Messages

Io ci sono.

Su, fatevi avanti.

I used last pfsense version, 2.3.1.

Do you suggest to try with opnsense 16.7 beta version?

If yes, can I install directly 16.7 beta version without upgrading my 16.1.7 installation?

Hi,

to test my opnsense configuration, I made some tests with pfsense.

With same configuration on pfsense, I get correct result: my 192.168.2.12 device doesn't uses VPN but WAN.

Can you help me?

Thanks in advance

No franco,

default gateway is WAN_DHCP on WAN interface.

I made a little modification to above rule: as destination I inserted wan_net and I my device is able to connect to Internet but always through VPN address.

I really don't understand.

Thanks Joerg,

I tried as you stated but now I haven't Internet access from 192.168.2.12.

I have:

6 rules on NAT Outbound (4 Manual for VPNINTERFACE and 2 automatic for Wan interface)

Under Firewall->Rules I have

Floating: 1 block rule for IPV6
WAN: 0 rule
LAN: 3 rules (1st is the one just added, others two enable IPV4 and IPV6 on Lan net)
PROVIDERVPN Interace: 0 rule
OpenVPN: 0 rule

I added on LAN tab following rule (as first rule):

Action: pass, Interface: lan, Source: 192.168.2.12, destination: any, gateway (isn't under advanced options): WAN_DHCP 192.168.1.1

Thanks for your help

Just tried: before new rule I get from /tmp/rules.debug

(192.168.2.1 is my opnsense router (LAN), 192.168.1.1 is my Internet router)


nat on $PROVIDERVPN  from 192.168.2.0/24 to any -> ip_gateway_VPN/32 port 1024:65535 
nat on $PROVIDERVPN  from 192.168.2.0/24 to any port 500 -> ip_gateway_VPN/32  static-port
nat on $PROVIDERVPN  from 127.0.0.0/8 to any -> ip_gateway_VPN/32 port 1024:65535 
nat on $PROVIDERVPN  from 127.0.0.0/8 to any port 500 -> ip_gateway_VPN/32  static-port

and then

tonatsubnets  = "{ 127.0.0.0/8 192.168.2.0/24 }"
nat on $WAN  from $tonatsubnets to any port 500 -> 192.168.1.7/32  static-port
nat on $WAN  from $tonatsubnets to any -> 192.168.1.7/32 port 1024:65535

So, I add a new rule for 192.168.2.12 and I get

nat on $WAN  from 192.168.2.12/32 to any -> 192.168.1.7/32 port 1024:65535

before above rules.

I tried again from 192.168.2.12 device (it's a blu-ray player) but I get VPN address (I checked with ipleak.net in a browser).

Have you any idea?

Thanks

Thanks franco.

I use hybrid mode.

Now I removed all new rules but I don't know if I need to add rules on outbound (Firewall->NAT->Outbound) and/or rules on Firewall->Rules.

Now I will try to add a new rule on NAT Outbound for my specific device and I will check /tmp/rules.debug.

Thanks

I tried also to add a specific  rule on Firewall->Rules for above device but doesn't works.

Just a little help?

Thanks in advance

Hi,

I have a problem with NAT Outbound and my VPN configuration.

I setup months ago OpenVPN (client) with my VPN provider and I setup (Firewall-NAT-Outbound) some manual rules like

192.168.2.0/24 on VPN interface (to force VPN on every device on my LAN).

All works very good.

Now I would like to setup an exception: for a specific device, 192.168.2.12 I want to use wan interface and not VPN.

So I added another rule for 192.168.2.12/32, as first rule, but this device uses always VPN interface.

So, where is my mistake?

Thanks for your help.

I have 4 cores inside OPNSense VM, only useful when I use VPN.

On Hyper-V have you disabled LSO, TSO, etc?

I disabled inside OPNSense but on ESXi are enabled (by default).

Thanks,

just tried: I disabled old WAN and LAN network adapters (with E1000 drivers) from ESXi and created two new adapters with VMXNET3 drivers.

After setup these new two adapters also on OPNSense (one for WAN and one for LAN), named vmx0 and vmx1, I tried some transfer tests and I get 450Mbps as peak speed: not bad :)

Perhaps it is enough (?).

Thanks for your help

Thanks weust,

I used E1000 as suggested on opnsense wiki.

Now I will try to change drivers (WAN and LAN)  and I will post my results.

Hi,

I resume this thread for my new problem.

Recently I upgraded my WAN from 100Mbps to 500Mbps: obviously I made some tests with my opnsense setup (VM on VMWare ESXi 6 Update 2) but I am not satisfied with speed.

First of all I tested WAN real speed (web surfing, torrent, ftp, usenet) without OPNSense (my iMac connected directly to Internet), no VPN and I found I get 480Mbps (for example with ftp file transfer or usenet) in some cases: I am impressed.

I repeated same tests (obviously under same conditions) with OPNSense (16.1.15 version) but I get an 30% average decrease: not good.

Then I checked OPNSense cfg, but I LRO, TSO and checksum was already disabled: on ESXi side I suspect TSO/LRO is enabled and I used E1000 driver on OPNSense VM machine (maybe VMXNET3 is better?).

Can you suggest me right direction to investigate?

Thanks in advance

Alessandro

I agree, these numbers are good.

When with openvpn will be possible to use aes-256-gcm, perhaps they will become even better.