Messages

I have a Wireguard VPN that I have setup to route specific URLs/IPs through using Outbound NAT and firewall alias and rule, which all works as expected for clients on my LAN bridge that are on a wired connection.

I have an Outbound NAT setup for my VPN:
Interface WAN_WG1
Source: Any
Port: *
Destination: *
Port: *
NAT Address: Interface Address
Static Port: No

Alias is a simple alias that just has domain.com defined

Firewall rule is simple:
Source: Any
Port: Any
Destination: VPN_Redirect Alias
Gateway: WAN_WG1

And when I go to domain.com, it correctly routes through the VPN gateway, but only for my wired clients.

I have a Ubiquiti U7Pro Wifi Access point that is a standalone AP.  It has an IP in the same LAN range that the rest of my network is in, no VLANs or anything... I can access all devices internal to my network, wired or not.  They are all in the same subnet.  I just have a single very basic LAN network setup.  All my LAN ports are configured on a Bridge in OPNSense, and the AP is plugged directly into one of those Bridged ports.  It's got a static IP, with the gateway configured for my OPNSense IP.

Everything works on wireless, with the exception of the traffic I expect to go through the VPN as defined by the firewall alias/rule.  It seems like it's somehow getting dropped.  It just times out when trying to access any of the sites defined in the alias.

I can see the firewall logging the packets from the wireless client as expected for the VPN Redirect rule, same as it does for my wired clients.  But the wireless client never actually makes it to the expected page, just times out.

Is there something special about this "extra" hop of the AP in relation to how NAT works that I'm not understanding or taking into account here?

Yeah, seems like an issue with OpenVPN Connect then.

I was also able to fix it on OpenVPN Connect by adding the following line in the client .ovpn file.

Code Select Expand

dhcp-option ADAPTER_DOMAIN_SUFFIX domain.name

Wonder why OpenVPN Connect isn't respecting the option pushed from the server.

Anyone know of a way around this?

OpenVPN Instances option DNS Default Domain does not seem to be working.  This should push a Connection Specific DNS Suffix.  And I just see that blank in my ipconfig /all entry on my client.

Everything works/routes as expected if I use FQDNs, but trying to use a hostname without the FQDN, doesn't work.

Just updated to 24.7 just to rule that out.

I also tried using DNS Search List, and that also doesn't seem to work.

I think the custom OpenVPN option ADAPTER_DOMAIN_SUFFIX should work, but the option for custom options has  been removed.

Is there any way to get this to work as expected?

I'm testing this with a windows client.  Using the latest version of OpenVPN client and OPNSense is fully updated.

Hello all, new to OPNsense, so go easy on me here...

I've got everything setup, it took a little bit to figure out a few things, but pretty much everything is working as I want it to.

Only one thing is a bit of an issue right now.  When I enable net.link.bridge.pfil_bridge (I have a 6 port mini-pc with an i5 CPU, and I am just using it as a full on switch/router), a single application breaks.  Literally everything else in the network works, I have file servers, VPN traffic, Web servers, all kinds of internal traffic that flows without issue... It's literally this one app that I'm having an issue with.

This application operates on UDP using port 55355.  If I disable the filtering, the application works as expected.

Thing is, these two clients do a LOT more than just this one application.  I do streaming on Twitch and with this, I use the two PC's to do a lot of things back and forth... My sound/mic goes from one PC to the other for capturing, I use MouseWithoutBorders to control the second client with the same keyboard and mouse, and a bunch more.  Everything else these two clients do with each other work without issue, it's literally just this one app.

I checked firewall logs, don't see any blocking between the two, I have no actual blocking rules there anyway... it's a very basic install at this point, I only added rules to do my VPN kill switch, which is working without issue.

I did some Wiresharking, and I see the traffic on both PCs (with the filtering on)... I don't know much on how to diagnose network captures beyond that, I was just making sure they were seeing traffic and they do...  So it's not like it's not transmitting...  It's almost as if it's like "slow" in some fashion.

This application does a lot of like "state" reading and it's reporting a "busy" state on the functions it's attempting, and thus breaks it's functionality, because it's waiting for it to be ready.

Naturally, this is likely netcoding issues with this application.  But I was wondering if there was anything I can try to attempt to fix this.  I'd rather not have to disable the filtering if I don't have to.

While everything else works great without the filtering, the one thing I lose then is NAT reflection for my externally hosted services, which I do use...

I'm open to any ideas here...

Thanks!