I am using PfSense as a firewall, with its VPN functionality. The client I use is Shrew Soft VPN client. As it is a split tunnel, is there a way I can force all traffic through the VPN connection, i.e. so my external IP is always the PfSense box's one.

The reason I would like to do this is because the locations I access my servers from has DHCP assigned addresses via the ISP. I cannot afford a static IP, it isnt included in my package, but I lockdown my servers to only some IP's. When the ISP allocates a new IP, I am unable to access my servers through SSH. I have allowed the IP of the PfSense box as it is in a location which has a static IP.

How would I overcome this, is there an alternative to trying to force the traffic through the VPN tunnel?

Thanks in advance for help.

migrated from security.stackexchange.com Apr 16 '14 at 17:49

This question came from our site for information security professionals.

  • Use Dynamic DNS. – tylerl Apr 16 '14 at 16:44
  • @tylerl please explain :) – user3227965 Apr 16 '14 at 16:48
  • Had a quick Google search, Ill look into that. Thanks – user3227965 Apr 16 '14 at 16:52

Configure your routing table in linux. Fairly straightforward, but will depend on your current configuration.

Type route -n to see your current routing table (on Mac OS X its netstat -rn).

Note the default route (the one that's destination, that matches everything. The basic way a routing table works is that traffic will match the most specific rule -- all it needs to know is where the first hop should go. So a command like:

sudo route add -net ppp0
sudo route add -net ppp0

would add a line to your routing table that will take send any traffic going to an address matching those rules (all IP addresses that start with 10.*.*.* for the first rule and all IP addresses that match 1.2.3.* for the second rule) and send traffic to the ppp0 interface. (Assuming its ppp0 interface).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy