VPN Part 3 - Aliases and Firewall

This is Part 3 of the VPN configuration. If part 1 and 2 configuration isn’t complete, this will cause problems.

At this point, the connection is up, there’s an IP address on it, this section will set up rules to allow traffic from internal networks to be sent across the VPN.

It will configure:

1. Alias group(s) that will hold the IP/Networks of servers to pass over the VPN
2. Outbound NAT rules to modify traffic so it can go over the VPN
3. Firewall rules to specify what traffic to configure

Creating the Aliases

1. Navigate the Web Interface to Firewall -> Aliases
2. Click + to add an Alias

Add an alias as follows:

Field	Value	Notes
Name	VPN_Websites	Try to avoid any odd names/putting spaces in etc
Type	Networks
Categories	VPN_Websites

3. Click Save
4. Click + to add a new Alias for IPv6 if needed:

Field	Value	Notes
Name	VPN_Websites_IPv6	Same comment about spaces as above
Type	Networks
Categories	VPN_Websites

5. Click Save
6. Click Apply

Creating a NAT Rule

These rules will inspect traffic coming into the router, and if it should be sent over the VPN, it will change the gateway to one of the VPN gateways that has been configured

Configure OPNsense to Allow Manual NAT Rules

1. Navigate to Firewall -> NAT -> Outbound
2. In the Mode section, select Hybrid outbound NAT rule generation
3. Click Apply

Make the NAT Rules

1. Ensue the Web Interface is at Firewall -> NAT -> Outbound
2. In the Manual Rules section, click +
3. Create a rule for IPv4 as follows:

Field	Value	Notes
Interface	WG_MULLVAD
TCP/IP Version	IPv4
Source Address	Your Internal Network - LAN/INT etc
Destination Address	VPN_Websites
Translation/Target	WG_MULLVAD address

4. Click Save
5. Create another rule for IPv6

Field	Value
Interface	WG_MULLVAD
TCP/IP Version	IPv6
Source Address	Your Internal Network - LAN/INT etc
Destination Address	VPN_Websites_IPv6
Translation Target	WG_MULLVAD address

6. Click Save
7. Click Apply

That’s it, all the configuration is done for Synclias

Testing Connectivity before using Synclias

If you’d like to test the VPN connectivity, you can route all of your traffic over the VPN :

• Edit the firewall rules to remove the relevant “VPN_Websites” and apply your changes
• Test with whatever “What is my IP address” site you like
• Remember to put the VPN Website alias back in when done!