Setup Policy Based Routing and Multi VPN That Stop Certain IP's from Internet

[archedraft]

How to use Policy Based Routing and Multi VPN

1. Make 2 VPN clients

• I Followed this guide http://www.komodosteve.com/archives/232

• NOTES: I used the same server port for both VPN's

• NOTES: I added the following commands into Advanced Config (When pfSense first boots it will randomly pick of the the 3 VPN_IP's

• SCREENSHOT: OpenVPN Client 1

• SCREENSHOT: OpenVPN Client 2

remote_VPN IP_#1 Port#;
remote VPN_IP_#2 Port#;
remote VPN_IP_#3 Port#;
remote-random;

2. Check to make sure you have three gateways: System -> Routing - Gateways (WAN_HDCP, USA VPN, EU VPN)

• SCREENSHOT: System Gateways

3. Next go to Firewall -> Aliases

• This is where you will setup two aliases for the USA VPN's and EU VPN's

• Make sure you have static IP address for the machines

4. Next go to Firewall -> Rules -> Lan

• I made 3 rules (1 that redircts the EU vpn through the EU gateway, 1 that redirects the US vpn through the US gateway, and 1 that selects every other IP address not specified in aliases and sends it to the defualt WAN gateway)

• Proto: ANY, Source: Alias, Gateway: VPN

• SCREENSHOT: Firewall Rules 1

• SCREENSHOT: Firewall Rules 2

5. Next go to Firewall -> NAT -> Outbound

• First delete all rules

• Select "Automatic outbound NAT rule generation" and click save

• Select "Manual Outbound NAT rule generation" and click save

• This should auto created any rules needed for the VPN's

• Now create a rule that will stop traffic if the VPN is down

• Click "Do not NAT", Interface "WAN", Protocol "any", Source "Alias"

• MAKE SURE you move the rule to the top of the list as pfsense carries out rules from top down

• SCREENSHOT: Firewall NAT Outbound 1

• SCREENSHOT: Firewall NAT Outbound 2

5. Next to go Firewall -> Rules -> Floating Rules

• Action "Block", Interface "WAN", Direction "any", Protocol "any", Source "alias"

• SCREENSHOT: Firewall Rules Floating 1

• SCREENSHOT: Firewall Rules Floating 2

• This along with with #5  will block your machine from going to internet

Special thanks to m3ki for all the help
http://forum.pfsense.org/index.php/topic,68191.30.html
http://forum.pfsense.org/index.php/topic,65331.0.html

[archedraft]

More Screenshots


[archedraft]

More Screenshots


[archedraft]

More Screenshots


[archedraft]

More Screenshots