Good evening!
I'm using Private Internet Access to esablish an OpenVPN tunnel. I'd like to exclude certain addresses from forwarding through said tunnel. I have successfully established the tunnel, but all traffic goes through it (likely from the route pulling on the tunnel)
Following https://help.ubnt.com/hc/en-us/articles/204952274-EdgeMAX-Policy-based-routing-source-address-based- I'm virtually certain I'm going to need policy-based routing for this one.
Currently, with a route-nopull in my ovpn file, I get no Internet access at all on any IP, so I must be doing something incorrectly. I'm using 192.168.17.37/32 right now to test.
Can anyone spot my mistake? Relavent parts of configuration below.
Thank you very much in advance.
----------OVPN FILE---------
client
dev tun
proto udp
remote us-siliconvalley.privateinternetaccess.com 1198
resolv-retry infinite
nobind
persist-key
persist-tun
cipher aes-128-cbc
auth sha1
tls-client
remote-cert-tls server
auth-user-pass /config/auth/PIA_Creds.txt
comp-lzo
verb 1
reneg-sec 0
crl-verify /config/auth/crl.rsa.2048.pem
ca /config/auth/ca.rsa.2048.crt
disable-occ
(I AM AWARE I NEED A ROUTE-NOPULL HERE - THAT CURRENTLY DISABLES INTERNET ACCESS)
----------INTERFACES----------
show-interfaces:
ethernet eth0 {
address 192.168.17.1/24
description Local
duplex auto
firewall {
in {
modify SOURCE_ROUTE
}
}
speed auto
}
ethernet eth1 {
address dhcp
description Internet
duplex auto
firewall {
in {
name WAN_IN
}
local {
name WAN_LOCAL
}
}
speed auto
}
loopback lo {
}
openvpn vtun0 {
config-file /config/auth/USSiliconValley.ovpn
}
----------ROUTING---------
# show protocols static
interface-route 0.0.0.0/0 {
next-hop-interface vtun0 {
description "PIA Default Route"
distance 1
}
}
table 1 {
interface-route 0.0.0.0/0 {
next-hop-interface vtun0 {
}
}
}
table 2 {
interface-route 0.0.0.0/0 {
next-hop-interface eth1 {
}
}
}
----------FIREWALL POLICY----------
# show firewall modify SOURCE_ROUTE
rule 10 {
description "Excluded from VPN routing"
modify {
table 2
}
source {
address 192.168.17.37/32
}
}
rule 20 {
modify {
table 1
}
source {
address 192.168.17.0/24
}
}