
Need help with UDM Pro and Proton VPN
I have a UDM Pro on Unifi OS 5.1.19 (latest as of posting) and Network 10.4.57 (latest as of posting).
I have a working (paid) Proton VPN connection that I have configured via the instructions from Proton VPNs site which also match all of the various youtube videos out there as well. It is "green"/connected and the tunnel is healthy.
I have created a policy based route to send all traffic from a dedicated VLAN through this tunnel. Again, following all of the videos and instructions, this is very straight forward.
Currently, the issue at hand is traffic that is Internet-bound dies at the gateway. My suspicion is traffic from this VLAN is not getting NATed before entering that tunnel and thus dropped and AI thinks this too however I want to see if others have any other testing or other suggestions before changing my global network NAT from "Auto" across the board to tweaking it. What I don't want to do is make a change that takes the whole network down, which of course is what I fear when contemplating making global changes like that.
From a client PC, the behavior is if I trace route to say 1.1.1.1 for example, it gets to the gateway IP and then dies. Obviously ping to anything outside is dead, etc.
I don't have any firewall policies on this VLAN applied, nor am I seeing anything logged from a firewall policy perspective that has anything to do with this VLAN.
I see many others have run into similar issues when I google search however the threads either are completely blank and no responses and years old, or their issues were related to something not applicable to my setup.
Since google searches have left me empty handed, I've tried a few different google AI chats that have all led me back to basically the same suggestion. SSHd into the UDM Pro, if I run the command: "iptables -t nat -S | grep wgclt1", evidently I should see a masquerade rule returned that should read something like: "-A UBI_NAT_POSTROUTING -o wgclt1 -j MASQUERADE" however I'm not getting any masquerade line returned.
The suggestion is to turn Auto off in the global NAT settings and remove this specific vlan from that list, then manually create my own masquerade rule for that vlan. Other posts I've read however say that if this global NAT setting is set to "auto" then it shouldn't matter and it should work fine already.
So before making any changes, I wanted to ask experts out there for some help and advice on this.
Thank you in advance.