pfSense Support Subscription

Author Topic: Exclude a Subnet From OpenVPN  (Read 974 times)

0 Members and 1 Guest are viewing this topic.

Offline NOYB

  • Hero Member
  • *****
  • Posts: 1703
  • Karma: +158/-273
    • View Profile
Exclude a Subnet From OpenVPN
« on: September 02, 2016, 11:11:27 pm »
 
Need to exclude a subnet (192.168.149.0) on Windows clients of pfSense OpenVPN.
 
Thinking there needs to be something added to the pfSense OpenVPN server custom options.
 
Need some guidance in right direction.
 
Thanks.
 

Offline Derelict

  • Global Moderator
  • Hero Member
  • *****
  • Posts: 9609
  • Karma: +1090/-309
    • View Profile
Re: Exclude a Subnet From OpenVPN
« Reply #1 on: September 03, 2016, 12:02:17 am »
I assume you are pushing a default gateway and want to make a local exclusion to another subnet other than the local subnet or something like that.

Perhaps something like:


push "route 192.168.149.0 255.255.255.0 net_gateway"


https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage
Las Vegas, Nevada, USA
Use this diagram to describe your issue.
The pfSense Book is now available for just $24.70!
Do Not PM For Help! NO_WAN_EGRESSTM

Offline NOYB

  • Hero Member
  • *****
  • Posts: 1703
  • Karma: +158/-273
    • View Profile
Re: Exclude a Subnet From OpenVPN
« Reply #2 on: September 03, 2016, 05:29:16 am »
 
Thanks for your suggestion.  I was barking up the wrong tree though.  The route table looked fine.
 
Turned out to be Windows OpenVPN client interface marked as "public" so Windows Firewall blocking stuff.
 
The fix was to run
Code: [Select]
Get-NetConnectionProfile
to get the interface index and then run
Code: [Select]
Set-NetConnectionProfile -InterfaceIndex {interface index} -NetworkCategory Private
to mark it as private.
 
Would be nice if it could somehow be pushed from the server though.  Are there any settings the OpenVPN server can push that will cause the Windows OpenVPN client interface to be marked as private?
 
Hope that doesn't open security hole.  I'm thinking it should be similar to being on the pfSense LAN with an interface marked as private.  Please correct me, share insights etc.
 
Thanks.
 
P.S. Those are PowerShell commands run as administrator by the way.
 
« Last Edit: September 03, 2016, 05:35:06 am by NOYB »

Offline Pippin

  • Full Member
  • ***
  • Posts: 252
  • Karma: +23/-3
    • View Profile
Re: Exclude a Subnet From OpenVPN
« Reply #3 on: September 03, 2016, 05:54:22 am »

Try this in server:

Code: [Select]
push "route-metric 512"
push "route 0.0.0.0 0.0.0.0"
2.3.2-RELEASE (amd64) - GB N3150N-D3V
"There must be someone with intelligence in the party"
"Well, that rules you out Pippin"

Offline NOYB

  • Hero Member
  • *****
  • Posts: 1703
  • Karma: +158/-273
    • View Profile
Re: Exclude a Subnet From OpenVPN
« Reply #4 on: September 03, 2016, 04:42:49 pm »
 
Still marked as "Public Network".  It is no longer "unidentified" though.
 
From what I understand, public/private is determined per the default gateway.  Though I'm not sure what criteria is used to make the determination.
 

Offline NOYB

  • Hero Member
  • *****
  • Posts: 1703
  • Karma: +158/-273
    • View Profile
Re: Exclude a Subnet From OpenVPN
« Reply #5 on: September 03, 2016, 09:21:54 pm »
 
Think I may have it resolved.  Time will tell for sure but looking good so far.
 
After adding the push route-metric and route, the interface network category was still set as "Public". 
But then after setting the network category to "Private", using the "Set-NetConnectionProfile" command it seems to stick with future connections.  So we'll see how well that holds up over time.
 
I consolidated the two push commands into a single command of:
Code: [Select]
push "route 0.0.0.0 0.0.0.0 vpn_gateway 9999"

Any gotchas lurking with the single command?  OpenVPN doc does mention the "vpn_gateway" keyword may not be compatible with all OS's.  But didn't mention any specifically.
 
Thanks to everyone for your help and getting me on the right path.