Topics

I need some help from the network experts. I'm trying to create this scenario:

- 2 OPNsense installations (site1 and site2)
- both connected to the internet
- clients on site2 LAN should use the internet connection of site1 for all traffic, not only HTTP(S)
- the servers to which the clients connect should not be able to detect that site2 even exists

This is what I've done so far:

- create a site2site tunnel using this guide: https://docs.opnsense.org/manual/how-tos/sslvpn_instance_s2s.html
- set "Redirect gateway" to "default" on site1 vpn config
- create "IN: allow any to any" firewall rules on site1 OpenVPN, site2 OpenVPN and site2 LAN
- create "OUT: block any destination except site1 public IP" rule on site2 WAN (to prevent accidently revealing site2 public IP)
- enable outbound NAT (hybrid mode) for any source on site1 WAN

Result:

- clients can access most web pages
- ifconfig.me shows public IP of site1

Problem:

- cannot log into Microsoft account
- login form shows up during first try
- when trying to submit the username, the connection drops
- the whole domain login.live.com is no longer accessible, including the login form that was successfully loaded before
- other domains are still accessible
- restarting all systems does not solve the problem (login form still not accessible)
- resetting the browser or using a private window makes the login form accessible again
=> looks like a ban from Microsoft side

Additional note:

- using the web proxy of site1 allows clients to successfully log into the Microsoft account using site1 public IP

Questions:

- How can Microsoft still detect the VPN configuration?
- How can I further debug the problem?

I've been struggling with setting up some basic firewall rules for hours now. It looks like everything I try is ignored. I have created a WAN interface and multiple LAN interfaces. Routing should be done from every LAN to the WAN, but not between the LANs.

I tried to disable ALL firewall rules on EVERY interface and even added a generic "block everything" rule on one LAN. But I can still send ICMP requests and reach an HTTP server on this LAN from another LAN. The only way I found working was to remove the interface's IP address of the LAN with the HTTP server - so the traffic is definitely flowing through OPNsense.

What is going wrong here? Do you have to explicitly enable the firewall somewhere?

Is there some way to trigger a custom action when opnsense detects a gateway failure?

Following use case:

My backup internet connection is via LTE. I have a small data package with just some 100 MB as default and need to switch to a better one before connecting the whole network via this gateway.