Setup firewall rules
Create alias for VPN clients
Firewall –> Aliases –> Add
Name –> Something rememberable, for example “WindscribeClients”
Description –> Client IPs that will use Windscribe VPN
Type –> Hosts
Hosts –>Add the IPs from your network that will be using Windscribe.
Save
Create LAN rule
Firewall –> Rules –> Your LAN Interface
Add a new rule to the top of the list
Action –> Pass
Interface –> Your LAN interface
Address Family –> IPv4
Protocol –> Any
Source –> Single host or alias –> The alias you created above, such as “WindscribeClients”
Click Advance
Tag –> Name it something like “Windscribe_VPN_Only”
Gateway –> The gateway group you created earlier, for example “Windscribe_VPN_Group”
Save
Create floating rule
Floating allow rule
Firewall –> Rules –> Floating
Add a new rule to the top of the list
Action –> Pass
Quick –> Check the box
Interface –> Select all the Wireguard interfaces you created by holding down the Ctrl key on your keyboard and clicking on the interfaces
Address Family –> IPv4
Protocol –> Any
Source –> Any
Destination –> Any
Click Advance
Tagged –> Use the same tag that you created in the LAN rule, for example “Windscribe_VPN_Only”
Gateway –> Default
Save
Floating block rule
Firewall –> Rules –> Floating
Add a new rule directly below the the floating pass rule you created
Action –> Block
Quick –> Check the box
Interface –> WAN
Address Family –> IPv4+IPv6
Protocol –> Any
Source –> Any
Destination –> Any
Log –> Check the box to enable “Log packets that are handled by this rule”
Click Advance
Description –> Block tagged Windscribe_VPN_Only traffic going over WAN
Tagged –> Windscribe_VPN_Only
Save
Create NAT Outbound rules
Firewall –> NAT –> Outbound
Select “Hybrid Outbound NAT rule generation”
Add new Mapping
Interface –> The Windscribe interface for your wireguard tunnel you created earlier
Address Family –> IPv4
Protocol –> Any
Source –> Network –> The alias you created above, such as “WindscribeClients”
Translation Address –> Interface Address
Save
Repeat steps to create additional Mapping for each Wireguard interface that you created.
Next: Test and confirm configuration
Leave a Reply