Seperating VPN Traffic from Non VPN Traffic

[tattinger]

This is my first post here. I have had a good experience with pfSense so far.

I installed pfSense 2.2.2 on a Supermicro MBD-A1SRM-LN7F-2758 motherboard with  16 GB memory.

I have quite a few computers on my Lan but only need about 2 computers to use the VPN. The way I set it up that it worked for me was by setting up an Alias in the Firewall settings where I listed the Ip's of all the computers that were not a part of the VPN group. This is working fine but my question is : It would be a little easier to just make a rule that states the computers that are a part of them VPN group since this is a much smaller list. For some reason I could not get it to work this way?

Any ideas or suggestions would be appreciated on how to accomplish this.

[Derelict]

Firewall rules are processed top down, first match wins.

Your rules need to list the most-specific cases first (the hosts you want to use the VPN) to less specific (everyone else use the default gateway).

Considering no real info was provided that's my blind guess as to what you did wrong.

There is a lot of information here about policy routing out a VPN:

https://forum.pfsense.org/index.php?topic=76015.0

https://doc.pfsense.org/index.php/What_is_policy_routing

[tattinger]

@Derelict:

Firewall rules are processed top down, first match wins.

Your rules need to list the most-specific cases first (the hosts you want to use the VPN) to less specific (everyone else use the default gateway).

Considering no real info was provided that's my blind guess as to what you did wrong.

There is a lot of information here about policy routing out a VPN:

https://forum.pfsense.org/index.php?topic=76015.0

https://doc.pfsense.org/index.php/What_is_policy_routing

Thanks you Derelict for your help. I have read through the url's that you have posted and still have not figured out what I did wrong however pfSense is working fine the way I did set it up. I will read over what you sent me incase I missed something.

The way I have it set up now is in Firewall aliases I have a list of all the IP's that I do not want to go through the VPN. I have my three interphases, VPN , Lan and Wan.
Under firewall Rules Lan I have a Firewall rule, Non VPN clients .

[johnpoz]

Why don't you post your rules and we can talk a look see.

[tattinger]

@johnpoz:

Why don't you post your rules and we can talk a look see.

Thanks johnpoz for your help.

Here are my firewall Rules:


[johnpoz]

I don't see anything in those rules that would send traffic out your vpn.. I see a rule that would send traffic out your wan dhcp connection if dest is not the lan network and are in the source alias.

Is wan_dhcp not set to default in your routes, gateway section?  And your vpn is?

[Derelict]

Yeah, that ! LAN Net is worthless.  You will never see traffic coming into your LAN interface destined for LAN net.  The hosts on LAN net will just communicate directly on the local subnet.

[tattinger]

@johnpoz:

I don't see anything in those rules that would send traffic out your vpn.. I see a rule that would send traffic out your wan dhcp connection if dest is not the lan network and are in the source alias.

Is wan_dhcp not set to default in your routes, gateway section?  And your vpn is?

wan_dhcp is set to default. Vpn is not.

Thanks johnpoz

@ Derelict,
Thanks for the info . A friend of mine helped me set it up and he thought the ! Lan Net would work .

[Derelict]

There aren't any rules that send traffic to a VPN based on what you've shown.  Are you sure you're using the VPN?

[tattinger]

@Derelict:

There aren't any rules that send traffic to a VPN based on what you've shown.  Are you sure you're using the VPN?

Yes I am using a VPN. I checked under status/Openvpn and it says Service is running. I checked in System Logs/Open VPN and everything looks good. When I do an ip check I do get the ip of the server. as I have stated in aliases I have listed all the non-vpn clients by ip's and I have verified that that these clients do not go through the VPN.

Thanks Derelict

[Derelict]

Then you must be getting a default route from the VPN server.  Typically one has to turn on Don't pull routes in the OpenVPN client config then policy route just the traffic they want over the VPN otherwise everything goes over the VPN.

As long as it's working for you…

[tattinger]

@Derelict:

Then you must be getting a default route from the VPN server.  Typically one has to turn on Don't pull routes in the OpenVPN client config then policy route just the traffic they want over the VPN otherwise everything goes over the VPN.

As long as it's working for you…

Yes Derelict it does work this way. I have been messing with it all weekend, however, I would like to learn how to set it up where I select only the 2 computers that I want to use the VPN and all others are excluded from VPN.

What Info can I provide so I can figure this out??

Thanks again.

[Derelict]

Just look at the OpenVPN threads.  There's a really long one about PIA that covers all this.  Sorry, I don't have a bookmark for it.

There's a checkbox in the OpenVPN client config that says don't pull routes.  With that checked make an alias for the hosts you want to go out the VPN and set the VPN as a gateway in a matching rule.

[tattinger]

@Derelict:

Just look at the OpenVPN threads.  There's a really long one about PIA that covers all this.  Sorry, I don't have a bookmark for it.

There's a checkbox in the OpenVPN client config that says don't pull routes.  With that checked make an alias for the hosts you want to go out the VPN and set the VPN as a gateway in a matching rule.

Appreciate the help. Will look for the post on PIA so I can figure it out.