Killswitch is not working with OpenVPN #28
Comments
|
Hi @munibsiddiqui I don't fully understand the problem
After you have the VPN and killswitch you want to connect to another VPN? is yes then makes sense because the other VPN may be adding its own routes the ones are probably closed by the existing VPN, if you want to have "chained" VPNs, I found it easy to have one in the router and then one in my devices. |
|
@nbari Thank you for quick response. Unfortunately thats not the problem. Let me explain it in steps. Steps
Now When I connect with OpenVPN protocol. (ExpressVPN, NordVPN, Manual with Configuration)
I hope you understand the problem well now. |
|
Hi, try to use your peer IP: normally is detected automatically |
|
@nbari Yes it detect automatically. But i did tried what you said and the results are same. It stops all the network activity, despite being connected with VPN.
|
|
The VPN is in utun2? probably is running in another interface, what about DNS queries? after VPN is on ping to IP works for example trying ping to 1.1.1.1? By the way what color/palette for your terminal you are using (looks very nice) |
|
@nbari Yes VPN interface is utun2. If VPN is connected and KillSwitch is enabled If VPN is Connected and KillSwitch is disabled I am using iTerm2 with theme the following theme :) |
|
utun2 is VPN interface.
|
|
some VPN clients come with a killswitch try to disable it, what provider is this? there are multiple things to check/do but instead of guessing I would suggest installing Wireshark, you open it and start your VPN, you will see a lot of traffic, and then you enable the killswitch, there you will catch all the request, including the peer IP as many other requests based on that firewall rules can be stunned |
|
@nbari Did tried but no fruitful result :( |
|
@nbari I tried to checked the pflog. It seems like the packet being blocked by the rules on utun2. I am not sure why, please have a look at the given log may be you can help me in right direction. |
|
for that log what was the Peer IP ? |
|
@nbari The Peet IP was : 79.142.64.209 |
|
Something is strange since is blocking traffic to the peer ip: |
|
@nbari Yes thats strange. We have the following rules in placed in PF. |
|
if you can share credentials/provider I could give it a try |
|
@nbari Can I have your email address so that I can send you the required information. |
|
install ssh-vault It will open your editor (probable vim), you write everything you need there, save and exit, and send me the |
|
@nbari Sorry for late. Please see the following information. |
|
hi @munibsiddiqui I am indeed having the same issue, I will check it these days and hopefully try to come with something working |
|
hi @munibsiddiqui here sharing some initial tests/findings, I notice that the tunnel is not changing the default gateway: if using other protocols, the interface instead of being but the default What I am doing for debugging is: $ sudo ifconfig pflog0 createDo some changes in the rules and load them: Then check the logs with: maybe we need to use the PF |
|
@nbari Awesome, I am trying to make few changes let see what happens :) |
|
@nbari I tried everything but haven't got any solution. But I found case which is interesting. When KillSwitch is applied after connecting VPN is blocks all network packet, interestingly I disconnected the VPN and leave the KillSwitch rules in placed and then reconnect the VPN it does not block any packet. :) Not sure why but this is interesting. May be the rules are blocking some port. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Hi,
Thank you for this awesome utility. Recently, I am facing the following problem with KillSwitch.
When connecting with IKEv2 and IPSec protocol the KillSwitch works great but as soon as I connect with OpenVPN (TCP or UDP) it stops the entire networks.
I have also checked it the rules are applied correctly using the command
pfctl -s rulesand it shows me the rules applied.@nbari Please help me in this context. I will really appreciate your help.
The text was updated successfully, but these errors were encountered: