OpenVPN Kill Switch
-
Ok so I have changed the VPN address to the IP address instead of the name. It appears to allow connection now with the firewall rules in place. Is there any disadvantage to using the actual IP rather then the name? I used the DNS reverse lookup to find it and it appears there are 4 seperate IPs can all link to the same address. I just picked one.
-
If they change IPs it will break. I'd pass DNS correctly. It could break all kinds of things eventually like downloading bogon table updates, upgrades, etc. Your firewall should be able to resolve DNS.
-
If they change IPs it will break. I'd pass DNS correctly. It could break all kinds of things eventually like downloading bogon table updates, upgrades, etc. Your firewall should be able to resolve DNS.
exactly copy your openvpn rule and adjust it to work for DNS. pfsense webgui can/will go nuts without DNS :))
-
Will this configuration pass DNS outside of the VPN only for resolving the VPN host address when connecting to VPN (or when automatically re-connecting to VPN after an unplanned disconnection), and otherwise pass all other DNS through the VPN?
-
Hi,
I don't like the floating rules trick because when the VPN goes down, it cannot reconnect anymore, blocked by the rule. But there is a workaround. Take a look at this post
Go to Advanced and then Miscellaneous and down in Gateway Monitoring you'll see "Skip rules when gateway is down" which on my fresh 2.1 install is off by default. It has the following description.
"By default, when a rule has a specific gateway set, and this gateway is down, rule is created and traffic is sent to default gateway.This option overrides that behavior and the rule is not created when gateway is down"
So basically when the VPN Gateway is down it puts the rule in but with the default gateway ruining the whole point.
This works for me :)
-
This post is deleted! -
https://www.infotechwerx.com/blog/Prevent-Any-Traffic-VPN-Hosts-Egressing-WAN
-
This post is deleted! -
This post is deleted! -
Locked this, it was just a spam magnet.