Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Outgoing data being routed to OpenVPN Client Connection

    Scheduled Pinned Locked Moved General pfSense Questions
    12 Posts 2 Posters 1.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • I
      icemanncsu
      last edited by

      I have a single WAN link working fine, hosting a web server on port 80.  My LAN rules are clean/empty except I am routing all outgoing data through my WAN gateway (so really only one rule).

      I just added an OpenVPN connection, along with creating a new interface for this connection.  Then specified my LAN subnet access to send data out over this interface, but did not add LAN rules to have any host do so.  Basically, just a connection to my OpenVPN server, but no assigned usage on my LAN.

      Looking at my RRD graphs I saw that all my outgoing data is now going out over my OpenVPN connection.  Why is this happening??  I will attach below a pic showing the current 8hr window before when all data was going out over WAN and after the OpenVPN connection. :-/


      Looking at pfinfo, I see that indeed the traffic is going out over VPN1 and not WAN as designed.

      I have tried adding an explicit rule in the LAN table for the web server host to only send out over WAN gateway, but it isn't doing so…

      Also, if I add more OpenVPN connections/interfaces, the data will still default out over VPN1 and not WAN like it should until forced over the VPNx gateways.

      This pfSense router is v2.2 and pretty clean installation besides disabling IPv6 functionality.

      Any ideas?

      1 Reply Last reply Reply Quote 0
      • DerelictD
        Derelict LAYER 8 Netgate
        last edited by

        I just added an OpenVPN connection, along with creating a new interface for this connection.  Then specified my LAN subnet access to send data out over this interface, but did not add LAN rules to have any host do so.  Basically, just a connection to my OpenVPN server, but no assigned usage on my LAN.

        I cannot decipher what you're talking about here.

        What is "specified my LAN subnet access to send data out over this interface?"

        Post shots of what you've done instead of telling us what you think you've done.

        Chattanooga, Tennessee, USA
        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
        Do Not Chat For Help! NO_WAN_EGRESS(TM)

        1 Reply Last reply Reply Quote 0
        • I
          icemanncsu
          last edited by

          @Derelict:

          I just added an OpenVPN connection, along with creating a new interface for this connection.  Then specified my LAN subnet access to send data out over this interface, but did not add LAN rules to have any host do so.  Basically, just a connection to my OpenVPN server, but no assigned usage on my LAN.

          I cannot decipher what you're talking about here.

          What is "specified my LAN subnet access to send data out over this interface?"

          Post shots of what you've done instead of telling us what you think you've done.

          1 Reply Last reply Reply Quote 0
          • DerelictD
            Derelict LAYER 8 Netgate
            last edited by

            How is ATTGW defined?

            Any floating rules?

            The rules on your VPN1 are wrong.  They apply to connections coming INTO pfSense FROM OpenVPN.  You don't need any rules there to make outbound connections to that tunnel.

            https://doc.pfsense.org/index.php/Firewall_Rule_Troubleshooting

            Chattanooga, Tennessee, USA
            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
            Do Not Chat For Help! NO_WAN_EGRESS(TM)

            1 Reply Last reply Reply Quote 0
            • I
              icemanncsu
              last edited by

              @Derelict:

              How is ATTGW defined?

              Any floating rules?

              The rules on your VPN1 are wrong.  They apply to connections coming INTO pfSense FROM OpenVPN.  You don't need any rules there to make outbound connections to that tunnel.

              https://doc.pfsense.org/index.php/Firewall_Rule_Troubleshooting

              I made the change to the VPN1 ruleset, but it was my understanding that I needed to explicitly allow my LAN traffic or individual host to leave through the VPN1 interface if I wanted to further control access.

              Here are the settings now…

              Traffic is still leaving on VPN1 instead of WAN.

              1 Reply Last reply Reply Quote 0
              • DerelictD
                Derelict LAYER 8 Netgate
                last edited by

                Yeah that's strange.

                Does checking your egress IP address at wimi.com or something confirm the traffic is actually going out the VPN?

                What happens if you change the LAN rule back to Gateway: default ??

                Disable the VPN1 NAT rule?

                I just tried it on my Xen stack and it works exactly as expected.

                Chattanooga, Tennessee, USA
                A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                Do Not Chat For Help! NO_WAN_EGRESS(TM)

                1 Reply Last reply Reply Quote 0
                • DerelictD
                  Derelict LAYER 8 Netgate
                  last edited by

                  Duh.  You are probably getting a default route from your VPN provider.  Add route-nopull; to the advanced settings of the VPN client and bounce it.

                  Chattanooga, Tennessee, USA
                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                  1 Reply Last reply Reply Quote 0
                  • I
                    icemanncsu
                    last edited by

                    @Derelict:

                    Yeah that's strange.

                    Does checking your egress IP address at wimi.com or something confirm the traffic is actually going out the VPN?

                    What happens if you change the LAN rule back to Gateway: default ??

                    Disable the VPN1 NAT rule?

                    I just tried it on my Xen stack and it works exactly as expected.

                    Yeah all my devices on my 'LAN' are on my WAN IP according to WIMI and Google search 'IP'.

                    Looking at pfInfo, all my outgoing packets are being logged under the ovpnc2 interface.

                    I also started a packet capture on VPN1, and nothing other than a few random packets were captured.  Not the heavy activity that is being shown in pfInfo.

                    1 Reply Last reply Reply Quote 0
                    • I
                      icemanncsu
                      last edited by

                      @Derelict:

                      Duh.  You are probably getting a default route from your VPN provider.  Add route-nopull; to the advanced settings of the VPN client and bounce it.

                      Ok, that did it.

                      But its really weird that the previous packet capture wasnt actually seeing the data that pfInfo said was passing across it.

                      1 Reply Last reply Reply Quote 0
                      • DerelictD
                        Derelict LAYER 8 Netgate
                        last edited by

                        Yeah.  Sorry.  I should have caught route-nopull; first thing instead of asking you to jump through all those screenshots.

                        Chattanooga, Tennessee, USA
                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                        1 Reply Last reply Reply Quote 0
                        • I
                          icemanncsu
                          last edited by

                          @Derelict:

                          Yeah.  Sorry.  I should have caught route-nopull; first thing instead of asking you to jump through all those screenshots.

                          No problem man!  Thanks for all the help!

                          1 Reply Last reply Reply Quote 0
                          • DerelictD
                            Derelict LAYER 8 Netgate
                            last edited by

                            Just learned: Note that if you're on 2.2 there's now a checkbox "Don't Pull Routes" that adds route-nopull for you.

                            Ignore the description on 2.2 - the descriptions for those two similar options are flipped.  Fixed in 2.2.1.  https://redmine.pfsense.org/issues/4273

                            Chattanooga, Tennessee, USA
                            A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                            DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                            Do Not Chat For Help! NO_WAN_EGRESS(TM)

                            1 Reply Last reply Reply Quote 0
                            • First post
                              Last post
                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.