Interesting routing issue

[maverick_slo]

Hello!

I use 2.2 and Openvpn server in tun mode.
When client connects all is working as intended except one route goes wrong.

See below:

Correct traceroute, traffic goes troug tunnel:

Tracing route to google-public-dns-a.google.com [8.8.8.8]
over a maximum of 30 hops:

  1    14 ms    14 ms    14 ms  10.15.20.1
  2    15 ms    41 ms    15 ms  2903.burek.net [YY.YY.YY.1]
  3    63 ms    23 ms    45 ms  mx-vi1-te-0-0-0.burek.net [IP HERE]
  4    44 ms    43 ms    43 ms  72.14.211.66
  5    45 ms    45 ms    45 ms  216.239.46.115
  6    45 ms    44 ms    45 ms  216.239.48.137
  7    45 ms    45 ms    45 ms  google-public-dns-a.google.com [8.8.8.8]
Trace complete.

INCORRECT route, traffic goes trough local firewall instead of tunnel:

Tracing route to [XX.XX.XX.12]
over a maximum of 30 hops:

  1    <1 ms    <1 ms    <1 ms  firewall.domain.local [192.168.1.1]
  2    13 ms    13 ms    13 ms  gw1.net [ZZ.ZZZ.0.1]
  3    12 ms    12 ms    12 ms  gw2.net [IP HERE]
  4    13 ms    12 ms    13 ms  six.burek.net [IP HERE]
  5    14 ms    14 ms    13 ms  [XX.XX.XX.12]
Trace complete.

[XX.XX.XX.12] is my WAN IP.
So if I connect from anywhere and login to my website (I have no SSL) anyone with access to router I`m connected to could see my login details.
Why only WAN IP is routed trough local gateway instead of tunnel?

Thanks!

[maverick_slo]

Oh IPv6 is working great and as it should.

[johnpoz]

Well what are the routes on the box?  Clearly you have route that says when trying to go [XX.XX.XX.12] go to firewall.domain.local [192.168.1.1]

[marvosa]

At this point, we can't confirm anything, we need more info.

Post your server1.conf and the routing table from PFsense and a connected client.

[maverick_slo]

I was thinking…
There is actually no need for routing table...
Let me explain.

If I connect to XX.XX.XX.XX with openvpn, clearly XX.XX.XX.XX MUST go trough local firewall and not trough the tunnel. If it would go trough the tunnel, openvpn woul not work :)
So this is by design IMHO.

[marvosa]

That all depends on your config, routing and full tunnel vs split tunnel.  We are all just speculating without looking at the config and your routing tables.