Avira Phantom VPN OPNsense VPN Split Tunneling Setup
Avira Phantom VPN OPNsense VPN Split Tunneling Setup
To leverage Avira Phantom VPN with OPNsense for split tunneling, the initial step involves setting up the Avira Phantom VPN client on a separate machine within your network. This machine will act as a gateway for specific traffic that you want to route through the VPN. Ensure the Avira Phantom VPN application is installed and properly configured on this dedicated device. Note the internal IP address of this client; this will be crucial for subsequent routing rules within OPNsense. Since Avira Phantom VPN does not offer a traditional VPN server component or configuration files for direct integration into OPNsense via OpenVPN or WireGuard, this client-based approach is necessary.
The core of split tunneling lies in selectively routing traffic through the Avira Phantom VPN client. In OPNsense, navigate to Firewall -> Aliases and create an alias containing the IP addresses or networks you wish to route through the VPN. For example, create an alias named avira_vpn_destinations containing a list of IPs. Next, go to Firewall -> Rules -> LAN (or your relevant interface). Create a new rule at the top of the list. The rule should specify:
Action: Pass
Interface: LAN
Protocol: Any
Source: LAN net (or the specific network you want to split tunnel)
Destination: avira_vpn_destinations (the alias created earlier)
Gateway: The IP address of the machine running the Avira Phantom VPN client.
This rule directs traffic destined for the IPs in avira_vpn_destinations through the Avira Phantom VPN client. Ensure the "Disable reply-to" option is unchecked. For DNS, if you want to use the Avira Phantom VPN DNS servers for the split-tunneled traffic, configure DNS resolver on the client machine to use Avira Phantom VPN's DNS. Then, create another firewall rule to redirect DNS queries from the split-tunneled network to the client machine.
OPNsense's firewall needs to allow traffic initiated from the Avira Phantom VPN client back into the internal network. Create a firewall rule on the interface where the Avira Phantom VPN client resides (likely LAN) that allows all traffic from the client's IP address to any destination on the internal network.
NAT (Network Address Translation) might be required. If the Avira Phantom VPN client is on a different subnet than the rest of your LAN, you might need to configure outbound NAT rules in OPNsense. Navigate to Firewall -> NAT -> Outbound. Create a new rule that translates traffic originating from the Avira Phantom VPN client's IP address to the OPNsense WAN IP address. This ensures that return traffic from the internet is properly routed back to the client.
To verify the split tunneling configuration, use a tool like traceroute or mtr from a machine within the LAN. Traceroute to an IP address within the avira_vpn_destinations alias should show the Avira Phantom VPN client's IP address as a hop. Traceroute to an IP address not in the alias should not show the client's IP.
If traffic is not routing correctly, double-check the firewall rules and routing configuration. Ensure that the alias avira_vpn_destinations contains the correct IP addresses. Verify that the Avira Phantom VPN client is functioning correctly and that it is able to reach the internet. Examine the OPNsense firewall logs to identify any blocked traffic. Pay close attention to DNS resolution; incorrect DNS settings can lead to connectivity issues.