VLAN and ProtonVPN IPsec

[ashoka]

You have mode config with both connection-mark=ProtonVPN and src-address-list=vpn. I never tested it, but I assume that packets would need both the right source address and connection mark. But you have no connection marks. Remove connection-mark=ProtonVPN and it will probably work.

Thank you! I could connect through the VPN tunnel. At least, the IP is in the Netherlands, as expected. Nevertheless, it is getting my global system DNS and I cannot access to some sites properly (probably MSS issues). I guess I will have to edit something more. Since a couple of versions ago, there is the variable use-reponder-dns in the IPSec mode-config; but if I activate it, I get a dynamic DNS in the whole router that I want to avoid. I’ve seen some other posts with this issue and it seems that the only way to deal with that is editing the firewall. Please correct me if I am wrong.

Btw, your “Exclude VPN traffic from fasttrack” rule allows access from 10.0.20.0/24 to anywhere and following “VLAN internet access only, NOT each other” has no effect on this traffic. You can add src-address-list=!vpn to fasttrack rule instead.

…

It is too late for me (I do remember we share the time zone, but not the activity time ) You are right, “only packets whose neither source nor destination is on the VPN address list” sounds sufficient. I even realize why I’ve made that mistake, you cannot express “ipsec-policy=in,ipsec or ipsec-policy=out,ipsec” in a single rule.

Yes… my firewall rules are far from perfect. I am still learning how to do it properly without breaking my current configuration. I have to test your suggestions

Thank you again