pfSense Gold Subscription

Author Topic: outbound openvpn to Expressvpn and route voIP traffic through it only - Bid $  (Read 7092 times)

0 Members and 1 Guest are viewing this topic.

Offline stephenw10

  • Hero Member
  • *****
  • Posts: 8111
    • View Profile
We have reached the limits of my own experience with this, anything further is experimental!  ::)
However since something apparently is causing you default route to change I think you first need to confirm this is happening when you connect the OpenVPN tunnel by comparing your routing table before and after.

Steve

Offline xbipin

  • Hero Member
  • *****
  • Posts: 1220
    • View Profile
i dont think the default gateway is being changed

screenshot attached for before vpn and after vpn

Offline stephenw10

  • Hero Member
  • *****
  • Posts: 8111
    • View Profile
No but it is pushing a route, 0.0.0.0/1, which includes the entire internet! It never has to use the default route any more because it has a route to everywhere.

This is the expected behaviour if the server is pushing the redirect-gateway def1 command:
Quote
Add the def1 flag to override the default gateway by using 0.0.0.0/1 and 128.0.0.0/1 rather than 0.0.0.0/0. This has the benefit of overriding but not wiping out the original default gateway.

You could prevent this by using the 'route-nopull' option in the client config but that will probably prevent any routing information being sent making the vpn connection useless. Might be worth a try though.  :-\

Steve

Edit: You can add routes back manually to the config file:
route yourvoipserverIP;
« Last Edit: May 01, 2012, 09:14:04 am by stephenw10 »

Offline xbipin

  • Hero Member
  • *****
  • Posts: 1220
    • View Profile
after i added route-nopull i get the below routing table which seems correct now


Offline xbipin

  • Hero Member
  • *****
  • Posts: 1220
    • View Profile
if i added the 'route-nopull' then went to AON and switched it back to Auto and under rules in lan to any removed the gateway which was as wan, all traffic goes out the default wan conenction which earlier wasnting working at all untill i specified wan as gateway so i guess that got solved.

according to this thread http://forum.pfsense.org/index.php/topic,7361.0.html its not possible to shape traffic that goes inside a tunnel so the whole tunnel traffic needs to be sent to a single queue so i just want to route the voip so i added 2 rules under floating tab one with direction out and selected source as any and destination as vpn subnet and other as traffic in, source vpn subnet and destination any and assigned the qvoip to both but only the in traffic goes to qvoip and the out still goes to qp2p. both the rules r set as queues

Offline xbipin

  • Hero Member
  • *****
  • Posts: 1220
    • View Profile
i guess i spoke too soon, AON needs to be left on but the default lan to any doesnt need a gateway atleast

Offline stephenw10

  • Hero Member
  • *****
  • Posts: 8111
    • View Profile
You will always need AON enabled due to changes in openvpn setup detailed by ermal.

That's a good result though. Did you have to add a route back in the client config?

Steve

Offline xbipin

  • Hero Member
  • *****
  • Posts: 1220
    • View Profile
no i didnt add any client config, all i did is add ur recommended command under advanced configuration in the client openvpn section which looks like this now

fast-io;route-delay 2;route-nopull;verb 5;tun-mtu 1500;mssfix 1450;fragment 1300;persist-key;

Offline stephenw10

  • Hero Member
  • *****
  • Posts: 8111
    • View Profile
according to this thread http://forum.pfsense.org/index.php/topic,7361.0.html its not possible to shape traffic that goes inside a tunnel so the whole tunnel traffic needs to be sent to a single queue

That's only true for traffic in tunnel going through the pfSense box. Since the traffic destined for the VPN enters pfSense unencrypted it should be possible to shape it. Though I'm not sure quite how!

i just want to route the voip so i added 2 rules under floating tab one with direction out and selected source as any and destination as vpn subnet and other as traffic in, source vpn subnet and destination any and assigned the qvoip to both but only the in traffic goes to qvoip and the out still goes to qp2p. both the rules r set as queues

Probably the out rule is not catching traffic because the VOIP server is not in the VPN subnet. Though the IN rule is catching traffic.  :-\

Steve
« Last Edit: May 01, 2012, 12:02:35 pm by stephenw10 »

Offline xbipin

  • Hero Member
  • *****
  • Posts: 1220
    • View Profile
but if u see, the rule under lan that says lan to sip server should go through vpn gateway, pfsense catches that and send it to the proper gateway so basically its able to detect upload traffic so then y cant it just assign the proper queue.

any1 else have any idea on how to send vpn traffic to the proper queue as all i would be sending through the tunnel is voip only so might as well send all vpn to the voip quene entirely

Offline stephenw10

  • Hero Member
  • *****
  • Posts: 8111
    • View Profile
Can you give some screen shots of your queue rules, firewall rules etc?

Steve

Offline xbipin

  • Hero Member
  • *****
  • Posts: 1220
    • View Profile
the rules on the floating tab are just queues


Offline xbipin

  • Hero Member
  • *****
  • Posts: 1220
    • View Profile
few more screenshots

Offline xbipin

  • Hero Member
  • *****
  • Posts: 1220
    • View Profile
the 2 rules on floating tab that say * to mysip and mysip to * were originally created when i wasnt using vpn and voip used to work directly through wan. after vpn, the only additional rule i created was under lan for UDP * to mysip using gateway expressvpn

Offline stephenw10

  • Hero Member
  • *****
  • Posts: 8111
    • View Profile
Well this is definitely outside my experience now.  ;)
However I think you need to disable the * to mysip rules on floating in order to make sure it's not them that are catching the inbound traffic and sending it to qvoip.

Also I can't see how outbound traffic can possibly end up in qp2p when the only reference to it is for port 28183.  :-\

Steve