Difference between Interface subnet and 192.168.2.0/24
-
Its not the adding of physical interfaces that confuses me.
The thing that confuses me is that I've always been able to firewall my pfsense road warriors just fine from the Openvpn firewall tab without the addition of an interface for their subnet.
So, what I'm wondering is was that interface necessary at all?
You have to assign an interface if you want to filter pfsense-as-client and pfsense-as-server VPN traffic separately. And for NATting too. search the forum for instructions on how to set pfsense as an Open VPN client to a VPN provider :)
-
If you run pfSense as server and pfSense as client you don't necessarily need to assign the interfaces.
The openVPN tab is basically a predefined interface group containing all openVPN interfaces even if they are not assigned.
With a few openVPN instances the ruleset becomes one big mess pretty fast. Good luck debugging.
Assigning the openVPN interface simply allows you to seperate the rules logically for different virtual interfaces.If you want to do NAT magic (outbound NAT) or run certain services on a VPN interface (igmp proxy) you need to assign them.
Otherwise you don't have the option in the various places to select the interface in the dropdown. -
Yeah - I have probably just never had a use scenario that required me to create an interface separately from the openvpn default interface.
-
Moreover, when you assign interfaces to single ovpn tun, you have to disable all the rules in the OpenVPN firewall tab. In the docs is explained that, even if you set the rules for the assigned ovpn interfaces, the rules in the OpenVPN tab STILL APPLY.
So, when you create a roadwarrior setup, the auto rule creation sets a rule to allow all in . This is totally unacettable if you have, like my setup, an OpenVPN = WAN (Internet).
