TITAM - Technical issues that affected me

There are obviously LOTS of ways to do this in pfsense.  This is just the way that I found, which seems to work. This rule should prevent an individual machine from "talking" using the default non-VPN WAN connection.  This will prevent it from sending any traffic if the VPN goes down.  Go to Firewall/Rules/Floating Action: Block Quick: Checked Interface: WAN Direction: any Address family: IPv4 Protocol: Any Source: Single host or alias / [set local IP address of host here i.e. 192.168.1.100] Destination: any Description: enter any description here [i.e. "Block this IP from using non-VPN WAN"]  Click "Save" Obvious notes: -  This only really works if the machine in question uses a static IP address. -  You can define multiple rules for different devices. -  You can set the rule to block a range of IP addresses by using "Network" instead of "Single host". This approach does not use policy-based routing and does not decide which machines u...

This was a quick test only, using a popular torrent client.   The Netgear is a recent (faster) example running the latest DD-WRT.  The pfsense box is an eBay i7-7500U special with the latest pfsense. Speeds are peak speeds through Private Internet Acccess (PIA) using AES-256 / SHA256 on their "Next Gen" network.  There were no changes to the rest of the setup between the two trials. Results: Netgear: 4 MiB/s  i7-7500U: 38 MiB/s That's almost a 10x improvement. Note I couldn't get these speeds using all torrents, as some of the sources are limited.  However, I know that the Netgear can't exceed 5 MiB/s no matter what, while the i7 definitely can do 38 MiB/s.  It's possible the i7 might be able to go even faster. From this, it does appear obvious that the Netgear is quite limited with respect to VPN crypto.  Obviously the i7 is vast overkill.  I got it since the price difference between the i3 and i5 was nominal and I really only feel like doin...

Again, this is to set up a private, separate, controllable network to implement parental control for the kids, without affecting the main network. First, don't do what I did here and use a Netgear with Circle built in.  The Synology is SO much better. Very briefly: set the Synology in bridge mode, then set up Safe Access for parental control. Basically: 1.  Get an RT1900AC or other Synology router. 2.  Boot it up, go to router.synology.com. 3.  Set it to Access Point mode. 4.  Give it a unique SSID. 5.  If you want, set it to a static IP address. 6.  Let it start up.  If you haven't already, plug it into your "first" router. 7.  Go to router.synology.com or the static ip:8000 to get to the web interface. 8.  Go to "Safe Access" and set up the profiles/settings you want. 9.  If you want, download the app "DS Router" for mobile management. OK, I probably got the order wrong.  You get the idea. Compared to using the Netgear, it's...

  As of Nov 14, it appears PIA has stopped working again: Play Store not working (on some devices, OK on others) YouTube not working (on some devices, OK on others) Can't connect to BBC.com, CNN.com, but can connect to most other sites fine Smart home devices offline (ecobee, Honeywell, etc)  Honeywell Home: Endless loading Of course, nothing changed on my end, and everything works just fine outside of PIA.  Mobiles also work outside of router-based PIA with the PIA app. See here for the original saga.  Seems they can't keep their network stable for more than 3 months at a time now.  Awesome stuff, those Next-Gen servers - a real improvement! Strangely, the new problems are not as widespread or consistent as before.  One device has no YouTube, but others do.  One device can't access CNN or BBC, but others do.  A third device has no Play Store, but others do. One constant is the smart home devices.  As before, they are connected, but cannot re...

 Problem:  After restoring your PIA connection from after it broke using router-based VPN, you do not have full connectivity.   Specifically, none of your smartphone apps or smart home devices work properly. Your router IS connected to the VPN You ARE using the correct encryption, port, and ca.crt combination They DO have a working internet connection They CAN see the internet They DO work outside the VPN But they can't log in to, or access, their respective servers through the VPN: Gmail: Useless "View more" link that does nothing Banking apps: Can't log in Starbucks: Endless "Finding stores" Ecobee:  "Trouble connecting to your device" Honeywell Home: Endless startup Ratuken Kobo: Endless accessing "My Books" Smart Life: Endless startup Lastpass: Password vault is empty Roblox: Endless loading Minecraft: Can't join multiplayer servers Terraria: Can't join other players  Pixel Guns 3D:  No multiplayer available Ecobee thermostat...

Problem: PIA stops connecting.  No changes on your side.  DD-WRT. Error: N VERIFY ERROR: depth=1 error=certificate has expired: C=US ST=OH L=Columbus O=Private Internet Access CN=Private Internet Access CA emailAddress=secure@privateinternetaccess.com 20200818 14:33:13 N TLS_ERROR: BIO read tls_read_plaintext error: error:14090086:lib(20):func(144):reason(134) Solutions: 1.  Your router time setting is wrong.  Try re-setting or selecting another NTP server, just to be sure. 2.  PIA changed something.  Seems they did so recently (August 18, 2020). If (2), your only real solution is to completely re-set up your DD-WRT router using the latest settings.  Instructions are here . Note: -  Specific protocols now need specific ports.  Be sure to get the right port/.crt combination. -  PIA added a line to "Additional Config": pull-filter ignore "auth-token" This line completely borked my ability to connect - DD-WRT wouldn't even try.  Taking...

Networking using Phone Number Analogy This is a simple guide to understanding basic networking, firewalls, port forwarding, servers and VPNs, using the analogy of telephone numbers at a small business. I hope this will be useful to anyone who is troubleshooting connectivity issues in their network. Single PC You're a small business owner, with a 1-room office ( computer ).  You set up a phone number with you phone company ( internet service provider, ISP ) to get calls.  Your phone number ( internet IP address ) is publicly available and you accept all incoming calls. Single PC Security Things are not ideal since bad actors are tying up your phone line and trying to mislead your employees into sabotage. So, you hire a security guard ( firewall) who screens all incoming and outgoing calls ( packets ) at the office door.  He stops anything that looks wrong, and lets the rest through. Obviously, the guard needs to be told when new employees ( programs ) ar...

VPNs are good but their connections are rarely perfect.  Usually, when they disconnect, your router fails over back to using the unencrypted WAN connection.  This is convenient but leaves your network connection exposed, which rather defeats the purposes.  Likely little point in being protected only 99% of the time, right? Worse, you don't even know if the VPN is off.  Everything just blithely continues on as usual.  You'll only know if you manually check.  Which is stupid. If you're like me, there are some devices on the network where you don't really care if they keep working or not.  Perhaps there are some where you actually want them to keep working, even if the VPN stops (Netflix?).  And there are probably a couple where you want them to stop working the second the VPN goes down. If you search you will find lots of VPN monitoring programs that purport to kill programs upon VPN disconnect.  However, not one of these will work if...

Short answer:  You can't. Wish I'd known this before spending half a weekend figuring out how to change client DNS servers by MAC or IP address. If you try to reset your router or PC to the OpenDNS DNS server addresses, it will not work.  DNSleak will still report you using the PIA DNS server(s) associated with PIA, such as 209.222.18.218. The reason is that PIA forces you to use these servers.  From the OpenDNS support system: DNS Servers Keep Changing Away from OpnDNS Automatically 3) 209.222.18.222 and 209.222.18.218: You are currently using a privateinternetaccess VPN service. This service's VPN client automatically sets your DNS servers to 209.222.18.222 and 209.222.18.218 and cannot be changed while you are connected to the VPN. Unfortunately, there is no way around this, and you will be unable to use OpenDNS while connected to this type of VPN client. Solutions: Cease using privateinternetaccess for VPN service and switch providers to one that suppor...

I expect a lot of people want to do what I want to do:  set up a VPN on my router.  This allows everything I do online to run through a VPN service first, and setting this up on a router automatically ensures that everything on my network (wired or wireless) is protected. Kewl though this is, there are lots of potential problems and pitfalls with setting up a VPN.  For example: -  Skype or VoIP devices not working properly -  Game consoles or online games not working properly -  Inability to remotely access web (http) and/or FTP servers within the protected network -  Inability to access remote web portals / management interfaces within the protected network These come down to two issues: -  Increased latency, which causes gaming, VoIP, Skype, streaming services etc. to fail -  Inability to "see" servers and remote interfaces living within the VPN from the outside world Finding answers to these issues is not easy.  Investig...