Phantom OpenVPN interface created under rules

[sammy]

A phantom interface named "OpenVPN" is automatically created under rules immediately after setting up an OpenVPN server. However, no traffic appears to pass through this interface. Adding the actual OpenVPN interface results in the creation of another interface under rules.

[franco]

This interface is for incoming OpenVPN connections and needs a pass rule to allow incoming traffic.  ;)


Cheers,
Franco

[sammy]

Franco,

That's what I initially thought as well. However, the allow rule on the interface doesn't permit any traffic. You need to go under "Interfaces" and assign the newly created VPN. This will add another interface under rules, which can then allow traffic to pass.

[franco]

The documentation doesn't agree...

https://docs.opnsense.org/manual/vpnet.html#id2
https://docs.opnsense.org/troubleshooting/openvpn.html


Cheers,
Franco

[sammy]

This documentation is accurate, but only after you complete the interface assignment under "Interfaces." The phantom interface is created under Firewall-Rules automatically; however, it does not allow any traffic to pass.

[Seimus]

Isn't that just the default group used for the VPN type in case you dont have any interfaces attached? It should be used in such cases where you do not have any interfaces, basically a default FW group that applies across multiple instances.

Regards,
S.

[Patrick M. Hausen]

Isn't that just the default group used for the VPN type in case you dont have any interfaces attached?

IMHO it is. And in 24.10 it is working perfectly fine to apply firewall rules to if you did not assign any individual OpenVPN interfaces. Here with my HA cluster at least.

Since this is the 25.1 subforum, there might of course be a regression, though.

[sammy]

Alright, that makes sense, and now everything seems to be working just fine. Thank you all for the guidance! Initially, I added an allow rule, but no traffic was passing. Now it's working, so I must have done something wrong earlier. I recently switched from pfSense to OPNsense, and it's been quite an interesting journey.

[Seimus]

Isn't that just the default group used for the VPN type in case you dont have any interfaces attached?

IMHO it is. And in 24.10 it is working perfectly fine to apply firewall rules to if you did not assign any individual OpenVPN interfaces. Here with my HA cluster at least.

Since this is the 25.1 subforum, there might of course be a regression, though.

Exactly what I thought but I didn't test these on the BETA.

Alright, that makes sense, and now everything seems to be working just fine. Thank you all for the guidance! Initially, I added an allow rule, but no traffic was passing. Now it's working, so I must have done something wrong earlier. I recently switched from pfSense to OPNsense, and it's been quite an interesting journey.

Glad to hear its working. These default FW groups are created for all VPN types, IPSEC, OpenVPN & Wireguard.

Sometimes odd issues are just a causality of a logical mistake.

Regards,
S.