So I got this vpn up and running and I am trying to determine if all traffic is being routed thru the tunnel, but it appears it is not. I have a pfsense firewall running OpenVPN that has 3 nics. A WAN, a LAN, and an OPT1. I have a wireless router connected to OPT1. LAN network is 10.0.0.0/24 OPT1 network is 10.10.10.0/24 OpenVPN network is 10.5.0.0/24 i have for testing, firewall rules that block all access to and from OpenVPN and OPT1(wireless devices) So its my thnking, if I have two devices connected to the wireless, they should, and can, ping each other with no issues. With the current firewall rules in place, if one device is not connected to the vpn, i should not longer be able to ping them anymore (yes?), I dont know. Because what is happening, when I am on the VPN, I am able to ping another wirless device. But if all traffic was indeed going thru the tunnel, the firewall rule would block it. Here is a traceroute while on the VPN to my iphone which is just on wirless: [quote] traceroute to 10.10.10.7 (10.10.10.7), 30 hops max, 60 byte packets 1 iPhone (10.10.10.7) 93.374 ms 94.668 ms 94.673 ms [/quote] It doesnt seem to be going out the vpn network at all. When I try and Ping a device on my lan (10.0.0.0/24 network) I get this: [quote] traceroute to nas (10.0.0.251), 30 hops max, 60 byte packets 1 10.5.0.1 (10.5.0.1) 3.305 ms 7.530 ms 7.542 ms 2 NAS (10.0.0.251) 7.535 ms 7.526 ms 7.516 ms [/quote] It looks here that this has indeed gone thru the vpn first (10.5.0.0/24 network) So with a limited knowladge of what is truly going on, it seems forcing all traffic thru the vpn is not possible if trying to comunicate to a device that is on the same network as your main connection? Can someone lend a hand in helping me figure this out, and possible make it so "ALL" traffic really does go thru the vpn. I would think the ideal situation would be when connected to the vpn, you wont be able to access anything on the main connection, unless it is routed back out somehow with NAT or something.

Ok, well after a while I reading and testing, I found the option "redirect gateway block-local" which gets me closer. It works as I want in Linux, but in windows not so much. I believe the problem I have in windows is I still have a route going from my interface address back out my interface address. Removing this seems to stop others on my wifi from seeing my computer while connected to vpn. [quote] 10.10.10.20 255.255.255.255 On-link 10.10.10.20 281[/quote] What I want to try, and cant find info on, is to modify this by using the commands in the config file. I dont know of a way to determine the interface IP though. Well aside from manually finding it, but is there a command you can use to substitute a manually entered IP for your interface IP when using the "route" commands in the config file?

Force all Traffic thru tunnel, working or not working?

changedsoul

So I got this vpn up and running and I am trying to determine if all traffic is being routed thru the tunnel, but it appears it is not.
I have a pfsense firewall running OpenVPN that has 3 nics. A WAN, a LAN, and an OPT1.
I have a wireless router connected to OPT1.
LAN network is 10.0.0.0/24
OPT1 network is 10.10.10.0/24
OpenVPN network is 10.5.0.0/24

i have for testing, firewall rules that block all access to and from OpenVPN and OPT1(wireless devices)

So its my thnking, if I have two devices connected to the wireless, they should, and can, ping each other with no issues.
With the current firewall rules in place, if one device is not connected to the vpn, i should not longer be able to ping them anymore (yes?), I dont know.
Because what is happening, when I am on the VPN, I am able to ping another wirless device. But if all traffic was indeed going thru the tunnel, the firewall rule would block it.

Here is a traceroute while on the VPN to my iphone which is just on wirless:

traceroute to 10.10.10.7 (10.10.10.7), 30 hops max, 60 byte packets
1 iPhone (10.10.10.7) 93.374 ms 94.668 ms 94.673 ms

It doesnt seem to be going out the vpn network at all.
When I try and Ping a device on my lan (10.0.0.0/24 network) I get this:

traceroute to nas (10.0.0.251), 30 hops max, 60 byte packets
1 10.5.0.1 (10.5.0.1) 3.305 ms 7.530 ms 7.542 ms
2 NAS (10.0.0.251) 7.535 ms 7.526 ms 7.516 ms

It looks here that this has indeed gone thru the vpn first (10.5.0.0/24 network)

So with a limited knowladge of what is truly going on, it seems forcing all traffic thru the vpn is not possible if trying to comunicate to a device that is on the same network as your main connection?

Can someone lend a hand in helping me figure this out, and possible make it so "ALL" traffic really does go thru the vpn. I would think the ideal situation would be when connected to the vpn, you wont be able to access anything on the main connection, unless it is routed back out somehow with NAT or something.

changedsoul

Ok, well after a while I reading and testing, I found the option "redirect gateway block-local" which gets me closer. It works as I want in Linux, but in windows not so much.

I believe the problem I have in windows is I still have a route going from my interface address back out my interface address.
Removing this seems to stop others on my wifi from seeing my computer while connected to vpn.

10.10.10.20 255.255.255.255 On-link 10.10.10.20 281

What I want to try, and cant find info on, is to modify this by using the commands in the config file. I dont know of a way to determine the interface IP though. Well aside from manually finding it, but is there a command you can use to substitute a manually entered IP for your interface IP when using the "route" commands in the config file?