DIY Router for VPN running pfsense with Vodafone fibrex

Forums › LAN (ethernet/Wifi/routers/Bluetooth) › DIY Router for VPN running pfsense with Vodafone fibrex

1 | 2 | 3

89 posts

Master Geek

#2022257 25-May-2018 09:19

olivernz: Persevere! These things are not easy and there is no way to really make it in any way more comfortable. One of the upsides is that you actually learn a LOT when confronted with these issues.

Oh, I forgot to post since I didn't think there was much interest in this thread, but I got it to work and have started to set up VPN clients. In order to get an internet connection, I had to point my WAN to igb1.10 and not igb1. I managed this by setting up VLAN 10 on the "DOS-like" interface before connecting to the Web based GUI. This created a igb.10. I then made my WAN connect to igb1.10 instead of igb1. I do not know if this is the right way, but I have an internet connection through the router. Comments will be appreciated as others might benefit from this.

The guys at NordVPN are super helpful and has provided me with a guide (in development) to assist with setting up multiple VPNs. I will sort this out tonight. More importantly for me is my next aim after setting up multiple VPNs, which is to channel the correct traffic through them. Example, if there is a device that is connecting to Netflix, I want the router to recognize it and send the traffic through to the US VPN client. Similarly if the same device connects to now.dstv.com (streaming service in South Africa which is geo-restricted), I want the router to recognize it and send the traffic through to the ZA VPN client. So if anyone know how to do this, please help me.

I saw 4 URLs for Netflix and will create an alias for them later. But where do I find these URLs for other sites? In particular for now.dstv.com ?

I've now added a 24 port fully managed switch to my mix which has a 550 page manual. So yeah, it will take me weeks to get it sorted. But in the end I will have a safer environment for my kids and have learnt a HEAP! ...by the way, still being challenged by my MikroTik router too. Just so much stuff to configure.

Wow ... good luck with that!!! I still have to set up my Vodafone Huawei HG659 to be an access point only for my wireless connections. Not sure how that is going to be done yet - as you can recall, I am a noob with this stuff.

Samsung

Shop now on Samsung phones, tablets, TVs and more (affiliate link).

sultanoswing

814 posts

Ultimate Geek

#2022259 25-May-2018 09:24

Great to hear of the progress!

Seriously - flog that HG659 on Trademe and get a proper dedicated AP e.g. Ubiquiti Unifi AC-LR. That said, I'm running an ASUS RT-AC68u in simple AP mode, in addition to a unifi.

Brend

89 posts

Master Geek

#2022293 25-May-2018 10:05

sultanoswing: Great to hear of the progress!

Seriously - flog that HG659 on Trademe and get a proper dedicated AP e.g. Ubiquiti Unifi AC-LR. That said, I'm running an ASUS RT-AC68u in simple AP mode, in addition to a unifi.

I hear you! I hate the damn thing. The only thing it has over my Asus RT-n66u is ac on 5GHz. My intention is to use my RT-n66u later on. But it is currently the work horse until this DIY router is done. The HG659 is just temporary, but will still need to do it's job in the setup and testing phase.

Brend

89 posts

Master Geek

#2025685 30-May-2018 13:59

Now, I want to channel the correct traffic through VPN-US, VPN-ZA, WAN. Example, if there is a device that is connecting to Netflix, I want the router to recognize it and send the traffic through to the US VPN client. Similarly if the same device connects to now.dstv.com (streaming service in South Africa which is geo-restricted), I want the router to recognize it and send the traffic through to the ZA VPN client. And because NeonTV doesn't like VPNs, I want the router to recognize any connection to NeonTV and divert the traffic through WAN. All other traffic must go through VPN-NZ.

muppet

2553 posts

Uber Geek

Trusted

#2025724 30-May-2018 15:39

Brend:

Now, I want to channel the correct traffic through VPN-US, VPN-ZA, WAN. Example, if there is a device that is connecting to Netflix, I want the router to recognize it and send the traffic through to the US VPN client. Similarly if the same device connects to now.dstv.com (streaming service in South Africa which is geo-restricted), I want the router to recognize it and send the traffic through to the ZA VPN client. And because NeonTV doesn't like VPNs, I want the router to recognize any connection to NeonTV and divert the traffic through WAN. All other traffic must go through VPN-NZ.

Well, that's going to be fun to setup.

You'll need to add some static routes - which will no doubt need to change on a very regular basis, so you'll be playing whack a mole.

1) Setup your default route to go through "VPN-NZ". That's easy.

2) You'll need to figure out ALL Netflix US netblocks and route them via VPN-US. Maybe this isn't hard. Hopefully someone maintains a list online, and in pfSense/opsense you can just setup a firewall rule that references this list and it will auto-update every hour. There's a list here - https://ipinfo.io/AS2906 - but not in a format you can just import. But you could enter those easily enough.

3) You'll need to figure out now.dstv.com netblocks and route them via VPN-ZA. Same as above.

4) Find all NeonTV ranges (I doubt they'll be many) and route them via the WAN Interface.

- le muppo.

Brend

89 posts

Master Geek

#2025728 30-May-2018 15:51

muppet:

Well, that's going to be fun to setup.

You'll need to add some static routes - which will no doubt need to change on a very regular basis, so you'll be playing whack a mole.

1) Setup your default route to go through "VPN-NZ". That's easy.

2) You'll need to figure out ALL Netflix US netblocks and route them via VPN-US. Maybe this isn't hard. Hopefully someone maintains a list online, and in pfSense/opsense you can just setup a firewall rule that references this list and it will auto-update every hour. There's a list here - https://ipinfo.io/AS2906 - but not in a format you can just import. But you could enter those easily enough.

3) You'll need to figure out now.dstv.com netblocks and route them via VPN-ZA. Same as above.

4) Find all NeonTV ranges (I doubt they'll be many) and route them via the WAN Interface.

- le muppo.

I got these ...

http://asn.blawk.net/2906 for Netflix

http://asn.blawk.net/328045 for DSTv

http://asn.blawk.net/9901 for Neontv

Can I use these? And if "yes", how?

How do I route the NeonTV ranges through WAN?

I tried a so many ways and for days now and I can't get a working setup.

muppet

2553 posts

Uber Geek

Trusted

#2025732 30-May-2018 16:00

I don't really have the patience (sorry) to talk you through the basics of routing on pfSense.

But simply in pfSense (I don't use opnsense but it shouldn't be much different) you can just add normal static routes, or to get tricker, add a firewall rule.

For Destination select "alias" and then the alias you created for the netblock you want to route to.

Then in advanced, you pick the gateway and save.

You'll probably find your openvpn interface(s) aren't in the list of gateways, you'll need to go to Interfaces->Assignments and add the the openvpn interfaces.

To create an alias you to go: Firewall->Aliases and click "Add". Then change the Type to URL (Table) and paste in what you've got above. Hopefully it works for you.

Give the alias a name etc.

Then you can reference the alias in the Destination I talked about above.

the other thing you can do with Firewall rules is route based on source. This way you can say "Hey all traffic from 192.168.0.5 which is my NeonTV box gets routed out the VPN" - You can't do this with standard static routes.

Brend

89 posts

Master Geek

#2025740 30-May-2018 16:17

muppet:

I don't really have the patience (sorry) to talk you through the basics of routing on pfSense.

Yeah ... you are unfortunately not the only one
But thanks for the time you did spend here. At least I get to review what I tried already.

But simply in pfSense (I don't use opnsense but it shouldn't be much different) you can just add normal static routes, or to get tricker, add a firewall rule.

I am still on pfsense. Not sure how static rules work, but I have tried multiple firewall rules without success ... guess I am doing something wrong every time

For Destination select "alias" and then the alias you created for the netblock you want to route to.

Then in advanced, you pick the gateway and save.

I did this, I could get it to work for Netflix to access the US servers and have the "full" Netflix but not for DSTv.

I tried something similar for NeonTV with WAN as the gateway, but it didn't work. Neon still thinks I am in another country even though https://ipleak.net/ tells me I am in NZ

You'll probably find your openvpn interface(s) aren't in the list of gateways, you'll need to go to Interfaces->Assignments and add the the openvpn interfaces.

I did this. They all showed being up

To create an alias you to go: Firewall->Aliases and click "Add". Then change the Type to URL (Table) and paste in what you've got above. Hopefully it works for you.

Give the alias a name etc.

Then you can reference the alias in the Destination I talked about above.

I did this with the asn.blawk.net references

the other thing you can do with Firewall rules is route based on source. This way you can say "Hey all traffic from 192.168.0.5 which is my NeonTV box gets routed out the VPN" - You can't do this with standard static routes.

I considered this, but it will not give me the desired result. E.g. NeonTV will be accessed with TV, iPad, Android tablet, but these devices will also connect to Netflix, DSTv and other sites including banking sites... which reminds me - I need my banking sites to bypass VPN too ...

sultanoswing

814 posts

Ultimate Geek

#2025748 30-May-2018 16:36

With the relative complexity of what you are trying to do, I'm reminded of the technology/software rule:

"Simple, Cheap, Works. Pick two"

muppet

2553 posts

Uber Geek

Trusted

#2025774 30-May-2018 16:58

So you got it to work, that's great.

But not everything.

The only other thing I can suggest is DNS - that's probably what's stuffing you.

What DNS Servers are you using? You might have to get really tricky and try and forward certain DNS requests to certain servers.

I'm sure what you're doing is possible, the fact you got it working for Netflix USA shows you you're on the right track. Have you installed Squid? It's X-Forwarded-For header will knacker your changes, remove it if you have.

Brend

89 posts

Master Geek

#2025789 30-May-2018 17:06

I am using the DNS servers as suggested by my VPN provider.

No squid installed.

Kiwifruta

1423 posts

Uber Geek

ID Verified

#2025797 30-May-2018 17:15

Curious as to why you are using VPN to unblock rather than a smart DNS service.

With a smart dns service there is no need to configure/map geoblocked services to VPN services. Internet remains full speed and smart DNS servcies cost less also. (dns4me is my pic).

I can understand if privacy and security are a higher priority than geo unblocking.

Brend

89 posts

Master Geek

#2025798 30-May-2018 17:18

Privacy and security are my main priorities. The fact that I can geo unblock is just an awesome extra. So I am trying to exploit it all in an overpowered machine.

sultanoswing

814 posts

Ultimate Geek

#2025811 30-May-2018 17:37

Love the aims and methods of the project. Keep it up, and keep us updated!

Brend

89 posts

Master Geek

#2025965 30-May-2018 21:51

muppet:

The only other thing I can suggest is DNS - that's probably what's stuffing you.

What DNS Servers are you using? You might have to get really tricky and try and forward certain DNS requests to certain servers.

1 | 2 | 3