Prevent Certain LAN ips from accessing WAN when OpenVPN goes down

[m3ki]

Alright I tried rules below.
If 192.168.1.5 -> VPN is enabled and vpn gateway is down. Traffic from 192.168.1.5 still flows to ISP.
If the rule is disabled then 192.168.1.5 cannot ping anything.

So it seems that the moment the traffic is redirected to VPN gateway rest of the routing table is skipped.

Any ideas?


[kejianshi]

Well - What ports are needed for DNS, OpenVPN and little things like that?
You could close everything on LAN, and only allow from LAN subnet to pfsense LAN IP (lets call it 192.168.1.1 for simplicity)

That would kill all traffic to the NET.

Then you could allow only that 1 port that openvpn needs out from LAN 192.168.1.5 to *.

That should do it.  One would think.

(Is the vpn client on the computer 192.168.1.5, or is pfsense the client?)
This is easier to do if the computer in question is the client and not pfsense as client.

[m3ki]

That's the thing the moment traffic is redirected to VPN Gateway every other rule seems to be skipped.

I am trying to wrap my head around this:
Policy Route Negation
When a firewall rule directs traffic into the gateway, it bypasses the firewall's normal routing table. Policy route negation is just a rule that passes traffic to other local or VPN-connected networks that does not have a gateway set. By not setting a gateway on that rule it will bypass the gateway group and use the firewall's routing table. These rules should be at the top of the ruleset – or at least above any rules using gateways.

Am I supposed to create another rule somewhere ?

[kejianshi]

I'd just make the computer the client directly and that solves so many issues.
If its a windows machine or a MAC, this is really easy.  If its some server, maybe not as easy.

[m3ki]

Haha yeah… that would be simpler.

What I want is:

Have 3x machines -> ISP
TV -> flow to US VPN
NAS -> Some other VPN

If OpenVPN links go down BLOCK TV and NAS from accessing outside world.
I did this with DDWRT before but I have no idea how to do this with PFsense. I must be missing something simple.

[kejianshi]

OK - I want to be sure about this, so I'll list a list of conditions.  Tell me which are true or false for you.

Your distant VPN server uses a fixed IP?

If your VPN drops you want everything connected to pfsense to not be able to access internet?

[m3ki]

@kejianshi:

OK - I want to be sure about this, so I'll list a list of conditions.  Tell me which are true or false for you.

Your distant VPN server uses a fixed IP?
NO It's dynamic. Using OpenVPN Client in pfsense

If your VPN drops you want everything connected to pfsense to not be able to access internet?
No only machines forwarded to VPN Gateway

[kejianshi]

In that case, not sure…  I'll be reading along and thinking about it a while.

[kejianshi]

You posted a screen shot above.  I cant see the whole page.  Can you repost the screen shot to include the interface tabs etc?

[m3ki]

Here you go


[m3ki]

This can easily be done using iptables I just don't know how to do it here.

Idea is mark packets to go to either one routing table or another. then if packet still arrives to unwanted interface drop it. I have my iptables rules in earlier  posts.

[kejianshi]

The rules, as they are now, pass everything.  For sure.  First you pass 192.168.1.5, and then you pass everything that isn't 192.168.1.5.
So, that everything.

For the first one, shouldn’t you specify a destination gateway?

[m3ki]

Yeah sorry I was doing some other tests to see here are the rules as they are now. OpenVPN gateway is down and I can still ping outside from 192.168.1.5


[kejianshi]

So, if you put in a rule immediately after the pass 192.168.1.5 to olive rule and you made it a block 192.168.1.5 to anywhere rule, I wonder what that would do?

Second what is the subnet the VPN is using?  I have 1 last question after this…

[m3ki]

Like so ?
Still lets traffic go though ISP.


[kejianshi]

If none of this works, I'm thinking this.

Traffic should go from 192.168.1.5 > some VPN subnet > WAN > VPN

(my understanding could be bad)

But, if you put a rule on the WAN to block any traffic that is source 192.168.1.5 and destination * that should block 192.168.1.5 when its not using VPN for sure.  Not sure if it will also block it when inside VPN also.  Never tried it.  Its easy to do, try and undo if needed.  Maybe try it.

If blocking 192.168.1.5 at the wan doesn't work or if it completely breaks 192.168.1.5 then I'm fresh out of unique and amazing ideas.

[m3ki]

Like so?
You would think this would work ;) So did I, I think this was the first think i tried.

anyway tried it again same thing.


[kejianshi]

Just an idle question?  Do you have a floating rule that says pass anything to anything because this is getting strange?
And are you sure the computer in question's IP is actually 192.168.1.5?

[m3ki]

hehe..
no but I have block source 192.168.1.5 to anywhere. Doesnt work either.

[kejianshi]

So, its going to the VPN as a gateway and then that gateway is sending to the openweb when the vpn fails.

Maybe make a rule on the WAN that blocks anything from source interface BOLEVPN that isn't on that one port that openvpn needs.

This isn't multi-public-IP system right?  Just 1 WAN?

[m3ki]

I really hoped that would work but no :(
It seems the rules are being bypassed and traffic just jumps to VPN gateway.

[kejianshi]

Did you apply some rules to the firewall outside the gui using command line?

[m3ki]

No I don't. I haven't gotten that desperate yet :D I am hoping someone who made pfSense would be able to shed some light on this.

[m3ki]

What does this mean: (from the docs)
Policy Route Negation
When a firewall rule directs traffic into the gateway, it bypasses the firewall's normal routing table. Policy route negation is just a rule that passes traffic to other local or VPN-connected networks that does not have a gateway set. By not setting a gateway on that rule it will bypass the gateway group and use the firewall's routing table. These rules should be at the top of the ruleset – or at least above any rules using gateways.

[kejianshi]

It just means that when you send LAN traffic to VPN as gateway it does an end run around the rest of pfsense rules and that if no gateway is stipulated it will use a default gateway.  Also says these rules belong at the top, which is where you have them.

Doesn't explain to me how to get a down VPN to cease and desist passing traffic.

BLOCK TRAFFIC WHEN VPN IS DOWN would be a great option to add to client VPN settings…

[m3ki]

Well I specified option in vpn client not to route traffic by default. Because by default it would add a rule to force stuff into vpn. That's why policy based routing works. I can throw stuff at vpn as needed.

Is there another way to mark packets to go to that gateway?

[kejianshi]

I don't know that that would fix your problems.  No matter how the traffic arrives at the VPN gateway it seems it might get to the WEB unless the VPN blocks traffic when down.  An easy fix would be to run those devices off a second small device that acts as a VPN client, like a small DD-WRT router instead of using pfsense as VPN client.  Then you could easily block any traffic not on a VPN port.  Short of that, I guess we have to wait for answer from ubber genius more than us…

[m3ki]

ok….. so I feel stupid now :)

I may have some progress now.

I have reread the other post over an over so it seems to somewhat work...
I still forward packets to VPN GW but also added DO NOT NAT rule for 192.168.1.5 on WAN. This seems to do the trick but I don't think it's right packets should theoretically go out. How do I drop them?

Status now if VPN is up olive goes through VPN properly.
If VPN is down Olive cannot ping google.


[kejianshi]

I wouldn't feel stupid - I didn't think to try killing it there in outbound NAT.  Nice.

[m3ki]

:) Yeah but stuff still goes out and isp still dropping it I assume. I have to drop it at the firewall.
I wish there was a book on pfsense with some diagram on how packets traverse the firewall.

[panz]

@m3ki:

the rule I used was…
Anything on WAN interface, Direction OUT,coming from 192.168.1.5 - to Anywhere BLOCK <--- this didnt work.
I also tried same as above going to WAN Subnet. that didnt work either.

I've setup the following rule, works perfectly:
Firewall: Rules –> Floating tab

IMPORTANT: it's NOT a quick rule!
Action: Block
Interface: WAN
Direction: any <-- (if set to OUT, it doesn't work!)
Source : any [here you need to enter 192.168.1.5]
Destination: any
[_/] Log packets that are handled by this rule
Description: FLOAT01_NO_INTERNET_IF_AIRVPN_IS_DOWN

[Nadar]

To my surprise I just tested this and can confirm the problem on 2.1 RC1. I also use policy routing, not default gateway, to route the VPN traffic, and I have nothing else that passes traffic for packets coming from "VPN subnet". It's seems clear to me that the "pass" on the LAN rule is a match for "pass" and thus no further rules are processed and no more consideration is made to whether that packet should be allowed. What I don't understand is why pfSense fall back to the routing table when the policy routing doesn't work. I can see that this could be wanted behaviour in some cases, but certainly not in all (it could for example route bandwith intensive traffic down an expensive link when the cheap link went down). I disagree that this should be an option in the VPN client, I'd rather have the chance to decide this on a per (policy routing) rule basis.

I havent tested with a floating block rule like panz suggests, but if that indeed works it makes me even more interested to get a detailed explanation to how and when firewall rules are processed. Are the floating rules processed before or after the interface rules, and are they processed several times for a single packet (that is for each interface it passes)? I've yet to find a detailed explanation for this, but I'm sure it must exist here somewhere? It's hard to design rules when you're not sure how they are processed.

[panz]

@Nadar:

Are the floating rules processed before or after the interface rules, and are they processed several times for a single packet (that is for each interface it passes)? I've yet to find a detailed explanation for this, but I'm sure it must exist here somewhere? It's hard to design rules when you're not sure how they are processed.

Floating rules are processed before the others.

All others interface rules are processed top –> down with the condition: first match = stop processing (so, if a packet matches the rules it encountered, further processing is halted).

One thing to consider is stateful inspection: if a packet is a reply to a legitimate one (= reply packet is matching the table) then it is allowed.

See "Firewalling with OpenBSD's PF packet filter" http://home.nuug.no/~peter/pf/en/

[FastLaneJB]

Hi all,

This has also been bugging me for a while and I'd just given up but with the event of 2.1 final I decided to reload my firewall from scratch and have another go. Tried a few of the suggestions in this thread that hadn't occured to me before but nothing seemed to work. However I believe I've cracked it in my limited testing and once you see why, the answer is obvious :)

Go to Advanced and then Miscellaneous and down in Gateway Monitoring you'll see "Skip rules when gateway is down" which on my fresh 2.1 install is off by default. It has the following description.

"By default, when a rule has a specific gateway set, and this gateway is down, rule is created and traffic is sent to default gateway.This option overrides that behavior and the rule is not created when gateway is down"

So basically when the VPN Gateway is down it puts the rule in but with the default gateway ruining the whole point.

With this ticked I then set the "Default allow LAN to any rule" and "Default allow LAN IPv6 to any rule" to run if Source is NOT my VPN Alias.

So now those hosts have Internet when the VPN is up via the VPN. When it goes down they lose Internet completely.

Hope this helps others. Took a while to figure it out.

[Nadar]

Great find FastLaneJB! I simply enabled this (I have a "VPN source net" instead of a VPN source alias - with no default allow rule), and it seems to behave largely as wanted. I do however still get some traffic to and from my "VPN source net" a while after taking down the VPN, but I haven't properly investigated the cause. It could have several reasons, not necessarily related to pfSense, and I'll have to take a closer look to figure out exactly what's happening.

[Annasdaddy]

thanks to fastlane and everyone else for the information.  Unfortunately, this doesnt seem to work for me.

I am trying to block all LAN traffic when my VPN goes down, and am about ready to drive myself crazy.

Anyone have any thoughts?

cheers

[panz]

@FastLaneJB:

Hi all,

This has also been bugging me for a while and I'd just given up but with the event of 2.1 final I decided to reload my firewall from scratch and have another go. Tried a few of the suggestions in this thread that hadn't occured to me before but nothing seemed to work. However I believe I've cracked it in my limited testing and once you see why, the answer is obvious :)

Go to Advanced and then Miscellaneous and down in Gateway Monitoring you'll see "Skip rules when gateway is down" which on my fresh 2.1 install is off by default. It has the following description.

"By default, when a rule has a specific gateway set, and this gateway is down, rule is created and traffic is sent to default gateway.This option overrides that behavior and the rule is not created when gateway is down"

So basically when the VPN Gateway is down it puts the rule in but with the default gateway ruining the whole point.

With this ticked I then set the "Default allow LAN to any rule" and "Default allow LAN IPv6 to any rule" to run if Source is NOT my VPN Alias.

So now those hosts have Internet when the VPN is up via the VPN. When it goes down they lose Internet completely.

Hope this helps others. Took a while to figure it out.

This doesn't solve 2 problems.

1. DNS leaks. The pfsense firewall itself will send out DNS queries even if your method is applied;

2. this method doesn't allow the creation of automated rules for VPN traffic itself so, for example, Amazon S3 won't work or will work intermittently, being "caught" by the default deny IPv4/IPv6 rule.

[Nadar]

@panz:

This doesn't solve 2 problems.

1. DNS leaks. The pfsense firewall itself will send out DNS queries even if your method is applied;

2. this method doesn't allow the creation of automated rules for VPN traffic itself so, for example, Amazon S3 won't work or will work intermittently, being "caught" by the default deny IPv4/IPv6 rule.

I don't see the relevance of your "problems" and this thread. The thread title is "Prevent Certain LAN ips from accessing WAN when OpenVPN goes down", and the way I understand that is that it's about preventing pfSense from rerouting policy routed traffic to the default gateway once the "policy routed gateway" becomes unavailable, and as such it seems spot on.

Regarding 1) That depends on how you configure your network. If you configure the client(s) in question to solely use VPN provided DNS servers, this DNS traffic will also cease when the VPN goes down. I don't know why you would want pfSense itself, or the DNS forwarder, to loose DNS connectivity in that situation, but if that's what you want you could probably also configure them to only use the VPN provider's DNS.

2. I don't even understand what you mean or how you create automated rules for VPN traffic, but provided that these automated rules were created correctly this solution should apply to them as well.

[panz]

@Nadar:

I don't see the relevance of your "problems" and this thread. The thread title is "Prevent Certain LAN ips from accessing WAN when OpenVPN goes down", and the way I understand that is that it's about preventing pfSense from rerouting policy routed traffic to the default gateway once the "policy routed gateway" becomes unavailable, and as such it seems spot on.

I think that all of us are using a VPN for privacy and security, so preventing DNS leaks is a matter we should deal with.

See https://redmine.pfsense.org/issues/753

@Nadar:

2. I don't even understand what you mean or how you create automated rules for VPN traffic, but provided that these automated rules were created correctly this solution should apply to them as well.

Perhaps you should take a look at your /tmp/rules.debug  ::)

[archedraft]

I also have my WAN send data through OpenVPN. After about 5 days the VPN goes down and then stops all traffic (which is preferred). Is there a way for pfsense to detect that the VPN connect is down and then automatically restart the service? or maybe there is a way to have a rule that restarts the VPN connection every 3 days?