Categories
Gaming Uncategorized

Transfer CS2 settings and configuration to another account

Sometimes I use a second account to play with lower ranked friends. To copy settings to the other account, make sure you’ve logged into both on your computer, and opened CS2. You need to know where you install games/STEAM. The default is in C:\Program Files (x86)\Steam . Once in there, navigate to

C:\Games\Steam\userdata\STEAMID\

Then for the new account, navigate to

C:\Games\Steam\userdata\STEAMID2

Now copy all of the 730 and recursive contents of folder into STEAMID2.

Categories
General Computing

Google search results showing incorrect date stamps and calendar – updated Sep 2023

I run into this a lot when I travel, or live in different parts of the world for a little bit. Example, my search results are showing up as BE while I am in Thailand. And as of Sep 22 2023, it looks like Google changed the way you modify this. So this is an update to what I previously posted November of 2022:

Same issue, slightly different way to fix it. Caveats, you will need to be logged into a Google account to fix. And protip, set your homepage to ncr, as that will not give you a region lock either: https://www.google.com/ncr

Click on Settings then Search settings in the bottom left:

Select other settings on the left, and then Language & region

Then select results region

Then search for and select your region and click on confirm

Then you are good to go. Enioy your search results.

Categories
General Computing

How to remove “All Bookmarks folder” in Chrome

This started happening a few days ago. Super annoying and takes up an extra folder or two in my bookmarks bar. But it can be removed. You can remove it by opening a new tab and typing:

 about://flags

Scroll to “Power bookmarks side panel” and change it to disabled. It will require a chrome relaunch.

Categories
Operating Systems

Did you get a Windows configuration update for Windows 11?

Did you received a Windows configuration update for Windows 11 on September 13th 2023 or so? I noticed this on 3 of my Windows 11 22H2 computers. This one was weird, typically there is a request for reboot based on a KB and lets you know. This one had no information regarding what it was related to.

Looking at my Windows update history (Search for Update History on your search bar), it is likely KB5030219 or KB5031217 . If you click on those links, it will direct you to the Microsoft KB and details as to what it likely was related to.

Let me know if I am wrong, but I am guessing this is likely what that meant.

Categories
Linux

Expanding / partition in Linux operating system live with no downtime

I had a disk that was not fully expanded. It only partitioned 4.8GB to the /. So I wanted to expand it live, with no downtime, or data loss. Either way, I would ALWAYS back up the data before doing this even you care about it at all. Either way you should have backups if you want to keep it regardless. I tested this just now with Almalinux 8, but I imagine it would work for a slew of other operating systems, as you only need fdisk and resize2fs, which all come with most operating systems.

I will say it one more time before we start, BACK UP YOUR DATA, always. And test those backups.

df -h to check current disk size or fdisk -l /dev/vda1

[root@72 ~]# df -h
Filesystem      Size  Used Avail Use% Mounted on
devtmpfs        3.8G     0  3.8G   0% /dev
tmpfs           3.8G     0  3.8G   0% /dev/shm
tmpfs           3.8G  395M  3.5G  11% /run
tmpfs           3.8G     0  3.8G   0% /sys/fs/cgroup
/dev/vda1       4.8G  3.8G  774M  84% /
tmpfs           777M     0  777M   0% /run/user/0

You will notice your mount pount/partition is tight or 100% used up. Expand that partition via KVM, VMWARE, Cockpit, Proxmox, etc. That is outside the scope of this article. It is technology dependent how you want to expand your disk. Once you’ve done that, you can reboot, or try running a rescan.

echo 1 > /sys/block/vda/device/rescan

Once that is done and you’ve expanded your disk, we can expand it. Drop into fdisk:

[root@72 ~]# fdisk /dev/vda

Welcome to fdisk (util-linux 2.32.1).
Changes will remain in memory only, until you decide to write them.
Be careful before using the write command.

Then we will run through deleting the primary partition, and recreating it with the entire disk you now have. Here is the combo of letters to get through the prompts. I will follow it up with text I ran, as I prefer to see it in console. p, d, 1, n, p, 1 and then hit enter for default first and last sector. Then n to NOT remove the signature, and w to write it out.

Command (m for help): p
Disk /dev/vda: 250 GiB, 268435456000 bytes, 524288000 sectors
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x318ba904

Device     Boot     Start       End   Sectors  Size Id Type
/dev/vda1  *         2048 507508351 507506304  242G 83 Linux
/dev/vda2       507508352 524285567  16777216    8G 82 Linux swap / Solaris

Command (m for help): d
Partition number (1,2, default 2): 1

Partition 1 has been deleted.

Command (m for help): n
Partition type
   p   primary (1 primary, 0 extended, 3 free)
   e   extended (container for logical partitions)
Select (default p): p
Partition number (1,3,4, default 1): 1
First sector (2048-524287999, default 2048):
Last sector, +sectors or +size{K,M,G,T,P} (2048-507508351, default 507508351):

Created a new partition 1 of type 'Linux' and of size 242 GiB.
Partition #1 contains a ext4 signature.

Do you want to remove the signature? [Y]es/[N]o: n

Command (m for help): w

The partition table has been altered.
Syncing disks.


Now that is done you can resize to expand it with resize2fs and run df -h once again to see the expansion complete.

[root@72 ~]# resize2fs /dev/vda1
resize2fs 1.45.6 (20-Mar-2020)
Filesystem at /dev/vda1 is mounted on /; on-line resizing required
old_desc_blocks = 1, new_desc_blocks = 31
The filesystem on /dev/vda1 is now 63438288 (4k) blocks long.

[root@72 ~]# df -h
Filesystem      Size  Used Avail Use% Mounted on
devtmpfs        3.8G     0  3.8G   0% /dev
tmpfs           3.8G     0  3.8G   0% /dev/shm
tmpfs           3.8G  395M  3.5G  11% /run
tmpfs           3.8G     0  3.8G   0% /sys/fs/cgroup
/dev/vda1       239G  3.8G  225G   2% /
tmpfs           777M     0  777M   0% /run/user/0
[root@72 ~]#

Boom, enjoy.

Categories
Uncategorized

Charles Schwab referral code

For whatever TD Ameritrade is dumping individual stock accounts. I’ll be moving my account over to Schwab which has a pretty decent new account referral bonus. If you create an account with this referral code: REFER48AYXMP4 or utilize this link: https://www.schwab.com/client-referral?refrid=REFER48AYXMP4 to get the bonus. Your transfer of your TD Ameritrade account will count towards these numbers:

Bonus deposit: $1,000
When you net deposit $500,000 or more
Bonus deposit: $500
When you net deposit $100,000 – $499,999
Bonus deposit: $300
When you net deposit $50,000 – $99,999
Bonus deposit: $100
When you deposit $25,000 – $49,999

If you are not depositing that much, you can also just use the start-kit code, it gives you $101 for only depositing $50: https://www.schwab.com/investing-starter-kit

As far as I have seen, I get zero benefit from this, but hopefully you get some free money for your transfer!

Categories
cPanel

Email accounts disappeared in cPanel

I am unsure why, but most likely this comes through via some sort of exploit of a plugin a user has. I have seen email accounts disappear in cPanel users email accounts page. Yet their email functions fine. I found this article and it spoke a little about the issue:

https://support.cpanel.net/hc/en-us/articles/360052477034-Email-accounts-are-missing

I found it was easiest to lay it out. My example shows user anthony@vivithemage.com was not there, and this is how to restore it. If you have the passwd file or if you recall what the usernames of the email accounts should be, you can get them back showing in cPanel to modify them. This will show you what user had an email account:

[root@madhost613 vivithemage.com]# cat /home/vivithem/etc/vivithemage.com/passwd
anthony:x:671:673::/home/vivithem/mail/vivithemage.com/anthony:/usr/local/cpanel/bin/noshell
[root@madhost613 vivithemage.com#

Or you can pull it out from your email_accounts.json file:

[root@madhost613 vivithemage.com]# cat /home/vivithem/.cpanel/email_accounts.json
{"vivithemage.com":{"quota_mtime":1676555934,"disk_mtime":1676530335,"account_count":1,"shadow_mtime":1676555934,"accounts":{"anthony":{"suspended_login":0,"disk_mtime":1494927201,"diskused":"8041555","diskmtime":1676530335}}},"__version":3,"vivithemage.net":{"accounts":{},"account_count":0},"vivithemage.org":{"accounts":{},"account_count":0}}
[root@madhost613 vivithemage.com]#

now create a new shadow file in the correct directory and change ownership to the ACCOUNT. In my case it is:

cd /home/vivithem/etc/vivithemage.com/
chown vivithem:vivithem shadow

and dump this line in for EACH user missing:

anthony:$6$eGMpFjEJEI3349z3$.dhfm1rs/ftxFa8Rt8zs4yAA5dHCBdOb7P2T42Pwi/i5GpXb45BjoXiDccRbtmrwwoQkAHWF3mOwOouloYvvS1:18635::::::

If you have a second user with Elyssa you would now have this:

anthony:$6$eGMpFjEJEI3349z3$.dhfm1rs/ftxFa8Rt8zs4yAA5dHCBdOb7P2T42Pwi/i5GpXb45BjoXiDccRbtmrwwoQkAHWF3mOwOouloYvvS1:18635::::::
elyssa:$6$eGMpFjEJEI3349z3$.dhfm1rs/ftxFa8Rt8zs4yAA5dHCBdOb7P2T42Pwi/i5GpXb45BjoXiDccRbtmrwwoQkAHWF3mOwOouloYvvS1:18635::::::

replace anthony with your username missing from passwd. The hash following is irrelevant, because once you do this, you can change the password via cPanel as you would normally.

Once done this auto populates them in cPanel with no restarts required. It’s a bit of a manual process, but at least this way you can get back on with your life and reset passwords.

Categories
General Computing

Google search results showing incorrect date stamps and calendar

UPDATE SEPTEMBER 22 2023 with a new link due to changes by Google:

I run into this a lot when I travel, or live in different parts of the world for a little bit. Example, my search results are showing up as BE while I am in Thailand.

This is actually a pretty easy fix. In chrome, while logged into my Google account, I go to google.com. Protip, set your homepage to ncr, as that will not give you a region lock either: https://www.google.com/ncr

Then click on settings, then Search settings.

Once there, scroll to the bottom and you will see the option for region settings. The default is current region, which picks up where you are based on IP address most likely, I have not investigated how it picks that region up.

Click on the show more option to show all of the other countries.

My preference is the United States, I select that and click save.

Once that is done, you are good to go. Your Google search results should always show your preferred date and calendar.

Categories
Android

Google Pixel 6 Pro Case vs Pixel 7 Pro Case

I really disliked what happened to my Google 6 Pro Case that I purchased direct from Google Store when the 6 pro was released. So it has about 12 months of daily driving use on it. It slowly started warping on the edges and flexing everywhere. Then it started to peal away from the inner plastic case. It was a shame. I was a huge fan of the Google Pixel 4 fabric cases, and they’ve since discontinued them. The good news is the Pixel 7 Pro case looks much better.

Categories
pfsense

Setting up openVPN client on your pfSense (Surfshark)

Surfshark provides a cheap VPN service that allows unlimited number of devices with ad blocking. In this tutorial we are going to configure pfSense with Surfshark and assign an interface to it so that we can route it to other services.

Surfshark information

The first step is getting your Surfshark credentials. Go to the login page at https://account.surfshark.com/  and log in. Next, go to Advanced >> Devices >> Manual, scroll down to the bottom of the page and take note of your service credentials.

On the same page of your account, you will find the list of all configuration files and domain name of their servers grouped by country/continent. Take this opportunity and copy the domain URL of the locations you want to use later on.

pfSense configuration

Once you are logged in on your pfSense, go to System >> Cert. Manager >> CAs and click on Add to create a new Certificate Authority as follows:

Descriptive Name: Surfshark_VPN
Method: Import an existing Certificate Authority
Certificate data:

-----BEGIN CERTIFICATE-----
MIIFTTCCAzWgAwIBAgIJAMs9S3fqwv+mMA0GCSqGSIb3DQEBCwUAMD0xCzAJBgNVBAYTAlZHMRIwEAYDVQQKDAlTdXJmc2hhcmsxGjAYBgNVBAMMEVN1cmZzaGFyayBSb290IENBMB4XDTE4MDMxNDA4NTkyM1oXDTI4MDMxMTA4NTkyM1owPTELMAkGA1UEBhMCVkcxEjAQBgNVBAoMCVN1cmZzaGFyazEaMBgGA1UEAwwRU3VyZnNoYXJrIFJvb3QgQ0EwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDEGMNj0aisM63oSkmVJyZPaYX7aPsZtzsxo6m6p5Wta3MGASoryRsBuRaH6VVa0fwbI1nw5ubyxkuaNa4v3zHVwuSq6F1p8S811+1YP1av+jqDcMyojH0ujZSHIcb/i5LtaHNXBQ3qN48Cc7sqBnTIIFpmb5HthQ/4pW+a82b1guM5dZHsh7q+LKQDIGmvtMtO1+NEnmj81BApFayiaD1ggvwDI4x7o/Y3ksfWSCHnqXGyqzSFLh8QuQrTmWUm84YHGFxoI1/8AKdIyVoB6BjcaMKtKs/pbctk6vkzmYf0XmGovDKPQF6MwUekchLjB5gSBNnptSQ9kNgnTLqi0OpSwI6ixX52Ksva6UM8P01ZIhWZ6ua/T/tArgODy5JZMW+pQ1A6L0b7egIeghpwKnPRG+5CzgO0J5UE6gv000mqbmC3CbiS8xi2xuNgruAyY2hUOoV9/BuBev8ttE5ZCsJH3YlG6NtbZ9hPc61GiBSx8NJnX5QHyCnfic/X87eST/amZsZCAOJ5v4EPSaKrItt+HrEFWZQIq4fJmHJNNbYvWzCE08AL+5/6Z+lxb/Bm3dapx2zdit3x2e+miGHekuiE8lQWD0rXD4+T+nDRi3X+kyt8Ex/8qRiUfrisrSHFzVMRungIMGdO9O/zCINFrb7wahm4PqU2f12Z9TRCOTXciQIDAQABo1AwTjAdBgNVHQ4EFgQUYRpbQwyDahLMN3F2ony3+UqOYOgwHwYDVR0jBBgwFoAUYRpbQwyDahLMN3F2ony3+UqOYOgwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAgEAn9zV7F/XVnFNZhHFrt0ZS1Yqz+qM9CojLmiyblMFh0p7t+Hh+VKVgMwrz0LwDH4UsOosXA28eJPmech6/bjfymkoXISy/NUSTFpUChGO9RabGGxJsT4dugOw9MPaIVZffny4qYOc/rXDXDSfF2b+303lLPI43y9qoe0oyZ1vtk/UKG75FkWfFUogGNbpOkuz+et5Y0aIEiyg0yh6/l5Q5h8+yom0HZnREHhqieGbkaGKLkyu7zQ4D4tRK/mBhd8nv+09GtPEG+D5LPbabFVxKjBMP4Vp24WuSUOqcGSsURHevawPVBfgmsxf1UCjelaIwngdh6WfNCRXa5QQPQTKubQvkvXONCDdhmdXQccnRX1nJWhPYi0onffvjsWUfztRypsKzX4dvM9k7xnIcGSGEnCC4RCgt1UiZIj7frcCMssbA6vJ9naM0s7JF7N3VKeHJtqe1OCRHMYnWUZt9vrqX6IoIHlZCoLlv39wFW9QNxelcAOCVbD+19MZ0ZXt7LitjIqe7yF5WxDQN4xru087FzQ4Hfj7eH1SNLLyKZkA1eecjmRoi/OoqAt7afSnwtQLtMUc2bQDg6rHt5C0e4dCLqP/9PGZTSJiwmtRHJ/N5qYWIh9ju83APvLm/AGBTR2pXmj9G3KdVOkpIC7L35dI623cSEC3Q3UZutsEm/UplsM=
-----END CERTIFICATE-----

Once you are done, click on Save.

The next step is creating the VPN client connection. Navigate to VPN >> OpenVPN >> Clients and press Add.

General Information

Disable this client: leave unchecked
Server mode: Peer to Peer (SSL/TLS)
Protocol: UDP on IPv4 only (you can also use TCP)
Device mode: tun – Layer 3 Tunnel Mode
Interface: WAN
Local port: leave blank;
Server host or address: The server address that you want to connect (e.g. us-sea.prod.surfshark.com)
Server port: 1194 (use 1443 if you use TCP)
Proxy host or address: leave blank
Proxy port: leave blank
Proxy Authentication: None
Description: Any name you like (e.g. Surfshark US Seattle)

User Authentication Settings

Username: Username from Surfshark account
Password: Password from Surfshark account
Authentication Retry: unchecked

Cryptographic Settings

TLS Configuration: Check
Automatically generate a TLS Key: Uncheck
TLS Key:

-----BEGIN OpenVPN Static key V1-----
b02cb1d7c6fee5d4f89b8de72b51a8d0
c7b282631d6fc19be1df6ebae9e2779e
6d9f097058a31c97f57f0c35526a44ae
09a01d1284b50b954d9246725a1ead1f
f224a102ed9ab3da0152a15525643b2e
ee226c37041dc55539d475183b889a10
e18bb94f079a4a49888da566b9978346
0ece01daaf93548beea6c827d9674897
e7279ff1a19cb092659e8c1860fbad0d
b4ad0ad5732f1af4655dbd66214e552f
04ed8fd0104e1d4bf99c249ac229ce16
9d9ba22068c6c0ab742424760911d463
6aafb4b85f0c952a9ce4275bc821391a
a65fcd0d2394f006e3fba0fd34c4bc4a
b260f4b45dec3285875589c97d3087c9
134d3a3aa2f904512e85aa2dc2202498
-----END OpenVPN Static key V1-----

TLS Key Usage Mode: TLS Authentication
Peer certificate authority: Surfshark_VPN
Peer Certificate Revocation list: do not define

Client certificate: webConfigurator default
Encryption Algorithm: AES-256-GCM
Enable NCP: Check
NCP Algorithms: AES-256-GCM and AES-256-CBC
Auth digest algorithm: SHA512 (512-bit)
Hardware Crypto: No hardware crypto acceleration

Tunnel Settings

IPv4 tunnel network: leave blank
IPv6 tunnel network: leave blank
IPv4 remote network(s): leave blank
IPv6 remote network(s): leave blank
Limit outgoing bandwidth: leave blank
Compression: Omit Preference (Use OpenVPN Default)
Topology: Subnet – One IP address per client in a common subnet
Type-of-service: leave unchecked
Don’t pull routes: checked
Don’t add/remove routes: checked

Ping settings

Inactive: 0
Ping method: keepalive
Interval: 10
Timeout: 60

Advanced Configuration

Custom options: paste the contents below

tls-client;
remote-random;
tun-mtu 1500;
tun-mtu-extra 32;
mssfix 1400;
persist-key;
persist-tun;
reneg-sec 0;
remote-cert-tls server;

UDP FAST I/O: leave unchecked
Send/Receive Buffer: Default
Gateway creation: IPv4 only
Verbosity level: 3 (recommended)

Press Save at the bottom of the page and Apply changes at the top of the page. Navigate to Status >> OpenVPN to verify your VPN Client is working. Check Client Instance Statistics and verify your new VPN Client connection is listed and that the Status is up.

Using mssfix 1450 as recommended by Surfshark caused constant connection drops. In this post we also checked both Don’t pull routes and Don’t add/remove routes boxes and created manual firewall rules to fit our scenario with multiple LANs, VLANs, etc.

Assigning interface to the VPN client connection

Navigate to Interfaces >> Interface Assignments and Add Surfshark VPN interface.

Press on the OPT1 to the left of your assigned interface and fill in the following information:

Enable: check
Description: Surfshark VPN
MAC Address: leave blank
MTU: leave blank
MSS: leave blank

Do not change anything else. Just scroll down to the bottom and press Save and Apply Changes.

Configuring DNS

This section will assume your DNS is already configured through a previous post. The next steps are just additional setting to include the VPN client on a working DNS Resolver instance.

Navigate to Services >> DNS Resolver >> General Settings and make sure that at Outgoing Network interfaces you either select All or also append your new VPN client interface as an outgoing interface. Do not remove any other interface from this list!

Enable: must already be checked
Outgoing Network Interfaces: Surfshark VPN
Register connected OpenVPN clients in the DNS Resolver: checked

Click Save and Apply Changes.

Configuring NAT

Navigate to Firewall >> NAT -> Outbound and select Hybrid Outbound NAT rule generation. (Automatic Outbound NAT + rules below). Press Save and Apply Changes. Now we can create our rules for the new VPN client by clicking on Add (down arrow):

Edit Advanced Outbound NAT Entry
Interface: SurfsharkVPN or whatever you called it
Source:
 your LAN network (e.g. 10.0.0.0/24)
Misc
Description: A nice name, such as NAT outbound for Surfshark US Seattle

Press Save and Apply changes.
Now click on Add (down arrow) again to create one more rule for ISAKMP IPsec VPN traffic:

Edit Advanced Outbound NAT Entry
Interface: Surfshark VPN or whatever you called it
Source:
 same LAN network from previous rule (e.g. 10.0.0.0/24)
Destination >> Port or Range: 500
Translation
Port or Range >> Static Port: checked
Misc
Description: A nice name, such as Manually created for ISAKMP – Surfshark US Seattle

Press Save and Apply changes.

Note that if you have multiple LANs, like me, you will need to repeat this process for each one.

Configuring Firewall

Navigate to Firewall >> Rules page and click on the Interface name you created in the previous steps. Next, click on Add to create a new firewall rule that allows any traffic to go through:

Action: Pass
Address Family: IPv4 (I am not using IPv6 on my homelab yet)
Protocol: Any
Source: 
Any
Destination: Any

Press Save and Apply changes.

You can repeat the steps above for different Server locations from Surfshark.

Now that everything is done, let’s test it. Navigate to Diagnostics >> ping:

Hostname: google.com
IP Protocol: IPv4
Source Address: Select the VPN Client interface
Maximum number of pings: 3

Click Ping and check the results. Should be something like

PING google.com (216.58.217.46): 56 data bytes
64 bytes from 216.58.217.46: icmp_seq=0 ttl=120 time=1.978ms
64 bytes from 216.58.217.46: icmp_seq=1 ttl=120 time=2.670ms
64 bytes from 216.58.217.46: icmp_seq=2 ttl=120 time=1.940ms

--- google.com ping statistics ---
3 packets transmitted, 3 packets received, 0.0% packet loss
round-trip min/avg/max/stddev = 1.940/2.196/2.670/0.336 ms

Passing traffic through the VPN

At this point, your VPN connection is up and running, but not really in use by pfSense. There are a couple options in how to start using the VPN. In this post I will cover how to:

  1. Configure the VPN connection as the default gateway, so all traffic from your home goes through it
  2. Configure the VPN connection for specific IPs, so that only these ones goes through the new VPN client connection

Option 1: Using VPN connection as your default gateway

Navigate to Firewall >> Rules >> LAN and edit the default IPv4 rule, that is the rule that allows all traffic on your network. Its description will probably be something like Default allow LAN to any rule.

Scroll down to the bottom and press on Display Advanced at the Extra Options tab. Change Gateway to Surfshark VPN and click Save followed by Apply Changes.

Option 2: Configuring specific IPs to use the VPN

In order to use this approach, you need to reserve IP for the device(s) you want to route through the VPN. Navigate to Services >> DHCP Server >> LAN scroll down to DHCP Static Mappings for this Interface, click on Add and do as follows:

Static DHCP Mapping on LAN

  • MAC Address: xx:xx:xx:xx:xx:xx
    • You can find this at Status >> DHCP Leases page
  • Client identifier: The name that will show up in the DHCP lease page
    • You can use the hostname
  • IP Address: The static IP to use (e.g. 10.0.0.5)
  • Hostname: The device host name
  • Description: A friendly description to identify the device

Click Save and Apply changes. Next, disconnect and reconnect the network cable of this device so that it can take the new IP. Repeat this steps for each device you want to put under the VPN.

Now that your devices have a static IP, navigate to Firewall >> Aliases >> IP and click on Add and do as follows:

Properties

  • Name: VPNCLIENT_USA_DEVICES
  • Description: Devices which are required to go through a USA OpenVPN client connection
  • Type: Host(s)

Host(s)

  • IP or FQDN: <IP you want to put under the VPN> (e.g. 10.0.0.5)
  • The hostname or description to help identifying the device

If you want to add more devices (hosts), click on Add Host and add the IP/FQDN + a description for each device.

When you are done, click on Save and Apply changes.

If you don’t have an alias called RFC1918 or Private_IPv4s created in previous posts, you will need to create it now. The goal for it is to help us identify what networks/IPs belong to your LAN and which belong to Internet (aka those not listed in RFC1918 or Private_IPv4s alias). Click on Add again and do as follows:

  • Properties
    • NameRFC1918 or Private_IPv4s
    • Description: All private IPv4 networks
    • Type: Networks
  • Network(s)
    • 10.0.0.0/8
    • 172.16.0.0/12
    • 192.168.0.0/16

Press Save and Apply changes.

Lastly, we need to update the firewall rule so that it redirects clients to the VPN based on the alias we just created. The current rule must be something like “accept any connection coming from any device going to any destination and use the default gateway (your WAN connection) for them”. What we want is: If the incoming devices belong to the alias we created, use the VPN as gateway. Otherwise, use the default gateway. Note we need two rules and they must appear in this order.

Go to Firewall >> Rules >> LAN and click on copy icon of the default IPv4 rule, that is the rule that allows all traffic on your network to for from * (any) to * (any). Its description will probably be something like Default allow LAN to any rule.

A new window will open with the same settings as the rule used as base, which you need to change the following:

Source

  • Invert match: unchecked
  • any: change it to Single host or alias
  • Source address: VPNCLIENT_USA_DEVICES (this is the first alias name)

Destination

  • Invert match: checked
  • any: change it to Single host or alias
  • Destination address: RFC1918 (this is the second alias name)

Extra Options

  • Description: Allow VPNCLIENT_USA_DEVICES to Internet rule through VPNClient_USA (assuming this is how you named your VPN interface)
  • Click on Display Advanced.

Advanced Options

  • Gateway: Select the interface you assigned to your VPN client connection

Click on Save. You probably have to move (drag and drop) the new rule before the one you copied it from. The rule that redirects traffic to the VPN must come before the default rule. Click on Save and Apply changes.

Optional: Using Surfshark’s DNS servers

As an additional step to protect your network, you can use Surfshark’s DNS server. For such, go to System >> General Setup >> DNS Server Settings and fill in:

DNS Server 1: 162.252.172.57
DNS Hostname: empty
Gateway: empty

DNS Server 2: 149.154.159.92
DNS Hostname: empty
Gateway: empty

Click Save and you are good to go. Test your anonymity by visiting http://dnsleaktest.com and have fun!

ps: If DNSSec support is enabled on your DNS Resolver configuration, you may have a false DNS leak report. You can disable DNSSec support, do the test and re-enable later.

This is shamelessly taken from crepaldi.us, but because his website kept going down I copy and pasted it so I can reference it here and share his lovely writeup.