G'day :mrgreen: First, thank you to the devs for creating such a marvelous product and providing it for free to the world :D Could I ask politely for a little help? I'll write as short as possible, for your reading convenience. [b]SYSTEM[/b] 1. pfSense 2.1.5, using built in OpenVPN-client to connect [b]certain [/b]LAN-'puters to [b]certain [/b]websites via PrivateInternetAccess.com. 2. pfSense setup exactly like in this tutorial: https://forum.pfsense.org/index.php?topic=76015.0, with extra options added: [code]auth-user-pass /etc/openvpn-password.txt;remote-cert-tls server;verb 5;keepalive 5 30;route-nopull;[/code] 3. Firewall rules logic: RULE1: a group of websites (combined in a group, called an 'alias') is to be visited via the VPN (for example: google.com). RULE2, after that in the settings: all other traffic (for example to openvpn.net) is to use the defaullt, unencrypted, gateway out to the internets. [b]PROBLEM[/b] OpenVPN randomly decides to send [u]other [/u]traffic over the VPN too. Which causes problems with security systems on the internet, which don't recognize the originating IP as 'the usually used IP'. [b]ADVISED[/b] - Over at the pfSense forum I was advised to add the route-nopull to the advanced settings. However, doing that gives this back in the OpenVPN log in the pfSense GUI: [code] openvpn[19546]: Options error: option 'route' cannot be used in this context ([PUSH-OPTIONS]) openvpn[19546]: Options error: option 'dhcp-option' cannot be used in this context ([PUSH-OPTIONS]) openvpn[19546]: Options error: option 'redirect-gateway' cannot be used in this context ([PUSH-OPTIONS]) [/code] To be honest, I have no clue what this means :oops: In that same pfSense tutorial thread, I noticed other users use: [code]--route-noexec[/code] Which, according to my understanding of this (little understanding, I admit, I am not that bright :mrgreen: ): https://unix.stackexchange.com/questions/16500/how-to-refuse-routes-that-are-pushed-by-openvpn-server Would be quit the opposite of route-nopull. [b]QUESTION[/b] So, I am a little lost as to how to solve my problem. route-nopull gives an error, and perhaps it even is not the right solution to my problem(?) Would anybody perhaps be willing to help me out? I am in your debt already ;) Thank you in advance very much, Bye,

Thank you politely for your answer :mrgreen: I thought I'd find the answer here since it is a OpenVPN-setting, not a pfSense setting (pfSense only is the server that runs OpenVPN). [quote]And this is a polite advice from me to you: stop using Private Internet Access. It's a US-based company that co-operates with the FBI and NSA to hand over customers' traffic logs.[/quote] That is very polite of you too - and kind :D ;) You are right, you are not the first who has told me this. I know I should use something else, you are absolutely right. The problem is: how do you find something that is reliable? 1. Most of the 167.000 'vpnreviewXYZ.com' sites are marketing scams; 2. I looked around in this forum, but, unless I overlooked something, there aren't hardly any reviews in the appropriate forum section. (I would have hoped, coming to the source op OpenVPN, that would have not been the case :oops: ). Now, I do know the workaround is to rent a couple of VPS'ses somewhere, and one way or the other chain these. But I am a rather retarded SOHO-user, and renting a couple of VPN's, learning how to install xNix & OpenVPN in them, chaining them, and maintaining/upgrading/fixing problems is a little bit out of my league: price wise (a couple of VPS'ses), timewise and brain wise :) So, I remain at: how to find something better? I will politely say thank you for your reply & a polite bye :mrgreen:

[quote="rogervansant"]I thought I'd find the answer here since it is a OpenVPN-setting, not a pfSense setting (pfSense only is the server that runs OpenVPN).[/quote] If you wish, you may subscribe to https://lists.sourceforge.net/lists/listinfo/openvpn-users, re-post your question there [i]in plaintext[/i] and hope that one of the OpenVPN experts there will help you. [quote="rogervansant"]You are right, you are not the first who has told me this. I know I should use something else, you are absolutely right.[/quote] If you believe Edward Snowden's been telling the truth so far, then you should know to steer clear of any VPN service provider which has for its head office in the USA or any of the "Five Eyes" countries. Some of the business partners of PIA quit to move out of the USA to start their own business ventures precisely due to the NSA PRISM program. [quote="rogervansant"]The problem is: how do you find something that is reliable?[/quote] Define [b]reliable[/b] [quote="rogervansant"]1. Most of the 167.000 'vpnreviewXYZ.com' sites are marketing scams;[/quote] Agree. [quote="rogervansant"]2. I looked around in this forum, but, unless I overlooked something, there aren't hardly any reviews in the appropriate forum section.[/quote] No, there aren't any reviews in sub-forum or other sub-forums of OpenVPN.net You may wish to surf to http://torrentfreak.com/which-vpn-services-take-your-anonymity-seriously-2014-edition-140315/ and [i]study[/i] it. The reviewer himself, Ernesto, reveals that some of those listed are his sponsors. What it means is that you have to take it with a pinch of salt. At the end of the review, there are about 409 comments - at the time of my writing this post. You'd do well to pay extra attention to them before you decide on which VPN service to subscribe to. [quote="rogervansant"]Now, I do know the workaround is to rent a couple of VPS'ses somewhere, and one way or the other chain these.[/quote] No, renting VPSes is NOT the solution unless you've full control over them as well as the datacenters that host them. [quote="rogervansant"]But I am a rather retarded SOHO-user, and renting a couple of VPN's, learning how to install xNix & OpenVPN in them, chaining them, and maintaining/upgrading/fixing problems is a little bit out of my league: price wise (a couple of VPS'ses), timewise and brain wise :)[/quote] You can always hire a couple of freelancers to help you with doing that kind of work. However, as I mentioned earlier, unless you've full control over them and the datacenters that host them, you're simply wasting your time, money and effort. [quote="rogervansant"]So, I remain at: how to find something better?[/quote] Define [b]better[/b] [i]May I politely ask you[/i].... What is your threat model? Who are you up against - local and global?

PrivateInternetAccess.com: pfSense + route-nopull: error ?

rogervansant

G'day :mrgreen:

First, thank you to the devs for creating such a marvelous product and providing it for free to the world 😃

Could I ask politely for a little help?

I'll write as short as possible, for your reading convenience.
SYSTEM
1. pfSense 2.1.5, using built in OpenVPN-client to connect certain LAN-'puters to certain websites via PrivateInternetAccess.com.
2. pfSense setup exactly like in this tutorial: https://forum.pfsense.org/index.php?topic=76015.0, with extra options added:

auth-user-pass /etc/openvpn-password.txt;remote-cert-tls server;verb 5;keepalive 5 30;route-nopull;

3. Firewall rules logic: RULE1: a group of websites (combined in a group, called an 'alias') is to be visited via the VPN (for example: google.com). RULE2, after that in the settings: all other traffic (for example to openvpn.net) is to use the defaullt, unencrypted, gateway out to the internets.

PROBLEM
OpenVPN randomly decides to send other traffic over the VPN too. Which causes problems with security systems on the internet, which don't recognize the originating IP as 'the usually used IP'.

ADVISED
- Over at the pfSense forum I was advised to add the route-nopull to the advanced settings. However, doing that gives this back in the OpenVPN log in the pfSense GUI:

openvpn[19546]: Options error: option 'route' cannot be used in this context ([PUSH-OPTIONS])
openvpn[19546]: Options error: option 'dhcp-option' cannot be used in this context ([PUSH-OPTIONS])
openvpn[19546]: Options error: option 'redirect-gateway' cannot be used in this context ([PUSH-OPTIONS])

To be honest, I have no clue what this means :oops:

In that same pfSense tutorial thread, I noticed other users use:

--route-noexec

Which, according to my understanding of this (little understanding, I admit, I am not that bright :mrgreen: ): https://unix.stackexchange.com/questions/16500/how-to-refuse-routes-that-are-pushed-by-openvpn-server

Would be quit the opposite of route-nopull.

QUESTION
So, I am a little lost as to how to solve my problem. route-nopull gives an error, and perhaps it even is not the right solution to my problem(?)

Would anybody perhaps be willing to help me out? I am in your debt already 😉

Thank you in advance very much,

Bye,

innogen

rogervansant wrote Could I ask politely for a little help?

Would anybody perhaps be willing to help me out? I am in your debt already 😉

I'll politely answer your questions:

1. As you are a customer of PIA, I suggest that you approach them for help.
2. Your problems don't seem to be directly caused by OpenVPN.
3. pfSense might be the most likely place where you'll find solutions.

And this is a polite advice from me to you: stop using Private Internet Access. It's a US-based company that co-operates with the FBI and NSA to hand over customers' traffic logs.

rogervansant

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.

innogen

Sorry, we encountered an error while displaying this content. If you're a user, please try again later. If you're an administrator, take a look in your Flarum log files for more information.

innogen

To rogervansant:

Ex-founder-owner-operator of now defunct Lavabit wrote: "This experience has taught me one very important lesson: without congressional action or a strong judicial precedent, I would strongly recommend against anyone trusting their private data to a company with physical ties to the United States."

URLs:

http://www.democracynow.org/2013/8/13/exclusive_owner_of_snowdens_email_service
http://www.reuters.com/article/2013/08/09/us-usa-security-snowden-email-idUSBRE97800520130809