Redirecting NTP traffic to VPN tunnel

[securvark 16]

Today I switched my pfSense box in place of my main router. It has taken over all DNS, DHCP and NTP, and has become the default gateway. All outgoing traffic is routed through VPN.

 

Well, almost all. DNS is direct, but that's encrypted over TLS.

 

NTP is still going out directly, and I can't seem to figure out why and what I'm doing wrong. Maybe someone can help.

 

I have a port forward like this:

 

INT: LAN

PROT: UDP

SRC Adr: LAN net

SRC Prt: *

Dest Adr: ! LAN address (not the pfSense box)

Dest Prt: 123

NAT IP: 127.0.0.1

NAT Prt: 123

 

A firewall rule on LAN as such:

 

PROT: IPv4 UDP

SRC: LAN net

Port: *

Dest Adr: 127.0.0.1

Dest Prt: 123

Gateway: *

 

PfSense is configured with a bunch of my favorite time servers (fqdn's so they get pool servers).

 

I now want to catch all pfSense NTP traffic and through it out the VPN instead of letting it go out directly. I made this rule:

 

PROT: IPv4 UDP

SRC: *

Port: *

Dest Adr: ! This Firewall

Dest Prt: 123

Gateway: VPN_GW

 

I played around with source, made it 'This Firewall', I made a floating rule with different options. I can't seem to get it right.

 

If you know how, or have ideas, please share .

 

Thanks!