I have OPNsense 20.1 running on my router. The present configuration has a gateway on the LAN interface address that passes traffic to a commercial VPN using OpenVPN. How can I add a second gateway address that sends traffic directly to the WAN interface?
???
What are your intentions? You can add static routes for specific networks?
What I would like to do is have the computers on the LAN network choose whether they are going to access the internet directly or via a VPN by choosing a different gateway address. So if your gateway is 192.168.0.1 you go to the internet via the ISP, or if the gateway is 192.168.0.2 you go to the internet via the VPN.
Here is a posting that is close to what I am trying to do:
https://www.neverslair-blog.net/2015/08/01/pfsense-how-to-bypass-a-vpn-connection-for-a-single-ip/
(https://www.neverslair-blog.net/2015/08/01/pfsense-how-to-bypass-a-vpn-connection-for-a-single-ip/)
The difference is that rather than setting firewall rules on the router for every computer bypassing the VPN, I would like to have the client choose by manually setting the gateway address.
This post is pretty much the same question I have:
https://forum.opnsense.org/index.php?topic=12294.0 (https://forum.opnsense.org/index.php?topic=12294.0)
The answer to the post did not help me though. If I add an Alias IP address to the LAN interface, I don't see how to detect that address in the rules. It would not be the source or destination address.
Here is a post that describes using subnetting rather than gateway address to decide what traffic goes through the VPN:
https://forum.opnsense.org/index.php?topic=1951.0
It still requires manually setting the client IP address to make the switch.
Here is another post with exactly the problem I would like to solve, adding a second gateway to the LAN interface:
https://forum.opnsense.org/index.php?topic=12294.msg56833#msg56833 (https://forum.opnsense.org/index.php?topic=12294.msg56833#msg56833)
The suggested solution was to add a virtual IP address, then add firewall rules to "create policy based routing." I tried to do that but it did not work for me. Could someone please post the rules that would be required? I have a working VPN tunnel to Private Internet Access called PIAVPN.