Outgoing data being routed to OpenVPN Client Connection
-
I have a single WAN link working fine, hosting a web server on port 80. My LAN rules are clean/empty except I am routing all outgoing data through my WAN gateway (so really only one rule).
I just added an OpenVPN connection, along with creating a new interface for this connection. Then specified my LAN subnet access to send data out over this interface, but did not add LAN rules to have any host do so. Basically, just a connection to my OpenVPN server, but no assigned usage on my LAN.
Looking at my RRD graphs I saw that all my outgoing data is now going out over my OpenVPN connection. Why is this happening?? I will attach below a pic showing the current 8hr window before when all data was going out over WAN and after the OpenVPN connection. :-/
Looking at pfinfo, I see that indeed the traffic is going out over VPN1 and not WAN as designed.
I have tried adding an explicit rule in the LAN table for the web server host to only send out over WAN gateway, but it isn't doing so…
Also, if I add more OpenVPN connections/interfaces, the data will still default out over VPN1 and not WAN like it should until forced over the VPNx gateways.
This pfSense router is v2.2 and pretty clean installation besides disabling IPv6 functionality.
Any ideas?
-
I just added an OpenVPN connection, along with creating a new interface for this connection. Then specified my LAN subnet access to send data out over this interface, but did not add LAN rules to have any host do so. Basically, just a connection to my OpenVPN server, but no assigned usage on my LAN.
I cannot decipher what you're talking about here.
What is "specified my LAN subnet access to send data out over this interface?"
Post shots of what you've done instead of telling us what you think you've done.
-
I just added an OpenVPN connection, along with creating a new interface for this connection. Then specified my LAN subnet access to send data out over this interface, but did not add LAN rules to have any host do so. Basically, just a connection to my OpenVPN server, but no assigned usage on my LAN.
I cannot decipher what you're talking about here.
What is "specified my LAN subnet access to send data out over this interface?"
Post shots of what you've done instead of telling us what you think you've done.
-
How is ATTGW defined?
Any floating rules?
The rules on your VPN1 are wrong. They apply to connections coming INTO pfSense FROM OpenVPN. You don't need any rules there to make outbound connections to that tunnel.
https://doc.pfsense.org/index.php/Firewall_Rule_Troubleshooting
-
How is ATTGW defined?
Any floating rules?
The rules on your VPN1 are wrong. They apply to connections coming INTO pfSense FROM OpenVPN. You don't need any rules there to make outbound connections to that tunnel.
https://doc.pfsense.org/index.php/Firewall_Rule_Troubleshooting
I made the change to the VPN1 ruleset, but it was my understanding that I needed to explicitly allow my LAN traffic or individual host to leave through the VPN1 interface if I wanted to further control access.
Here are the settings now…
Traffic is still leaving on VPN1 instead of WAN.
-
Yeah that's strange.
Does checking your egress IP address at wimi.com or something confirm the traffic is actually going out the VPN?
What happens if you change the LAN rule back to Gateway: default ??
Disable the VPN1 NAT rule?
I just tried it on my Xen stack and it works exactly as expected.
-
Duh. You are probably getting a default route from your VPN provider. Add route-nopull; to the advanced settings of the VPN client and bounce it.
-
Yeah that's strange.
Does checking your egress IP address at wimi.com or something confirm the traffic is actually going out the VPN?
What happens if you change the LAN rule back to Gateway: default ??
Disable the VPN1 NAT rule?
I just tried it on my Xen stack and it works exactly as expected.
Yeah all my devices on my 'LAN' are on my WAN IP according to WIMI and Google search 'IP'.
Looking at pfInfo, all my outgoing packets are being logged under the ovpnc2 interface.
I also started a packet capture on VPN1, and nothing other than a few random packets were captured. Not the heavy activity that is being shown in pfInfo.
-
Duh. You are probably getting a default route from your VPN provider. Add route-nopull; to the advanced settings of the VPN client and bounce it.
Ok, that did it.
But its really weird that the previous packet capture wasnt actually seeing the data that pfInfo said was passing across it.
-
Yeah. Sorry. I should have caught route-nopull; first thing instead of asking you to jump through all those screenshots.
-
Yeah. Sorry. I should have caught route-nopull; first thing instead of asking you to jump through all those screenshots.
No problem man! Thanks for all the help!
-
Just learned: Note that if you're on 2.2 there's now a checkbox "Don't Pull Routes" that adds route-nopull for you.
Ignore the description on 2.2 - the descriptions for those two similar options are flipped. Fixed in 2.2.1. https://redmine.pfsense.org/issues/4273
