Merlin 380.65_4 OpenVPN Simple Policy Rules Question

[Kaydog]

I have my openvpn all setup and connected to pia. I would like to have 3 static Ip's not go through the vpn while all others go thru the vpn. my ip range is 192.168.1.2 to 254. My static Ips 192.168.1.251, 192.168.1.252, and 192.168.1.253.

I've tried the following:
192.168.1.251 0.0.0.0 WAN
192.168.1.252 0.0.0.0 WAN
192.168.1.253 0.0.0.0 WAN

But when I apply this all Ips go to wan. What am I missing?

 

[Martineau]

I have my openvpn all setup and connected to pia. I would like to have 3 static Ip's not go through the vpn while all others go thru the vpn. my ip range is 192.168.1.2 to 254. My static Ips 192.168.1.251, 192.168.1.252, and 192.168.1.253.

I've tried the following:
192.168.1.251 0.0.0.0 WAN
192.168.1.252 0.0.0.0 WAN
192.168.1.253 0.0.0.0 WAN

But when I apply this all Ips go to wan. What am I missing?

https://www.snbforums.com/threads/open-vpn-client-redirect-internet-policy.37530/#post-308797

 

[CaptainSTX]

https://www.snbforums.com/threads/open-vpn-client-redirect-internet-policy.37530/#post-308797

Try shortening up your DHCP pool so that the static addresses are not included within the pool.

 

[Kaydog]

Try shortening up your DHCP pool so that the static addresses are not included within the pool.

Thanks Martineau and CaptainSTX. I got it working. I followed both yours and Yorgi's input. Here is what I did. I made my dynamic ip pool 192.168.1.100-254, Then I assigned the 3 static ips 0f 192.168.1.2,3,&4

So my policy rules are as follows:
192.168.1.2 0.0.0.0 WAN
192.168.1.3 0.0.0.0 WAN
192.168.1.4 0.0.0.0 WAN

Then I directed all of the dynamic ip pool thru the vpn:
192.168.1.100/30 0.0.0.0 VPN
192.168.1.104/29 0.0.0.0 VPN
192.168.1.112/28 0.0.0.0 VPN
192.168.1.128/26 0.0.0.0 VPN
192.168.1.192/27 0.0.0.0 VPN
192.168.1.224/28 0.0.0.0 VPN
192.168.1.240/29 0.0.0.0 VPN
192.168.1.248/30 0.0.0.0 VPN
192.168.1.252/31 0.0.0.0 VPN

Was there an easier way? The second half seems a little cumbersome.

Thanks again,
Kaydog

 

[CaptainSTX]

Thanks Martineau and CaptainSTX. I got it working. I followed both yours and Yorgi's input. Here is what I did. I made my dynamic ip pool 192.168.1.100-254, Then I assigned the 3 static ips 0f 192.168.1.2,3,&4

So my policy rules are as follows:
192.168.1.2 0.0.0.0 WAN
192.168.1.3 0.0.0.0 WAN
192.168.1.4 0.0.0.0 WAN

Then I directed all of the dynamic ip pool thru the vpn:
192.168.1.100/30 0.0.0.0 VPN
192.168.1.104/29 0.0.0.0 VPN
192.168.1.112/28 0.0.0.0 VPN
192.168.1.128/26 0.0.0.0 VPN
192.168.1.192/27 0.0.0.0 VPN
192.168.1.224/28 0.0.0.0 VPN
192.168.1.240/29 0.0.0.0 VPN
192.168.1.248/30 0.0.0.0 VPN
192.168.1.252/31 0.0.0.0 VPN

Was there an easier way? The second half seems a little cumbersome.

Thanks again,
Kaydog

You could shorten your DHCP list down to 20 then you would have many fewer IPs to assign to VPN. If clients are connecting by WiFi then your router really can't handle many more clients. If connecting by Ethernet then adjust accordingly.

 

[john9527]

Was there an easier way? The second half seems a little cumbersome.

WAN rules always take precedence over VPN rules.....so you can just add your entire subnet to the VPN, then the WAN exceptions.

192.168.1.0/24 0.0.0.0 VPN
192.168.1.2 0.0.0.0 WAN
192.168.1.3 0.0.0.0 WAN
192.168.1.4 0.0.0.0 WAN

 

[Kaydog]

WAN rules always take precedence over VPN rules.....so you can just add your entire subnet to the VPN, then the WAN exceptions.

192.168.1.0/24 0.0.0.0 VPN
192.168.1.2 0.0.0.0 WAN
192.168.1.3 0.0.0.0 WAN
192.168.1.4 0.0.0.0 WAN

Thanks John,
Much more eloquent! I like it.
Best,
K