Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    OpenVPN Kill Switch

    Scheduled Pinned Locked Moved OpenVPN
    21 Posts 13 Posters 18.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • luckman212L
      luckman212 LAYER 8
      last edited by

      I'd actually like to see a screenshot of how this is configured myself, if anyone can post one!

      1 Reply Last reply Reply Quote 0
      • Y
        YoMan
        last edited by

        I am also very interested to know how this is set up, if someone could explain how to ensure that the only the VPN is allowed through he WAN that would be greatly appreciated. =)

        1 Reply Last reply Reply Quote 0
        • DerelictD
          Derelict LAYER 8 Netgate
          last edited by

          Firewall > Rules, Floating tab

          Action: Pass
          Disabled: unchecked
          Quick: checked
          Interface: WAN
          Direction: out
          TCP/IP Version: IPv4
          Protocol: UDP
          Source: any
          Destination: any
          Destination port range: 1194

          Then below that rule:

          Action: Reject
          Disabled: unchecked
          Quick: checked
          Interface: WAN
          Direction: out
          TCP/IP Version: IPv4
          Protocol: any
          Source: any
          Destination: any
          Destination port range: any

          That will allow outbound connections to any server on UDP 1194 and block everything else.  You could limit the destination IP to just your VPN server's IP with a destination of single host or alias.  Naturally, if you do not connect on UDP 1194 you will need to adjust the Pass rule.  You will not be able to resolve DNS or anything out WAN with these rules in place.  All traffic except UDP 1194 will be blocked.

          Chattanooga, Tennessee, USA
          A comprehensive network diagram is worth 10,000 words and 15 conference calls.
          DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
          Do Not Chat For Help! NO_WAN_EGRESS(TM)

          1 Reply Last reply Reply Quote 1
          • Y
            YoMan
            last edited by

            Thank you very much. I got it working!

            1 Reply Last reply Reply Quote 0
            • Y
              YoMan
              last edited by

              Ok so I thought it was working, well its half working.  So Im using UDP port 1126 for my VPN.  Anyways I realized that if I block any on protocol, my VPN cant connect for some reason even though pass UDP 1126 is the first rule.  Is there any reason why the openvpn would be using some other port/protocol to initiate connection?

              1 Reply Last reply Reply Quote 0
              • DerelictD
                Derelict LAYER 8 Netgate
                last edited by

                Is quick checked on the pass rule on UDP/1126 on WAN out?  The source should be any any, the dest should be any UDP/1126.  The dest IP address could optionally be your remote server IP address to further limit the rule.

                Chattanooga, Tennessee, USA
                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                1 Reply Last reply Reply Quote 0
                • Y
                  YoMan
                  last edited by

                  Yes quick is checked on both the pass rule and the block rule.

                  Here is a screenshot of both my rules.
                  https://imgur.com/Z9ywGxZ,6vAzcwq#0

                  The order on my floating rules is the Pass rule is on top, block rule is 2nd.

                  Now the issue is if I turn off the block rule, then I can connect to my VPN, I can at that point re-enable the block rule and my VPN stays connected and all is good. But if the block rule is enabled and I lose my VPN connection and it needs to reconnect, it cannot do so.  I just dont want to have to manually come into pfsense each time it loses connection to turn on and off the firewall rules to reconnect.

                  Does OpenVPN require some other port to do the initializing sequence or something?

                  1 Reply Last reply Reply Quote 0
                  • DerelictD
                    Derelict LAYER 8 Netgate
                    last edited by

                    Like I said in my original post, you won't be able to do ANYTHING but connect to the VPN.  If you are using a hostname instead of IP address for the VPN server you probably won't be able to resolve it, etc.  You might very well have to pass some other things (like DNS) in order to get it to work.  I don't know how paranoid you are about DNS leakage, etc.  Most people seem to be all wrapped around the axle about it when it really doesn't matter if all you're trying to do is watch TV from another location.

                    ETA: Note that the DNS servers used by the firewall and the DNS servers given to your client hosts to use don't have to be the same.  You could configure the rules to allow connections to your ISP DNS servers, and put those in the DNS server settings for pfSense to use (System > General Setup) but tell your client hosts to use DNS servers provided by your VPN provider.  The latter DNS servers would only be reachable if the VPN is up.

                    Chattanooga, Tennessee, USA
                    A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                    DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                    Do Not Chat For Help! NO_WAN_EGRESS(TM)

                    1 Reply Last reply Reply Quote 0
                    • Y
                      YoMan
                      last edited by

                      Ok so I have changed the VPN address to the IP address instead of the name.  It appears to allow connection now with the firewall rules in place.  Is there any disadvantage to using the actual IP rather then the name?  I used the DNS reverse lookup to find it and it appears there are 4 seperate IPs can all link to the same address. I just picked one.

                      1 Reply Last reply Reply Quote 0
                      • DerelictD
                        Derelict LAYER 8 Netgate
                        last edited by

                        If they change IPs it will break.  I'd pass DNS correctly.  It could break all kinds of things eventually like downloading bogon table updates, upgrades, etc.  Your firewall should be able to resolve DNS.

                        Chattanooga, Tennessee, USA
                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                        1 Reply Last reply Reply Quote 0
                        • H
                          heper
                          last edited by

                          @Derelict:

                          If they change IPs it will break.  I'd pass DNS correctly.  It could break all kinds of things eventually like downloading bogon table updates, upgrades, etc.  Your firewall should be able to resolve DNS.

                          exactly copy your openvpn rule and adjust it to work for DNS. pfsense webgui can/will go nuts without DNS :))

                          1 Reply Last reply Reply Quote 0
                          • S
                            stewie2016
                            last edited by

                            Will this configuration pass DNS outside of the VPN only for resolving the VPN host address when connecting to VPN (or when automatically re-connecting to VPN after an unplanned disconnection), and otherwise pass all other DNS through the VPN?

                            1 Reply Last reply Reply Quote 0
                            • O
                              OyyoDams
                              last edited by

                              Hi,

                              I don't like the floating rules trick because when the VPN goes down, it cannot reconnect anymore, blocked by the rule. But there is a workaround. Take a look at this post

                              Go to Advanced and then Miscellaneous and down in Gateway Monitoring you'll see "Skip rules when gateway is down" which on my fresh 2.1 install is off by default. It has the following description.

                              "By default, when a rule has a specific gateway set, and this gateway is down, rule is created and traffic is sent to default gateway.This option overrides that behavior and the rule is not created when gateway is down"

                              So basically when the VPN Gateway is down it puts the rule in but with the default gateway ruining the whole point.

                              This works for me :)

                              1 Reply Last reply Reply Quote 0
                              • J
                                jameshouston135 Banned
                                last edited by

                                This post is deleted!
                                1 Reply Last reply Reply Quote 0
                                • F
                                  Fabio72
                                  last edited by

                                  https://www.infotechwerx.com/blog/Prevent-Any-Traffic-VPN-Hosts-Egressing-WAN

                                  1 Reply Last reply Reply Quote 0
                                  • P
                                    Pollerd Banned
                                    last edited by Pollerd

                                    This post is deleted!
                                    1 Reply Last reply Reply Quote 0
                                    • manjulaagarwal1955M
                                      manjulaagarwal1955 Banned
                                      last edited by

                                      This post is deleted!
                                      1 Reply Last reply Reply Quote 0
                                      • stephenw10S
                                        stephenw10 Netgate Administrator
                                        last edited by

                                        Locked this, it was just a spam magnet.

                                        1 Reply Last reply Reply Quote 0
                                        • First post
                                          Last post
                                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.