported_attachments/1/Screen Shot 2013-08-09 at 7.12.12 PM.png_thumb)

                                    1 Reply Last reply Reply Quote 0
                                    • M
                                      m3ki
                                      last edited by

                                      This can easily be done using iptables I just don't know how to do it here.

                                      Idea is mark packets to go to either one routing table or another. then if packet still arrives to unwanted interface drop it. I have my iptables rules in earlier  posts.

                                      1 Reply Last reply Reply Quote 0
                                      • K
                                        kejianshi
                                        last edited by

                                        The rules, as they are now, pass everything.  For sure.  First you pass 192.168.1.5, and then you pass everything that isn't 192.168.1.5.
                                        So, that everything.

                                        For the first one, shouldn’t you specify a destination gateway?

                                        1 Reply Last reply Reply Quote 0
                                        • M
                                          m3ki
                                          last edited by

                                          Yeah sorry I was doing some other tests to see here are the rules as they are now. OpenVPN gateway is down and I can still ping outside from 192.168.1.5

                                          ![Screen Shot 2013-08-09 at 7.20.11 PM.png](/public/imported_attachments/1/Screen Shot 2013-08-09 at 7.20.11 PM.png)
                                          ![Screen Shot 2013-08-09 at 7.20.11 PM.png_thumb](/public/imported_attachments/1/Screen Shot 2013-08-09 at 7.20.11 PM.png_thumb)

                                          1 Reply Last reply Reply Quote 0
                                          • K
                                            kejianshi
                                            last edited by

                                            So, if you put in a rule immediately after the pass 192.168.1.5 to olive rule and you made it a block 192.168.1.5 to anywhere rule, I wonder what that would do?

                                            Second what is the subnet the VPN is using?  I have 1 last question after this…

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.